Monthly Archives: November 2018

In this episode, Jeffrey is discussing security in DevOps with his guest, Henry Been. Henry is an independent DevOps and Azure architect from the Netherlands. He enjoys working with development teams to create and deliver great software — and for him, this includes the full DevOps cycle; starting with discovering and planning new features and ending only when end users are satisfied. Henry's interests include the Azure cloud, Agile, DevOps, software architecture and the design and implementation of testable and maintainable software. Next to his work, Henry is one of the Microsoft ALM DevOps Rangers — which is a group of 130 engineers worldwide who share professional guidance and create gap-filling solutions surrounding Azure.

Henry and Jeffrey discuss, in-depth, everything you want to know when it comes to security with DevOps. Henry offers advice on how to implement security into your DevOps practice, makes recommendations on how to be more secure at each stage of the software development application lifecycle, highlights possible vulnerabilities that you might want to watch out for, and offers tools you can utilize to combat this and up your security in your DevOps environment.

Topics of Discussion:

[:40] About today's episode and featured guest expert.

[1:35] Jeffrey welcomes Henry to the podcast.

[1:41] What Henry has been up to of late.

[2:21] How Henry has found himself in the DevOps space.

[3:08] Henry shares some information about the ALM DevOps Rangers he is a part of.

[4:16] About the half-marathon Henry recently finished!

[5:50] How did the term DevSecOps come about? And what do people need to know about it?

[7:22] Henry offers advice on how to implement security into your DevOps practice.

[8:26] Henry's recommendations for being more secure at each stage of the software development application lifecycle.

[12:47] The vulnerabilities of copying your database offsite.

[13:44] Is keeping your database offline more secure than having it online?

[14:04] A word from Azure DevOps sponsor: Clear Measure.

[14:29] Henry outlines ways to limit the surface area of personal access to environments.

[16:29] A vulnerability in the FCKeditor WYSIWYG HTML editor and how to avoid it.

[17:53] Henry and Jeffrey's take on why many are fearful of a scheduled, automated deployment or redeployment.

[20:45] The work Henry has done with Azure Policy and how can help.

[24:04] One of the most vulnerable attack surfaces: any area that a human's account has access to.

[24:41] What's on the roadmap for Henry!

[26:32] How to keep up with Henry and everything he's doing.

[27:02] Henry's recommendations to those who want to learn more about security in their DevOps environment.

Mentioned in this Episode:

Azure DevOps

Azure DevOps User Group on Meetup

Microsoft ALM DevOps Rangers

DevSecOps

SQL Clone from Redgate

Redgate

Clear Measure (Sponsor)

Infrastructure as code

FCKeditor WYSIWYG HTML

Azure Policy

Henry's Blog (HenryBeen.nl)

Henry's Twitter @Henry_Been

Want to Learn More?

Visit AzureDevOps.Show for show notes and additional episodes.

Follow Up with Our Guest:

Henry Been's LinkedIn

Henry's Blog

Henry's Twitter

Download this episode (MP3, 28:43, 27.6 MB)

Watch this episode on YouTube

This episode on the AI DevOps Podcast site

In today's episode, Jeffrey is joined by Eric Hexter, the Chief Technology Officer of Quarterspot LASO — a fintech company that produces lending platforms using machine learning. He built the company in the Cloud with DevOps as a foundational component of delivering the product. Eric has filled roles as CTO, Chief Architect, Developer, and Consultant. He's spent most of his career working with web technologies, with a total of twenty years experience producing technology solutions that deliver business value.

As Jeffrey says, Eric is the DevOps King. He's done some incredible work over the past decade and a half and has even written some books — well, namely one book back in 2012, ASP.NET MVC 4 in Action, co-authored by Jeffrey as well.

Eric and Jeffrey talk all about DevOps Diagnostics today, running through the various categories within it, such as: system metrics, log files, air conditions, heartbeats, and data integrity checks. Eric also gives his recommendations to those new and experienced with the system — tools, resources, and services.

Topics of Discussion:

[:47] About today's guest, Eric Hexter.

