In recent years, how we approach development has dramatically changed with the rise of DevOps, Cloud Computing, and Container technologies. Many stakeholders at our organizations are ecstatic about Shift Left, DevSecOps and VSM, but how are we as Java developers embracing this new cultural shift? In this session we will explore the most common Critical Challenges to Adopt DevOps Culture in Software Organizations, best practices and some excellent news with success stories.

1. Ixchel Ruiz
DevOps for Java Developers
@JCConf Taiwan 2022

6. — Why?
“HUMAN writing code for HUMANS to
improve HUMAN life ”

7. @ixchelruiz

9. DEVOPS & JAVA

10. DEVOPS & JAVA

13. Good News

14. Using Analytics to Guide
Improvement during an
Agile – DevOps
Transformation
IEEE SOFTWARE

15. Case Study
Fannie Mae 2012
•Only 10 teams using agile-like techniques
•Releases → 9 to 18 months
•Technical-polyglot ecosystem
•461 applications
•~ Hundreds utilities
•~18,000 open source components

16. Case Study
Fannie Mae: 2016
Quality → Applications improved quality 30% to 48% when
measured by critical defects
Productivity → 28% gain (deliveries)
Cadence → 21 times (more than 19,000) builds per month with
half the previous staffing, while improving quality

17. DEVOPS & JAVA

18. Building Software

21. DevOps, DevSecOps, Shift Left

22. DevOps : Starting point
“Movement started to coalesce some time between
2007 and 2008, when IT operations and software
development communities raised concerns what they
felt was a fatal level of dysfunction in the industry”

23. The Phoenix Project
2013

24. DevOps
Culture
Increased transparency, communication, and collaboration →
cross-team
Shared responsibilities → "you build it, you run it"
Autonomous teams → make decisions faster and easier (risk)
Feedback → performance and stability
Automation

25. DevSecOps

26. DevSecOps
Security Assessment
Static Application Security Testing (SAST) → known
weaknesses and insecure coding practices
Software Composition Analysis (SCA) → software components
Dynamic Application Security Testing (DAST) → outside-in
approach

27. DevSecOps
Security Assessment
Web Application Firewalls (WAF) → monitor traffic
Container image scanning → scan container images
Software Cloud Security Posture Management (CSPM)
→ misconfigurations in cloud infrastructure

28. Shift Left

29. DevOps
Shift left
Bring testing and security measures into code development
processes early

30. Testing

31. Security

33. Microservices

34. Martin Fowler
“A single application as a suite of small services, communicating
with lightweight mechanisms. Built around business capabilities
and independently deployable by an automated deployment.
May be written in different programming languages”

37. Tools

38. Security

39. https://github.com/jfrog/frogbot

40. https://github.com/jfrog/frogbot

41. https://jfrog.com/blog/get-peace-of-mind-about-security-when-deploying-containers-from-docker-desktop/

42. IntelliJ Idea Plugin

43. Microservices

44. Microservices

45. Mature Ecosystem

46. Testing

47. Tools

48. wiremock.org

49. wiremock.org
WireMock is a simulator for HTTP-based APIs
( service virtualisation tool; a mock server )
Runs
Standalone Process, without the HTTP Server, in Docker
Proxying
Record and Playback
Simulating Faults
Stateful Behaviour

50. wiremock.org
https://github.com/wiremock/wiremock

51. rest-assured.io

52. rest-assured.io
REST Assured is a Java DSL for simplifying testing of REST
Specifying Request Data
i.e Path Parameters, Cookies, Headers, Multi-value Parameter
Verifying Response Data
i.e. Cookies, Status, Body/content matching, Measuring response time
Authentication
i.e OAuth1, OAuth2
Spring Support

53. rest-assured.io
https://github.com/rest-assured/rest-assured

54. testcontainers.org

55. testcontainers.org
Java library that supports JUnit4, Jupiter/JUnit5 and tests
Provide lightweight, throwaway instances
common databases,
selenium web browsers,
anything (docker container)

56. testcontainers.org
https://github.com/testcontainers/testcontainers-java

59. Production Testing

60. Testing @ Production

61. Monitoring

62. Observability

63. Pillars

64. Traces

65. Metrics

66. Logs

67. Tools

70. cncf.io
“The Cloud Native Computing Foundation seeks to drive
adoption of [technologies & techniques] by fostering
and sustaining an ecosystem of open source, vendor-
neutral projects”

71. cncf.io
“The Cloud Native Computing Foundation seeks to drive
adoption of [technologies & techniques] by fostering
and sustaining an ecosystem of open source, vendor-
neutral projects”

72. Scheduling & Orchestration

73. Orchestration

74. Monitoring

75. Observability and Analysis

76. Monitoring

77. Tracing

78. Logging

80. prometheus.io

82. openmetrics.io

84. opentelemetry.io