DevSecOps is an indispensable practice for every enterprise today. In my previous blog, I shared my point of view on an end-to-end DevSecOps Automation Framework. I promised to come back with a point of view around full-stack DevSecOps and the pipeline ensembles realizing the same. Here you go!

In a real life scenario, an end-to-end enterprise level DevSecOps pipeline is actually an ensemble of several micro pipelines!

Let us dig deep in to this. Figure 1 shows the full-stack view of a typical business solution.

Figure 1: Full-stack view of a typical business solution

Now, we can’t have a single, big, DevSecOps pipeline to manage this full-stack. It will be like going back to monoliths from microservices! What is a more practical approach?

Figure 2: DevSecOps pipeline ensemble

Figure 2 describes one way to approach this problem by applying DevSecOps at every layer of the full-stack. To reap the full benefit from DevSecOps and GitOps, one need to apply the same at every layer of the stack described in Figure 1. Applicability of automation and impact on the value stream varies from layer to layer. For example, the level of automation in building and managing physical entities such as a datacenter will be limited compared to the level of automation that can be applied in building software. Nevertheless, there is a scope at every layer (at least at a process level). Also, note the pipeline delivery pipeline, the left most one in Figure 2, meant to establish consistency and standardization. The “uber” pipeline (outmost one in Figure 2)stitches each layer together all pipelines to deliver the final business solution.

#gitops #pipeline #devops #devsecops #hybrid-cloud