[1:19] Jeffrey welcomes Eric to the podcast.

[2:28] How Eric first got interested in the world of DevOps.

[4:01] Eric talks about some of the key points made from his presentation on the Azure DevOps User Group on Meetup.

[6:46] What Cloud DevOps diagnostics consist of.

[8:10] What categories .NET developers need to be watching in order to operate their systems effectively.

[9:08] Eric talks about one of these categories: his favorite system metrics.

[12:15] Eric gives a quick rundown on queue-based processing.

[14:23] Eric's favorite queue at the moment.

[15:21] The importance of having metrics on every running piece of your application.

[18:23] A word from Azure DevOps sponsor: Clear Measure.

[18:52] How Eric looks at system metrics.

[20:06] On Eric's team, who looks at the metrics?

[20:34] Eric gives an explanation of the next category of Cloud DevOps diagnostics: log files.

[22:32] What Eric recommends developers should be logging to a text file.

[23:33] Eric explains what a decorator pattern looks like in code.

[24:42] Eric briefly explains built-in log files.

[25:03] How Eric brings all these log files together to cohesively view them all.

[26:31] How does Eric log files?

[27:30] Why logging as a first class feature within the application can be incredibly useful.

[29:14] The next category of Cloud DevOps diagnostics: air conditions and common patterns within it.

[38:13] The next category: heartbeats.

[42:00] Eric dives into the next diagnostics category: data integrity checks.

[44:04] The differences in structured logging compared to regular logging.

[48:46] For structured logging, does Eric have a favorite library?

[50:41] Eric's recommendations tools and services to get started in all of this.

[53:06] Eric's advice on how to consolidate all your flat files to start a consistent view.

[54:16] Eric's favorite heartbeat source.

[55:00] Additional resources Eric recommends listeners to go check out after this week's episode.

Mentioned in this Episode:

Quarterspot

ASP.NET MVC 4 in Action, by Eric Hexter, Jeffrey Palermo, Jimmy Bogard, Matthew Hinze, and Jeremy Skinner

Azure DevOps

Azure DevOps User Group on Meetup

PREMIS
Azure Storage

New Relic

Stackify

Application Insights

Azure Queue Storage

Clear Measure (Sponsor)

Grafana

Loggly

The Netflix Tech Blog

Want to Learn More?

Visit AzureDevOps.Show for show notes and additional episodes.

Follow Up with Our Guest:

Eric Hexter's LinkedIn

Download this episode (MP3, 56:36, 54.3 MB)

Watch this episode on YouTube

This episode on the AI DevOps Podcast site

I do pull in the Exec function from psake just because it was coded very well.  This build script is just powershell and is geared for .Net Core

. .\BuildFunctions.ps1

$projectName = “OnionDevOpsArchitecture”

$base_dir = resolve-path
.\

$source_dir =
“$base_dir\src”

$unitTestProjectPath =
“$source_dir\UnitTests”

$integrationTestProjectPath =
“$source_dir\IntegrationTests”

$uiProjectPath =
“$source_dir\UI”

$databaseProjectPath =
“$source_dir\Database”

$projectConfig = $env:BuildConfiguration

$version = $env:Version

$verbosity = “q”

$build_dir =
“$base_dir\build”

$test_dir =
“$build_dir\test”

$aliaSql =
“$source_dir\Database\scripts\AliaSql.exe”

$databaseAction = $env:DatabaseAction

if
([string]::IsNullOrEmpty($databaseAction))
{ $databaseAction = “Rebuild”}

$databaseName = $env:DatabaseName

if
([string]::IsNullOrEmpty($databaseName))
{ $databaseName =
$projectName}

$databaseServer = $env:DatabaseServer

if
([string]::IsNullOrEmpty($databaseServer))
{ $databaseServer =
“localhost\SQL2017”}

