Bhangi rinopa mapurojekiti ayo kune akawanda makondirakiti. "Zvekunze" nyora kodhi, wozotumira mhedzisiro nenzira isiri nyore. Kunyanya, maitiro acho aitaridzika seizvi: vakapa purojekiti yakapfuura bvunzo dzekushanda navo, uye yakaedzwa mukati mebhangi perimeter yekubatanidza, mutoro, zvichingodaro. Zvaiwanzoonekwa kuti bvunzo dzaikundikana. Ipapo zvese zvakadzokera kumugadziri wekunze. Sezvaunogona kufungidzira, izvi zvaireva nguva dzekutungamira kwenguva refu dzekugadzirisa bug.
Bhengi rakafunga kuti zvaigoneka uye zvakafanira kudhonzera pombi yese pasi pebapiro rayo, kubva pazvisungo zvekuburitsa. Saka kuti zvinhu zvose zvive yunifomu uye pasi pekutonga kwezvikwata zvinotarisira chigadzirwa mubhangi. Kureva, sekunge kontrakta wekunze aingoshanda pane imwe nzvimbo mukamuri rinotevera rehofisi. Pamusoro pekambani stack. Aya madhiri akajairwa.
Ko Sec yakabva kupi? Chengetedzo yebhangi yakaisa zvikumbiro zvakakwirira pamusoro pekuti kontrakta yekunze ingashanda sei muchikamu chetiweki, kuwana kupi munhu ane, sei uye ndiani anoshanda nekodhi. Ingori kuti IB yanga isati yaziva kuti kana makondirakiti anoshanda kunze, mashoma emabhangi maitiro anoteverwa. Uye ipapo mumazuva mashoma munhu wose anofanira kutanga kuvacherechedza.
Chizaruro chakareruka chekuti kontrakiti aive nekuwana kwakazara kune chigadzirwa kodhi yakanga yatotenderedza nyika yavo pasi.
Panguva ino, nyaya yeDevSecOps yakatanga, yandinoda kukuudza nezvayo.
Ndedzipi mhedziso dzinoshanda dzakatorwa nebhangi kubva mumamiriro ezvinhu aya?
Paiva nekukakavadzana kukuru pamusoro peidi rokuti zvinhu zvose zviri kuitwa nenzira isina kururama. Vagadziri vacho vakati chengetedzo inongobatikana kuyedza kukanganisa budiriro, uye ivo, sevarindi, vanoedza kurambidza pasina kufunga. Nekudaro, nyanzvi dzezvekuchengetedza dzakazeza pakati pekusarudza pakati pezvibodzwa: "vagadziri vanogadzira kusagadzikana mudunhu redu" uye "vagadziri havagadzirire njodzi, asi ivo pachavo." Iyo gakava ingadai yakaenderera kwenguva yakareba kana isiri yezvitsva zvemusika zvinodiwa uye kubuda kweDevSecOps paradigm. Zvaigoneka kutsanangura kuti iyi otomatiki yemaitiro anoteera ruzivo rwekuchengetedza zvinodiwa "kunze kwebhokisi" ichabatsira munhu wese kuramba achifara. Mupfungwa yokuti mitemo inonyorwa pasi pakarepo uye haishanduki panguva yemutambo (kuchengetedzwa kwemashoko hakuzorambidzi chimwe chinhu chisingatarisirwi), uye vashanduri vanochengeta ruzivo rwekuchengetedzwa kwemashoko pamusoro pezvose zvinoitika (kuchengetedzwa kwemashoko hakusanganisi chimwe chinhu kamwe kamwe) . Chikwata chega chega chine basa rekuchengetedza kwekupedzisira, uye kwete dzimwe hama dzechikuru dzisinganzwisisike.
- Sezvo vashandi vekunze vatove nekuwana kodhi uye akati wandei masisitimu emukati, zvinokwanisika kubvisa kubva mumagwaro izvo zvinodiwa "kusimudzira kunofanirwa kuitwa zvachose pazvivakwa zvebhangi."
- Ukuwo, tinofanira kusimbisa kudzora zviri kuitika.
- Kubvumirana kwaive kusikwa kwezvikwata zve-cross-functional, apo vashandi vanoshanda pamwe chete nevanhu vekunze. Muchiitiko ichi, iwe unofanirwa kuve nechokwadi chekuti timu inoshanda pane zvishandiso pamaseva ebhangi. Kubva pakutanga kusvika pakupedzisira.
