April 2023 Summaries

Splitting a monolith into microservices involves careful planning, prioritization of services, and strategic approaches like the Strangler Fig method to mitigate risks. This process can enhance scalability, flexibility, and system resilience while preventing a distributed monolith, which can occur if network delays complicate service calls. The Strangler Fig approach, favored by many companies, involves gradually decoupling less tightly integrated services, allowing ongoing feature development and reducing risk. Key steps include identifying services to split, minimizing unnecessary code movement, and maintaining consistent interfaces to ensure seamless traffic redirection between the monolith and new services. Feature flags play a crucial role in testing and transitioning by enabling load, stress, and parity testing. This gradual transition allows for scalable and reliable migration, with platforms like Split offering tools and support to manage feature deployment and experimentation effectively, thereby reducing risk and enhancing visibility across development teams.

Harness Continuous Integration now supports Apple Silicon M1 machines, providing iOS developers with the opportunity for faster and more efficient app development by utilizing the enhanced performance of the M1 architecture within their CI/CD pipelines. The M1 chip, introduced by Apple in 2020, marks a significant shift from Intel processors, offering improvements in processing speed, power efficiency, graphics, and machine learning. Harness has integrated M1 machines into its system, combining this powerful hardware with its managed cloud service to optimize developer workflows and reduce build times. The blog guides users on configuring pipelines to run on M1 machines, selecting specific Xcode versions, and using Rosetta for Intel-based architecture compatibility. By leveraging these resources, developers can enhance their app development process, and the blog encourages readers to explore these capabilities by signing up for a free trial with Harness CI/CD.

Integrating security into the software development lifecycle through a shift-left approach, continuous integration/deployment, and regular security testing significantly enhances digital infrastructure security. Application security focuses on protecting individual software applications from external threats and internal vulnerabilities through measures like secure coding and vulnerability management. DevOps security, or DevSecOps, emphasizes integrating security into the entire digital infrastructure, including platforms and networks, by fostering collaboration between development and IT operations teams and utilizing automated tools and CI/CD pipelines. Key practices for securing digital infrastructure include conducting regular security audits, performing penetration testing, implementing access control and authentication, and maintaining secure configuration management. Additionally, building a security-focused culture through training, collaboration, and continuous improvement is crucial for maintaining robust security measures. Tools like Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Security Information and Event Management (SIEM) solutions play a vital role in enhancing application and DevOps security. By adopting these best practices and technologies, businesses can strengthen their digital infrastructure security, reduce the risk of cyber-attacks, and adapt to emerging threats.

Feature flags can significantly enhance logging strategies by allowing dynamic management of log levels and sampling rates, which helps reduce costs and maintain consistency without requiring code redeployments. The approach involves wrapping logging in an internal library for consistent formatting and using feature flags to control sampling rates and log levels at the class level. By employing tools like Split, teams can set up default logging levels with the flexibility to override them, enabling real-time adjustments and more efficient incident response. This method allows for runtime log level management without interrupting program execution and supports dynamic configurations through key-value pairs or custom JSON. Split further aids product development teams by offering a comprehensive feature management and experimentation platform, providing data-driven insights, risk reduction, and improved team visibility, thereby facilitating faster and more confident feature releases.

Harness has introduced an SDK for Erlang and Elixir within its Feature Flags platform, aimed at helping developers create scalable and fault-tolerant distributed applications, particularly suitable for industries like fintech, IoT, and telecom. The SDK allows seamless integration and management of features, following established patterns to ensure smooth deployment. Recognized for its concurrency and reliability, Erlang is complemented by Elixir's modern syntax, making them a popular choice for building distributed systems. Existing users of Harness Feature Flags can expect consistent support and performance, with documentation available to guide new users through the setup process. The process involves using the SDK in code and creating flags within the Harness app to enable progressive delivery and faster deployment.

Penetration testing is a critical cybersecurity practice used to identify and mitigate vulnerabilities in systems, networks, and applications by simulating real-world attacks, ensuring compliance with regulatory standards, and building customer trust. Various types of penetration testing, such as white box, black box, and gray box testing, along with network, application, wireless, and physical penetration testing, help organizations assess different security aspects. Tools like Nmap, Metasploit, and Burp Suite aid testers in detecting and exploiting vulnerabilities, though the process carries risks such as service disruptions and legal issues if not properly scoped. Regulatory standards like PCI DSS, HIPAA, and GDPR often require penetration testing, and the field is rapidly evolving with trends like the integration of AI and continuous testing. Harness Security Testing Orchestration (STO) enhances penetration testing by automating vulnerability detection and remediation, providing a unified view of security risks, and preventing the deployment of vulnerable applications.

Harness has announced new integrations between its Continuous Integration (CI) and Feature Flags modules and Jira Software, designed to enhance visibility and collaboration in the software development process. Unveiled at Atlassian Team '23, these integrations aim to boost productivity by providing a consolidated view of development issues across different environments, thus reducing the need for context-switching and tool management. Available in the Atlassian Marketplace, the integrations allow users, including project managers and non-technical personnel, to gain insights into feature development and release information directly within Jira, streamlining workflows and improving the developer experience. This collaboration between Harness and Atlassian reflects a shared commitment to helping organizations deliver high-quality software more efficiently while aligning development outcomes with customer needs.

