Operations | Monitoring | ITSM | DevOps | Cloud

January 2022

IP ranges - better security for more confidence

Today, we’re announcing that one of our most popular feature requests, IP ranges, is now generally available for CircleCI Cloud customers. This feature enables teams to meet compliance requirements by limiting the connections that communicate with their infrastructure. No company wants to give the entire internet access to their artifact repositories or other sensitive environments. With IP ranges, teams are able to open up their IP-based firewalls to only CircleCI.

Run Datadog Synthetic tests in your Jenkins pipelines

Continuous integration (CI) has become the mainstream approach to software development as it enables organizations to iterate quickly while minimizing the risk of releasing faulty code. To implement CI, many organizations rely on Jenkins—one of the most mature and widely used automation servers on the market. Jenkins comes with hundreds of community-backed plugins to help you easily integrate it with other tools in your development workflow.

Mind Your Dependencies: Defending against malicious npm packages

Modern software projects are mostly composed of open source code. The question of who really controls this code, and is responsible for detecting and fixing software supply chain security issues, became a significant source of concern after the discovery of the Log4Shell vulnerability.

Running regular security scans with scheduled pipelines

Security is a vital part of application development, yet it may be neglected until an attacker takes advantage of a vulnerability in the system. The consequences of a security breach can damage an application’s integrity as well as a company’s reputation and revenue. Software architects and engineers need to pay special attention to securing the systems they work on.

Continuous Service Virtualization, Part 2: Steps for Optimizing DevOps

In my prior blog, Continuous Service Virtualization, Part 1: Introduction and Best Practices, we offered an introduction to continuous service virtualization (SV) and discussed some key best practices. In this, the second and final post in the series, we will discuss the continuous SV lifecycle and how it helps to optimize DevOps and the continuous integration/continuous delivery (CI/CD) pipeline.

Continuous Software Pipelines: Why Enterprises Are Going Cloud-Native 2021 Dev Week Cloud Keynote

Why are enterprise organizations making a move from on-premise solutions to completely cloud-native? What does that mean for improving, scaling, and securing their CI/CD pipelines? And what exactly is continuous packaging, anyway? Join Dan McKinney in this Dev Week Cloud session he answers all of these questions, helping attendees understand the true difference between cloud-hosted and cloud-native, how to get started with migrating to a cloud-native solution, and the true benefits of being entirely within the cloud.

Cloud-Native Pipelines: Secure Software Delivery, Made Simple Dev Week Cloud Workshop Session

Your entire tech stack is likely in the Cloud - so why aren’t your software packages? Whether you’re currently on-premise, have your own in-house solution or have a bit of a hybrid set up, join us in this session to explore why the future is cloud-native, what the benefits of this are over cloud-hosted, and how to easily set up a secure, cloud-native software pipeline in 60 seconds.

"Build It Yourself, They Said. It Will Be Worth It, They Said" Dev Week Enterprise Keynote Session

“We’ll build it ourselves!” We’ve all heard it, seen it, and likely been directly impacted by the decision to build a custom, in-house solution rather than use an existing one. Whether it’s a CI/CD tool, artifact management solution, or even the entire DevOps tech stack, it’s a common misconception that building it internally is easier, cheaper, and faster. When, in fact, the complete opposite is true!

Continuous Software Pipelines: Why Enterprises Are Going Cloud-Native Dev Week Enterprise Open Talk

Your entire tech stack is likely in the Cloud - so why aren’t your software packages? Whether you’re currently on-premise, have your own in-house solution or have a bit of a hybrid set up, join us in this session to explore:- Why enterprise organizations are making the move from on-premise solutions to completely Cloud-Native ones- What this means for improving, scaling, and securing their CI/CD pipelines- What the benefits of this are over cloud-hosted- How to easily set up a secure, cloud-native software pipeline in 60 seconds.

Package Management for Gaming Software Development

There is huge scope required when building video games. They are not just computer programs; they’re audio-visual artistic works. It’s a collaborative effort between software engineers, animators, scriptwriters, graphic designers, photographers and sound engineers. Working with these collaborators and assets leads to a different software pipeline than the average software project.

Practical Tips & Tricks for Speeding Up Your CI/CD Pipelines

When developing software and maintaining CI/CD and testing pipelines we are often compelled to increase our test coverage by adding more tests, and therefore improve our apps’ quality. After all, more automation equals better software, right? There’s a flipside to this equation however, and a point at which we start seeing diminishing returns from each test we add. Taken to extreme, these diminishing returns begin to actively harm our ability to deliver working software.

Get the most of your .Net Builds

Give your.Net ecosystem the full power of DevOps running on AWS - The JFrog Platform covers the full application lifecycle of.NET builds from developer fingertips through distribution to consumers while covering application security, vulnerability analysis and artifact flow control. In this webinar will see how you can configure your.NET builds on AWS, so that they take full advantage of JFrog Platform for managing the lifecycle of your.NET artifacts.

