Dive Into ISV With MegazoneCloud
Date of creation : 2024-07-24
Dive Into ISV With MegazoneCloud
ISV stands for "Independent Software Vendor," which refers to independent software developers that create and sell software capable of operating in various environments without relying on specific hardware or platforms. We decided to call this ISV.
Dev, Ops, and Sec
As of 2023, there are 18,387 ISV companies actively developing and operating solutions in the United States alone. Considering that there are not just hundreds or thousands, but over ten thousand solutions, it feels quite complex. ISVs are categorized based on the purpose and functionality of the software they develop. They are divided into various categories including business applications, security, data management and analytics, cloud solutions, development tools and platforms, communication and collaboration tools, industry-specific solutions, e-commerce and digital marketing, enterprise services, game development tools, and multimedia and graphic software.
It can be said that this is the root of development, and this month, I will introduce DevSecOps, one of the ISV categories.
You may have heard of DevOps. You might have seen the image below many times, but the term DevOps is an abbreviation for Development Operations, which was first mentioned and used by Patrick Debois in 2009.
Previously, development teams and IT operations teams were separate and performed their respective roles, but to achieve customer satisfaction and faster value delivery, the tasks of the development and operations teams are combined and automated to provide software. The key is to reduce release time through a cycle where development and operations run simultaneously, quickly responding to changes, and ultimately connecting organically from development to deployment, from modification to redeployment.
<reference: https://velog.io/@dongminlee94/MELT-Data-Standardization>
However, at some point, security was added as an important element of DevOps, and ISVs began to present the upgraded DevSecOps.
I understand DevOps, but what is DevSecOps?
DevSecOps is an abbreviation for Development, Security, and Operations, combining security with the existing DevOps concept that binds development and operations into a single cycle.
In recent development cycles, which can be as fast as a few days or weeks, traditional security methods and policies are recognized as causes of decreased overall efficiency, leading to security checks being treated as a formal act at the final stage. To improve this, it is necessary to automate security policies and technologies in the development pipeline through DevSecOps.
<reference: https://bigsteptech.com/blog/devsecops-what-is-it-why-is-it-important/>
GitLab and DevSecOps
There is an ISV solution that is often mentioned alongside DevOps. This solution is GitLab. GitLab is an innovative tool that provides all the functionalities of DevSecOps in a single application, offering developers a systematic and integrated DevOps platform. This can revolutionize collaboration and the software development process.
GitLab is the perfect tool for DevOps innovation, equipped with all the features needed for efficient development and continuous collaboration. Utilizing GitLab can significantly enhance the efficiency of development tasks.
Why GitLab?
The reason GitLab is frequently mentioned with DevSecOps is that its features and integrated platform meet all the requirements of DevSecOps. DevSecOps is an approach that encompasses development, security, and operations, and to implement it efficiently, a tool that provides a comprehensive range of features is necessary. GitLab perfectly meets these demands, making it suitable as a DevSecOps tool.
Integrated Development Environment (IDE) Provided
GitLab allows management of all development processes such as coding, building, testing, and deployment on a single platform.
Enhanced Security Features
It provides security features such as code scanning, vulnerability analysis, and security policy enforcement, allowing security to be considered from the development stage.
Security threats can be quickly detected and responded to.
Collaboration and Version Control
Teams can collaborate and track code changes.
Features like branch management, merge requests, and code reviews support an efficient development process.
Automation and CI/CD Features
Processes such as building, testing, and deployment can be automated to increase development speed and quality.
It supports the construction of various CI/CD pipelines.
Open Source and Scalability
GitLab is developed on an open-source basis, making customization easy.
It provides various plugins and integration features to build according to organizational requirements.
For example, when developing a new feature, if new code is committed to a SaaS-based CRM tool, GitLab automatically triggers the CI/CD pipeline to build, test, and deploy the application. During this process, GitLab's tools continuously scan the code to identify vulnerabilities, allowing potential issues to be detected early without separate security tools.
If a project needs to comply with the General Data Protection Regulation (GDPR), GitLab can automatically verify whether data processing practices meet the required standards, generating compliance reports without additional manual work. Additionally, through GitLab's merge request feature, team members can easily review, discuss, and quickly approve code changes, reducing delays and improving code quality.
After deployment, GitLab comprehensively monitors the application to help quickly resolve any issues that arise, maintaining the stability and security of the application. All these tasks can be easily performed using GitLab Enterprise.
