September 2022 Summaries

Octopus Deploy introduced the Configuration as Code (Config as Code) feature in March 2022, allowing users to manage deployment processes and settings through version control systems like Git. Responding to customer feedback, Octopus added the ability to store non-sensitive variables in Git alongside deployment processes, enhancing the power and flexibility of Config as Code by allowing major changes to deployment processes and variables on feature branches without affecting others until ready to merge. Sensitive variables remain in the Octopus database, with plans to explore secure Git storage in the future. Users must manually migrate existing Git project variables to this new system, as automated migration posed a risk of disruption. The transition phase results in three possible project states: Git projects with Git variables, Git projects with database variables, and database projects, but support for Git projects with database variables will eventually be removed. The Octopus Configuration Language (OCL) schema was refined to improve usability, merging values for the same variable and flattening scopes to streamline the OCL editing experience. The latest version of Config as Code is available for cloud and on-premises users in the 2022.3 release, and users are encouraged to provide feedback to shape future developments.

In response to the United States government's 2021 Executive Order on Improving the Nation's Cybersecurity, software vendors are now required to produce Software Bills of Materials (SBOMs), which catalog the components of a software application to enhance transparency and security. This mandate aims to mitigate cybersecurity risks by ensuring that all software acquired by the government includes a detailed inventory of its components, thereby increasing trust between vendors and government entities. The Octopus Workflow Builder is a tool designed to assist developers in generating and integrating SBOMs into their deployment processes, ensuring compliance with the new regulations. By automating the creation and scanning of SBOMs, the tool provides a way to manage and monitor software components effectively, thus supporting businesses in maintaining security and fulfilling governmental requirements. As global awareness of SBOMs grows, businesses may increasingly demand such transparency to address potential cybersecurity vulnerabilities proactively.

Testing is a critical component of DevOps processes, ensuring software quality at each stage of the delivery pipeline through an iterative cycle of building, testing, and releasing. Automated testing, which includes functional and non-functional tests, is essential for customer satisfaction and team success, as evidenced by studies like the 2021 State of DevOps DORA Report, which highlights continuous testing as a marker of elite performance. Functional tests focus on specific operations within the software, such as unit and integration tests, while non-functional tests assess system performance, security, and scalability. Both manual and automated tests have their place, with automated tests enabling faster iterations and integration with tools like Octopus Deploy to streamline deployment management. This comprehensive testing approach ensures that applications can maintain high standards of reliability and functionality, thus supporting a successful Continuous Delivery strategy in DevOps.

The integration of Jira Service Management with Octopus, available as an early access preview in the Octopus 2022 Q3 release, aims to streamline change management processes for DevOps teams by connecting Octopus deployments to change requests in Jira Service Management. This integration supports the automatic creation of change requests or links deployments to existing ones, ensuring compliance with company policies and regulatory requirements through a complete audit log. It allows teams to configure workflows by enabling Jira Service Management for specific projects and environments, facilitating a more automated approval process. By setting up prompted variables, users can link deployments to existing change requests or create new ones during deployment time, with Octopus recognizing change requests as approved once they reach the Implementing stage. This feature is designed to make deployment pipelines more efficient and compliant, while the development team invites feedback and discussions from users to further enhance the integration.

In June 2021, Octopus Deploy introduced its first set of actions in the GitHub Marketplace to integrate GitHub workflows with Octopus Deploy, and these actions have since been improved, with a new action added as part of the Octopus 2022 Q3 release. The updates include support for Semantic Versioning (SemVer) release tags, improved usability by removing unused parameters and supporting environment variables for contextual values, and a new Push Build Information action that allows users to send detailed commit, build, and issue tracking information to Octopus. Additionally, job summaries are now supported, making it easier to understand action outputs. These enhancements aim to streamline workflows and encourage the automatic adoption of bug and security fixes by pinning to major versions.

DevOps emerged as a significant movement in technology, gaining momentum after Patrick Debois organized the first "DevOps Days" conference in 2009, although it initially faced skepticism and was difficult to define. Over time, the annual State of DevOps Reports, initiated by Alanna Brown and led by researchers like Nicole Forsgren, Gene Kim, and Jez Humble, provided empirical data to substantiate the movement's benefits, leading to the identification of the "DORA metrics": Deployment Frequency, Lead Time, Mean Time to Recovery (MTTR), and Change Failure Percentage. These metrics demonstrated a clear link between high performance in tech teams and positive business outcomes across industries. The book "Accelerate" further explored these findings, emphasizing the importance of focusing on capabilities rather than maturity and advocating for practices that improve speed and quality without sacrificing reliability. The integration of DORA metrics into tools like Octopus Deploy underscores their value in assessing and guiding DevOps performance, helping organizations track and enhance their development processes.

The Octopus 2022 Q3 release introduces several enhancements to streamline the development and deployment workflow, emphasizing the Config as Code solution. Key features include version-controlled variables for improved development workflow, ITSM change management integrations with ServiceNow and Jira Service Management, and DevOps Insights for actionable DORA metrics to assess and enhance DevOps performance. These updates aim to bolster the security, scalability, and traceability of CI/CD pipelines, ensuring compliance with regulatory requirements. The release also includes GitHub Actions updates for enhanced usability and cloud target discovery simplifications, along with breaking changes affecting external feed requests and ServiceNow approval caching. This comprehensive release is available for both Octopus Cloud users and self-hosted customers, aiming to support modern DevOps teams in creating reliable, auditable, and efficient deployment processes.

Alpine Linux is a widely used lightweight Docker image favored for its small size and efficiency, making it suitable for creating custom Docker images. Although it is popular, users should be aware of its reliance on the musl C standard library instead of the more common glibc, which can lead to compatibility issues with some third-party tools and libraries, notably affecting Python builds and certain container applications like those using Calamari. Best practices for optimizing Alpine-based images include removing unnecessary cached package lists using the `apk add --no-cache` command and employing multi-stage builds to separate development and runtime dependencies, which can significantly reduce image size and improve performance. Despite potential compatibility challenges, Alpine remains a practical choice for Docker images due to its efficiency and the flexibility it offers through advanced features like virtual packages.

The Apache HTTP Server, a widely-used web server, has an official Docker image available on Docker Hub, which has been downloaded over a billion times. This guide explains how to use the HTTPd Docker image to host static websites or build custom Docker images by embedding HTTPd. Initially, users can host static content by mounting files, but creating a custom Docker image with embedded web files is more efficient. Additionally, the guide details how to integrate advanced HTTPd configurations, such as a health check endpoint, by modifying the configuration files. It also compares Debian and Alpine-based HTTPd images, highlighting the smaller size of Alpine images, and provides instructions for creating a lightweight custom image using the Alpine variant. The document concludes by suggesting additional learning resources, including how to build and deploy containerized applications using the Octopus Workflow Builder on AWS platforms.

Addressing vulnerabilities is a critical aspect of software development that extends beyond the deployment phase, as evidenced by high-profile cases emphasizing the need for proactive risk management. Vulnerabilities typically emerge post-deployment, as testing may not detect all issues, and undetected vulnerabilities only become exploitable once deployed. To mitigate risks, it is crucial for developers to actively track and resolve vulnerabilities post-deployment to protect user data, company reputation, and prevent potential downtime. Furthermore, the short sprints of DevOps processes can help manage vulnerabilities by making it easier to identify and rectify issues. Effective vulnerability management involves regular patching and updating of tools and infrastructure, staying informed about industry security news, and using vulnerability scanners to identify known issues in code and infrastructure. The article underscores the importance of shared responsibility models, such as Amazon's, which delineate security responsibilities between service providers and customers.