DevOps & DevSecOps in Cloud Native Architecture

• DevOps & DevSecOps process framework in cloud native architecture
• This chapter covers the overview of DevOps and DevSecOps process framework under Cloud Native.

Objectives

• Understand the roles and integration of DevOps and DevSecOps in Cloud Native Architecture
• The advantages and benefits of DevOps and DevSecOps in an organization
• Explore 6 best practices under DevOps

Traditional SDLC Model

• SDLC (Software Development Lifecycle) refers to a structured process for building, deploying, and maintaining applications designed to run in cloud environments using cloud technologies.
• Key stages of SDLC: Planning, Design, Development, Testing, Deployment, Monitoring and Maintenance, Feedback and Iteration
• Development teams work on code, which is then sent to the testing team for validation against requirements in traditional SDLC.
• The operations team gets involved near the end of the process for release handover in traditional SDLC.
• DevOps aims to break the silos, enabling better collaboration and performance.

Traditional Communication Model Challenges

• Aims to address high probability of errors, management bottlenecks, lack of transparency and high costs
• Also addresses late feedback, late fixes and updates and difficult and costly changes

Introduction to DevOps

• DevOps is about automating and streamlining processes required to build, test, deploy, and monitor applications by leveraging cloud native technologies and tools.
• Goal is to shorten systems development life cycle and provide continuous delivery with high software quality.
• DevOps is complementary with Agile software development, and several aspects came from Agile methodology.

DevOps: the three-stage conversation

• Inter-dependence between 3 elements make DevOps effective in achieving fast, reliable and scalable software delivery.
• Three Pillars: People, Process, and Products
• People: Right Culture and Collaboration involving development, operations and security. Developer, Ops and Security teams work collaboratively, communicate effectively and share ownership & responsibility of the entire application lifecycle.
• Process Well defined processes (workflow & methodology) with automation and continuous improvement ensure faster and safe application deployment, such as automated CI/CD pipelines
• Products Technology & tools support the processes and empower people to execute DevOps effectively, such as Kubernetes, Terraform, Docker.
• Development and operations teams work in collaboration to minimize the effort and risk involved in releasing software.
• Introduce collaboration by ensuring that the Ops team is giving constant feedback to the development team about the code, analyzing the impact considering end users and troubleshooting any problems together to gain stability of the product.
• DevOps enables a cultural change to remove the barrier between development & operations, working together for common set of objectives.

DevOps Model

• DevOps embraces agility & problem-solving.
• Collaboration is central.
• A DevOps mindset encourages broader communication instead of sticking strictly to one discipline.

DevOps Practices in CNA Environment

• Key DevOps best practices in CNA - on building, deploying, monitoring and maintaining cloud native apps:
• Continuous Integration
• Continuous Delivery/Deployment
• Microservices -Containerization
• Infrastructure as Code
• Monitoring and Logging
• Communication and Collaboration
• Adopting these practices helps teams deliver cloud applications faster with high quality and at scale.

Continuous Integration (CI)

• Involves automatically building and testing microservices whenever code changes are committed to the repository.
• Jenkins, GitLab are example of CI servers
• CI is for automated build and test along with varying levels of notifications fundamental to keep agile efforts on track.
• Automated tests are ran, a docker image is built for microservice and pushes image to container registry (Docker Hub) when developer pushes code to the repository using a CI pipeline.

Continuous Delivery/Deployment (CD)

• Automated deployment involves automatically deploying to staging or production environment after code passes tests.
• Kubernetes and Helm are tools for CD
• After a successful CI build, the next step is to deploy the app to staging or production for container orchestration.

Microservices - Containerization

• Cloud native application is made up of small loosely coupled services that can be developed, deployed and scaled independently.
• DevOps practices enables seamless operation of these microservices ensuring they can be continuously delivered and monitored.
• Containerization involves packaging applications (microservices) and their dependencies for easy deployment
• Each microservice is encapsulated within its container (Docker) which ensures consistency across environments
• Tools are Docker and Kubernetes.
• Container Orchestration manages containers at scale (based on demand) such as Kubernetes

Infrastructure as Code (laC)

• Practice in which infrastructure is provisioned and managed using code with version control and continuous integration.
• Cloud's API-driven model enables developers & system administrators to interact with infrastructure programmatically, and at scale, instead of needing to manually set up and configure resources.
• Automated Provisioning involves cloud-native infrastructure like compute (VMs, containers), networking (Load Balancer), dB, storage and security configurations being defined as code & version-controlled
• Can be provisioned programmatically
• Declarative infrastructure involves cloud resources described in declarative languages
• Allows infrastructure to be described as a set of desired states rather than a series of commands.

Infrastructure as Code Benefits

• Allows teams to replicate, scale or recover infrastructure easily and consistently.
• Use of code makes configuration changes repeatable and standardized.
• Frees developers + administrators from manually configuring operating systems, system applications, or server software.
• Example tools: AWS CloudFormation, Terraform, Ansible, Kubernetes

Continuous Monitoring & Logging

• Allows for enabling teams to gain insights into application health, performance, security and infrastructure capacity
• Critical in ensuring microservices are running reliably.
• Key Practices: Real-time Monitoring using metrics, logs and traces, Log Aggregation where Microservices logs are aggregated into a central logging system for troubleshooting and analysis, and Alerting where Notification alerts are sent when certain critical metrics' threshold are triggered.
• Common tools are Prometheus and Grafana

Communication and Collaboration

• Collaboration & communication between development and operations is important for success of DevOps.
• DevOps ensures issues are identified early and faster to allow for appropriate, early responses or resolutions to changing requirements and conditions.
• Automated Continuous Feedback Loops
• Use of Collaboration Tools: Microsoft teams, ChatOps to help facilitate real-time communication among DevOps cross-functional teams to solve issues efficiently.
• GitHub/GitLab provides version control and collaboration features to streamline communication between members on code changes.

