Root-Of-Trust for Continuous Integration and Continuous Deployment Pipeline in Cloud Computing

Cloud computing has gained significant use over the last decade due to its several benefits, including cost savings associated with setup, deployments, delivery, physical resource sharing across virtual machines, and availability of on-demand cloud services. However, in addition to usual threats in almost every computing environment, cloud computing has also introduced a set of new threats as consumers share physical resources due to the physical co-location paradigm. Furthermore, since there are a growing number of attacks directed at cloud environments (including dictionary attacks, replay code attacks, denial of service attacks, rootkit attacks, code injection attacks, etc.), customers require additional assurances before adopting cloud services. Moreover, the continuous integration and continuous deployment of the code fragments have made cloud services more prone to security breaches. In this study, the model based on the root of trust for continuous integration and continuous deployment is proposed, instead of only relying on a single sign-on authentication method that typically uses only id and password. The underlying study opted hardware security module by utilizing the Trusted Platform Module (TPM), which is commonly available as a cryptoprocessor on the motherboards of the personal computers and data center servers. The preliminary proof of concept demonstrated that the TPM features can be utilized through RESTful services to establish the root of trust for continuous integration and continuous deployment pipeline and can additionally be integrated as a secure microservice feature in the cloud computing environment.     

5G MANO自动化测试实践

工欲善其事,必先利其器。自动化测试工具就是5G时代的利器。本文针对5G时代人工测试面临的挑战,提出5G MANO自动化测试解决方案、原理、方法和流程,并结合ZTEMANO项目中的HATT自动化测试工具和自动化测试实践进行论证。自动化测试,极大的提升测试效率,输出高质量的5G产品,为运营商5G建设贡献力量。     

一种云计算时代的DevOps自动化运维平台

为改变运维部门的传统运维模式,建立新的自动化运维模式,本文提出一种云计算时代的DevOps自动化运维平台。该平台不仅能满足目前企业对云计算数据中心各类设备的日常运维管理要求,具备良好的扩展性,而且能够为纳管设备的整个管理生命周期提供一系列自动化管理手段,涵盖了其规划、设计、实施和运维等各个阶段,有效缩短上线周期、提高运维效率、有效支撑业务、保障系统合规、有效管理风险。     

基于DevOps的轻量级持续交付方案

如何快速向用户交付可靠的产品,是近年来持续交付研究和应用的热点问题,传统的软件敏捷方法在交付过程中缺乏团队协作和标准化的构建流程,大公司DevOps框架因体系复杂在中小规模企业应用时会产生迭代速度和产品质量相互制约的矛盾,本文提出一种基于DevOps轻量级的持续交付框架,在角色叠加、迭代频繁的项目场景中,以脚本形式自动实现项目代码获取、测试、构建和部署,完成项目持续交付.通过行业调查、企业实践验证方案不仅可以缩短项目周期、提高交付质量,还能够实现交付过程可视化,促进软件质量不断改进.     

DevOps中国调查研究

DevOps已提出近十年,其作为敏捷方法在完整的软件生命周期上的延伸,旨在从文化、自动化、标准化、架构以及工具支持等方面,打破开发与运维之间的壁垒,重塑软件过程,以实现在保证高质量的前提下,缩短从代码提交到产品上线之间的周期.在竞争日益激烈的市场环境下,用户对于产品服务的稳定性以及更新频率和效率的要求不断提高,DevOps在学术界和工业界的关注程度因此也不断提高.Puppet Labs在2013年开始了全球DevOps现状的问卷调查,迄今已发布了5份报告.国内DevOps的发展相对滞后,对于国内DevOps现状的研究在工业界和学术界均处于空白.2016年和2018年分别进行了两次关于DevOps国内现状的问卷调查以填补这一空白,两次调查的受访人数分别为74和66人.基于两次调查结果,从DevOps涵盖的IT性能表现、组织文化及相关实践、开发与运维实践、工具支持、领导力、工作比例、员工敬业度及满意度这8个方面,综合分析了DevOps在国内的发展现状与趋势,并与Puppet Labs报告的全球现状进行了对比.总体而言,国内DevOps虽呈现了稳步发展的态势,但与国际水平相比尚存在明显差距,目前能达到国际高水平IT性能的受访团队仅6%.通过对比,总结了17条发现,经过综合分析,获得了3个主要结论：（1）员工素质和人才紧缺是国内DevOps滞后、过程成熟度不高的症结;（2）DevOps化越成熟,员工敬业度和满意度越高;（3）Scrum敏捷开发和基于主干开发是最普遍采纳的实践.基于分析结果,在未来实践与研究上给出了多项建议.     