$databaseScripts =
“$source_dir\Database\scripts”

if
([string]::IsNullOrEmpty($version))
{ $version = “9.9.9”}

if
([string]::IsNullOrEmpty($projectConfig))
{$projectConfig = “Release”}

Function Init {

    rd
$build_dir -recurse -force  -ErrorAction Ignore

       md $build_dir
> $null

       exec {

              &
dotnet clean
$source_dir\$projectName.sln
-nologo -v $verbosity

              }

       exec {

              &
dotnet restore
$source_dir\$projectName.sln
-nologo –interactive -v
$verbosity 

              }

    #Write-Host
$projectConfig

    #Write-Host
$version

}

Function Compile{

       exec {

              &
dotnet build
$source_dir\$projectName.sln
-nologo –no-restore -v
$verbosity -maxcpucount –configuration
$projectConfig –no-incremental
/p:Version=$version /p:Authors=”Clear
Measure” /p:Product=”Onion
DevOps Architecture”

       }

}

Function UnitTests{

       Push-Location -Path
$unitTestProjectPath

       try {

              exec {

                     &
dotnet test -nologo -v
$verbosity –logger:trx
–results-directory $test_dir –no-build
–no-restore –configuration $projectConfig

              }

       }

       finally {

              Pop-Location

       }

}

Function IntegrationTest{

       Push-Location -Path
$integrationTestProjectPath

       try {

              exec {

                     &
dotnet test -nologo -v
$verbosity –logger:trx
–results-directory $test_dir –no-build
–no-restore –configuration $projectConfig

              }

       }

       finally {

              Pop-Location

       }

}

Function MigrateDatabaseLocal {

       exec{

              &
$aliaSql $databaseAction $databaseServer
$databaseName $databaseScripts

       }

}

Function MigrateDatabaseRemote{

       $appConfig =
“$integrationTestProjectPath\app.config”

    $injectedConnectionString =
“Server=tcp:$databaseServer,1433;Initial
Catalog=$databaseName;Persist Security
Info=False;User
ID=$env:DatabaseUser;Password=$env:DatabasePassword;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection
Timeout=30;”

       write-host “Using connection string:
$injectedConnectionString“

    if (
Test-Path “$appConfig“ )
{

        poke-xml
$appConfig “//add[@key=’ConnectionString’]/@value”
$injectedConnectionString

    }

       exec {

              &
$aliaSql $databaseAction $databaseServer
$databaseName $databaseScripts
$env:DatabaseUser $env:DatabasePassword

       }

}

Function Pack{

       Write-Output “Packaging
nuget packages”

       exec{

              &
.\tools\octopack\Octo.exe pack –id
“$projectName.UI” –version
$version –basePath $uiProjectPath
–outFolder $build_dir

       }

       exec{

              &
.\tools\octopack\Octo.exe pack –id
“$projectName.Database”
–version $version –basePath
$databaseProjectPath –outFolder $build_dir

       }

       exec{

              &
.\tools\octopack\Octo.exe pack –id
“$projectName.IntegrationTests”
–version $version –basePath
$integrationTestProjectPath –outFolder
$build_dir

       }

}

Function PrivateBuild{

       Init

       Compile

       UnitTests

       MigrateDatabaseLocal

       IntegrationTest

}

Function CIBuild{

       Init

       MigrateDatabaseRemote

       Compile

       UnitTests

       IntegrationTest

       Pack

}

This episode Jeffrey brings you a live recording from the Microsoft Ignite event. Today, he's talking with several people, including Greg Leonardo, an Azure MVP and Cloud Architect; Josh Gaverick, an MVP in Application Lifecycle Management and an Senior Application Architect at 10th Magnitude; Rob Richardson, a Microsoft MVP in ASP.NET who also builds web properties for small and medium sized businesses; and Colin Dembovsky, an ALM MVP and Cloud Solution Architect at 10th Magnitude.

Tune in to hear highlights from each of the guest's panels, what they have enjoyed learning about at the conference, their insights on various topics in the Azure space, their day-to-day work and projects outside of the conference, and their predictions on the future of Azure!

Topics of Discussion:

[:40] About today's episode.

[:51] Jeffrey introduces his first guest this episode, Greg Leonardo.

[1:55] How Greg journeyed into the Azure space.

[2:49] What has been going on in Greg's local community of Tampa, Florida.

