The Triangle of Value

It seems like everyone wants everything these days. They want high quality products and services in the quickest amount of time at the lowest price possible. This is never the case.

I don’t recall people talking about this fundamental concept very often that is The triangle of value. It’s also known by many other names. This is a basic resource constraint when you are offering a product or service.

The triangle of value is this:

You have Time, Cost and Quality – Pick two.

You can have a low cost product very quickly but the quality suffers.

You can have a high quality product relatively quickly but it will be very expensive.

You can have a high quality product at a low cost but it will take lots of time to develop.

This is true of project management and DevOps as well. At the end of the day, these are the three elements you have to work with.

Open source products also work like this. You can have a low cost product (it’s free…so to speak) which is high quality with many features, but it gets done on donated time. It may take some time before a bug is corrected or a new features are added.

Other things that affect the “triangle of value”

Skill and Experience

Skill can reduce the amount of time it takes to make something and it can also affect quality of a product or service. Then again, you will pay more money for an individual with a higher skillset especially if you want to keep them around.

Technology

It can be something that decreases the amount of time you spend on producing a product or service. It can be in the form of automation or another catalytic process. At the end of the day, all advancements of technology are catalysts for getting more stuff out of a process. On the other hand, technology can take time and expertise to develop. This also can cost more money for better tech.

How does this understanding play into DevOps or anywhere else?

In an ideal world, you may be able to hire the brightest minds who are up to the task, have the best equipment, plenty of lead time for getting to market and an unlimited budget…but this is not the case.

It may be more like, you only could hire 2 of the 5 positions for experienced programmers (maybe your one of them) and they aren’t that bright (they just think they are), you have second hand equipment that is a few years old, your budget is a quarter of what you were promised and last week was when you had to get the project done.

That’s ok, these are the reality of the industry. You do with what you can the best you can, the same principles apply.

If you don’t have enough manpower, you make it up with overtime and finding leverage somewhere…maybe automation.

If you don’t have the latest equipment, let’s say it’s slow…you make it up by getting more of the older equipment and use them in parallel using some clever programming and networking.

If you have a short lead time, you loosen your “quality” regiment (as in hope your developers don’t make mistakes writing code by forgoing tests) to save on the time you spend in development.

DevOps CI/CD the “Holy Grail” may be a lofty goal to achieve if your resources are limited, but it is a worthwhile and doable. It may take some time to figure out how to do it and to build and train the resources to do this.

At the end of the day, what you most value is what you will get. You can’t have it all but you can choose what you can live with.

I am open to feedback and any suggestions you may have. Until then, have a good day.

Testing for DevOps – How to have 10 deploys a day versus 10 emergencies a day

Ten deploys a day was the tech talk that started DevOps as an integrated practice for software development. However, if they simply pushed out code without checking it, then the story would have been different. Without testing the code, it would be more like 10 or more Disasters a day… A down production site would result in some serious consequences such as:

  • Loss of customers
  • Loss of confidence in the company
  • Loss of employment for all who are involved

You get the pictures. Though the use of automation is a key principle of DevOps, automation is also an efficient way to multiply human error. Without efficient testing of code, CICD would be meaningless. If you write code quickly and deploy it, BUT it’s broken code, well you defeated the purpose of having software rapidly deployed and updated. Testing of code is one of the most fundamental part of DevOps there is.

But I’m a great coder and I don’t make mistakes…(or whatever is your excuse)

Well, that may be the case, however as your software product grows and more people are touching a code, the likelyhood some form of human error (that may not be yours) will be introduced into the code. It’s bad enough when you haven’t worked on the code let’s say in a couple of weeks, you don’t remember what you did. You don’t want to be called back into work on a Friday because your code changes you created bombs out on a production system… Test for it so you can sleep soundly knowing that you have a safety net in place.

Writing tests is a fundamental practice.

The fundamentals – Vince Lombarti, who is know as the winningest coaches in football once went to the lockerroom of his players after they had a major loss from a previous season and said .“..This is a football…” Part of writing good code is writing checks or tests for your code. Unfortunately, many programmers don’t write tests for their code, especially web developers who are use to just writing and fixing it as it breaks. It has been my experience that the reason many programmers don’t test code is quite simply, they don’t know how. We’ll get you pointed the right direction.

