user story and release must meet to be considered done. For a user story, the definition may include code completion, the level and types of testing, and (just enough) documentation. For a release, the definition the application layer while using existing infrastructure. Program Scope Program spans core capabilities and underlying platform or infrastructure. The government is responsible for primary Complexity Many contractors are required to develop program elements. Program can leverage test infrastructure and automated tests, and testers are active throughout development. Test Environment

to which its policies are expressed as code.” c. CREATE A SINGLE, SHARED SOURCE CODE REPOSITORY FOR OUR ENTIRE ORGANIZATION i. Firm-wide shared source code repository is powerful way to share local local discoveries to the entire organization 1. Configuration standards for libraries, infrastructure, and environments 2. Deployment tools 3. Testing standards and tools, including security 4. Deployment ability to not be responsible for unsupported platforms ii. Systematically review production infrastructure and services for items that are causing disproportionate amounts of failure and unplanned work;

high performers had MTTR 168x faster than low performers b. CREATE OUR CENTRALIZED TELEMETRY INFRASTRUCTURE i. Remove the silos of information – Developers don’t just log what’s interesting to development fact-based problem-solving e. ENABLE CREATION OF PRODUCTION METRICS AS PART OF DAILY WORK i. Create infrastructure to make it easy for Dev or Ops to create telemetry for functions built ii. Generate graphs problems g. FIND AND FILL ANY TELEMETRY GAPS i. Expand metrics from business, application, infrastructure, client software, and deployment pipeline levels 1. With every production incident identify

streams of work were significantly behind schedule. Surprising discovery: only 50% of the source code in Dev/Test environments matched Prod. They fixed forward, but changes not put back into version consistent, & secure c. CREATE OUR SINGLE REPOSITORY OF TRUTH FOR THE ENTIRE SYSTEM i. ALL parts (code & environments) of the system are shared in a version control repository ii. Version control is value stream iii. Everything, everything, everything is checked into version control 1. Application code & dependencies 2. Environment scripts & creation tools 3. DB scripts and reference data 4. Containers

Compliance: e. Myth—DevOps Means Eliminating IT Operations, or “NoOps” f. Myth—DevOps is Just “Infrastructure as Code” or Automation: g. Myth—DevOps is Only for Open Source Software: 2. Foreword xix 3. Imagine secure service to the customer b. THE BUSINESS VALUE OF DEVOPS i. Code and change deployments (thirty times more frequent) ii. Code and change deployment lead time (two hundred times faster) iii. Production Consider when we have an annual schedule for software releases, where an entire year’s worth of code that Development has worked on is released to production deployment. Like in manufacturing, this

of management get in the way of goals. The employee wants the shortest possible path to shipping code without needing layers of approval. Management should be close enough to the action that they can in the interest of shipping code. If there is a backlog in exploratory testing, people who normally do development will help test. Software engineers will oversee their code in production and help make make changes to the infrastructure if necessary to improve performance.  Fairness and social responsibility: The workplace must be fair. Arbitrariness provokes negative reactions. If someone needs to

risks of the underlying infrastructure must be measured and quantified, so that the total risks and impacts to software applications are understood.  Deploy immutable infrastructure, such as containers concept of immutable infrastructure is an IT strategy in which deployed components are replaced in their entirety, rather than being updated in place. Deploying immutable infrastructure requires standardization standardization and emulation of common infrastructure components to achieve consistent and predictable resultConceptual Model DevSecOps LifecycleDevSecOps Pillars DevSecOps EcosystemDevSecOps Software Factory

Segregated technical and business functions  Development  Operations (Operational Waterfall)  Infrastructure Ops  Product Ops  Product Management  Every technology under the sun  Solaris, Windows planning and demos  Put everything into a repository (configurations, scripts, etc.) Infrastructure as Code  Turned over repeatable and automatable tasks to the product team wherever possible. Control encourages technical learning.  How we need to improve  Sharing ideas, code, Community of Practice, etc.  Test Driven Infrastructure  Blue – green deployments  Combining DevOps Scrum – planning, standups

to a problem.  if we mandate that projects reuse code whenever possible, each project may have to spend time searching archives of available code to find something that is a near fit, and then deal and design patterns. Incremental delivery and staged investments reduce cost and risk.  Custom code is almost not custom these days. A developer incorporates open source frameworks, uses standardized are already available.  There are “cookbooks” available with templates for deploying systems, code snippets that handle common tasks, and well-known and well-studied algorithms for solving typical

install it I need… • root access on a bunch of servers, but I need more servers so I need… • an Infrastructure as a Service platform, but for high availability I need… • another rack of servers, but to pay