[3:59] What Greg and Jeffrey share in common: supporting VetsinTech!

[4:48] Greg explains what a front door is in the Azure space.

[5:40] Where to find more information about the work Greg is up to.

[7:01] Greg explains some of the interesting ideas found in his book.

[10:27] A word from Azure DevOps sponsor: Clear Measure.

[10:53] Jeffrey introduces the next set of guests: Josh Gaverick, Rob Richardson, and Colin Dembovsky.

[11:50] How the conference has been so far for the three of them.

[12:23] Highlights from Rob's talk at the conference.

[14:35] What has been Josh's highlights of the conference thus far and what his talk was about.

[17:21] Colin's highlights at the conference.

[19:18] Josh's insights on SQL Managed Instance.

[20:09] About Josh's other talks at the conference.

[21:16] About Rob's current projects at his job.

[24:45] What Colin works on day-to-day.

[28:18] About Josh's current work.

[35:27] Recommendations for listeners to check out after this week's episode!

[41:22] Jeffrey asks: five years from now, where are we going to be?

Mentioned in this Episode:

Azure DevOps

Microsoft Ignite

Hands-On Cloud Solutions with Azure, by Greg Leonardo

VetsinTech

Clear Measure (Sponsor)
Azure Front Door Service

GregLeonardo.com

SQL Managed Instance

The Mythical Man-Month: Essays on Software Engineering, by Fred Brooks

Micro Focus

Azure Kubernetes Service (AKS)

Windows Containers

Want to Learn More?

Visit AzureDevOps.Show for show notes and additional episodes.

Follow Up with Our Guests:

Greg Leonardo's LinkedIn

GregLeonardo.com

Josh Garverick's LinkedIn

RobRich.net

Colin Dembovsky's LinkedIn

Download this episode (MP3, 51:03, 49.0 MB)

Watch this episode on YouTube

This episode on the AI DevOps Podcast site

Jeffrey Palermo is joined by Aaron Bjork on the Azure DevOps Podcast today! Aaron is a Principal Group Program Manager at Microsoft where he directs all work in the areas of Agile project management, reporting, and collaboration for Azure DevOps Services. He's a 16-year Microsoft veteran who has spent his career building products that promote and encourage team productivity. He is also a recognized Agile thought leader and speaks regularly with companies around the world on how to improve their software development practices. He has a proven track record of setting a vision, creating and building teams, driving user experience, and delivering results.

In this episode, Jeffrey and Aaron speak about creating and promoting culture through Azure DevOps, how companies can effectively adopt DevOps principles, and how to view analytics and metrics. Aaron also explains his main focuses and goals for Azure DevOps and how he came to join Microsoft and land his role as Principal Group Program Manager.

Topics of Discussion:

[:47] About today's guest, Aaron Bjork.

[1:57] Jeffrey welcomes Aaron to the podcast and he gives a bit of background about himself.

[4:40] How Aaron came to join Microsoft and land his role as Principal Group Program Manager.

[7:54] What are the main focuses and goals for Azure DevOps in Aaron's role?

[10:22] A word from Azure DevOps Podcast sponsor: Clear Measure.

[10:55] Aaron's thoughts on the culture of Azure DevOps.

[14:11] Aaron's advice to mid-sized, non-technology-based companies trying to adopt DevOps principles.

[16:36] What metrics does Aaron look at in Azure DevOps?

[19:54] Does Aaron collect data manually or is it all automatic through Azure DevOps?

[21:25] Aaron talks about where to find your analytics view within Azure DevOps.

[23:50] Having eliminated the dedicated tester role, who are the bugs now created by?

[26:24] What is Aaron spending his time on these days?

Mentioned in this Episode:

Azure DevOps

Clear Measure (Sponsor)

Azure Boards

Power BI

Want to Learn More?

Visit AzureDevOps.Show for show notes and additional episodes.

Follow Up with Our Guest:

Aaron Bjork on LinkedIn

Download this episode (MP3, 30:35, 29.4 MB)

Watch this episode on YouTube

This episode on the AI DevOps Podcast site