From DevOps to NoOps how not to get Equifaxed ApiDays Global Paris. On the virtues of immutable infrastructure.

1. From to
from oops to NoOps
CONTINUOUS DEPLOYMENT CLOUD HOSTING
31/1/2018 ApiDays Global @Paris

2. HI.
Ori Pekelman
Chief Product Officer @ Platform.sh
I am oripekelman everywhere
(github/linked-in/twitter)

3. They tell you in these conferences
that APIs are as much about code as
it is about operations. And that
DevOps is not about tools, but about
culture.
On both accounts they are partially right.
I am going to tell you that it’s not
only about culture, or tools but also
about abstractions.

4. And this conference is about
Sustainability. Which is a concept.
I will talk about abstractions, semantics
and such.
But this talk means to be useful. Yell
at me if I am not.

5. So .. before going into abstractions let’s talk some real-world

6. So .. before going into abstractions let’s talk some real-world

7. Equifax is a clusterfuck of such
epic proportions it is not an
easy subject.
Their brand now is the following:

8. Equifax is a clusterfuck of such
epic propotions it is not an
easy subject

9. For people whose main line of
business is consumer trust.
Well, good thing that consumers
are not their clients.

10. We will look at just two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

11. We will look just at two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

12. We will look just at two of the
epic moments of this saga.
1. The infamous
CVE-2017-5638

13. At $4,000,000,000 this person is
worth way more than Steve
Austin at just $29,791,399
(adjusted for inflation).

14. What do you gather was the
salary of a person who has a
manual/menial “update this
package” job might be?

15. “We can rebuild him. We have
the technology. We can make
him better than he was. Better,
stronger, faster.”

16. Jay Rogers: The HL-10. We
rebuild it from scratch. Modern
technology can do wonders
today.
Col. Steve Austin: Yes, I know...

17. Abstractions
Was this a fault of Gary? Was this the fault
of his manager Diane?
I posit this was the fault of thinking
software wrong.

18. What is software?
● Think of it as a fractal. Not a box.
● There is the application code, yes.
● But usually multiple applications in
multiple programming languages.
● That depend on multiple
data-backends
● That contain a state of the world
● All of which run on multiple platforms
with a complex network structure that
has semantics.

19. What is software?
Code by itself doesn’t run. It is a useless
thing. It needs the infrastructure. It needs a
state of the world (data).
If you are testing only the code you are not
testing the software.

20. Software is a function of time.
What is software?

21. ● Over time two things happen to
software:
○ Creating new stuff
○ Repairing broken stuff
What is software?

22. Creating new stuff is voluntary. You do it
on your own rhythm. The better
automation you have the faster and more
productive you will be.
The better your tests are … less you will
suffer from quality degradation and rot.
What is software?

23. What is software?
Repairing broken stuff must not
be on your own rhythm.
The fix CVE-2017-5638 should
have been deployed an hour
after it was out.

24. Robustness
Robustness used to be about minimising
change. Marble looks robust. Cement.
The realization that what resists change is
brittle is a recent one.

25. Robustness
We used to think about software as code.
As a state of code.
Now we must think about software as
change, as a flow. As a dynamic system
where people, machines, and processes
interact continuously.

26. Semantics
At platform.sh we really do spend a bunch
of time asking ourselves not “how do you
build”; not even “how do you build
consistently”; but “what does it mean to
consistently build in a world where change
is good, where you do really want to be
able to push security fixes into production
as soon as they are available because you
don’t want to be an Equifax but you also
want a stable world.”.

27. 1. Version everything. Make everything
auditable.
Think holistically.

28. 2. Software is Code. Data Services. Data
State. Network Configuration. Permissions.
Underlying infrastructure.
Think holistically.

29. 3. Make everything semantic. A build script
is not semantic. A minor version is not
semantic.
Think holistically.

30. Think holistically.
4. Always be building. Consistently.
Immutable infrastructures.

31. 1. Hey, can you give me, in 5 minutes, the
version of every goddamn library we
are running in production?
2. Hey, how much time would it take you
to move to another cloud provider?
3. Hey, do we run our Root File System
Read-Only?
Test yourself. Test your Ops.
Ask:

32. Equifax happened
Because without full automation
and thinking holistically, in
system terms, fear of change will
drive the business.

33. Equifax happened
Because there was a specific
procedure in place to update a
specific part of the software to
be done by a human.

34. Let’s see if I talked really, really
fast and have time for epic
failure #2!

37. No. It wasn’t this. That would be half-competent.

43. Is it Diane or Gary’s fault
again?
No. It is about snowflakes. When
infrastructure is done by hand
you need a “change request
form”.

44. There is no way in hell a “mature
enterprise” will have procedures
that are lightweight enough to
roll-out a full new project in a
day. If you need to fill a form. If
you need to go through IT and
Security for this specific thing.

45. In an emergency someone will
“power through”.
And when that happens. Well
you’ve seen.

46. Full automation allows you no
only to have robust
management of your compliance
requirements; But also it allows
you to manage waivers and
exceptions; Fast.

47. If you can not rebuild your full
infrastructure in minutes. From
scratch. Applying all security
updates for every single service
and library. And be 100% sure
that nothing will possibly break.
It is because you were thinking
software wrong.

48. And you might get Equifaxed.

49. Bonus Bonus Slide, so how is
Equifax doing right now?
Can I have some version discovery please?
https://developercentre.equifax.com.au/CHANGELOG.txt
https://services.inivio.com.au/WebResource.axd?d=test
curl -I https://developercentre.equifax.com.au
X-Powered-By: PHP/5.4.16
https://www.cvedetails.com/vulnerability-list/vendor_id-74/produc
t_id-128/version_id-149817/PHP-PHP-5.4.16.html

50. Git-driven infrastructure
With a single git push
deploy an arbitrarily complex
cluster
(with micro-services, messages
queues and the lot.)

51. Clone a byte-for-byte copy of
your production site in less
than a minute
Every git branch has a url
Eliminates QA bottlenecks
14x faster human testing and validation
Fail proof, predictable deployments
Quick bug fixes and security release
resolution

52. Fully managed backend services

53. Unique, triple-redundant
architecture
Automatic high-availability
High Performance
Dynamic scaling
Multi-Cloud. Sovereign Hosting.
GDPR compliant. The works.

54. @platformsh
CONTINUOUS DEPLOYMENT CLOUD HOSTING