Ndiko kuti, makondirakiti anogona kubvumidzwa mukati, asi ivo vanofanirwa kupihwa zvikamu zvakasiyana. Kuti varege kuunza imwe mhando yehutachiona kubva kunze kune zvivakwa zvebhangi uye kuti varege kuona kupfuura izvo zvinodiwa. Zvakanaka, kuitira kuti zviito zvavo zvinyorwe. DLP yekudzivirira kubva pakudonha, zvese izvi zvaisanganisirwa.
Muchidimbu, mabhanga ese anouya kune izvi nekukurumidza kana gare gare. Pano takaenda nenzira yakarohwa uye takabvumirana pamusoro pezvinodiwa kune nzvimbo dzakadaro apo "vekunze" vanoshanda. Pakaonekwa huwandu hwematurusi ekudzora maturusi, njodzi yekutarisa maturusi, anti-virus kuongororwa pamaseketi, magungano uye bvunzo. Izvi zvinonzi DevSecOps.
Pakarepo zvakava pachena kuti kana pamberi peDevSecOps kuchengetedzeka kwebhangi kwakanga kusina simba pamusoro pezvinoitika padivi remugadziri, ipapo mune itsva paradigm chengetedzo inodzorwa nenzira yakafanana nezviitiko zvakajairika pazvivakwa. Chete pari zvino pave nechenjedzo pamagungano, kutonga kwemaraibhurari, zvichingodaro.
Chasara kuendesa zvikwata kumuenzaniso mutsva. Zvakanaka, gadzira zvivakwa. Asi izvi zvidikidiki, zvakafanana nekudhirowa zizi. Chaizvoizvo, isu takabatsira nezvivakwa, uye panguva iyoyo maitiro ebudiriro achinja.
Chii chachinja
Takasarudza kuishandisa mumatanho maduku, nokuti takanzwisisa kuti maitiro akawanda aizoparara, uye vazhinji "vekunze" vangave vasingakwanisi kutsungirira mamiriro matsva ekushanda pasi pekutarisirwa kwevanhu vose.
Chekutanga, takagadzira zvikwata-zvinoshanda uye takadzidza kuronga mapurojekiti tichifunga nezvezvitsva zvinodiwa. Mupfungwa yesangano takakurukura kuti ndeapi maitiro. Mhedzisiro yacho yakanga iri dhayagiramu yepombi yegungano nevose vaitarisira.
- IC: Git, Jenkins, Maven, Roslyn, Gradle, jUnit, Jira, MF Forify, CA Harvest, GitlabCI.
- CD: Ansible, Puppet, TeamCity, Gitlab TFS, Liquidbase.
- Muedzo: Sonarqube, SoapUI, jMeter, Selenium: MF Fortify, Performance Center, MF UFT, Ataccama.
- mupiro (kutaura, kutaurirana): Grafana, Kibana, Jira, Confluence, RocketChat.
- Operations (kuchengetedza, kutarisira): Ansible, Zabbix, Prometheus, Elastic + Logstash, MF Service Manager, Jira, Confluence, MS Project.
Stack yakasarudzwa:
- Knowledge Base - Atlassian Confluence;
- Task tracker - Atlassian Jira;
- Artifact repository - "Nexus";
- Inoenderera mberi yekubatanidza sisitimu - "Gitlab CI";
- Inoenderera mberi yekuongorora system - "SonarQube";
- Chikumbiro chekuchengetedza chekuongorora system - "Micro Focus Forify";
- Kukurukurirana system - "GitLab Mattermost";
- Configuration manejimendi system - "Ansible";
- Monitoring system - "ELK", "TICK Stack" ("InfluxData").
Vakatanga kugadzira timu yaizove yakagadzirira kudhonzera macontractors mukati. Pane kuziva kuti pane zvinhu zvakawanda zvakakosha:
- Zvese zvinofanirwa kuve zvakabatana, zvirinani kana uchitumira kodhi. Nekuti paive nemakondirakiti akawanda sezvo kwaive nemaitiro mazhinji akasiyana ebudiriro ane hunhu hwavo. Zvakanga zvakafanira kuenzanisa munhu wese mune imwe chete, asi nesarudzo.