Continuously Securing Software Supply Chain

Catch this session to see a breakdown of the recent news related to software supply chain security and what you can do to meet new requirements and protect your software from such attacks. With new software supply chain attacks reaching the spotlight at an accelerating pace, security research uncovering novel attack methods and new mandates and guidelines starting to come into effect — it can be hard to stay on top of the latest developments and their implications.

API performance testing with k6

Performance testing measures how well systems perform when subjected to various workloads. The key qualities being tested are stability and responsiveness. Performance testing shows the robustness and reliability of systems in general, along with the specific potential breaking points. In this tutorial, you will use k6 to do load testing on a simple API hosted on the Heroku platform. Then you will learn how to interpret the results obtained from the tests.

No Internet? No Problem. Use Xray with an Air Gap - Part II

With software supply chain attacks on the rise, implementing DevSecOps best practices in an air gapped environment is a must. In an effort to secure an organization’s internal network, there is an increasing trend of separating the internal network from the external one. Essentially creating an enclosed and disconnected environment from the public internet. An air gapped solution provides stricter security requirements, but that’s not enough.

Using GitOps for Infrastructure and Applications with Crossplane & Argo CD

During this Webinar, Tracy and Viktor cover GitOps best practices for uniformly dealing with infrastructure and applications. If you have been following the Codefresh blog for a while, you might have noticed a common pattern in all the articles that talk about Kubernetes deployments. Almost all of them start with a Kubernetes cluster that is already there, and then the article explains how to deploy an application on top.

Testing locally with CircleCI runners

Many development teams start their CI/CD journey with a local build box (or six) that run their tests. In several mobile teams I worked on, for example, we had a few Mac Mini boxes with physical devices plugged in that we used for running local UI and unit tests. Eventually we migrated to a cloud-based solution, which brought us much greater stability and many new features. But moving to the cloud also meant our local hardware was obsolete.

Build private CircleCI orbs on any organization

Using CircleCI’s orbs is a great way to share CI/CD configuration across projects. Public orbs work well for wide adoption, but private orbs have been helpful for organizations needing to share common internal configuration in a secure, non-public way. Private orbs work only within the organization that publishes them. We recently opened up private orbs access to all CircleCI customers, including those on the Free plan.

Getting started with continuous integration for Nest.js APIs

Nest.js is a scalable and efficient server-side Node.js framework built with TypeScript. Nest.js was created to provide a structural design pattern to the Node.js development world. It was inspired by Angular.js and uses Express.js under the hood. Nest.js is compatible with the majority of Express.js middleware. In this tutorial, I will lead you through building a RESTful API with Nest.js. The tutorial will familiarize you with the fundamental principles and building blocks of Nest.js.

How to deploy the Google Cloud Ops Agent with Ansible

Site Reliability Engineering (SRE) and Operations teams responsible for operating virtual machines (VMs) are always looking for ways to provide a more reliable, more scalable environment for their development partners. Part of providing that stable experience is having telemetry data (metrics, logs and traces) from systems and applications so you can monitor and troubleshoot effectively. Many Google Cloud services, including Google Compute Engine, provide basic system metrics out of the box.

Effective Incident Management: How to Improve Collaborative Software Development

* Are you using Azure DevOps as the starting point of your delivery process on the Azure cloud? Join this webinar to learn advanced tips and tricks for simplifying and accelerating your CI/CD pipelines with Azure DevOps and the JFrog Platform. Sharing a detailed demo of a real-world release pipeline triggered from Azure DevOps, we’ll review best practices and hard-won lessons for how you can streamline your end-to-end process and ensure it meets the security and quality requirements of large-scale enterprise delivery.

CircleCI now offers the most generous free plan anywhere

TL;DR: Our free plan is newly re-launched, giving teams access to more build minutes, larger resource classes, and our most popular features formerly only available on paid plans. Visit our sign up page to get started today. Our mission has always been to help teams deliver software faster and better, and today marks a huge milestone for development teams everywhere: we are proud to now offer the most feature-rich and most generous free tier for CI/CD on the market.

What developers get, out-of-the-box, from the most generous free plan anywhere

Freemium plans are a great way for companies to introduce developers to their products and offer a hands-on demonstration of the value they provide. But it can be extremely frustrating for developers when a free tier limits access to key features or doesn’t provide enough capacity to evaluate how the product performs in real-world development scenarios.

Config best practices: Docker layer caching

Let’s face it: Creating the optimal CI/CD workflow is not always a simple task. In fact, writing effective and efficient configuration code is the biggest hurdle that many developers face in their DevOps journey. But you don’t need to be an expert to set up a fast, reliable testing and deployment infrastructure. With a few straightforward techniques, you can optimize your config.yml file and unleash the full potential of your CI/CD pipelines.

