Build Trust in Your Build-to-Deployment Flow!

Build Trust in Your Build-to-Deployment Flow

Baruch Sadogursky, JFrog

Baruch Sadogursky Developer Advocate @JFrog

>Job definition (part of): Hang out with the DevOps guys

@jbaruch

About me

JavaOne Russia 2012

The cloud silver bullet The right tool for the job Binaries all the way The magic of release

Agenda

JavaOne Russia 2012 3

EVERYTHING *aaSThe New Silver Bullet

What’s So Good About *aaS?

*aaS features Continuous Delivery

User advantages>Latest version/features>No upgrades/maintenance

Developer advantages>Agile>Rapid feedback>Users are the best beta-testers>No long-term support

Everybody wins?

Continuous Delivery FTW

JavaOne Russia 2012

Used to quarterly release cycles “Secure” pace Minimizing the entropy caused by

developers with ADD

Almost, except the IT

JavaOne Russia 2012

Herding Cats

Developers>Increasing entropy

+IT (operations)

>Maintaining stability

=DevOps

>Stable change

JavaOne Russia 2012

Continuous Delivery Challenge

Very frequent releases More than one version in production Complicated access levels Root cause analysis

>Tracing from binaries to source Version tracking Not everyone is ready for CD

9JavaOne Russia 2012

Continuous Delivery Challenge

Very frequent releases More than one version in production Complicated access levels Root cause analysis

>Tracing from binaries to source Version tracking Not everyone is ready for CD

It’s… Agile!

Agile principles applied for DevOps We have good tooling for Agile

development>Version control>Unit testing and code coverage>CI servers>Hot swap tools

What’s up with tooling for agile DevOps?

Agile Tooling for DevOps Checklist

Versioning Access control Traceability Promotions Tags and

annotations Search

How Do I Know?

JFrog SaaS offering>Artifactory Online

› Gradle, Grails, SpringSource, Typesafe, Jenkins, etc.

We build, release and eat our own dog food>Continuously

HERE COMES BINARY REPOSITORYThe Right Tool for the Job

Here Comes Binary Repository

E.g. Artifactory Proxy Smart storage

>Much more than a passive space Critical for CI/CD and ALM

Tooling Chain

JavaOne Russia 2012

Artifactory in DevOps Ecosystem

JavaOne Russia 2012

DEMO TIME!Meet Your Binary Repository

Binaries All the Way

From some point product in your lifecycle, all you care about is binaries

Lots of things to do after the software is built

The Release Pipeline

Source: Agile ALM, Michael Hüttermann, Manning Publications Co.

JavaOne Russia 2012

Passing the software to QA

Different access rights Different physical location Ability to annotate

Staging and Preproduction

Replication of Production environment>Lock versions of dependencies and

artifacts Allow access to set of users

Going to Production

Convert staging binaries to production

Allow public access Change settings Tag

Traceability

Binaries should be traceable at every stage>Sources >Dependencies>Environment details>Tags

Where’s the information?>Version control system>Build server

Traceability with Artifactory Plugin

Adding Metadata about the build>Gathers build information>Uploads artifacts in a bulk>Uploads build information>Maintains bi-directional links

DEMO TIME!Tracing Artifacts

WHAT MY FRIENDS THINK I DODevOps

What Others Think I Do

What I Think I Do

What I Really Do

What I should Do

JavaOne Russia 2012

Target: Automation

It’s impossible to release frequently with manual procedures>While maintaining quality

Use your binaries storage to release

JavaOne Russia 2012

THE MAGIC OF RELEASEPut your repository to work

Release Candidates

Your next build is a release-candidate

Once successfully built and tested, click the button>Automatic versions switch

› From integration to release

>Right place to put your binaries› Move from Staging to Public

>Automatic VCS tagging

Releasing with Release Candidates

Process:1. Produce and build snapshots until

satisfied2. Once satisfied, build a release

candidate3. Stage RC, check and verify4. Once verified, release

Releasing With Artifactory Plugin

Changes versions in build script Allows choosing a target deploy

repository Creates a VCS tag/branch

DEMO TIME!Release With Release Candidates

OOTB Release Management

Pros>Out of the box>Supports the

“by the book” release cycle

>Supports majority of the tools

Cons>Limited

extensibility>May not fit

your requirements

JavaOne Russia 2012

satisfied2. Once satisfied, build a release

candidate3. Stage RC, check and verify4. Once checked, release

satisfied2. Once satisfied, build release

candidate3. Stage RC, check and verify4. Once checked, release

Redundant build

Lots of things can go wrong during one more build

If we won’t build it, we won’t screw it Revised Process:

