Slides from my DevOpsExpo London talk "From oops to NoOps". They tell you in these conferences that DevOps is not about tools, but about culture. And they are partially right. I am going to tell you that it’s not only about culture or tools but also abstractions. It is a lot about how you see software and its value. About our mental model of what software is: how it runs, evolves, and interacts with the other facets of an enterprise. We used to view software as code. As a state of code. Now we think about software as change, as a flow. A dynamic system where people, machines, and processes interact continuously. At Platform.sh we spend a bunch of time asking ourselves not “How do you build?” - or even “How do you build consistently?” - but rather “What does it mean to consistently build in a world where change is good?” A world that lets you push security fixes into production as soon as they’re available because you don’t want to be an Equifax but you do want stability. In this presentation, I will go over what we think software is and why having the right ideas about software will help you get your culture right and your tooling aligned, as well as gain in productivity, and general happiness and well-being.

1. From to
from oops to NoOps
CONTINUOUS DEPLOYMENT CLOUD HOSTING
31/10/2017 DevOpsExpo London

2. HI.
Ori Pekelman
Chief Product Officer @ Platform.sh
I am oripekelman everywhere
(github/linked-in/twitter)

3. They tell you in these conferences that
DevOps is not about tools, but about
culture.
And they are partially right.
I am going to tell you that it’s not only
about culture, or tools but also about
abstractions.

4. I will talk about abstractions, semantics
and such. But this talk means to be
useful.

5. So .. before going into abstractions let’s talk some real-world

6. So .. before going into abstractions let’s talk some real-world

7. Equifax is a clusterfuck of such
epic proportions it is not an
easy subject.
Their brand now is the following:

8. Equifax is a clusterfuck of such
epic propotions it is not an
easy subject

9. For people whose main line of
business is consumer trust.
Well, good thing that consumers
are not their clients.

10. We will look at just two of the
epic moments of this saga.

11. We will look at just two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

12. We will look just at two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

13. We will look just at two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

14. At $4,000,000,000 this person is
worth way more than Steve
Austin at just $29,791,399
(adjusted for inflation).

15. What do you gather was the
salary of a person who has a
manual/menial “update this
package” job might be?

16. “We can rebuild him. We have
the technology. We can make
him better than he was. Better,
stronger, faster.”

17. Jay Rogers: The HL-10. We
rebuild it from scratch. Modern
technology can do wonders
today.
Col. Steve Austin: Yes, I know...

18. Abstractions
Was this a fault of Gary? Was this the fault
of his manager Diane?
I posit this was the fault of thinking
software wrong.

19. What is software?
● Think of it as a fractal. Not a box.
● There is the application code, yes.
● But usually multiple applications in
multiple programming languages.
● That depend on multiple
data-backends
● That contain a state of the world
● All of which run on multiple platforms
with a complex network structure that
has semantics.

20. What is software?
Code by itself doesn’t run. It is a useless
thing. It needs the infrastructure. It needs a
state of the world (data).
If you are testing only the code you are not
testing the software.

21. Software is a function of time.
What is software?

22. ● Over time two things happen to
software:
○ Creating new stuff
○ Repairing broken stuff
What is software?

23. Creating new stuff is voluntary. You do it
on your own rhythm. The better
automation you have the faster and more
productive you will be.
The better your tests are … less you will
suffer from quality degradation and rot.
What is software?

24. What is software?
Repairing broken stuff must not
be on your own rhythm.
The fix CVE-2017-5638 should
have been deployed an hour
after it was out.

25. Robustness
Robustness used to be about minimising
change. Marble looks robust. Cement.
The realization that what resists change is
brittle is a recent one.

26. Robustness
We used to think about software as code.
As a state of code.
Now we must think about software as
change, as a flow. As a dynamic system
where people, machines, and processes
interact continuously.

27. Semantics
At platform.sh we really do spend a bunch
of time asking ourselves not “how do you
build”; not even “how do you build
consistently”; but “what does it mean to
consistently build in a world where change
is good, where you do really want to be
able to push security fixes into production
as soon as they are available because you
don’t want to be an Equifax but you also
want a stable world.”.

28. 1. Version everything. Make everything
auditable.
Think holistically.

29. 2. Software is Code. Data Services. Data
State. Network Configuration. Permissions.
Underlying infrastructure.
Think holistically.

30. 3. Make everything semantic. A build script
is not semantic. A minor version is not
semantic.
Think holistically.

31. Think holistically.
4. Always be building. Consistently.
Immutable infrastructures.

32. Equifax happened
Because without full automation
and thinking holistically, in
system terms, fear of change will
drive the business.

33. Equifax happened
Because there was a specific
procedure in place to update a
specific part of the software to
be done by a human.

34. Let’s see if I talked really, really
fast and have time for epic
failure #2!

37. No. It wasn’t this. That would be half-competent.

43. Is it Diane or Gary’s fault
again?
No. It is about snowflakes. When
infrastructure is done by hand
you need a “change request
form”.

44. There is no way in hell a “mature
enterprise” will have procedures
that are lightweight enough to
roll-out a full new project in a
day. If you need to fill a form. If
you need to go through IT and
Security for this specific thing.

45. In an emergency someone will
“power through”.
And when that happens. Well
you’ve seen.

46. Full automation allows you no
only to have robust managment
of your compliance
requirements; But also it allows
you to manage waivers and
exceptions; Fast.

47. If you can not rebuild your full
infrastructure in minutes. From
scratch. Applying all security
updates for every single service
and library. And be 100% sure
that nothing will possibly break.
It is because you were thinking
software wrong.

48. And you might get Equifaxed.

49. Git-driven infrastructure
With a single git push
deploy an arbitrarily complex
cluster
(with micro-services, messages
queues and the lot.)

50. Clone a byte-for-byte copy of
your production site in less
than a minute
Every git branch has a url
Eliminates QA bottlenecks
14x faster human testing and validation
Fail proof, predictable deployments
Quick bug fixes and security release
resolution

51. Fully managed backend services

52. Unique, triple-redundant
architecture
Automatic high-availability
High Performance
Dynamic scaling
Multi-Cloud. Sovereign Hosting.
GDPR compliant. The works.

53. @platformsh
CONTINUOUS DEPLOYMENT CLOUD HOSTING