►
From YouTube: Compliance as Code - Lessons Learned From Regulated Organizations - Sergiu Bodiu, Standard Chartered
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Compliance as Code - Lessons Learned From Regulated Organizations - Sergiu Bodiu, Standard Chartered
How can you use infrastructure as code to create frictionless on-boarding environment. Extend this framework to enable specific requirements based on the 1) type of products is offered and 2) country in which their products are sold. How do you create a secure cloud management layer for application teams without loss of productivity and agility? Learn how to take the operations team on a journey of automation and how the organization looks like after hiring engineers to develop those capabilities following SRE model. Migrating applications to Cloud services creates a model of shared responsibility between the customer and Cloud Service provider (CSP). CSP operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.
To learn more click here: https://sched.co/FuJZ
A
Well,
welcome
everyone
for
those
who
know
what
compliance
is
or
those
who
want
to
learn
about
compliance.
Welcome
for
those
who
are
just
dozing
off
again.
Thank
you
for
coming
to
my
session.
I'm
going
to
talk
about
compliance
is
called
lessons
learned
from
regulated
organization.
A
quick
agenda
about
DevOps
keeps
eating
the
world
compliances
code
infrastructure's
code
and
continues
compliance
a
little
bit
about
myself,
so
I'm,
an
architect.
A
I
worked
at
Standard
Chartered
I
work
for
pivotal
before
I
worked
for
JP
Morgan
bank
of
America
X
alumni,
Adobe
I
organized
the
DevOps
days,
Singapore
conference
for
the
fourth
year
and
I'm,
the
founder
of
spring
user
group
in
Singapore
I,
think
we
have
a
lot
of
changes
in
the
industry
and
you
probably
are
familiar
with
the
code.
Software
keeps
hitting
the
world.
In
fact,
it's
more
of
a
DevOps
where
developers
work
with
operators
to
produce
high-quality
software
faster,
more
reliably,
cheaper
and
you
don't
buy
DevOps
I
get
certified.
A
You
actually
go
to
the
DevOps
days,
all
around
the
world
and
it's
more
of
a
community
where
you
share
the
lessons
learned
and
you
learn
the
practices.
So
I
was
very
kind
of
interested
when,
in
the
keynote
87
percent,
I
think
were
very
of
the
enterprises
that
bought
DevOps
are
kind
of
sad
and
they
are
not
seeing
the
benefits,
of
course,
because
you
cannot
buy
DevOps,
you
cannot
make
a
developers
and
operators
work,
you
can
buy
tooling,
but
that
doesn't
equate
to
best
practices
and
principles.
A
A
It
does
mean
that
you
have
to
look
at
the
way.
You've
been
developing
the
software
and
you
need
to
reshape
and
reorganize
the
hierarchy
and
roles
and
responsibilities
and
I'm
not
just
talking
about
labeling
people,
bas
into
product
managers
or
project
managers
into
product
owners.
It
doesn't
change.
You
need
to
do
workshops,
you
need
to
do
roadmaps.
You
need
to
do
product
backlog
planning,
and
this
is
just
like
a
template
that
you
might
want
to
use.
A
So
if
we're
talking
about
development
practices,
it's
all
about
iteration,
it's
all
about
the
feedback
loop.
You
should
do
and
try
to
do
a
whiteboard
with
your
team
to
explain
what
is
the
feedback
loop.
So
if
we
start
with
unit
testing,
if
the
feedback
loop
is
within
seconds,
if
you
talk
about
per
programming,
it's
within
minutes,
you
talk
to
your
parenting
about
a
specific
subject
very
deeply.
If
you
are
doing
stand-ups,
you
do
it
daily.
If
you
do
acceptance,
maybe
you
do
it
weekly?
Maybe
you
do
it
daily?
It's
up
to
you.
A
A
Obviously,
you
would
like
to
do
some
exploration
and
you
would
make
a
very
good
investment
if
you
would
write
features
and
you
would
focus
on
the
narrative
rather
than
specifications
or
as
a
double
use
or
all
the
legacy
paperwork
and
one
good
advice
in
terms
of
what
you
should
change
in
your
development
lifecycle.
