NaviSite TestDev Cloud A Cloud Based, Dynamic, and Scalable Development & Testing Platform Moving testing environments into the cloud is a logical first step for companies looking for a secure entry point into cloud provisioning. Testing, development, and staging can be a low cost/low risk way to trial run adoption of cloud computing, with immediate benefits to the enterprise. GET THERE. NaviSite is transforming IT with Managed Cloud Services and Managed Applications for enterprises. www.navisite.com +1 978.682.8300 1.877.485.9251 Boston - New York - San Jose - London - New Delhi 1 NaviSite, Inc. www.navisite.com A Time A Time Warner Cable Cable Company Company
Executive Summary Enterprises are finding that leveraging virtual machine capacity in the cloud offers compelling cost savings in infrastructure provisioning, and in many cases improved business capabilities. Examples include more costeffective enterprise application management; faster, easier Disaster Recovery for IT production environments; and the economies of scale afforded by cloud storage. Leveraging cloud infrastructure and services for software development and testing also presents significant cost and time-saving opportunities. Enterprises can reduce capital expenses and time related to test-dev provisioning, while improving quality assurance throughout the software development life cycle. Performing test-dev using managed cloud infrastructure enables the enterprise to achieve stronger product release standards faster, and meet ever-more challenging compliance regulations. Strategically, moving testing environments into the cloud is a logical first step for companies looking for a secure entry point into cloud provisioning. Implementing cloud-based testing, development, or staging can be a low cost/low risk way to trial-run adoption of cloud computing, with concurrent, immediate benefits to the enterprise. Cost Benefits of Cloud-Based Development and Testing It is inefficient and risky to cannibalize development or production systems for dynamic, unstable test-dev workloads. Dual-purposing infrastructure for testing or staging software can adversely impact development capacity, or even (often unpredictably) production environments. Yet provisioning dedicated infrastructure for testing can entail significant capital, support, and real estate expense. It takes considerable time and money to procure, configure and maintain hardware and software test-dev environments. IT infrastructure requirements vary at different stages of the software development lifecycle (SDLC). Software development methodologies themselves are undergoing change from serial waterfall development processes to more agile processes such as Rapid Application Development (RAD) and Scrum. Figure 1: Waterfall Development Infrastructure Workloads 2 NaviSite, Inc. www.navisite.com
Nonetheless, at each stage of the SDLC, provisioning infrastructure both just in time and for only what is needed offers significant cost savings. In the waterfall model, QA and staging environments are characterized by high resource demand under fixed deadlines; for example, full regression or load-testing an enterprise application or product prior to release. Typically, QA is responsible for integration and regression testing, whereas Development conducts unit testing (as with bug fixes). Staging occurs after regression and integration testing, when QA hands off an image to Operations or IT. During load-testing software and configuration are tweaked and tuned for performance (as opposed to functionality). This is best done in an environment that mirrors the production environment as much as possible. For both QA and staging, cloud-based, virtual IT resources can be deployed and paid for on an as-needed basis. The enterprise need not support infrastructure that is not in use, and can simply turn it off when testing is done. Demand for infrastructure resources may be especially high during load-testing. For certain applications, like e-commerce and hosted applications, cloud-based load-testing offers customers benefits not only from a pay-as-you-go cloud-based infrastructure model, but also can provide an environment more like virtual production. In the newer agile development models, releases are far more frequent (weeks rather than months or years), and testing may be part of the development process. Whether done in development or QA, application testing places demand on the infrastructure. Agile software development methodologies have front-loaded the need for resources, and perhaps made them even more dynamic. Figure 2: Agile Development Infrastructure Workloads In addition to dynamic testing of workloads, development environments benefit from cost-effective, ondemand infrastructures. Whether.NET framework or JAVA oriented, Integrated Development Environments (IDEs) are increasing in scope and functionality, making greater demands on infrastructure. A cloud-based virtual infrastructure can be seamlessly deployed with virtually any IDE: Eclipse, NetBeans, Microsoft s VisualStudio, or IBM s WebSphere Studio Application Developer. 3
Some cloud service providers offer pre-built environments including specific development tools (for example.net frameworks for MS Azure), whereas others provide configurable application servers and allow you to stick with the tools you already have. While some of these vendors offer pay-as-you-go options for development tools, you can be sure that if they do not offer a bring-your-own-license model, you will be paying a premium for these environments. Providing a flexible operating platform for existing development tools avoids any retraining expense and additional licensing costs. Pricing Fine Print Almost all cloud service providers promote a pay-as-you-go model. However, it is important to note not all of these models are the same; as they say, it is important to look at the fine print. There may be caps on resources (by server, for instance) with overage charges for spikes in usage specific to each type of resource. Instead of paying for pools of resources dedicated to each workload, select a provider that charges for an aggregate resource pool across varied workloads. Figure 3: The Fine Print of Costs Faster Time to Market Besides cost-savings, leveraging cloud-based infrastructure for development and testing enables faster time to market with a more thoroughly tested product. Cloud-based services, specifically managed Infrastructure as a Service (IaaS), are designed for the efficient configuration, provisioning and de-provisioning of capacity that is at the core of their business model. Through browser-based UIs, set-up of test-dev environments that typically require weeks in purchasing cycles, and/or internal IT scheduling, can take just minutes. With the appropriate role-based permissions, development and testing professionals are more in control of their own destiny; they are not beholden to (frequently) over-burdened IT or Operations. Development and QA can easily and quickly define virtual machine (VM) environments appropriate to their application development and testing needs. Enterprises can choose from a wider variety of operating platforms (OS and application servers) than they could afford to maintain internally. Attributes can include 4
