In this talk, Paul will demonstrate why writing infrastructure in general programming languages is a better choice for infrastructure management. Pulumi is an open source tool that allows users to write their infrastructure code in TypeScript, Python, DotNet or Go. General purpose languages allow infrastructure code to have integrated testing, compile time checks as well as being able to create infrastructure APIs and is more suited to infrastructure management than DSLs, JSON or YAML. In addition, he will demonstrate how to build infrastructure that manages Serverless, Kubernetes, PaaS and IaaS systems across multiple cloud providers.

Way too many Digital Transformation efforts are struggling. Whether being driven by a desire to modernize business processes and systems, or a business focus to drive innovation by leveraging Cloud Services, or a goal to become a data-driven business that is utilizing Machine Learning and AI inferences to make business decisions, data is being found to be a major source of friction. Most organizations do not have the data culture and the accompanying organizational structures in place to effectively and efficiently extract business value from their their data, either by monetizing it internally by making data-driven decisions, or externally by taking the insights and inferences to market. They do not have a Data Strategy in place that treats their data across the enterprise as a ‘Product’. A Product they can derive significant business value from.

In this session, Sanjeev Sharma, Principal analyst at Accelerated Strategies, will explore what it takes to adopt such a Data Strategy and scale it at an enterprise. The challenges that need to be overcome to ensure the cultural inertia to become a Data-driven is overcome. To ensure that Data-as-a-product is a driver of Digital Transformation, not an inhibitor.

In this talk we’ll take you to a scaling journey, from 3 developers to a 100. We’ll talk about the challenges each milestone in this growth brings, both technological and methodological, and how to solve those challenges using the right mix of people, the right selection of tools and the correctly crafted process. The speakers excel in the different aspects of this triangle and went through this journey (more than once) themselves. And the fun and entertaining presentation as a Greek tragedy can’t hurt, can it?

Microservices can be hard; understanding container best practices can be hard as those practices are still being discovered. This session helps you minimize the learning curve with container orchestration, specifically Kubernetes, by bringing DevOps best practices into the mix. This is not another Hello World session with quick tips. Instead, you can expect a deep dive into how you can truly go from zero to DevOps superhero by simply selecting container tooling specifically built for simplifying the process. In doing so, you will also learn how these tools can provide better orchestration for cloud services, abstraction and encapsulation for your microservices deployments and visibility into what runs where and why. You will not only walk away with a deeper understanding of this area, but also some hands-on material to help you get started.

With 40 million developers, 300,000 of open source projects, 500 billion open source package downloads annually -- what could go wrong? Or better yet, what could we get more right? In a two year long collaboration with Gene Kim and Dr. Stephen Magill, we objectively examined and empirically documented software release patterns and cybersecurity hygiene practices across 30,000 commercial development teams and open source projects. At the heart of our endeavor: what attributes can we use to identify the best open source project behaviors, what behaviors have been adopted by the best development teams relying on those projects, and is there a future where machines are applying such knowledge to building applications on our behalf? Our research uncovered a number development and cybersecurity hygiene behaviors across open source software projects that we categorized as exemplars, laggards, features first, and cautious. The exemplars represented the very best OSS suppliers with extraordinary track records for releasing updates, remediating vulnerabilities, staffing well, and demonstrating high adoption rates. We also uncovered exemplary development behaviors across teams that utilize open source software components, that included: defining process to update components, reducing the number of library versions in use, and automating practices that aid in updating dependencies. In this session, I will reveal the insights we uncovered. Attendees will learn which techniques, team structures and release patterns exemplary development teams have been championed at large enterprises and open source projects alike. I’ll share observations of exemplary teams release new code 2.4X faster and remediate security vulnerabilities 2.9X faster. Finally, I’ll shed light on how we could apply these exemplary practices using AI and ML to pave the way toward machines making safer software faster.

DevOps and the subsequent move to bring security in under the umbrella of DevSecOps has created a new ethos for security. This is good. But, when things go wrong–and we know they will–are we going to be successful with the DevSecOps model, or will we be left searching yet again?

In an attempt to answer this question, we will look back in history to learn how engineering decisions affect the lives of those around us, with an eye on how to make meaningful progress today.

Along the way, we will highlight the high-performing DevSecOps teams of today and introduce MEASURE, a framework for approaching DevSecOps in your organization. Topics range from empathy to lean to system safety with the hope to frame a new playbook for devs, ops, and security to work together.

