January 2021 Summaries

Integrating static and dynamic code analysis can significantly enhance software quality by identifying vulnerabilities early, addressing runtime issues, and improving deployment reliability, which is especially crucial given the widespread reliance on software during challenging times like the COVID-19 pandemic. Static code analysis involves examining source code against predefined rules before execution, identifying vulnerabilities and ensuring adherence to coding standards, while dynamic analysis evaluates an application during or after execution to address runtime vulnerabilities. Both methods have distinct advantages and limitations; static analysis excels in identifying issues in unexercised code, whereas dynamic analysis provides insight into production scenarios, making them complementary. Harness supports this integration by combining static and dynamic analysis to strengthen CI/CD pipelines, ensuring code readiness for production and reducing potential production incidents.

Jenkins, once a leading CI/CD platform, is now facing criticism due to its extensive plugin ecosystem, which creates significant challenges such as dependency hell, security vulnerabilities, and maintenance burdens. The platform's plugin model, likened to the chaotic "Slippers the cat" story, has become overwhelming with 1,788 available plugins, many of which are defunct, abandoned, or have complex dependency chains. These dependencies often lead to compatibility issues, security risks, and increased maintenance efforts, prompting users to consider alternative platforms like Harness, which offers a more streamlined solution with self-contained Docker container plugins that have no dependencies. The growing complexity and management difficulties with Jenkins are causing organizations to rethink their CI/CD strategies in favor of more modern and efficient solutions.

Harness has introduced several enhancements to its Cloud Cost Management and Continuous Delivery (CD) platforms, including the integration of disk utilization metrics for Kubernetes recommendations and the implementation of machine learning-powered anomaly detection to identify unexpected cost spikes. These updates aim to provide more accurate and predictable cloud spending forecasts by allowing users to set budget constraints within Perspectives. Furthermore, Harness has added a Deployment Freeze feature to its CD platform, enabling companies to schedule deployment pauses during critical events to ensure application uptime. In addition to product updates, Harness has announced significant milestones, such as securing Series C funding and achieving a $1.7 billion valuation. The company also expanded its browser support to include Safari and has been featured in various media outlets discussing its recent achievements. Upcoming virtual events and developments include a focus on Azure and the release of Drone 2.0.

Split is implementing a new streaming architecture using Server-Sent Events (SSE) to deliver feature flag changes in real time, reducing latency to under a second while maintaining reliability with a hybrid model that includes automatic fallback to polling. This shift comes as a response to customer feedback emphasizing the importance of immediate change propagation, and it builds upon a stable polling architecture that has served increasing traffic demands, including half a trillion flags in the previous month. The new system, set to be the default within two months, aims to improve performance by minimizing network traffic and leveraging native browser support, with ongoing benchmarks ensuring consistent results across different locations. While streaming will be the preferred mode due to its speed and efficiency, polling remains an option for situations where it offers advantages such as scalability and resilience in unreliable networks. Split's approach to feature flag management, which includes tools for experimentation and data-driven decision-making, continues to evolve with this technological advancement, promising an exciting future for users looking to enhance development processes.

Split's integration with Amplitude allows for precise targeting by syncing behavioral and predictive cohorts to personalize feature delivery and enhance experimentation efficiency. This partnership removes the need for manual targeting, reducing errors while improving customer experiences by using Amplitude’s cohorts directly within Split. The integration facilitates the automatic updating of cohorts, enabling personalized customer interactions and faster testing processes by targeting specific user groups with feature flags. This approach not only enhances customer journeys but also accelerates experimentation programs by generating insights from user behavior to form new testing hypotheses. Split's comprehensive solution includes extensive resources and support, offering product development teams the tools and confidence to release impactful features efficiently and with reduced risk.