run-time memory, processing power (CPU), storage and bandwidth, as well as operating systems like Windows or Linux, and application servers like Apache or Glassfish. Figure 4: Server Configuration & Control Once the enterprise is satisfied with a configuration, it can be saved so that a new instance of the environment can be quickly replicated for scaling, or be newly provisioned the next time it is required. Users with the appropriate permissions can browse and re-use already defined VM configurations (templates). These templates can be managed: cloned, restarted, de-provisioned, etc., through a few steps on the service provider s customer portal. The use of saved configurations not only reduces time in set-up, but also a number of errors in QA and staging environments that are timeconsuming to fix. With consistent and known testing configurations there are fewer cycles wasted on inaccurate or erroneous testing (cloud service portals can also provide automatic documentation of configuration and run-time performance data not always easy to generate in the course of internal operations). The time saved in provisioning and more accurate test cycles allows QA and staging to better meet product deadlines, as well as stronger product release standards. In other words, enterprises can achieve faster time to market with a more thoroughly tested product. Based on their multiple experiences with similar applications and architectures, managed cloud service providers (CSPs) can guide enterprises in the initial set-up of the test dev environment. Besides standardized configuration tools, the experienced CSP Figure 5: Provisioning With Templates should be able to up-load pre-built VM images. Once tested for security and supportability, these can be moved into a production environment. CSPs may provide on-boarding services to help users configure their initial VM s. Service providers with extensive experience in managed application hosting can be particularly helpful migrating applications from hosted or dedicated environments to cloud infrastructure. 5
Use Case: Cloud-Based QA with Phased-in Production The Problem An enterprise was interested in leveraging NaviSite Managed Cloud Services (MCS) for QA, primarily loadtesting with possibly some production servers for portions of their web-based student loan service. NaviSite worked with the development team to determine how the application should be segmented for the cloud and how to optimize the supporting VM configurations and infrastructure. The Approach The customer decided to phase in cloud-based production based on the location of the end-user (in this case, a specific state). The customer had identified latency requirements, and NaviSite was consulted for configuration benchmarks based on its experience with similar applications. The Solution The AppCenter portal allowed for easy and fast provisioning of staging environments, and reported on four performance metrics: CPU, run-time memory, bandwidth usage (to/from the Internet), and storage. Through an iterative process, staging allowed the customer to tweak and tune these parameters for optimal performance. Once configurations were optimized, AppCenter configuration templates made provisioning production fast and foolproof. At first, the enterprise continued to run both their own infrastructure and NaviSite MCS. Subsequently, they migrated exclusively to NaviSite MCS. Lessons Learned For developers, cloud-based infrastructures can support their IDE (whether working in a waterfall or agile environment) as well as (or better than) on-premise infrastructure. All they need to change are IP addresses. Firewalls, ports, net-balancers, can all be configured such that the cloud test-dev environment is a secure virtual extension of their LAN. In agile development methodologies like RAD and Scrum, cloud-based infrastructure can provide individual developers on-demand capacity for more frequent compiling and running entire applications under different user scenarios. Whether it occurs in QA or development, full regression or integration testing may not have been practicable with existing infrastructure. Most managed CSPs support script-based testing (like Borland s SILK or Oracle s e-test suite). It may be easier to accommodate geographically distributed development teams using an experienced CSP and cloud-based environment. A CSP can provide benefits such as redundant Tier 1 Internet connections, rolebased access, and levels of security that are likely better than most enterprises can afford on their own. Achieving Compliance and Stronger Product Release Standards Cloud-based test-dev environments offer unique capabilities to meet growing compliance regulations that encompass software systems and IT. Some of these regulations include PCI DSS, OWASP for web-oriented systems, and emerging software release management best practices as embodied in ITIL. PCI DSS is focused on the handling of sensitive cardholder data, and as such mandates certain requirements relative to software development and testing. PCI DSS 6.3 defines specific testing and development requirements and guidance: Testing all security patches & system/software configuration changes before deployment (6.3.1) Separate development, test, and production environments (6.3.2) Separation of duties between development, test, and production environments (6.3.3) Production data (live PANs) are not used for testing or development (6.3.4) Removal of test data and accounts before production systems become active (6.3.5) Removal of custom application accounts, usernames, and passwords before applications become active or are released to customers (6.3.6) Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability (6.3.7) 6