- Kune akawanda makondirakiti, uye kugadzirwa kwemaoko kwezvivakwa hakuna kukodzera. Chero basa idzva rinofanira kutanga nekukurumidza - ndiko kuti, muenzaniso unofanirwa kuiswa ipapo ipapo kuti vanogadzira vave neseti yemhinduro dzekugadzirisa pombi yavo.
Kuti titore danho rokutanga, zvakanga zvakakodzera kunzwisisa zvakanga zvichiitwa. Uye taifanira kusarudza kuti tosvika sei ikoko. Isu takatanga nekubatsira kudhirowa dhizaini yemhinduro inotangwa mune zvese zvivakwa uye CI/CD otomatiki. Takabva tatanga kuunganidza conveyor iyi. Taida chivako chimwe chete, chakafanana kumunhu wese, uko maconveyor mamwe chete aizomhanya. Takapa sarudzo nekuverenga, bhangi rakafunga, ndokuzofunga kuti chii chaizovakwa uye nemari ipi.
Inotevera kugadzirwa kwedunhu - kuiswa kwesoftware, kugadzirisa. Kuvandudzwa kwezvinyorwa zvekuendesa zvivakwa uye manejimendi. Kunotevera kunouya shanduko kune conveyor rutsigiro.
Takasarudza kuedza zvose pamutyairi wendege. Sezvineiwo, panguva yekutyaira, imwe murwi yakaonekwa mubhangi kekutanga. Pakati pezvimwe zvinhu, mutengesi wepamba weimwe yemhinduro akapihwa kune chiyero chemutyairi wekufambisa nekukurumidza. Chengetedzo yakasvika pakumuziva sezvaaityaira ndege, uye zvakasiya pfungwa isingakanganwiki. Patakasarudza kushandura, nerufaro, iyo nhanho yezvivakwa yakatsiviwa neNutanix mhinduro, yaive yatove mubhangi kare. Zvakare, zvisati zvaitika yaive yeVDI, asi takaishandisa zvakare kune masevhisi ezvivakwa. Pamavhoriyamu madiki haina kukwana muhupfumi, asi pamavhoriyamu makuru yakava nzvimbo yakanaka yekusimudzira nekuyedzwa.
Iyo yese yese stack yakawedzera kana kushoma kujaira kune wese munhu. Zvishandiso zveotomatiki muAnsible zvakashandiswa, uye nyanzvi dzezvekuchengetedza dzakashanda pamwe chete navo. Iyo Atlassin stack yakashandiswa nebhangi pamberi peprojekiti. Fortinet kuchengetedza maturusi - yakakurudzirwa nevanhu vekuchengetedza ivo pachavo. Iyo yekuyedza furemu yakagadzirwa nebhangi, hapana mibvunzo yakabvunzwa. Sistimu yekuchengetera zvinhu yakamutsa mibvunzo; ndaifanira kujaira.
Makontrakta akapiwa murwi mutsva. Vakatipa nguva yekuinyora zvakare kuGitlabCI, uye kutamira kuJira kune chikamu chebhangi, zvichingodaro.
Mbichana mbichana
Stage 1. Kutanga, takashandisa mhinduro kubva kumutengesi wepamba, chigadzirwa chakabatanidzwa kune chitsva chakagadzirwa DSO network segment. Iyi puratifomu yakasarudzwa kune yayo nguva yekutumira, kuwedzera kuchinjika uye mukana weakazara otomatiki. Miedzo yakaitwa:
- Kugona kwekuchinjika uye kwakazara otomatiki manejimendi eiyo virtualization platform infrastructure (network, disk subsystem, computing resources subsystem).
- Otomatiki yeanoona muchina lifecycle manejimendi (templating, snapshots, backups).
Mushure mekugadzwa uye kugadziridzwa kwekutanga kwepuratifomu, yakashandiswa senzvimbo yekuiswa kwechipiri nhanho subsystems (DSO zvishandiso, retail masisitimu ekuvandudza maratidziro). Maseti anodiwa emapaipi akagadzirwa - kusikwa, kudzima, kugadziridzwa, backup yemashini chaiwo. Mapaipi aya akashandiswa sedanho rekutanga rekutumirwa.
Mhedzisiro yacho ndeyekuti michina yakapihwa haizadzise zvinodiwa nebhangi pakuita uye kukanganisa kushivirira. Iyo DIT yebhangi yakafunga kugadzira yakaoma yakavakirwa paNutanix software package.