Application security testing is an essential process for identifying and mitigating vulnerabilities in software applications, thereby safeguarding them from potential cyber threats. With the increasing complexity of cloud computing and mobile technologies, attackers find more opportunities to exploit vulnerabilities, making regular and early testing crucial. Key benefits include the prevention of data breaches, compliance with regulatory requirements, and the protection of organizational reputation. Various testing methods such as penetration testing, vulnerability scanning, and code review are employed to identify security flaws. Automated tools like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) enhance the efficiency of these processes. The future of application security testing is shaped by trends such as AI and machine learning, increased focus on mobile and IoT devices, automated vulnerability remediation, and the integration of security practices into the software development lifecycle through approaches like DevSecOps. Harness Security Testing Orchestration offers a solution to streamline testing, ensuring compliance while maintaining development velocity.

Implementing Value Stream Management (VSM) in software development teams can significantly enhance efficiency and productivity by eliminating non-value-adding practices, setting measurable goals, and fostering a positive work environment. VSM involves a three-phase process—analysis, design, and implementation and integration—where teams analyze current processes, design new efficient workflows, and integrate these improvements while measuring progress against set goals. Best practices for VSM include establishing clear objectives, collecting and analyzing data to identify improvements, creating a value stream map, and continuously optimizing processes. Challenges in VSM implementation, such as incorrect time and cost estimation, inadequate resources, and resistance to change, can be mitigated with proper preparation and planning. Feature Management & Experimentation tools can further streamline VSM by automating data collection and analysis, thereby reducing costs and enhancing process optimization through predictive analytics and machine learning. Overall, VSM helps teams deliver higher-quality products faster and stay competitive in the evolving software market.

Automation testing is a vital component of modern software development, enhancing both accuracy and efficiency by replacing manual, repetitive tasks with automated processes. This approach is increasingly important due to the growing complexity of software applications and the demand for rapid delivery. By implementing test automation frameworks, development teams can improve productivity, accuracy, and overall developer experience, enabling them to deliver high-quality software more reliably and swiftly. Automation testing includes various types of tests such as functional, regression, performance, integration, and GUI testing, and it supports continuous integration and delivery processes. While automation testing offers numerous benefits like error reduction, faster execution, and improved collaboration, it also presents challenges such as selecting the right tools, creating and maintaining test scripts, and training teams. To succeed, it's crucial to plan and execute a comprehensive testing regimen, ensure the quality of test scripts, and regularly update the test suite. Harness, as a software delivery platform, offers solutions like Test Intelligence™, Policy as Code, and continuous verification to streamline the software development lifecycle, allowing for more frequent, reliable releases.

Harness has introduced Cache Intelligence, a feature designed to automate dependency caching, which reduces build times by up to 45% and enhances software delivery efficiency within continuous integration (CI) pipelines. This feature addresses the common issue of lengthy build times caused by the absence of a local cache in ephemeral environments like containers or virtual machines, which are often used in modern CI solutions. By automatically managing the caching and restoring of known dependencies, Cache Intelligence simplifies cache configuration and maintenance, allowing developers to focus more on coding rather than managing cache logic. Demonstrations show substantial build time reductions, with examples given using the Harness Developer Hub, where Cache Intelligence cut build times from nearly 11 minutes to just over 6 minutes. The feature supports various build tools, including Bazel, Maven, Gradle, Node, Yarn, and Go, and offers customization for non-standard dependency locations.

Implementing a disaster recovery plan is crucial for minimizing downtime and financial losses, with chaos engineering playing a pivotal role in enhancing system resilience by proactively identifying and addressing vulnerabilities. Disaster recovery involves restoring systems and data after unexpected events, such as cyberattacks or natural disasters, which can severely impact business operations and reputation. It requires strategies like data backups, system restorations, and the establishment of disaster recovery sites to ensure data safety. Cloud Disaster Recovery (CDR) is vital even for cloud-based companies, as it safeguards data and reduces downtime in emergencies. While disaster recovery focuses on restoring services post-incident, business continuity ensures critical operations remain available during disruptions. Best practices for disaster recovery planning include regular risk assessments, resource listing, failure simulations, and staff training. Chaos engineering, by intentionally injecting failures into systems, helps organizations test reliability and identify weaknesses, allowing for faster recovery and improved system robustness. With a strong focus on governance, automation, and resilience, chaos engineering contributes to better user experience, incident response, and application performance, ultimately supporting disaster recovery efforts.

Split's support for the System for Cross-Domain Identity Management (SCIM) aims to enhance feature management and improve developer efficiency by centralizing user and group management across applications, thereby reducing risks and streamlining onboarding and offboarding processes. By integrating with identity providers like Azure Active Directory and Okta, Split enables automation of user and group provisioning, allowing teams to efficiently manage access and optimize their product development process. SCIM support simplifies the governance of Split users and groups, mitigating the risks associated with manual management outside of security platforms. The Split Feature Data Platform facilitates feature flag deployment and experimentation, ensuring safe and controlled releases while providing insights into feature performance. With a focus on increasing release efficiency and reducing mean time to recovery (MTTR), Split offers tools and support to transform how development teams work, including product explainer videos, tutorials, and interactive challenges through Split Arcade. Users can explore these functionalities with a free 30-day trial or on the Enterprise tier plan.