Getting started with scheduled pipelines

CircleCI’s scheduled pipelines let you run pipelines at regular intervals; hourly, daily, or weekly. If you have used scheduled workflows, you will find that replacing them with scheduled pipelines gives you much more power, control, and flexibility. In this tutorial, I will guide you through how scheduled pipelines work, describe some of their cool use cases, and show you how to get started setting up scheduled pipelines for your team.

Building a React dashboard to visualize workflow and job events

Data visualization is the process of translating large data sets and metrics into charts, graphs, and other visuals. The resulting visual representation of data makes it easier to identify and share real-time trends, outliers, and new insights about the information represented in the data. Using CircleCI webhooks, we can gather data on workflow and job events. In this tutorial, I will lead you through the steps to create a React-based dashboard to visualize this data.

Building a Laravel API for CircleCI webhooks

Software applications consist of interconnected systems - each providing a specialized service towards the common goal of meeting a business need. As with any network, an efficient data exchange mechanism is key to its functionality, effectiveness, and responsiveness. In the past, data exchange was performed using polling requests. At regular intervals, a system would make a request to get the latest information or find out if there is an update to deal with.

Season 1 Finale: The Top 3 Themes for Software Leaders in 2022

CircleCI CTO Rob Zuber reflects on season 1 of The Confident Commit, finding the common threads that emerged, including these top 3 themes for software leaders: complexity, scale, and people. Listen to Rob's take on where software is headed and hear about the upcoming season 2 of The Confident Commit.

Check Out JFrog's New Community Site for Developers

JFrog has been hard at work behind the scenes restructuring how we share information with the developer community. We wanted to create a one-stop resource for developers who code in a variety of languages, with a focus on DevOps, DevSecOps, and cloud native technologies. So without further ado … let me introduce you to our new JFrog Community site!

CTO Corner with Yoav Landman, JFrog | Episode 1: Build Info

Want a glimpse at what it is like to be a CTO of a DevOps company? Join JFrog’s CTO Yoav Landman for our new CTO Corner Series. Each episode will feature a topic that is at the forefront of every technologist's mind… or should be. Yoav will be discussing hot topics in tech with other industry leaders giving you an opportunity to see behind the curtain of the decision makers.

DevOps 2022: 5 Big Rocks to Harness the Software Supply Chain

Together with the community, JFrog pioneered what we now know as DevOps with a focus on binaries (aka software packages, artifacts or images). A decade ago, no one thought binary management would be a thing — now it’s a standard most companies can’t live without. Back then, we said software universality would be necessary, and now others follow suit. People thought cloud would be a single-vendor decision.

JFrog Artifactory on Your Choice of Cloud Provider

JFrog Artifactory is a scalable, universal, binary repository manager that automatically manages your artifacts and dependencies throughout the application development and delivery process. Artifactory supports Kubernetes, the de facto orchestration tool in the industry, for automating deployment, scaling, and management of microservices and containerized applications..

HTTP request testing with k6

Many of the multi-faceted applications development teams deploy every day are loosely coupled and every service exists to power another service. Most teams developing fullstack applications know that testing the communication between these services essential. Part of the process is testing HTTP request endpoints, and this tutorial focuses on exactly that. I will lead you through learning how to extend the k6 framework to test our HTTP endpoints.

CI/CD - What You Need to Know

Continuous integration (CI) and continuous delivery or deployment (CD) cover the process of automatically merging, building, and testing code changes ready for release, and – in the case of continuous deployment – releasing those changes to users. If you’re developing software for others to use, you’ll need to go through some form of build and test process before you make your latest changes available.

Cloud Nimble: The Next Evolution

Over the last several years, systems architects have had to make sure their systems are cloud native, with applications that are optimized for scalable cloud technology infrastructure. In today’s environment, you should be asking whether your solutions are cloud nimble as well. For the modern enterprise, cloud computing is now the default model for applications, storage, and compute.

Enhanced security for the Spot-Jenkins plugin

Many of Spot by NetApp customers run Jenkins as a core part of their CI/CD processes and use it together with Spot’s Elastigroup to deploy jobs running on spot instances. This integration has helped our customers realize up to 90% savings on cloud computing, and seamlessly fits into their existing DevOps workflows.

Pulling All Your Kubernetes Cluster Images from a Private Artifactory Registry

There are many benefits to working with JFrog Artifactory as your private Docker registry, allowing you to store, share and deploy your binary artifacts in a single source of truth. This blog post will focus on using Artifactory in Kubernetes. Specifically, we’ll walk through the steps for configuring Kubernetes to pull images from Artifactory and most importantly – scale up! It will also describe how you can enable cluster-wide authenticated access to Artifactory behind the scenes.

Spot publishes module collection in Ansible Galaxy

Ansible is an open-source IT automation engine that automates provisioning, configuration management, application deployment, orchestration, and many other IT processes. It is one of the most widely-used provisioning tools in the industry to enable infrastructure as code (IAC), made popular by its ease of use and simple, but powerful automation. With easy integration, you can use Ansible and Spot to fully automate and optimize your cloud infrastructure.