Stage 2. Isu takatora stack yakatsanangurwa, uye takanyora otomatiki kuisirwa uye post-kugadziridza zvinyorwa zveese subsystems kuitira kuti zvese zvifambiswe kubva kumutyairi kuenda kudunhu rakananga nekukurumidza sezvinobvira. Masisitimu ese akaiswa mukukanganisa-kushivirira gadziriso (apo kugona uku kusinga ganhurwe nemarezinesi emutengesi marongero) uye akabatana nemametric uye zviitiko zvekuunganidza subsystems. IB yakaongorora kutevedzera zvainoda ikapa mwenje wegirinhi.
Stage 3. Kutama kwese subsystems uye marongero awo kuenda kuPAC itsva. Infrastructure automation scripts akanyorwa patsva, uye kutama kweDSO subsystems kwakapedzwa nenzira yakazara otomatiki. Iwo ma contours ekuvandudza IP akagadzirwazve nemapaipi ezvikwata zvebudiriro.
Stage 4. Automation yekuisa software yekushandisa. Mabasa aya akaiswa nevatungamiri vechikwata chezvikwata zvitsva.
Stage 5. Kushandisa.
Kusvika kure
Zvikwata zvebudiriro zvakakumbira kuchinjika kwakanyanya mukushanda nedunhu, uye chinodiwa chekusvika kure kubva kumalaptop emunhu chakasimudzwa pakutanga kweprojekiti. Bhangi rakanga ratove neremote access, asi rakanga risingakodzeri vanogadzira. Icho chokwadi ndechekuti chirongwa chakashandisa chinongedzo chemushandisi kune yakachengetedzwa VDI. Izvi zvakanga zvakakodzera vaya vaingoda tsamba uye pasuru yehofisi kubasa kwavo. Vagadziri vangazoda vatengi vanorema, kuita kwepamusoro, vaine zviwanikwa zvakawanda. Uye zvechokwadi, ivo vaifanira kunge vakamira, sezvo kurasikirwa kwechikamu chevashandisi kune avo vanoshanda neVStudio (semuenzaniso) kana imwe SDK isingagamuchirwi. Kuronga huwandu hukuru hweakakora static VDIs ezvikwata zvese zvebudiriro zvakawedzera mutengo weiyo VDI mhinduro.
Isu takasarudza kushanda pakuwana kure kure zvakananga kune zviwanikwa zvechikamu chebudiriro. Jira, Wiki, Gitlab, Nexus, kuvaka uye kuyedza mabhenji, mabhenji chaiwo. Vachengetedzi vakadaidzira kuti kupinda kunogona kupihwa chete pasi pezvinotevera:
- Kushandisa matekinoroji aripo kare mubhangi.
- Izvo zvivakwa hazvifanirwe kushandisa aripo domain controller anochengeta marekodhi ezvigadzirwa zveakaundi zvinhu.
- Kuwana kunofanirwa kuganhurirwa kune izvo chete zviwanikwa zvinodikanwa nechimwe timu (kuitira kuti chimwe chigadzirwa timu isakwanise kuwana zviwanikwa zvechimwe chikwata).
- Kunyanya kutonga pamusoro peRBAC mumasisitimu.
Nekuda kweizvozvo, nzvimbo yakaparadzana yakasikirwa chikamu ichi. Iyi dura yakachengeta zvese zvekusimudzira chikamu zviwanikwa, zvese mushandisi zvitupa uye zvivakwa. Hupenyu kutenderera kwemarekodhi mune ino domain inotungamirwa uchishandisa IdM iripo mubhangi.
Yakananga kure kure yakarongwa pahwaro hwemidziyo yaivepo yebhangi. Kupinda kwekutonga kwakakamurwa kuita mapoka eAD, kune iyo mitemo pamamiriro ezvinhu anoenderana (rimwe chigadzirwa boka = rimwe boka remitemo).
VM Template Management
Iko kumhanya kwekugadzira gungano uye yekuongorora loop ndeimwe yeKPIs huru yakagadzwa nemusoro wechikamu chekusimudzira, nekuti kumhanya kwekugadzirira nharaunda kunokanganisa zvakananga nguva yekuitwa kwepombi. Sarudzo mbiri dzekugadzirira base VM mifananidzo dzakatariswa. Yekutanga ndiyo yakaderera saizi yemifananidzo, default kune ese zvigadzirwa zvehurongwa, kuteedzera kwakanyanya nemitemo yebhangi maererano nezvirongwa. Yechipiri ndiyo base image, iyo ine heavy-duty POPPO yakaiswa, iyo nguva yekuisa iyo inogona kukanganisa zvakanyanya kumhanya kwekuita kwepombi.