Is
you
really
should
focus
on
testing
and
I'll
talk
a
bit
more
about
testing
as
it
relates
to
compliance?
A
But
if
your
company
has
the
ice
cone,
where
you
have
very
little
unit
testing
and
a
lot
of
manual
testing
that
looks
like
an
ice
cone,
try
to
switch
it
in
into
a
pyramid
where
you
have
a
good
foundation
of
unit
testing
integration,
testing,
acceptance,
testing
and
very
little
manual
handoff,
because
guess
what
you
cannot
automate
that
so
what
is
the
governance
manual?
So
if
you
work
in
the
regulated
industry,
it's
all
about
or
charts
responsibilities.
A
Who
is
the
stakeholder?
Who
is
the
owners
and
there's
a
lot
of
other
bodies
that
come
into
picture?
So
if
you
deploy
a
product,
you
need
to
have
a
country
compliance
because
you're
gonna
sell
a
service
in
a
particular
country
which
is
regulated
by
a
specific
agency.
I'll,
give
you
a
quick
example.
So
I
was
flying
here
from
London
to
Singapore,
from
Singapore
to
Kuala
Lumpur
to
Shanghai,
but
unfortunately,
London
was
delayed
because
there
was
at
understorms.
So
my
flight
was
delayed,
so
the
first
half
an
hour.
A
They
need
to
give
you
water,
the
fact,
the
first
two
hours
they
already
need
to
make
amenities
and
if
they
were
delayed,
so
you
would
imagine
all
my
flights
were
like
within
three
hours
so
by
delaying
a
full
four
hours.
I
couldn't
already
fly
so
I
had
to
make
amendments
to
my
flight
and
I,
flew
London,
Shanghai
directly,
so
I
skipped
home,
and
that
wasn't
done
because
the
airline
has
the
best
interest.
For
me.
It's
actually
the
airline
has
a
policy
and
they
are
fine,
really
ridiculous
prices
when
they
don't
follow
the
policies.
A
So
compliance
is
code.
What
are
we
talking
so
I'm
gonna,
give
you
examples
on
business.
Singapore
Singapore
has
a
very
forward-looking
regulator:
I'm
a
yes
Monetary
Authority
of
Singapore,
and
they
they
have
started,
probably
the
first
ones.
Moving
from
your
PDF
documents
were,
let
me
step
back
from
paper
the
PDF
documents
to
actual
api's,
where
you
have
information
about
the
customers,
my
info,
what
I
always
can
check
via
an
API
call?
A
Who
am
I
dealing
all
the
KYC,
all
the
AML
is
being
done
at
the
regulatory
body,
and
now
they
also
give
you
theorems,
which
are
technical
risk
memorandums
which
give
you
a
documentation
in
terms
of
okay.
These
are
the
best
practices
that
you
are
following.
They
don't
set
up
a
test,
but
you
are
so
organization
you
can
parse
that
reference
that
risk
memorandum
and
parse
it
into
a
computer,
understandable
code
and
that's
what
we
did.
A
Obviously,
because
we
want
to
move
to
cloud
and
I
think
there's
a
lot
of
demand
all
around
the
world
where
IT
organizations
in
the
banks
insurance
travel,
they
they
see
a
benefit
in
outsourcing
that
to
a
vendor
provider.
So,
if
you're
looking
in
the
challenges,
they
say
well
what
application?
What
are
the
frameworks?
Is
it
justifiable?
Is
it
enough,
and
maybe
the
fifth
one
they
will
ask?
Well
what
about
the
security?
A
Can
we
actually
deploy
the
application
on
to
the
cloud
and
especially
in
this
region,
where
you
have
South
Korea,
you
have
India,
you
have
Indonesia
you
actually
kind
of
deploy
it
on
cloud.
You
need
to
think
of
an
on-premise
data
center
on-premise
cloud,
how
they
call
it
private
clouds,
which
don't
make
sense,
because
you
don't
get
the
benefit
of
public
cloud
and
pay
as
a
utility.
You
actually
need
to
make
a
lump
sum
investment.