In this talk we will discuss some emerging methods and techniques to strengthen trust during cloud deployments, to attest to their legitimacy and to strengthen the overall security posture in automated cloud deployments.

The concept of automating cloud governance also includes automating
the derivation of compliance artifacts to reduce the effort of auditing and
allow the compliance posture to be observed in real time and continuously,
rather than as captured snapshots of observations.

If you have struggled to make some security sense of the gaps we see everyday in current state major cloud provider environments, then come attend this talk and join the clarion call already underway to improve it!

TBD

The dawn of DevOps was driven by community; we can trace its genesis back to the very first DevOpsDays in Ghent in 2009, a volunteer-led event that spawned hundreds in its own form and a global movement of humans who want to work better. Whilst not every organization is a capitalist organization, there are plenty of charities and governmental organizations after all, there are myriad examples of enterprises whose goal is to generate profits and shareholder value no matter what their higher organizational purpose that persist in pursuing DevOps values and sharing stories of their own endeavors. Whilst capitalism may seem at odds with the idea of community, of practitioners volunteering their expertise and experiences to be shared with like-minded souls, so this talk seeks to explore what giving and taking means, how generosity is paid forward and how communities create learning opportunities for the global greater good.

IBM Z has long been the foundation of the systems of record for large organizations, this foundation provides the highly scalable, reliable, secure system organizations need. With the drive to digital transformation organizations not only need these “ilities” but also need to be able to move at the speed business requires today. With that need, IBM has been working to provide cloud native developer experience for building traditional z/OS applications, supporting both the open tool chains but also the processes and practices normally found in cloud native development. With the latest announce of IBM Wazi for Red Hat Code Ready Workspace providing both the Code capability of a full developer environment, but also providing the sandbox of a full environment for isolated development test environments running in your existing OpenShift environment running in an intel hardware environment. This session will discuss how this new developer experience supports the cultural transformation required to support the new ways of working to support the Digital transformation.

Digital transformation is no longer an option. Every organization knows it must become a digital leader to survive. Successful digital transformation is not just about changing technology, it’s also about changing the way organizations work together. In this talk, Kris Pennella, Director, Open Innovation Labs at Red Hat will weave in real world customer examples of transformative efforts. She’ll examine how companies are going beyond reimagining their ways of working from focusing on changing mindset and the future of their organizations.

Regardless of what tech role you may play, one thing is for certain. All technology professionals will need to sharpen and diversify a range of skills to meet the rising demands of the new decade and new normal. This session will review the results and trends from DevOps Institute's 2020 Upskilling: Enterprise DevOps Skills Report and provide insight into which skills are considered "must have", "nice to have" and "not as important" across human, process, automation and functional categories.

Transitioning to remote work requires intentionality, and a well-executed strategy positions a company to be more efficient, inclusive, and cohesive. Join Darren Murph, Head of Remote at GitLab, to learn how his team has implemented remote-first practices in a rapidly growing startup. Come prepared to have your prior notions of management turned upside-down, leaving with a tactical guide to scaling culture, process, iteration, and collaboration in a post-office world.

Over the past eight years, Puppet has surveyed more than 30,000 technical professionals around the world in the most comprehensive and longest-running study on the topic of DevOps. In the 2019 State of DevOps Report, we looked specifically at how organizations are integrating security into the software delivery lifecycle.

This presentation will highlight some of the common patterns and practices that highly evolved DevOps organizations have in place to enable tighter integration with security. The talk will provide a practical roadmap for adopting and expanding DevOps success and focus on:

How executing well on DevOps is key to enabling DevSecOps
The top 5 practices that increase your team's confidence in your security posture.
Common challenges of integrating security into the development lifecycle, especially in the middle phases where things tend to get messy.

Technology has finally caught up to the way humans like to conduct business. Up until quite recently, technology-based business models were primarily oriented around transactions, but as our technical abilities have matured, especially in the way we move and use data, we are able to enact technology-enabled, relationship-based business models. However, just because these relationship based models are technically possible does not mean the shift is easy. How can we, as technologists, make the shift from transactions to relationships? And what are our responsibilities as the crafters of this new digital relationship infrastructure? Let’s start a digital transformation conversation.

