By Kostiantyn Severenchuk at Automation in Action: summer conference. Video: https://youtu.be/mvbElkLtY0Y TOPIC DESCRIPTION The DevTestSecOps approach and its implementation on real projects. How to cook it, how to eat it, and its value. Let’s dive deep into the world of automation and its coverage with real examples. Why it is so important? Bonus funny stories as well.

1. CONFIDENTIAL. Copyright © 2018
DevTestSecOps
Prepared for Automation in action
Jul 2019

2. 2
WHO AM I
Kostiantyn Severenchuk System Architect @Epam Systems
• 10+ years in IT
• DevTestSecOps practice
• Support & Maintenance
• QA/QC
• Build Engineering
• System Engineering
• SRE
• Development???

3. LET’S START FROM THE BASICS

4. 4
Continuous Value Delivery Through DevOps
Early Feedback | Transparency | Continuous Delivery
Cycle Time Reduction| Optimization
Implement Monitor
DESIGN
DEVELOP INNOVATE
PRODUCT
BACKLOG
OPERATE
Value delivery
Value definition
Adaptive learningValue creation
Agile ITIL
INFRA/OPS
USERS
OPS
BACKLOG
BIZ
DEV/TEST

5. 5
DevOps Capabilities
DevOps
Orchestration
Automation
CI/CD
Configuration
Management
Scalability/
Reliability
Backup/DR
Networking
Security
Monitoring
• Orchestration
• Automation
• Infrastructure as Code
• Platform as a Service
• CI/CD
• Blue-green deployment
• Pipeline as a Code
• Configuration Management
• Scalability/Reliability
• Backup/DR
• Networking
• Security
• Monitoring

6. 6
DEVOPS TOOLSET

7. 7
SECOPS & DEVOPS

8. 8
Too many talks

9. WHAT IS IMPORTANT & WHY

10. 10
WHAT’S FIRST?

11. 11
ITIL VS ITSM FUNDAMENTALS

12. 12
ITIL FUNDAMENTALS

13. 13
SDLC VS SDL FUNDAMENTALS

14. 14
VIRTUALIZATION FUNDAMENTALS

15. 15
MONITORING FUNDAMENTALS

16. 16
SCM/VCS FUNDAMENTALS

17. 17
SILVER BULLETS

18. DEVTESTSECOPS IN ACTION AND WHY

19. 19
LET’S START
19

20. 20
DevTestSecOps approach in action
Roadmap
Strategy
Dev
Test
Sec
Ops
Perf
Digital
approach
Web Channel
Delivery
SFP
Project
SoftwareFactoryPlatformSFP
DevTestSecOps
Processes
Scope
B a c k l o g
TBC TBC
TBCTBC
TBC
TBC SFP v 1.0.0
SFP v 1.0.1
…
SFP v 1.2.0

21. 21
DEVOPS MAGIC

22. 22
RELEASE ANTIPATTERNS
• Sitting bleary-eyed in front of Monitor at 2 A.M. the day after the release day, trying to figure out how
to make it work
• Frequent correction to the release process during the course of release
• Frequent calls to the development team to explain why a deployment is going wrong on a release day
Deploying Software
Manually
• Having deployed successfully many times to staging, the deployment into production fails
• Configuration of the system is carried out by modifying the configuration directly on production
systems
• The operations team takes a long time to prepare an environment for the release
Manual Configuration
Management of Production
Environments
• There is little, if any, collaboration between the development team and the people who actually
perform deployments to create this collateral
• Releasing into staging is the first time that operations people interact with the new release
• The bigger the difference between development and production environments is the less realistic the
assumptions that have to be made during development are
Deploying to a Production-
like Environment Only after
Development Is Completed

23. 23
MANUAL WORK

24. 24
STEPS FOR GOAL ACHIEVEMENT
Automated
Frequent
Provide meaningful feedback

25. 25
UMBRELLA

26. 26
GUIDANCE & GOVERNANCE

27. 27
Why DevTestSecOps
1
2
3
4
5
Build once, deploy many
Enable self-service and
on-demand capabilities
Leverage SMEs for support and
best practices
Identify opportunities to remove
bottlenecks
Increase and assume
accountability
Why DevTestSecOps

28. 28
ONE STEP CLOSER TO IDEAL WORLD
CI / Build
Server
Builds / Status
Notifications
Artefact
Repository
CI
Dashboard
QA
Cloud
Version
Control
PROD
approval
gateway
Production
Deployment
Mock /
Unit Tests
Сode
Analysis
Code Review
UAT, INT
PERF
PROD
Security
check
Performance
Test
Integration
Test
Functional &
Regression
Test
• Fully Automated CI/CD Pipeline
• Built-in quality and Security gates
• Frequent and fast feedback
Feedback

29. 29
CI/CD TOOLSET REPRESENTATION & AUTOMATION

30. 30
AUTOMATION

31. 31
BUILD A HOUSE WITHOUT BASE

32. WHAT CAN BE AUTOMATED?

33. 33
REALITY

34. WHAT CAN NOT BE AUTOMATED?

35. 35
REALITY

36. ZONES OF RESPONSIBILITY

37. 37
REALITY

38. BONUS STORIES

39. 39
App in Docker vs Performance & Security

40. 40
SOMETHING WENT WRONG

41. 41
GCP (everyone has bugs)

42. 42
WHAT ABOUT TOOLS

43. 43
Performance

44. 44
Business vs Technical debates

45. 45
OVERESTIMATE

46. 46
DYNATRACE VS INFRA TESTING

47. 47
IDEAL LIFE

48. 48
ANY QUESTIONS?