What are the various test you can do for code?

There are hundreds of different tests you can do on software, some are appropriate and some are not appropriate for testing your software. Here are a list of some of the more common tests. For the purpose of testing in a DevOps environment, there are basically two categories of test you can do for code. I’ll put particular emphasis on what are the must have tests. We’ll cover the must have tests. We’ll touch on the other tests.

Functional Tests

These are the most basic test we need to have in place for Continuous Integration.

  • Unit testing
  • Integration testing
  • Systems testing
  • Acceptance testing

Non Functional Tests

These are also important tests but are not functional test (testing key functions in software) to have AFTER you have the core functional test in place. Here are a few non functional tests.

  • Security testing – find security holes and exploits in your code.
  • Performance testing – find out how quickly your code runs.
  • Stress testing – find out how much load your application can take before it degrades or breaks.

Behavioral driven testing

This is influenced by BDD – Behavior driven development which is at the core TDD – Test driven development where development of software is defined by very specific test cases. In the case of BDD, the tests are defined in terms of a user story. This affects how you would write unit tests and acceptance tests. Testing frameworks like cucumber support this kind of writing of user stories.

Unit testing

Every bit of function you write should (must) be unit tested. It should be the most basic test that is used with any code that goes into production.

Basic principles of unit testing.

Test the smallest testable part of an application. That is a unittest.

Write your function to handle a particular error – i.e. division by zero.

test fixture – what’s needed to perform a test

Write a test case – 1/0

Write an assertion. Unit test assertion functions are very simple, they are functions that call your function and compares the returned result or state or value. For instance if you function returns a numeric value, you may use an assertion like

functionx > 0

or

assert.greater(functionx, 0)

This is dependent on your framework or library as far as if it supports different conditions for testing assertion.

These tests are best done with a testing frameworks or assertion libaries. For java, there’s JUnit, Python uses unittest, Javascript can use JestJS, MochaJS, Jasmine.

You can read more about unit testing here.

Integration testing

This is also very important. What if the guys who are responsible for writing the database interface makes a change that the busness logic guy didn’t know about or the frontend guys didn’t know about the change in the functions for business logic. Your code justs breaks and that’s not good for your mental health. You can read more about integration testing here.

Acceptance testing

This is what your customer sees and interacts with. This is probably the most time consuming part of writing tests for. Never the less, if the customer is not able to press the “pay” button, you and your company are going to lose money…and that’s not good. Your going to catch this with a good automated testing approach. These days if your testing a web app or website, use selenium or a framework that drive selenium to test the web interface with clicks and data input values. You can record your test using the Selenium IDE in Firefox or Chrome. It will take some massaging of your recording to make a good automated acceptance test.

Depending on your testing strategy, your approach and framework you will use will vary. Regardless of your approach, I’ll always recommend unit testing your code.

Tying it in to DevOps

Continuous integration is a strategy and software testing being both a strategy for instance Behavior driven development with various frameworks as tactics such as cucumber as a framework that supports Behavior driven testing.

Without software testing and a sound testing methodology, you couldn’t have Continuous integration. That is the Holy Grail of DevOps.

I am open to any comments or suggestions to this article. Until then have a good day.

Blackbird – Privacy tool for securing your Windows PC

One of the cool things about using a package management system is you can look at a central repository to see if there are interesting and useful tools for making your life as a Systems Administrator easier. Even if your title isn’t a Sys Admin, you end up fixing your own machine anyways.

In the Chocolaty public repository, there is a package Blackbird which will secure your Windows machine for privacy and it does a lot. It removes not only the common privacy inhibiting updates, it also helps speed up your machine by turning off many services you don’t need.

What’s the big deal, I got nothing to hide?

Maybe you don’t and I’m not one to judge. The reality is, many big software companies indiscriminatly collect information through the Windows operating system. We don’t really know what they use this information they collected on us for. I like keeping my information private. Here is a perspective given by Alok Bhardwaj TEDx talk. His company also developed the Epic privacy browser.

