DevOps Mutualization - How are banks orchestrating DevOps and the 'Glue' utilised to create existing self-service workflows? about community HOT 9 CLOSED

As mentioned during our call ( #52 ) - I think it would be more interesting in terms of tooling to discuss the 'glue' and self-service workflow automation that teams at FIs are producing to ensure the proper controls are laid down, and some sort of integration with an internal registry of projects or namespaces that have some known lifecycle and association with systems/CIDB, etc. The individual tools that are selected, automated, and orchestrated will constantly change, but the integrations between these tools and internal systems could be an interesting problem to collaborate on - at the very least, share approaches and learnings, etc. What do others think?

from community.

@DovOps - I have updated the title and body of this story based on your feedback and the content of the DevOps Mutualization discussion on 30th July 2020 - #52 (comment)

Please feel free to feedback as I circulate the notes of our last meeting to the group.

James.

from community.

"The individual tools that are selected, automated, and orchestrated will constantly change, but the integrations between these tools and internal systems could be an interesting problem to collaborate on - at the very least, share approaches and learnings, etc. What do others think?"

@DovOps we can start by mapping the various automation tools and the main categories. For example Infrastructure as code, configuration management, Container Management (Kubernetes) and than we can describe how a potential integration between those tools may look like.

from community.

Hey @natishalom - I recommend we do this in a way that allows people to contribute into a central mark down table that can be consumed into a wiki at a later date. I've come up with the following rough example to kickstart discussion.

What am I missing / getting wrong? 🤔 😄

Resource Type Table

Describes the type of DevOps resource to be categorised.

Resource Table

Describes the resource being utilised in banking DevOps teams.

Resource Integration Mapping Table

Describes resource integration, the direction of integration and how the resources are being integrated.

from community.

This looks like a good start.
The partners report on this subject could be useful to break down the list of players per category

https://www.gartner.com/document/3984924?ref=shareSummary&submissionGuid=e0d105df-dcff-4094-a6d6-dc488e0caa8f

from community.

All - Thank you for attending the FINOS DevOps Mutualization How are banks orchestrating DevOps and the 'Glue' utilised to create existing self-service workflows? session.

Please find a list of the attendees below

DevOps Mutualization Meeting Attendees

Date and Time : Thursday 24th September @ 12:30pm ET / 5:30pm BST

from community.

Please find below meeting minutes from the DevOps Mutualization Formation Meeting that took place on Thursday 24th September @ 12:30pm ET / 5:30pm BST.

DevOps Mutualization Meeting Minutes

Date and Time : Thursday 24th September @ 12:30pm ET / 5:30pm BST

• How is infrastructure provisioned against the SDLC?
  • Infrastructure and code deployment happening through SDLC.
  • Terraform and other such technologies like Bit Bucket being engaged.
• How does a developer run a security scan before merge? 
  • This happens prior to pull request merge.
  • Developers can trigger from IDEs using SonarCube, Black Duck and others
  • Build time is a factor for being able to run security tests in realtime. Software should build fast to enable.  
  • Dependencies are a particular problem as you can pull in multiple dependencies from external sources.
    • How is this reflected in build tickets and evidence stores?
  • Getting a complete view of dependencies is ideal end state depending on the tech stack.
  • Dependency information is obtained according to the build tools.
  • Xray is used depending on the tech stack.
  • Docker images are also scanned.
  • Dependency information is also known within C++ tech stacks.
• Shifting left on engineering gates was a subject matter of interest that was raised by the group.
• The following items were highlighted as areas of interest for future deep dives
  • SDLC/CIM
  • Group Specific Controls / Gates
  • Self Service Portal
  • Metrics - Collection and Reporting
• Evidence store within the SDLC toolchain was selected as the deep dive by the group
• When is performance testing done?
  • Project owners define the test criteria
      - The tooling defines that criteria
      - The testing is done as part of the release pipeline and is collected as evidence
• Defining what should go into an evidence store manifest will be a good aspect for mutualization
• Self service portal and DevOps tools wrappers
  • Is there was a terraform script for all the tools, it would be great to standardise on that.

from community.

Hey all - The following Self Service Glue Document has been created in the DevOps Mutualization Project on GitHub to break the conversation out of this issue and place it in project where people can add their own documents and edit existing ones through pull requests.

https://github.com/finos-labs/devops-mutualization/blob/master/docs/self-service-glue.md

Let me know if you have further questions.

James.

from community.

This issue has now moved into the DevOps Mutualization Project and can be found here -> finos/devops-automation#2

from community.