The DevOps Tools Lifecycle Mesh offers an updated and comprehensive visual representation of the DevOps ecosystem, focusing on the importance of integration and APIs over single-vendor solutions. It aims to provide lifecycle context and accurately categorize tools based on their primary use cases, addressing the shortcomings of previous visuals that either focused solely on application development or IT operations. The landscape of DevOps has evolved rapidly, with some companies exiting, new entrants, and acquisitions, prompting an update for 2021. The creators, inspired by previous visualizations like XebiaLabs' Periodic Table and CA Technologies' London Tube map, emphasize that no single tool or vendor dominates the DevOps ecosystem, highlighting the significance of integration for effective operation. The Mesh seeks to correct misrepresentations in tool categorization, particularly in expansive areas like CI/CD and monitoring, where tools are often inappropriately grouped without differentiation.

ABC Fitness Solutions transitioned from using Jenkins to Harness for their software deployment process, significantly reducing maintenance efforts and increasing deployment velocity by 20%. This change allowed the DevOps team, led by engineers Chris Jowett and David Leonard, to focus more on platform improvements rather than constant troubleshooting of Jenkins pipelines, which had become unreliable and eroded developer confidence. The shift to Harness provided metrics that helped restore trust in the deployment process and led to a more efficient and reliable software delivery system. As a result, the company has been able to prioritize platform advancements and foster a more productive development environment, aligning with their mission to innovate and empower fitness leaders.

In an episode of ShipTalk, Ravi Lachhman interviews Tracy Ragan, CEO of DeployHub, who discusses her career journey and the significance of community in the open source and DevOps spheres. Ragan emphasizes the evolution of DevOps from scripted to declarative automation, highlighting the role of the Continuous Delivery Foundation in promoting collaboration and innovation. She shares insights from her extensive experience in configuration management, detailing her work with OpenMake Software and the challenges of transitioning from monolithic to microservices architectures. Ragan also underscores the importance of finding one's voice, especially for women in tech, and the value of contributing to open-source communities as a way to build professional recognition and personal connections.

Lessonly transitioned from using Heroku and Jenkins-Spinnaker pipelines to Harness, significantly improving operational efficiency by reducing service onboarding time from a week to minutes and eliminating extensive maintenance work. Initially, Heroku's lack of infrastructure flexibility and increasing costs prompted the move to AWS, where attempts to use Jenkins and Spinnaker-based pipelines proved inadequate due to their complexity and lack of essential features like RBAC and audit trails. The switch to Harness empowered developers with self-service deployment, advanced role-based access control, and audit capabilities, allowing them to manage their services more effectively without disrupting the developer experience. This transition enabled site reliability engineers like Stephen Gregory and Tyler Henrichs to focus more on application development rather than deployment maintenance, all while ensuring the shift went unnoticed by developers, highlighting the seamless integration of the new system.

The blog post explores various deployment strategies aimed at enhancing application reliability and reducing risks, with a focus on blue-green and canary deployments, which are popular among mission-critical web applications. Blue-green deployments use two identical environments to ensure smooth transitions and straightforward rollbacks, while canary deployments incrementally release updates to a subset of users to minimize risk. The post also discusses basic, multi-service, rolling deployments, and A/B testing, highlighting their pros and cons. It emphasizes the importance of choosing the right strategy based on the application and environment, and mentions the role of Continuous Integration and Continuous Delivery (CI/CD), as well as Continuous Verification (CV) in improving deployment outcomes. The author suggests leveraging automation and modern tools like Harness to simplify and scale software delivery, citing case studies where these strategies have reduced deployment-related downtime and improved operational efficiency.

Harness, an AI-driven software delivery platform, has secured $115 million in new financing, elevating its valuation to $1.7 billion, with the funds aimed at expanding its capabilities to enable efficient software deployment akin to tech giants like Google and Facebook. Led by Alkeon Capital with participation from new investors such as Battery Ventures and Citi Ventures, this investment highlights confidence in Harness's innovative approach to continuous delivery and cloud cost management. Since its 2017 launch, Harness has revolutionized software delivery by progressing through three generations of development, culminating in an AI/ML-driven platform that automates deployment verification and rollback, reducing lead times for developers. The company recently announced the acquisition of Drone.io and plans to release new modules, enhancing its CI/CD capabilities, while continuing to grow its global team, which is lauded for its positive workplace culture and recognized by platforms like Forbes and Glassdoor.

