Patterns and Antipatterns for Software updates
- 1. DevOps Patterns and Anti-Patterns of continuous Software Updates What can possibly go wrong?!
- 5. “As every company becomes a software company, Security vulnerabilities are the new oil spills” IDENTIFY FIX DEPLOY
- 6. Vulnerabilities which can be identified sooner, but can take years for fixing and deploying Hardware Vulnerabilities ● “63% of organizations face security breaches due to hardware vulnerabilities” - Techrepublic article IDENTIFY Immediately FIX Months DEPLOY Years
- 7. - The register, UK https://www.theregister.co.uk/2017/05/12/nhs _hospital_shut_down_due_to_cyber_attack/
- 8. Vulnerabilities which have moderate time for all the 3 steps, yet affect the industry much higher Security Vulnerabilities that led to data breaches ● “Proactive work that we do through defense in depth, that's great, but you've got to be prepared to react and respond when something doesn't go right.” - Brad Arkin, CSO, Adobe IDENTIFY Weeks FIX Weeks/Days DEPLOY Weeks/Months
- 10. Vulnerabilities which have faster times for all the 3 steps, yet affect the industry much much higher Vulnerabilities in components that affect every industry ● Vulnerabilities in Micro-processors IDENTIFY ASAP FIX ASAP DEPLOY ASAP
- 11. Which systems are affected by Meltdown? Technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). Which systems are affected by Spectre? Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones.
- 13. In a span of 6 years, with over 31000 survey responses, a report on the adaptation of DevOps and categorisation brings light to the spectacular results!
- 15. Obviously, this is not a new idea! ❏ XP: Short feedback ❏ Scrum: Reduce cycle time to absolute minimum ❏ TPS: Decide as late as possible and Deliver as fast as possible ❏ Kanban: Incremental change ❏ And now, our vision is Liquid software - Updates as fast as possible
- 17. So, which version of Java are we on? How much have we upgraded since mid-2017?
- 18. How do we Update?
- 19. Maybe, we don’t trust the QA!
- 20. It does depend on other factors
- 21. So, is this a solution?
- 22. Also, that’s when we have an option or if we care! What if, we don’t? ❏ Your Browser ❏ Your Smartphone ❏ Smartphone applications (for most of us) ❏ Twitter or alike applications in our devices
- 23. So, here’s a pattern for both - of course proven! ❏ Problem: Updates went terribly wrong and is affecting the current deployments ❏ Solution: Local rollbacks, Have a previous version saved on the device prior to update. Rollback in case problem occurred ❏ Have a Plan B!
- 24. An Era of IoT
- 25. And, in this era of IoT, software updates play a crucial role
- 26. To avoid such update costs and risks, OTA updates needs to be continuous ❏ Problem: Physical recalls are costly. Extremely costly. Also, you can’t force an upgrade. ❏ Solution: Implement over the air software updates, preferably, continuous updates. ❏ Basically, DevOps for IoT
- 27. Well, we thought our problems are hard Things under your control Server-side Updates IoT (Mobile, Automotive, Edge) Updates The availability of the target ✓ ✕ The state of the target ✓ ✕ The version on the target ✓ ✕ The access to the target ✓ ✕
- 28. So, a number of things can go possibly wrong - A Knight- mare ❏ 1 out of 8 servers was not updated ❏ New system reused old APIs ❏ New clients sent requests to machine contained old code ❏ Engineers undeployed working code from updated servers, increasing the load on the not-updated server ❏ No monitoring, no alerting, no debugging
- 29. Lessons learned ❏ Humans are bad at repetitive tasks - we need to Automate everything ❏ Seldom deployments generate anxiety and stress, leading to errors - we need to update frequently in order to develop skill and habit ❏ Target state can affect the update process and the behavior of the system after the update - we need to know the Target state before upgrade, reverting might not be a Solution based on the target state
- 30. And things are different when it comes to social media
- 31. What can we do to avoid such a mass-outage? ❏ Let’s not impact all the users by a bug in release, release to a small number of users first effectively reducing the blast radius and observe. If a problem occurs, stop the release, revert or update the affected users ❏ Progressive delivery ❏ We cannot rely on feedback only - Implement tracing, monitoring and logging ❏ Rollbacks is not an option for some deployments, feature flags can save us from such huge issues - Embed 2 versions of the features in the app itself and trigger them with API calls
- 32. Long time to update is no more acceptable ❏ We will probably lose all the users if we take weeks/days to update in this age ❏ We need to ensure Zero downtime upgrades in order to be User friendly as well as Enterprise ready
- 33. Thus, we gain the missing trust with all the proven Continuous updates patterns
- 34. 3434 24/7 Dedicated Support + DevOps Acceleration Service Arm THE JFROG PLATFORM BUILD TEST RELEASE DEPLOY Continuously integrate automate & deploy Clear security and compliance issues Distribute to production site Control and monitor the flow On Premises & Multi Cloud Store and manage all types of packages ACCESS FEDERATION Authentication, ACLs SSO, Access Tokens
- 35. “Our goal is to transition from bulk and rare software updates to extremely tiny and extremely frequent software updates; so tiny and so frequent that they provide an illusion of software flowing from development to the update target” We call it the Liquid Software vision
- 36. Thank You