一种面向软件配置管理制品的层次分类方法

配置管理工具（Configuration Management Tool,CMT）作为运维自动化的组成部分,是实现开发运维一体化（Development and Operations,DevOps）的重要支撑技术.当前互联网开源社区中存在数量众多CMT脚本制品,但是缺乏有效的层次分类管理,给快速检索和高效利用CMT脚本制品造成困难.针对该问题,提出一种面向CMT制品的基于在线非结构化描述文档分析的层次分类方法.该方法利用标签共现性关系（tag co-occurrence）建立层次类别体系,基于描述属性特征,实现对CMT制品的层次分类器;并使用混合的样本划分方式针对“数据倾斜”问题进行了改进.对超过11000例训练数据和1000例测试数据进行实验,结果表明,改进的样本划分方式得到的最佳查准率、查全率、调和平均值分别达到0.81、0.88、0.85,较传统方式查全率提高0.15,调和平均值提高0.06,该结果验证了层次分类方法的有效性.     

CloudsStorm: A framework for seamlessly programming and controlling virtual infrastructure functions during the DevOps lifecycle of cloud applications

The infrastructure-as-a-service (IaaS) model of cloud computing provides virtual infrastructure functions (VIFs), which allow application developers to flexibly provision suitable virtual machines' (VM) types and locations, and even configure the network connection for each VM. Because of the pay-as-you-go business model, IaaS provides an elastic way to operate applications on demand. However, in current cloud applications DevOps (software development and operations) lifecycle, the VM provisioning steps mainly rely on manually leveraging these VIFs. Moreover, these functions cannot be programmatically embedded into the application logic to control the infrastructure at runtime. Especially, the vendor lock-in issue, which different clouds provide different VIFs, also enlarges this gap between the cloud infrastructure management and application operation. To mitigate this gap, we designed and implemented a framework, CloudsStorm, which enables developers to easily leverage VIFs of different clouds and program them into their cloud applications. To be specific, CloudsStorm empowers applications with infrastructure programmability at design-level, infrastructure-level, and application-level. CloudsStorm also provides two infrastructure controlling modes, ie, active and passive mode, for applications at runtime. Besides, case studies about operating task-based and big data applications on clouds show that the monetary cost is significantly reduced through the seamless and on-demand infrastructure management provided by CloudsStorm. Finally, the scaling and recovery operation evaluations of CloudsStorm are performed to show its controlling performance. Compared with other tools, ie, “jcloud” and “cloudinit.d”, the scaling and provisioning performance evaluations demonstrate that CloudsStorm can achieve at least 10% efficiency improvement in our experiment settings.     

新型信息化系统建设下的敏捷开发模式

当今社会,敏捷逐渐成为业界的主流开发模式,越来越多的组织成功实现了敏捷转型,在研发效率提升和客户价值等方面成绩斐然.敏捷已经从传统纯研发领域,向前延伸到了业务敏捷,向后扩展实现了DevOps开发运维一体化.为快速响应和满足用户需求,缩短系统建设周期,避免因业务变化导致的开发工作浪费,保证产品交付质量,公司决定研发敏捷转...     

自动化工具对中国DevOps实践的影响

DevOps作为一次软件工程领域的变革,近10年迅速发展的原因是多方面的.关注了中国DevOps的发展历程中自动化工具带来的实际影响以及自动化工具产生的一系列问题.使用系统化文献评价获取了目前DevOps实践中被研究者分析最多的自动化支持工具,从50篇文献中识别出包括Docker、Chef、Jenkins和Puppet等69个自动化工具;然后通过灰色文献评价从一些中文博客文章中分析出自动化工具在中国DevOps实践中出现的3个层次的问题;最后通过民族志访谈方法分析了在中国环境下各方对待3个层次问题的看法和建议,得出自动化工具对中国DevOps实践的两个影响：（1）自动化工具在DevOps实践的前期作用明显,可以认为DevOps实践就是使用自动化工具;（2）软件组织实现DevOps转型以后需要减少对自动化工具的依赖,形成自己的DevOps文化.对于自动化工具在中国DevOps实践中产生的问题,整合访谈内容后形成了解决问题的3个建议,并给出了一个转型范例.     

面向云服务的DevOps知识获取与应用

DevOps作为一种新兴范型能够实现开发和IT运维之间的高度协同,从而在完成高频率部署的同时,提高生产环境的可靠性、稳定性、弹性和安全性.DevOps与云计算一起能够实现资源的按需供给.DevOps制品和云服务的规模不断增长,大量的DevOps知识分散在不同的社区和来源中,没有得到有效的组织、管理和使用,如何针对大量可选的DevOps方法和工具进行有效的决策和选择成为亟待解决的问题.针对这一问题,提出了一套完整的DevOps知识管理方法.方法首先针对一组可访问的知识源进行多种方式的知识获取、组织、转换和存储;然后提出了DevOps知识分类方法,并设计实现了DevOps知识库原型系统;最后基于谓词逻辑提出了DevOps需求的描述方法,并展示了基于需求的DevOps知识库的使用.