DevOps Implementation Example

• A typical DevOps adoption example is shown
• Jenkins is used to show the build pipeline

DevOps – Typical CI/CD Pipeline

• Steps include Coding and Version Control, CI Continuous Integration, CI Continuous Deployment, Automated Testing, Infrastructure as Code, Monitoring and Logging and Continuous Feedback Loop
• Coding and Version Control Developers write & commit code to shared central repository (GitHub). Code stored in a version control system.
• CI Continuous Integration: When code is pushed to repository, tool like Jenkins can be triggered to run automated tests (unit & integration tests) on new code. Build artefact is created when tests pass.
• CI Continuous Deployment: CD pipeline automatically deploy new app image to staging and pre-production environments.
• Automated Testing: The D pipeline deploys the new app to staging/ pre-production environment, automated tests are rerun. Test results are logged and developers are notified if something breaks. Infrastructure as Code: DevOps engineers provision cloud resources, networks and services required to run apps.
• Monitoring and Logging: After production deployment, teams monitor and track application and infrastructure performance and heath.
• Continuous Feedback Loop: Developers and Ops teams check and review logs and metrics, address any issues and work collaboratively to improve code and infrastructure.

Advantages of Adopting DevOps

• Improved Communication & Collaboration: Breaks down the silos between Dev and Ops teams creating more cohesive teams working towards common objectives.
• Faster Time to Market (Delivery): Continuous Integration and Continuous Deployment (CI/CD) allow for rapid frequent release cycles to be delivered.
• Higher Quality Software Product: Automated testing ensures code quality and help detect bugs early in development cycle.
• Achieves Cost Efficiency by automating manual repetitive tasks and human errors, and reducing downtime and maintenance costs.
• Scalability and Flexibility is realised through Infrastructure as Code and containerization using frameworks like Docker and Kubernetes
• Results in allowing systems to be scaled up & down efficiently
• Organisation are able to respond to market changes or customer needs with agility

Additional benefits of DevOps

• Enhanced Monitoring and Feedback
  • Continuous monitoring of applications & infrastructure & feedback loops improve system reliability
  • Real-time metrics enables better decision-making and proactive improvements
• Greater Customer Satisfaction
  • Frequent updates and fast bug fixes improve user experience
  • Better alignment helps to service better serve users

What is DevSecOps?

• DevSecOps is an extension of DevOps that integrates security practices into the entire DevOps pipeline (development, testing, operations).
• Continuous security integration throughout the SDLC should also be included.
• Security is considered early in the development process rather than an afterthought after deployment phase.

Key Principles of DevSecOps

• Shift Left Security enables Security to be integrated early in SDLC rather than after development is complete.
• Collaboration requires Developers, Ops Engineers, and Security teams to work together where security is everyone's shared collective responsibility.
• Automation involves automating security checks (code analysis, vulnerability scanning and test for insecure configurations). Use penetrating tools like Metasploit or Burp suite to simulate attacks and identify weaknesses.
• Continuous Monitoring -Report and Action is used to Continuously monitor for security events, unusual activity during operations and pos-deployment.
• It also involves the used of an IDS tool like Snort to monitor network attacks along with the implementation of logging and alerting.
• Any vulnerability discovered should be addressed quickly through patches, updates or configuration changes.

DevSecOps WorkFlow- Security Testing

• Code Development (Static Application Security Testing (SAST)) with tools like SonarQube and Fortify run to identify vulnerabilities, such as SQL injection, cross-site scripting and insecure data handling.
• Version Control (Secure Git Repositories) for Secure the version control process is necessary to ensure code meets security requirements before being committed with enforce tools.
• Continuous Integration (Dynamic Application Security Testing (DAST) is run to simulate attacks to find vulnerabilities with tools like OWASP ZAP and Burp Suite.
• Automated Security Testing enables ensure ensure images are free from known vulnerabilities using scanning tools.
• SCA (Software Composition Analysis) tools are used to scan vulnerabilities in open-source third party libraries/dependencies

Additional DevSecOps Security Flows

• Continuous Delivery/Deployment (Secure CD Pipeline) to follow security best practices and check for misconfigurations along with Secrets Management.
• Security in Deployment Pipeline enables scan for vulnerabilities, test for insecure configurations and ensure the system is secure at every stage.
• Automated Penetration Testing involves the use of tools like Metasploit or Burp Suite used to simulate attacks in staging or pre-production environments.
• Continuous Monitoring & Incidence Response is used for real time monitoring of security events, unusual activity with tools includes log monitoring and alerting for incident response and remediation

Benefits of DevSecOps

• Improved Security - Issues are detected and rectified faster.
• Faster Time-to-Market - Automated security checks enable quick feedback allowing teams to fix issues in real-time and keep development moving. Also allows to fixes issues in real-time and keep development moving.
• Helps to reduce risks with continuous monitoring and testing, ensuring security gaps and vulnerabilities are minimised.
• Enables regulatory Compliance to be adhered to easier with security already built in so audit's easier

Conclusion

• DevOps practices help companies achieve agility, scalability and resilience
• The adoption of DevOps practices such as CI/CD, automated testing, IaC and continuous monitoring allows teams to develop and deliver cloud native applications faster with high quality and at scale.
• To foster collaboration, increase automation and ensure, DevOps practices help applications evolve continuously to meet customer needs and business goals.
• By integrating security into DevOps workflow, DevSecOps makes ensuring its everyone's responsibility from the start of the development process and throughout the entire stages.