Deploying managed cloud infrastructure for development and testing can immediately address PCI DSS requirements 6.3.2 and 6.3.4, and help with the others as well. CSPs who store sensitive data should already have achieved PCI DSS compliance; the enterprise can benefit from this experience. The PCI DSS compliant CSP provides well-documented, mature processes supporting testing and staging software. Even with mature SDLC processes in place within the enterprise (e.g. Rational s Unified Process Framework, RUP, or ITIL s Application Management), strong release management has become more of a challenge. Faster, more frequent releases with agile development, the distributed nature of applications (enabled in part by SOA ) and geographically disbursed development teams (3rd parties, outsourced, offshore), have all put more emphasis on strengthening pre-production, staging, and release of software. Deploying cloud infrastructure in a staging or pre-production phase not only buys you more capacity faster hence speed to release it also provides more visibility into the process thru standardized VM environments and the CSP customer portal. The documentation of VM configurations, provisioning/de-provisioning, and hand-offs to production environments all contribute to an audit trail for release management. The enterprise remains in control of, and responsible for, release standards. But the clear, traceable segregation of VM environments (QA to staging, staging to production) is a powerful tool in strengthening release management. A Productive Way to Sample Cloud Infrastructure Many enterprises are cautious about trusting any part of their SDLC to a cloud infrastructure, let alone a CSP. Few are willing to start by putting a production system in the cloud. A test-dev deployment offers a unique opportunity to phase in cloud technologies, realizing some immediate benefits with minimal cost and risk. Staging hosted applications in particular benefit from the scalability of cloud infrastructure and the verisimilitude to production environments, and provide a good picture of how an application and organization will adapt to the cloud. Use Case: Using Cloud-Based QA to Lower Costs The Problem A large enterprise new to cloud technologies was interested in augmenting their test/qa environment. They were attracted by the costs savings; specifically, avoiding building out more of their own infrastructure. The IT staff also was trying to get a feel for how easy it was to test using cloud technologies. The Approach The customer had a mature on-premises IT environment, with 8 containers, or VLAN s, with specific functions, properties, and permissions. They worked with NaviSite to define the new QA container and required connections: 1. To/from the Internet 2. To/from the on-premises containers (development and production) and the cloud 3. Connectivity to the on-premises mainframe hosting their SQL data warehouse The Solution Communications with the mainframe was achieved via VPN tunnels set up with specific firewall rules to echo those of their production environment, with the ability to tweak and tune the parameters for security and traffic load. NaviSite MCS ensured separation of duties per compliance regulations, and supported a welldocumented, mature process for staging and testing code with role-based access control via the AppCenter. Lessons Learned The enterprise realized benefits of faster ramp-up time, paying only for resources used with no investment in additional infrastructure. Even better, they also gained experience migrating their infrastructure and application to the cloud. Staging environments are similar to other business functions where an enterprise can sample cloud technologies in a controlled, low risk manner. For example, servers or environments devoted to customer demonstrations or application proof of concept engagements can also leverage cloud infrastructure for immediate benefit. 7
Summary A recent World Economic Forum report, Exploring the Future of Cloud Computing, acknowledged the compelling cost benefits of leveraging the cloud. It also identified another benefit that could impact organizations, whole industries, and even entire economies dramatically accelerating the way companies create new products and services, in part through enabling product development professionals around the world to collaborate more effectively and access more powerful and economical computer resources. By leveraging managed cloud infrastructure for software development and testing, enterprises can realize: Cost savings by paying only for what is used when required, with no capital expenses, maintenance, or real estate costs associated with on-site infrastructure; Savings in time with greatly reduced machine set-up and rapid, easy access to the capacity required to meet the dynamic, time-sensitive nature of software QA and staging; Improved QA and stronger release management through more comprehensive testing not limited by infrastructure capacity and more time; Enhanced ability to meet growing compliance regulations by demonstrably separating development, testing, and mission-critical production environments; A low cost/low risk migration path to trial-run application performance, with immediate benefits to the enterprise. Working with an experienced CSP enables enterprises to realize these benefits faster. The experience gained in provisioning and optimizing performance for multiple applications across different industries and platforms can be advantageous. Enterprises have the flexibility to build upon standardized platforms, while retaining much of their existing tools and processes. Adopting cloud-based test-dev is a productive first step, bringing immediate benefits, with low cost and risk to the enterprise. About NaviSite Managed Cloud Services (MCS) NaviSite s Managed Cloud Services enable on-demand scalable provisioning of IT services including applications, servers, storage, and networks. The NaviCloud Platform offers unique enterprise IT advantages that tap into the core of NaviSite s application and enterprise infrastructure management expertise. Designed specifically to meet enterprise IT demands, the NaviCloud Platform delivers services on best-ofbreed technology infrastructure from leading vendors including Cisco Systems and VMware - all provided under one of the industry s strongest SLAs. Whether supporting seasonal computing demand spikes, creating robust and cost-effective software development and testing environments, or building full application lifecycle management for mission critical enterprise applications, the NaviCloud Platform offers today s premiere cost-effective enterprise-class infrastructure option. To contact a NaviSite TestDev Cloud or NaviSite cloud computing expert, please visit us at http://www.navisite.com or call 877-485-9251. 8