Infrastructure uye chengetedzo zvinodiwa zvakatariswawo panguva yekusimudzira - kuchengetedza mifananidzo kusvika parizvino (zvigamba, nezvimwewo), kubatanidzwa neSIEM, zvigadziriso zvekuchengetedza zvinoenderana nebhangi zviyero.
Nekuda kweizvozvo, zvakasarudzwa kushandisa zvidhori zvidiki kuitira kuderedza mutengo wekuzvichengeta kusvika parizvino. Zviri nyore kugadzirisa base OS pane kupeta mufananidzo wega wega kune mitsva yePOPPO.
Zvichienderana nemhedzisiro, rondedzero yakaumbwa yehushoma inodiwa seti yeanoshanda masisitimu, iyo inogadziridzwa inoitwa neboka rekushanda, uye zvinyorwa kubva papombi zvine basa rekugadzirisa software, uye kana zvichidikanwa, shandura iyo vhezheni. yesoftware yakaiswa - ingoendesa iyo inodiwa tag kune pombi. Hongu, izvi zvinoda kuti devops chigadzirwa timu ive neyakaomarara mamiriro ekutumira, asi zvinoderedza zvakanyanya nguva yekushanda inodiwa kutsigira mifananidzo yepasi, iyo ingangoda inodarika zana base VM mifananidzo kuchengetedza.
Kuwanika paInternet
Chimwe chigumbuso nekuchengetedzwa kwebhangi kwaive kuwana zviwanikwa zveInternet kubva munzvimbo yekusimudzira. Uyezve, kuwana uku kunogona kukamurwa kuva mapoka maviri:
- Infrastructure access.
- Developer access.
Kuwanikwa kwezvivakwa kwakarongwa nekuita proxy ekunze repositori neNexus. Ndiko kuti, kuwana kwakananga kubva kumashini chaiwo hakuna kupihwa. Izvi zvakaita kuti zvikwanisike kusvika pakuwirirana nekuchengetedzwa kweruzivo, izvo zvaipesana nekupa chero mukana kune kunze kwenyika kubva muchikamu chebudiriro.
Vagadziri vaida kuwana iyo Internet nezvikonzero zviri pachena (stackoverflow). Uye kunyangwe mirairo yese, sezvataurwa pamusoro, yaive nekuwana kure kure kudunhu, haisi nyore nguva dzose kana usingakwanise kuita ctrl+v kubva kubasa remugadziri mubhangi muIDE.
Chibvumirano chakaitwa neIS kuti pakutanga, padanho rekuyedza, kuwana kuchapihwa kuburikidza nemumiriri webhangi zvichienderana nerunyoro ruchena. Pakupera kwepurojekiti, kuwana kuchaendeswa kune iyo dema-rondedzero. Matafura makuru ekuwana akagadzirwa, ayo airatidza zviwanikwa zvikuru uye matura kwaidiwa kuwana pakutanga kweprojekiti. Kuronganisa masvikiro aya kwakatora nguva yakati rebei, izvo zvakaita kuti zvikwanise kusimbirira pakukurumidza kuchinjika kune vatema.
Mhinduro
Basa racho rakapera risingasviki gore rapfuura. Zvinoshamisa kuti, vese makondirakiti akachinjika kune nyowani stack nenguva uye hapana akasara nekuda kweiyo otomatiki nyowani. IB haisi kukurumidza kugovera mhinduro yakanaka, asi hainyunyuti kana, kubva kwatinogona kugumisa kuti vanoifarira. Kunetsana kwadzikira nekuti kuchengetedzwa kweruzivo zvakare kunonzwa kutonga, asi hakukanganise maitiro ebudiriro. Zvikwata zvakapihwa basa rakawanda, uye chimiro chese chekuchengetedza ruzivo chakava nani. Bhangi rakanzwisisa kuti shanduko kuenda kuDevSecOps yakanga isingadzivisiki, uye yakazviita, mukuona kwangu, nenzira yakapfava uye yakarurama.
Alexander Shubin, mugadziri wehurongwa.
Source: www.habr.com