This program does not only apply to Windows 10, but also older versions of Windows (8, 7 and Vista).

Isn’t removing Windows telemetry updates enough?

One would think so. According to the Blackbird site it does the following:

  • Removes Windows updates that enable tracking – 51 updates.
  • Disables services that talk to Microsoft – 23+ services.
  • Blocks IPs addresses used for Telemetry – 364 urls

That is a WHOLE lot of settings to tweek.

Installing Blackbird

Using Chocolaty.

In command line type:

PS C:> choco install blackbird

or

Download from here.

Running blackbird

Blackbird has a few command line options, here are a few useful ones:

-? Print all the options available.

-v Verbose mode. Displays additional info on all changes being made.

-s Silent mode. Skips any pauses

-scan Full system scan. Green is good/red is bad.

-std STD mode. Force removal of known spy tasks.

-l Fix network/LAN connectivity issues.

-i Fix Bluetooth pairing issues.

-bak Backup mode. Backup current system settings to an external file.

Blackbird needs to be run in Administrator mode.

Before making any changes on your Windows machine, make a backup:

PS C:\ blackbird -bak

I like seeing all the changes made and making sure networking works correctly. In Powershell in admin mode, type:

PS C:\ blackbird -v -l

I’d recommend checking for updates on blackbird periodically. Of course, with Chocolaty, this would be a snap.

PS C:\ choco update blackbird

If you cover both your local Windows machine with securing your browser activities with TOR Browser or any other privacy browser(i.e. epic) and aVPN service, you should have great privacy on your Windows machine.

Feel free to give comments and feedback.

Until then, have a good day.

The Elephant in the room – 3 key points of DevOps – Strategy, Tactics and Implemention

Elephant in the room?

When people talk about DevOps, most people don’t know what their talking about or usually they only know part of what is DevOps. The blind men describing an elephant is what comes to mind.

One blind man says he feels it’s like a rope. The second blind man said it’s like a thick branch of a tree. The third blind man said it’s a huge wall.

DevOps is the elephant in the room.

We tend to only “see” one part of the elephant and we view it from our own role or perspective.

For many people, the answer of what is DevOps tends to falls between these kinds of viewpoints:

  • To systems administrators, it’s about use of Automation techniques to manage many machines and deploy code (i.e.Ansible, Kubernetics).
  • To a developer, it is a consistent code development environment and automated integration system (i.e. Docker, Git).
  • To a project manager and stakeholders, it is an Agile development methodology for software and product development.

These answers are both right and wrong at the same time. This is where the understanding of Strategy and Tactics come into play. With this, you can recognize and understand the “elephant in the room” and how to use these tactics and strategies.

The Difference between Strategy and Tactics

The culture and management practices of DevOps can be looked at as the Strategy. The implementation DevOps in the form of tools and processes used are the Tactics. One is at a global level, the other is the “hands on” task(s). Strategies don’t change often. Tactics do change depending on the situation. It’s an important to understand these perspectives to understand what “DevOps” really is.

What is Strategy from the DevOps point of view?

Strategy is the plan to archive a long term goal.  DevOps may employ many different strategies.  Here are a few examples:

These strategies are NOT always going to be appropriate for your shop for a variety of reasons and may need to be modified or other alternative strategies may need to be used.   SCRUM vs Lean?  Up to you and your team.

What is Tactics from the DevOps point of view?

Tactics is the actual methodology of implementation of a strategy.  Depending on your own needs and circumstances, the tactics you chose depend on the strategy your seeking to fulfill. Here are some examples of of tactics:

  • Using a Git shared repository is a tactic for Continuous Integration .
  • Using  Kanban software and workflow is a tactic for Lean software development.
  • Using Ansible to setup standardized servers is the tactic for the “cattle not pets” strategy.
  • Having small team of five people consisting of people from Operations, Development and Quality Assurance is the tactic  for the two pizza team and break down silos strategy.

Tactics may change for different systems you manage.  For instance an MDM (Mobile Device Manager) platform would be the appropriate choice for managing Smartphones NOT Ansible or Chef and in this sort of environment, Docker may not be appropriate for development of the front end app.