We’ll examine Amazon’s culture, practice, and technology using a sample of quotes from our CTO, Dr. Werner Vogels. He has a great talent for saying big things in a few words. Amazon’s history and culture of DevOps will be covered, our stance on building reliable systems as well, and we will take a peek into the future of the Cloud. Our goal is simply to share a model that has seen remarkable success.

Software delivery is a top priority for organizations that own software, yet it remains one of the most challenging problems enterprises face today. Continuous delivery enables software changes of all types to reach production environments in a safe, quick, and sustainable way. The goal is to make deployments, in whatever architecture, predictable and routine such that developers can perform deployments on demand. Join this session to learn how Harness can help you scale and sustain enterprise software delivery pipelines. Attendees will learn the fundamentals of successful continuous delivery pipelines including AIOps and Pipeline Governance for risk management.

Automation and DevOps have changed the way organizations deliver products. The shift towards DevOps made it pretty clear that companies are adopting this organizational model in order to facilitate a practice of automated software deployment. While the traditional idea of a “software release” dissolves away into a continuous cycle of service and delivery improvements, organizations find that their traditional application security solutions are having a hard time to adapt to the new process and security becomes an inhibitor to the complete process.

How should enterprises retrofit their current software delivery practices? Forward-thinking companies must embrace new technologies while still driving critical business needs with older applications and platforms...and maintaining automation, visibility, and governance.
Join us as we share how organizations can empower their teams with the freedom of selecting the right tools for their mission while retaining corporate compliance guard-rails. The new paradigm of software delivery is not to simply rip and replace, but to embrace choice, enable experimentation, improving the rate of innovation.

Containers help enterprises modernize legacy applications and create new cloud-native applications that are both scalable and agile. In this talk, Matt takes us along two different customers' journeys to container strategy and deployment -- one with legacy IT ripe for modernization and the other cloud-native seeking optimization. He'll share lessons learned along the journey from infrastructure design through deployment using ECS, EKS, OpenShift, CloudFormation and Terraform.

How should enterprises retrofit their current software delivery practices? Forward-thinking companies must embrace new technologies while still driving critical business needs with older applications and platforms...and maintaining automation, visibility, and governance.

As a developer-focused company, InfluxData is always interested in how the community is doing. During the first two weeks of April, we conducted an online survey to find out how developers are handling life and work during the COVID-19 pandemic. In this presentation we’ll talk about some of the challenges that developers and companies are facing, and how they’re working to overcome them.

Modern software demands velocity, and traditional “outside in” scanning and firewalling are creating bottlenecks and slowing things down. In this talk, Jeff will approach application security from the “inside out”. We will show you how to create simple agents that get inside a running application (like a profiler or debugger) and give you access to everything you need for fantastic security observability. We’ll demonstrate real agents that identify vulnerabilities without changing any code, scanning, or extra steps. We’ll identify vulnerabilities, analyze access control, and even prevent RCE attacks. Unlike scanning and firewalling, this approach establishes a safe and powerful way for development, security, and operations teams to collaborate. We’ll discuss how software security instrumentation works, how it’s being used in many organizations, and the implications for the practice of application security.

Essentially, observability is a collection of approaches and best practices that allow us to look into a running software system, and understand how it behaves, how it misbehaves and what’s broken inside. While the idea is brilliant and perfectly works in teams that own software systems end-to-end, enterprises face a set of unique challenges that can drive observability useless if not properly addressed. In this talk, I will explain these challenges and how they can be solved before turning into unsolvable problems. We will look into technical, organizational, processual and political aspects - all these are unavoidable when applying such a change to an enterprise. The listener will learn what to look for in order to apply observability ideas in their enterprise without risk of failure, and hopefully get excited about possibilities and chances that come with the introduction of observability in their enterprise.

We’ll review the market trends of this evolving space, discuss why LCNC is a huge win for the business, and what it takes to open up an existing closed business platform for external developers to build on.

In less than five years, AWS Lambda has been adopted by nearly half of companies with infrastructure in AWS. In this talk, we'll examine the serverless usage of thousands of Datadog customers to provide a look at how (and how much) serverless is being used in the real world. You'll leave with a better understanding of how serverless technologies are being adopted, what other technologies are being adopted, as well as best practices and trends we've seen emerge. There are even some surprises along the way.

