TL;DR: A Systematic Literature Review was carried out to provide a better understanding of this topic from the human factor's perspective, and raises the following question: Is DevSecOps going to become mainstream?
Abstract: DevOps goes beyond automation, continuous integration and delivery processes, since it also encompasses people. In fact, DevOps promotes the collaboration between the development team and the operations team. When security comes into DevOps routines, people play an even more relevant role involving the collaboration between those teams and security team. Moreover, security is especially relevant while developing critical systems where we need to manage goals, risks and evidences. After implementing security into the DevOps toolchain, work only starts. We also need to start with behavioral changes in order to create a security culture. Several authors underlined DevSecOps, as one of the proposals for solving or, at least, minimizing this challenge. However, to date, the characterization of such a culture remains unclear. In this paper, a Systematic Literature Review was carried out to provide a better understanding of this topic from the human factor's perspective. However it raises the following question: Is DevSecOps going to become mainstream?
TL;DR: This paper describes a joint research with a Smart Healthcare application provider on a model-based approach to automatically assigning multiple software deployments to hundreds of Edge gateways and demonstrates the viability and its usefulness in supporting DevOps in Edge computing applications.
Abstract: Edge computing brings software in close proximity to end users and IoT devices. Given the increasing number of distributed Edge devices with various contexts, as well as the widely adopted continuous delivery practices, software developers need to maintain multiple application versions and frequently (re-)deploy them to a fleet of many devices with respect to their contexts. Doing this correctly and efficiently goes beyond manual capabilities and requires employing an intelligent and reliable automated approach. Accordingly this paper describes a joint research with a Smart Healthcare application provider on a model-based approach to automatically assigning multiple software deployments to hundreds of Edge gateways. From a Platform-Specific Model obtained from the existing Edge computing platform, we extract a Platform-Independent Model that describes a list of target devices and a pool of available deployments. Next, we use constraint solving to automatically assign deployments to devices at once, given their specific contexts. The resulting solution is transformed back to the PSM as to proceed with software deployment accordingly. We validate the approach with a Fleet Deployment prototype integrated into the DevOps toolchain currently used by the application provider. Initial experiments demonstrate the viability of the approach and its usefulness in supporting DevOps in Edge computing applications.
TL;DR: There is a clear need for lifelong learning among software engineering professionals as (future) developers often struggle in operations related skills such as command line or networking.
Abstract: We present the design of a online course that focuses on container-based virtualization as part of the DevOps toolchain. In addition, we outline the professional background of participants taking the course, and describe how this affects perceived previous knowledge of DevOps. We found out that the self-evaluated conceptual understanding of DevOps topics is nearly equal regardless of the participants professional identity (e.g., student or developer). However, there are significant differences in how much participants have used tools like Docker before. We conclude that there is a clear need for lifelong learning among software engineering professionals as (future) developers often struggle in operations related skills such as command line or networking.
TL;DR: A prototypical implementation of an anomaly detection system that operates in the staging environment to compare the current incoming release with previous ones according to predefined metrics is described in the form of a "proof of concept".
Abstract: The tools employed in the DevOps Toolchain generates a large quantity of data that is typically ignored or inspected only in particular occasions, at most. However, the analysis of such data could enable the extraction of useful information about the status and evolution of the project. For example, metrics like the "lines of code added since the last release" or "failures detected in the staging environment" are good indicators for predicting potential risks in the incoming release. In order to prevent problems appearing in later stages of production, an anomaly detection system can operate in the staging environment to compare the current incoming release with previous ones according to predefined metrics. The analysis is conducted before going into production to identify anomalies which should be addressed by human operators that address false-positive and negatives that can appear. In this paper, we describe a prototypical implementation of the aforementioned idea in the form of a "proof of concept". The current study effectively demonstrates the feasibility of the approach for a set of implemented functionalities.
TL;DR: In this paper, the authors propose an expansion of the application area of the DevOps models, toolchains, and even utilities to the CPS and SoS domains, which can be then automatically re-purposed for new workflow tasks, as well as to fill the remaining DevOps tooling gap with actual Systems of the Arrowhead Framework.
Abstract: The stakeholders in the Cyber-Physical System-of-Systems (CPS, SoS, CPSoS) domains need to adopt current methodologies that enable reliable but also flexible and timely completion of development, integration, deployment, operation, and even maintenance-related tasks. The so-called DevOps (Development & Operations) approach has been proven in various other domains of IT-related service completion and operation. Both the technology set and the management approaches of CPS and SoS practitioners can benefit the adoption of the DevOps toolchain success stories – the everyday life of software, cloud and IT-service development, and operations-focused companies. This paper proposes an expansion of the application area of the DevOps models, toolchains, and even utilities to the CPS and SoS domains. It proposes to create an abstraction of CPS devices as reusable infrastructure resources, which can be then automatically re-purposed for new workflow tasks, as well as to fill the remaining DevOps tooling gaps with actual Systems of the Arrowhead Framework.