Implementation is the key

Even after understating the Strategies of DevOps and developing the Tactics to implement DevOps, if people are not DOING the tasks to implement the tactics,  just doing what they always done, they don’t have a DevOps shop. People need to participate. The place to begin is with collaboration and creating an environment where there is trust and the people involved are actually carrying out the tactics as day to day activities. To get collaboration, people need to have ownership in the project and get recognition for their part. Create an environment where people are willing to take risks and are not afraid of failure. To do this, it’s important that failure is valued as part of the learning process instead of blaming people or finger pointing.  In fact back in the 70’s at IBM, Tom Watson Jr. recounts calling to his office a young executive made a $10 million dollar mistake. Expecting to be fired, the executive presented his letter of resignation. Tom Watson just shook his head:“You are certainly not leaving after we just gave you a $10 million education.” Learning from failure is part of IBM s culture, it should be part of every successful company s culture.

There is NO right way to do this

You can read books like The Phoenix Project or  The Goal (Which The Phoenix Project is based on) and apply the Theory of constraints, or  read any number of books written about DevOps.    However, the original talk they done on 2009 10+ Deploys Per Day , Allspaw and Hammond didn’t do something all that new as these concepts were done by others.  Lean manufacturing is where Kanban and Lean software development came from.   Site Reliability Engineering , which is in principle DevOps, was developed at Google around 2003, well before the Velocity 9 conference.  At Netflix,  they weren’t thinking about DevOps when they developed their “DevOps” shop.
I am of the opinion that you have to examine BOTH the STRATEGIES AND TACTICS of what worked at various organizations and what didn’t and focus on collaboration.  Building a collaborative environment that encourages ownership of a project, gives recognition and encourages people to take risks and not be afraid of failure is the key first step to creating a DevOps shop.  Doing this will make adopting  the “Elephant in the room” less intimidating and will put DevOps in your grasp.

Feel free to give me your comments and suggestions.

Until then, have a great day.

Windows package management with Chocolatey

What does DevOps have to do with Windows package management?

Good question, since maintaining consistency with software tools is a key principle in Development Operations. You don’t always have a choice on what environment or platform you can run and you are stuck with maintaining a Windows environment. Windows has been a pain for myself and many other people taking care of Window machines because the business needs them. Besides the most common problems in maintaining a Windows machine, installation and management of software is a big pain. It’s very likely that you have to support Windows in a desktop environment and server environment. I always thought, being an old school Unix Sys Admin, “Why can’t we have an automated package manager like apt-get, pkgadd, which are available in Unix/Linux in Windows?”
The answer I and many others found is in Chocolatey.

What is Chocolatey?

Chocolatey is a nuget based Windows package manager. Nuget is a .net framework library manager developed by Microsoft. The mechanisms used in Nuget is used for installing Windows packages.
Chocolatey does the following:
1 – Install software
2 – Upgrades software
3 – Remove software
4 – Installs dependencies
5 – Support unattended installs
6 – Support private repositories
7 – Works with automated provisioning systems (Ansible, Chef, Puppet, etc)
8 – Allows creation of private custom packages

Installing Chocolatey.

First, Chocolatey requires the minimum of Windows 7 sp 1 with Powershell Version 3 or later. Windows 10 on up meets the minimum requirement..

Install via powershell
As administrator, run the following on powershell window:
Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString(‘https://chocolatey.org/install.ps1’))

https://chocolatey.org/api/v2/package/chocolatey

After you install chocolatey, you can add any package you want.

$ choco install firefox

It will install the latest version of firefox.

To update firefox,

$ choco upgrade firefox

It will update firefox to the latest version.

To list all of the packages you have installed on your machine.

$ choco list –local-only

Chocolatey v0.10.11
7zip.portable 18.5

yed 3.18.1.1
84 packages installed.

This creates a list of all applications managed by chocolatey.

There are other things you can do with chocolatey such as creating your own packages, running your on repository and use tools like Ansible, Puppet or Chef to deploy these packages to your Windows machines. It’s beyond the scope of this article. I may cover this in a future article, just be aware it’s available.

Until then, have a good day.

Roy