Iterable significantly improved its software deployment process by adopting Harness, which led to a threefold increase in deployment velocity, an 85% reduction in downtime risk, and a 50% decrease in change failure rate. Before implementing Harness, the company faced challenges due to a complex and outdated delivery workflow, requiring extensive manual effort and resulting in frequent deployment failures. With over 1000 servers to manage, the deployment process was cumbersome, taking a full day for weekly batch deployments and often leading to issues that were difficult to resolve. By transitioning to Harness, Iterable was able to streamline its deployment process, allowing developers to deploy independently and securely, reducing rollback time from four hours to just 20 minutes, and cutting deployment effort by 89%, ultimately enhancing the stability and quality of their software delivery.

Harness significantly reduced its cloud spending by 40% through a proactive, engineering-led approach to cost management, shifting from a reactive, top-down oversight. This strategy involved empowering engineers with detailed cost visibility and accountability, allowing for impactful infrastructure optimizations. Harness implemented changes such as managing cloud costs on an hourly basis, providing engineers with tools to correlate deployments with financial impact, and setting up cloud budgets with monthly usage alerts. These efforts resulted in substantial savings, reducing monthly costs from $100,000 to $60,000, and inspired the development of their Cloud Cost Management software to help other organizations achieve similar results. Examples of success include customers like Relativity and GoSpotCheck, who achieved significant savings by addressing inefficiencies and idle costs.

Netlify is a popular tool among front-end developers for deploying and hosting applications due to its ease of use, speed, and reliability. This guide demonstrates how to build a simple React calculator app using create-react-app, integrate feature flags using Split, and deploy the app with Netlify. The tutorial highlights creating essential components, such as buttons and results, and implementing feature flags to control the rollout of new functionalities like BACKSPACE, allowing for incremental or immediate user deployment without code changes. The combination of Netlify and Split enables faster releases and quicker bug detection, offering a robust solution for front-end development. Additionally, Split provides comprehensive feature management and experimentation tools, helping teams release impactful features efficiently while maintaining high visibility and reduced risks.

A/B testing is a crucial tool for product development, aiding in setting goals, designing experiments, measuring success, and learning from outcomes, including failures. Effective A/B testing begins with a roadmap driven by metrics rather than hierarchy-driven opinions, allowing product teams to focus on measurable goals like customer retention or revenue segments. The process involves hypothesis formulation, metric design, and data-driven decision-making, emphasizing the importance of learning from both successful and unsuccessful experiments. Guardrail metrics can help detect negative side effects, while progressive delivery and feature flags can mitigate risks by controlling feature releases. Organizations with mature experimentation cultures often empower all team members to conduct tests, but starting with a centralized approach guided by experts is advisable. Ultimately, the goal is to build a culture of continuous learning and improvement, making data-driven decisions to enhance product value and customer satisfaction.

Harness has introduced a new feature called Custom Deployments, allowing users to deploy technologies not natively supported by the platform, such as legacy systems like Weblogic and WebSphere, as well as modern solutions like Google Cloud Functions. This feature integrates with Continuous Verification for improved monitoring and verification of deployments. Custom Deployment templates can be defined at the account level, leveraging the Account Level Template Library, and are versioned for flexibility. Users can create infrastructure definitions, set up workflows, and manage deployments through the Harness UI. The service dashboard tracks deployed instances and reflects updates based on scripts that query infrastructure states. Custom Deployments are already being used by some users for legacy workloads, and the Harness team encourages the community to share their implementations and innovations using this feature.

Integrating vulnerability scanning into CI/CD pipelines using Harness and Nexus IQ is a strategy aimed at enhancing security by preventing the deployment of artifacts with severe vulnerabilities. The process involves using Harness to operationalize Nexus IQ's vulnerability scanning, allowing for the deployment of hygienic artifacts only. The setup includes managing secrets through Harness Secrets Manager, setting up workflow variables, and creating workflows for scanning artifacts, interpreting scan results, and deploying applications. By programmatically interpreting scan results and incorporating them into a Harness Pipeline, users can automate the detection of severe vulnerabilities and halt deployments if necessary. This integration exemplifies a DevSecOps approach, shifting security practices towards development and self-service while ensuring application security testing evolves alongside modern software development practices.