January 2018 Summaries

AWS provides a convenient mechanism for assigning IAM roles to EC2 instances, allowing applications running on these instances to inherit the permissions associated with those roles without needing to embed credentials or keys in the code. This approach simplifies and secures deployment practices by enabling the assignment of roles to EC2 instances either during their creation or to existing ones using the AWS CLI. Once assigned, these roles can be utilized to assume secondary roles, offering additional permissions for specific tasks, similar to using the sudo command. The process involves creating trust policies to allow the EC2 service to use these roles and accessing instance metadata to generate keys that can be used by the AWS CLI and other tools, which automatically retrieve and use these credentials without needing manual configuration. This flexible security model enhances the management of permissions and execution of processes with varying privileges, promoting a more secure and dynamic cloud environment.

Will it Deploy? is a new video series launched by Rob Pearson, focusing on automating the deployment of various technologies using Octopus Deploy, starting with an ASP.NET Core web app on Microsoft's Azure platform. The series aims to make deployment more engaging by automating cloud infrastructure provisioning and ensuring zero-downtime production deployment through a blue-green deployment pattern. The deployment process involves several steps, including setting up an Octopus Azure account, provisioning cloud infrastructure via an Azure Resource Manager Template, using Azure Powershell scripts for staging and production slot management, and deploying the web app to an App Service staging slot. The series encourages viewers to learn how to automate their application and service deployments and invites them to suggest frameworks or technologies for future episodes.

Octopus 4.0 introduced a shift from Angular to React for its UI, prompting significant discussion on the existing role-based access control system, which has evolved to offer fine-grained permissions that many organizations rely on. While some customers operate with full administrative access, others have invested heavily in configuring detailed permissions, making any drastic simplification unfeasible. The transition to React and TypeScript revealed several bugs, particularly around access permissions, which required extensive patching. The move to React highlighted the complexity of the system, as permissions errors would crash the UI, unlike the more forgiving Angular implementation. To address these challenges, Octopus is working to streamline permissions by reducing client-side checks and focusing on API-driven UI to enhance maintainability and reduce code duplication. This approach aims to simplify permission management while retaining functionality and ensuring stability for existing customers.

In January 2018, Octopus Deploy released a security-focused update, version 2018.1, aimed at enhancing security for both on-premises and upcoming Octopus Cloud users, with a recommendation for all users to upgrade. This release introduced a new versioning strategy and announced the initiation of a closed Alpha program for Octopus Cloud, with plans for an open Beta and official launch later in the year, along with a Data Centre edition. The update included several security enhancements, such as penetration testing and a security audit, and rolled up recent patches into the release. It also introduced new built-in roles and permissions, creating a distinction between Octopus Administrators and Octopus Managers to improve role clarity and prevent privilege escalation. Additionally, changes in package acquisition timing and step configuration offer more flexibility in deployment processes, although these changes may affect some users due to a database migration. Users are encouraged to review the release notes for detailed upgrade steps and to provide feedback on the new features.

Octopus Deploy has decided to align its versioning strategy with its monthly release schedule, moving from a version number system to a calendar-year-based versioning to enhance predictability and cohesion in its software releases. This change reflects the company's evolution towards a more structured and deliberate approach in software development, emphasizing continuous delivery and incremental updates without altering pricing or licensing. The decision comes from past experiences with ad-hoc versioning that led to internal tensions and a lack of cohesive storytelling in product releases. By adopting a consistent release cadence, Octopus Deploy aims to improve communication, maintain high autonomy among teams, and ensure that each release tells a cohesive story that aligns with a DevOps culture. This strategy underscores the importance of understanding the rationale behind existing practices, akin to the principle of Chesterton's fence, to make informed changes that benefit both the company and its customers.

Matthew Casperson explores the advantages of using Kotlin's standard library functions, such as run, let, also, and apply, to improve code readability and reduce complexity compared to traditional Java code. These functions are categorized into transformation functions (run and let) and mutation functions (also and apply), with each serving different purposes in handling object values. Casperson demonstrates how these functions can simplify code by reducing the number of variables and clarifying the relationships between them, making the code easier to understand and maintain. Additionally, he highlights how these functions can help identify mutating operations, which is useful for testing and managing external state dependencies. By employing these Kotlin functions, developers can write more concise and intention-revealing code that is within the cognitive limits of the average developer's memory capacity.

Matthew Casperson's blog post from January 17, 2018, provides a guide on deploying a Java web application using Octopus Deploy 4.1, focusing on modifying the web.xml file in a package sourced from Maven Central. The post explains the process of installing WildFly and configuring it with an admin user, setting up Maven Central as an external feed, and adding an Application User to enable authentication for the Hawtio management application. It details the use of C# scripting to update specific elements in the web.xml file, such as enabling authentication and setting roles and realms, which is achieved through XPath statements that modify the XML structure before deployment. Additionally, a channel rule is set to ensure the correct version of Hawtio is deployed despite version discrepancies in Maven Central. The deployment process is tested and confirmed by accessing the Hawtio interface, demonstrating the flexibility and customization options available when deploying Java applications with Octopus Deploy.

In 2018, Octopus Deploy, led by founder Paul Stovell, aimed to expand its platform with four key themes: launching a cloud-hosted version, broadening its reach beyond the Microsoft ecosystem, evolving into a comprehensive DevOps tool, and enhancing performance, scalability, stability, and user experience. The company planned to introduce a cloud-hosted version of Octopus, starting with a closed alpha and progressing to an open beta by March, focusing on long-term investment and organizational change. Octopus sought to extend its capabilities by supporting non-Microsoft technologies, including AWS, Linux, Python, Ruby, and Kubernetes. Additionally, the goal was to transform Octopus into a versatile DevOps tool capable of managing a variety of processes beyond deployments, such as disaster recovery and compliance checks. To ensure scalability and user satisfaction, Octopus intended to implement features like "Spaces" for isolating projects and "Workers" for running scripts externally, alongside efforts to improve performance and address user feedback through UserVoice suggestions.

In 2017, Octopus Deploy experienced significant growth and underwent substantial internal changes to better align with its goals, including hosting a kick-off event, hiring talent from across Australia, and focusing on monthly feature releases. The company made progress on its 2017 roadmap, achieving several key milestones such as enhancing the user interface, expanding Java support, and improving deployment stability, though some planned projects like Octopus Ops and the Slack App were not completed due to resource allocation challenges. Despite facing increased competition from Microsoft's VSTS Release Management, which gained ground in Azure-heavy deployments, Octopus remained committed to refining its product for complex deployment scenarios and enhancing its cloud offerings. The year also saw a major UI overhaul from AngularJS to React, reflecting the company's readiness to invest in long-term improvements despite the high costs and effort involved. As Octopus embarked on these changes, it also recognized the need to manage ambitious projects more iteratively to avoid drifting off course, a lesson learned from the challenges faced during the year.