As organizations rapidly adopt new technologies such as serverless, containers, and servicemesh, cloud infrastructure is becoming increasingly “immutable”: infrastructure is never modified after it is deployed. If it needs to be modified in any way, new infrastructure has to be provisioned through code. Unfortunately, traditional cloud security approaches are untenable for securing transient cloud native infrastructure. As a result, over 30 billion records have been exposed in cloud breaches over the past two years and the velocity as well as sophistication of attacks is increasing. The only way to secure immutable infrastructure is to adopt a paradigm of immutable security. In this talk, Piyush will deep dive on the three principles behind immutable security and illustrate how to implement it.

One of the most aspirational yet sparingly applied aspects of DevOps and DevSecOps is Security as Code. Most development teams are aware that integrating security within their SDLC needs to be more than just shifting security scans to the left. Yet, the majority do little more than scanning in their CI/CD pipelines because it is extremely difficult to automate security policies in rapidly changing ephemeral environments. Join NeuVector’s Solution Engineer, Tracy Walker, as he demonstrates the ease and benefits of fully automating Security as Code for Kubernetes using NeuVector.

TBD

Planning, provisioning, and changing infrastructure are becoming vital to rapid cloud application development. Incorporating infrastructure-as-code into software development promotes transparency and immutability and helps prevent bad configurations upstream. In this talk, we’ll cover best practices for writing, testing, and maintaining infrastructure at scale using policy-as-code both in build-time and run-time. We’ll compare the two methods and review sample use cases that showcase the benefits of each.

Have you used Jenkins? It helps you automate just about anything. No wonder people call it the “Swiss army knife” of DevOps. In this talk, we’ll go well beyond Jenkins and into the realm of Cloud and Kubernetes, with CloudBees CI (Core). At a technical level, we’ll discuss scalability patterns, storage, fault tolerance, and cost optimization. Several new features will be presented, including Hibernation for Managed Masters, using the CloudBees CI on AWS Quick Start, which you can freely use after the session. We hope you enjoy, and we'd love to hear your feedback in chat!

Join D2iQ’s Co-Founder and CTO, Ben Hindman, to learn how to experience true digital transformation by using containers / Kubernetes.

With individual teams empowered to spin up micro services, you should increase your velocity with Serverless. But if your teams don’t collaborate, they can turn a software monolith into the Tower of Babel. I’ll cover how clear team communication, critical CI/CD tools, testing, and observability can help your team build serverless together.
Screen reader support enabled.

Starting and progressing on a journey to transformation can be a daunting challenge for most organizations. Red Hat Open Innovation Labs uses a combination of open technology and open practices to upskill organizations on both the technology and cultural changes needed to ultimately start the journey toward transformation. In this session we follow one customer’s transformation journey, starting with accomplishing metrics-based cloud delivery.

TBD

As the DevOps movement continues to see momentum many organizations don’t know where to start. A common misconception is tooling will make you “DevOps”. While tools can give you the software that will allow you to automate, continuously deliver, monitor, and more; alone they won’t get you to the necessary practices to take advantage of the benefits DevOps has to offer. In this talk attendees will learn why it’s the people and culture that matter most and how to leverage DevOps best practices along with processes to make the most out of your DevOps journey.
Being a champion in the DevOps world means going beyond the win by delving deeper into the team/organizational structure and culture. By identifying outlying issues beyond tools, and then working with others to embrace necessary change, DevOps champions can lead the charge in organizational transformation and adoption of DevOps.

In our containerized application world, we can revolutionize the way apps are secured by building security and compliance guardrails into our apps and our application development processes from the start.
In this session, Tim Hinrichs, CTO of Styra and co-founder/inventor of the Open Policy Agent project, will show examples of policy-as-code guardrails, deployed across the stages of app development, deployment and runtime, including:
Git: How to structure repositories so that teams can write independent API authorization policies that snap into an application-wide authorization system that enforces those policies automatically, all without relying on a paper process or PDFs.
CICD: How to impose governance over the policies written by individual teams so that just like application code, bad policies are rejected well before they cause problems.
Kubernetes: How to ensure deployment of the application is properly bound to the policies that are intended to secure it.
Runtime: How to write policies that limit the risk of data exfiltration, lateral movement and insider attacks or mistakes.
Throughout the discussion the audience will see working code snippets to ground the discussion and a bit of live-coding.
Three Key Takeaways:
How to leverage the open source tools to build policy-as-code guardrails.
Best practices from the community for limiting risk.
How to shift security left, and bring policy into your development culture, without manual overhead.