1. Produce and build snapshots until satisfied

2. When satisfied, check and verify3. Once checked, release

Target: Automation

It’s impossible to release frequently with manual procedures>While maintaining quality

Use your binaries storage to release

JavaOne Russia 2012

Automation Flexibility

YMMV (great deal)

Write your own release logic

Pre and post build deploy hooks

We Know: We Don’t Know Better

Flexible Release

Code your release strategy>Versioning scheme>VCS (tagging, branching, commit

comments)>Promotion hook (copy/move, comments,

status) Available by REST

Controlling Versioning Scheme

Classic versioning scheme:>Release version

› 2.0.3

>Integration version› 2.0.4-SNAPSHOT

YMMV>Write your own strategy for versioning

Example: Promotion of Snapshots

Sometimes the build takes long time…

But that’s the silly reason

Example: Promotion of Snapshots

Choose existing build to become a release

Using REST API without build server Invoke promotion plugin

>Convert to next version>Tag, branch, etc.>Promote (copy/move)

CODE TIME!Plugin What?

Artifactory is open for user plugins Simple Groovy DSL Your code runs inside the server Uses Public API (PAPI)

>Search for artifacts>Search for builds>Copy/move artifacts>Manipulate files

› E.g. change versions in descriptors

Pluggable Architecture with DSLs

JavaOne Russia 2012

As a response for various events>Download/Create/Delete>Login>Release

Scheduled On demand

JavaOne Russia 2012

Plugin Invocation Options

Plugin Code

Manipulating Version Control Systems

JavaOne Russia 2012

Plugin Code

Manipulating BuildInfo object

JavaOne Russia 2012

Plugin Code

Creating and replacing artifactsJavaOne Russia 2012

http://repo-demo:8080/artifactory/api/plugins/build/promote/snapshotToRelease/gradle-multi-example/1?params=snapExp=d14|targetRepository=gradle-release-local

JavaOne Russia 2012

Calling REST API With CURL

JavaOne Russia 2012

Artifactory server

JavaOne Russia 2012

Artifactory server

Plugins API

JavaOne Russia 2012

Artifactory server

Plugins API

Plugin name

JavaOne Russia 2012

Artifactory server

Plugins API

Plugin name

Build name and number

JavaOne Russia 2012

Artifactory server

Plugins API

Plugin name

versioning scheme

JavaOne Russia 2012

Artifactory server

Plugins API

Plugin name

versioning scheme

Target repository for release

Recap: Promotion of Snapshots

Choose existing build to become a release

Using the REST API without building Invoking the promotion plugin

>Convert to next version>Tag, branch, etc.>Promote (copy/move)

DEMO TIME!Release by Snapshot Promotion

4 Commandments of DevOps

Automate everything

Version everything

Trace everything

Report/Log/Feedback everything

Designed by Jessica Allen on Dribbble.com

4 Commandments of DevOps

Automate everything

Version everything

Trace everything

Report/Log/Feedback everything

Designed by Jessica Allen on Dribbble.com

Build Trust in Your Build-to-Deployment Flow!

Technology

SOC 2: Build Trust and Confidence

CQ5 Development Setup, Maven Build and Deployment

How build and deployment should shape software architectures

How to Build Trust In Relationships Guide

How to build trust in business

We Do Not Just Build Solutions We Build Trust

Can innovative corporate reporting build trust in a ... · 4 Can innovative corporate reporting build trust in a volatile world? Can innovative corporate reporting build trust in

How to Build Trust Online

EY - Can innovative corporate reporting build trust in a ... · PDF fileCan innovative corporate reporting build trust in a volatile world? Can innovative corporate reporting build

Build Trust as You Communicate

Dave Rocker: Build Trust With Your Employees

15 Ways to Build Trust Online

Steps to build trust V andelay I ndustries Agenda How we build our model Why trust is important? Why do individuals lack trust? Vandelay’s

How to build trust through communication final

Medina: Combining Evidence to Build Trust

Build and deployment

Trust Semantics in IoT Entities’ Deployment - AI-IoT …ai-iot2016.iit.demokritos.gr/sites/default/files/papers/AI_IoT... · Trust Semantics in IoT Entities’ Deployment ... entities

Easy Continuous Deployment You Can Trust

Build trust in survey responses

Lean Build and Deployment Automation