People, process, and technology for ILM and SLM adoption Rosemary Wang Chief Developer Advocate

Circa 2018 Some Concepts for Research API Author i zation (OAuth & OpenID) Testing & Testing-Dr i ven Development (TDD) Continuous Delivery Pipelines-as-Code Infrastructure-as-Code REST API Standards Basic Networking Basic Linux/Windows Systems Basic Secur i ty (Vulnerability Management) Site Reliability Engineer i ng Observability (Monitor i ng, Logging, Tracing) Public Cloud Constructs Container i zation (Orchestrators & Runtimes) Secret Management Code (Python, Ruby, Golang) Chaos Engineer i ng Release & Deliver Software Microservices User Interfaces/APIs DevOps Site Reliability Engineer i ng “Platform”? PaaS which uses patterns like which you which you more easily by applying which has technologies classif i ed as sometimes packaged as which can be runs on All done as securely as possible Philosophy whose practical implementation can be through Physical Devices Pr i vate Cloud Datacenter Infrastructure Public Cloud (IaaS) Network, Systems & More composed of which can be which runs on Trying to put the terms together Confusing Job Descr i ptors Pr i vate Public Cloud Site Reliability Engineer/Developer Platform DevOps Release Infrastructure Systems Network

Infrastructure / Secur i ty Lifecycle Management is the practice of changing infrastructure or secur i ty resources.

Changes to infrastructure/ secur i ty Create Read Update Delete

Chief Developer Advocate HashiCorp She/her @joatmon08 Rosemary Wang

Datacenter Public Cloud 1 Public Cloud 2

Datacenter Public Cloud 1 Public Cloud 2 Lifecycle management

Datacenter Public Cloud 1 Public Cloud 2

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Scale As code Self-service Systems of record

Infrastructure Lifecycle Management Secur i ty Lifecycle Management Did the patch fail? Vulnerability patch management Read Monitor i ng Observability Which machines still need updates?

Read Infrastructure Lifecycle Management Monitor i ng Secur i ty Lifecycle Management Observability • Audit changes to infrastructure • Identify dr i ft • Validate policy conformance • Audit system access • Identify vulnerabilities • Validate artifact provenance

People & process Encourage self-service of information Build conf i dence for change People Audit and document system evolution Iterate on unif i ed “platform” interface Process

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Scale As code Self-service Systems of record

Infrastructure Lifecycle Management Secur i ty Lifecycle Management What gets disrupted when we patch? How do we access machines for patching? Vulnerability patch management Create Modular i zation Access control

Create Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Access control • Isolate changes to parts of the system • Decouple infrastructure dependencies • Isolate least pr i vilege access • Decouple identity from access policy

People & process Identify kebab vs. cake teams Agree on interface over implementation People Balance productivity and secur i ty Support f l exibility Process

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Scale As code Self-service Systems of record

Infrastructure Lifecycle Management Secur i ty Lifecycle Management What do we need to do to f i x the vulnerability? How do we roll out the patch? Vulnerability patch management Update Standardization Remediation

Update Infrastructure Lifecycle Management Standardization Secur i ty Lifecycle Management Remediation • Develop consistent deployments • Improve predictability of changes and rollbacks • Develop baseline for detecting anomalous behavior • Improve speed of f i xes

Datacenter Public Cloud 1 Public Cloud 2

Datacenter Public Cloud 1 Public Cloud 2 Remediation without Standardization

Datacenter Public Cloud 1 Public Cloud 2 Remediation with Standardization

People & process Justify refactor i ng effort Establish evergreen standards Focus on value over technical details People Develop consistency in process Document edge cases Process

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Scale As code Self-service Systems of record

Infrastructure Lifecycle Management Secur i ty Lifecycle Management Can we replace machines instead of updating? Are short-lived resources a compensating control? Vulnerability patch management Delete Immutability Ephemerality

Delete Infrastructure Lifecycle Management Immutability Secur i ty Lifecycle Management Ephemerality • Change resource by creation and deletion • Support lower r i sk refactor i ng patterns • Change time-to-live of resources to reduce attack surface • Support resiliency patterns for short-lived resources

People & process Shift paradigm from static to dynamic Apply immutability to larger use cases People Develop constant rate of change Establish provisioning as remediation Process

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Infrastructure Lifecycle Management Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Scale As code Self-service Systems of record

As code Self-service Systems of record Scale How often can we push a commit to update the image?

Scale Self-service Systems of record As code How often can we push a commit to update the image? How can a developer patch their VM without asking operations?

Scale Systems of record Self-service As code How often can we push a commit to update the image? How can a developer patch their VM without asking operations? How do we document exceptions if we can’t patch?

As code Self-service Systems of record • Build conf i guration or policy for automation • Enable orchestration across system Scale

Scale As code Self-service Systems of record • Build abstraction for complexity of knowledge • Enable anyone to extend system to support business needs

Scale Systems of record • Build inventory of infrastructure, secrets, identities, and policies • Enable visibility and orchestration across systems at scale Self-service As code

People & process Shift paradigm from clicking resources to selecting systems Offer escape hatches for edge cases People Accommodate rapid rate of change Use systems of record to assess blast radius Process

Summary

Infrastructure Lifecycle Management As code Self-service Systems of record Modular i zation Secur i ty Lifecycle Management Ephemerality Remediation Access control Standardization Immutability Delete Update Create Monitor i ng Read Observability Foundations for ILM/SLM Scale

Datacenter Public Cloud 1 Public Cloud 2

Datacenter Public Cloud 1 Public Cloud 2 Monitor i ng/ Observability

Datacenter Public Cloud 1 Public Cloud 2 Everything done as code

Datacenter Public Cloud 1 Public Cloud 2 Established systems of record

Lifecycle management at scale Design and build for change, which affects process and people.

Check out recordings from HashiConf 2024 The building blocks of ILM & SLM developer.hashicorp.com Examples Learn more

Thank you @joatmon08