With GitLab, you can address development, security, and compliance all at once. By using GitLab Enterprise, you can experience a more efficient and secure development environment through GitLab's features.
Potato, Potato, GitLab, GitHub, aren't they the same?
GitLab and GitHub have in common that they are source code repositories based on Git technology. The difference between the two lies in the DevOps elements. GitLab has built-in CI/CD and DevOps workflows, while GitHub requires users to integrate their desired CI/CD tools manually. For example, it uses third-party programs like Jenkins, CircleCI, and TravisCI.
✅GitLab (designed for enterprise operations) vs GitHub (designed for developer project sharing)
GitHub requires third-party paid services when used extensively, and it is dependent on Azure, making it somewhat challenging to implement a multi-cloud strategy. Additionally, GitHub struggles with the scalability and deployment of large monorepos, leading to longer deployment times and not providing zero-downtime upgrades. This particularly delays the work of DevOps teams in organizations with many users. Unlike GitHub, GitLab offers nearly zero-downtime upgrades to resolve these issues.
✅So, if I want to use GitLab, do I have to use the paid version instead of the free version?
GitLab is offered in two versions: Community Edition (free version) and Enterprise Edition (paid version). The reason to use GitLab for a fee is due to the additional features and benefits provided by the paid version compared to the free version.
✅Key Features of GitLab Paid Version
Managing multiple cases/projects for large-scale project management
Controlling and approving Merge Requests, Merge History, Audit capabilities
Customizing user dashboards, managing the overall group pipeline status, compliance and regulatory management
<reference: GitLab Dashboard>
Benefits of Using GitLab Through Megazone Cloud
GitLab that customers can easily use
DevOps Consulting
Identifying requirements for systematic assessment and consulting -> As-Is analysis -> Suitability evaluation -> Preparing pipelines & architecture -> Security & compliance, etc., we develop a customized consulting strategy tailored to the client's environment.
Building GitLab-based DevOps Pipeline
Providing configurations for the desired DevOps environment based on various cases, including integration with multiple DevOps tools and optimizing DevOps pipelines for cloud-native environments.
GitLab CarePack for Stable DevOps Service Operation
A dedicated GitLab engineer is assigned to provide quick technical inquiries, offering support for the operation and maintenance of GitLab, assisting with system stability and problem resolution.
Training to Establish DevOps Culture
Providing customized training services from basic user & admin training for utilizing GitLab to hands-on CI/CD pipeline practice and utilizing security features.
Financial Sector Case Using GitLab
A financial client in South Korea, as an industry leader, aimed to secure a 'Life & Finance Platform' by enhancing platform competitiveness through the integration of digital and offline financial advantages, completing a comprehensive financial portfolio, and strengthening non-financial platforms and lifestyle content. However, they faced the following challenges in building the platform.
The client had difficulties in maintenance and management due to different build and deployment methods for applications based on the operating environment. There were issues with limited integration of the client's ITSM* process due to project management based on heterogeneous configuration management.
*ITSM stands for IT Service Management, which is a system for managing IT services and client tasks.
The client experienced issues with management and costs by using multiple toolchains such as Jenkins, Spinnaker, SVN, GitLab, and third-party configuration management solutions. Therefore, the client needed to improve operations by simplifying the development process to reduce costs and save time. Today, GitLab not only provides services for DevOps but also in the security domain, and they chose GitLab, which can utilize all the above tools at once and resolve the client's issues. The reasons the client chose GitLab are as follows.
Firstly, the client felt complexity in authentication and permission management among solutions due to the use of multiple toolchains such as Jenkins, Spinnaker, SVN, GitLab, and third-party configuration management solutions in a DevOps environment. GitLab served as an integrated platform, achieving simplified management and improved work efficiency.
Secondly, when introducing GitLab based on the client’s legacy system (ITSM) – third-party configuration management solutions, the application of heterogeneous configuration management solutions led to increased redundancy in managing development sources and a higher likelihood of failures. Thus, the integration of ITSM – GitLab unified the configuration management environment for code management and version control.
Thirdly, the client faced limitations in the scalability of the legacy compliance system in the legacy system (ITSM) – third-party configuration management solution environment. They advanced the DevOps management environment based on container security, open-source dependency/license policy, and vulnerability review functions provided by GitLab. This allowed the client to integrate the development platform environment and centralize DevOps management using GitLab.