A
A
If
I'm
moving
to
the
cloud
on
AWS,
they
have
me
covered
and
if
you
go
into
their
compliance
page
again,
they
have
a
ton
of
ISO
documentation,
a
ton
of
frameworks
that
they've
been
out
audited,
but
in
reality
and
I'm
just
going
to
give
you
in
a
few
slides.
It's
not
particularly
true,
so
what
we've
done
is
like
any
good
citizens.
A
We
looked
at
the
best
practices
and
the
best
practice
at
the
time
was:
you
need
to
implement
AWS
config,
an
AWS
config
is
a
way
for
you
to
interact
with
the
services
from
AWS,
catalog
and
then
check
on
the
state.
So
when
there
is
a
change
into
a
service
like
RDS
or
I
or
as
tree,
you
can
have
who
and
you
can
plug
in
and
then
you
can
start
configuring
rules.
So
we
started
implementing
rules,
because
that
was
you
know
code,
and
we
felt
that
it's
actually
the
best
choice
to
do
it.
A
So
configuration
management
lands
on
your
ADA
West
Resources
in
order
to
control
your
objectives,
so
the
control
objectives
are
really
the
targets
that
you
need
to
meet
in
order
to
pass
the
audit
or
in
order
to
offer
a
service
within
a
country
to
your
desired
customers.
So
this
is
what
we
did.
We
actually
talked
about
it
at
AWS
summit
and
we
implemented
comprises
code
engine.
So
let
me
try
to
guide
you.
A
So
what
we
did
is
we
started
having
this
lambda
function,
several
s
where
we
start
aggregating,
AWS
config
rules,
then
we
configure
I,
am
policies
and
I
am
roles
to
give
access
to
an
special
auditor
account
to
check
in
on
those
resources
and
actually
verify.
If
those
resources
follow
the
policy,
then
we
set
up
a
config
dashboard
which
they've
since
relaunched
and
they
call
it
pager
duty.
Then
we
have
this
rule
set
because
we
have
standard
chat.
It
is
about
in
72
markets.
So
we
have
a
ton
of
applications.
A
This
is
AWS
config
rule
on
the
right
side.
You
have
what
is
considered
compliance
rules
so
there's
about
27
there's
a
total
of
75
if
I
remember
correctly,
which
are
telling
you
which
are
the
controls
and
by
the
way
this
is
all
available
on
the
following
github
and
was
presented
at
a
SS
summit.
But
if
you
look
at
the
code
that
is
needed
for
verify
and
multi-factor
identification,
so
if
you're
doing
banking,
it's
not
only
good
to
safeguard
with
a
password
and
a
complex
password,
but
you
also
need
to
have
a
physical
token
or
like.
A
A
Now
remember
the
diagram
where
I
talked
to
you
about
the
share
responsibility
between
AWS
and
the
customers.
Well,
if
you
look
at
what
is
needed
to
pass
a
PCI
DSS
compliance
which
in
human
terms,
means
if
I
want
to
do
payments
in
the
cloud,
these
are
the
things
that
I
need
to
implement
and
actually
everything
is
shared
and
there's
a
ton
of
things
that
I
need
to
implement
as
a
customer.
The
only
thing
that
is
being
granted
from
AWS
is
the
physical
security.
A
A
Then
the
next
one
is
it's
verifying
the
access
key
and
expiration
and
the
creation
of
the
user,
and
then
the
last
one
is
a
third
rule
which
kind
of
checks
on
the
password
policies,
because
you
need
to
have
a
certain
strength
for
your
password
inspect
is
open-source
framework
is
developed
by
chef.
However,
it's
actually
been
acquired
from
vocano
spec.
So
it's
a
five
years,
six
years
old
project,
it
has
been
authored
in
Germany
by
a
few
compliance
officers
who
work
with
Deutsche
Telekom.
A
So
there's
plenty
of
experience
in
in
that
framework
and
I
definitely
advise
you
to
work
with
so
what
we
did
next,
if
we
look
at
the
we've
kind
of
found
the
language,
so
we
set
up
this
objective,
so
we
need
to
meet
the
regulatory
obligation.
We
need
to
have
statuary
and
contractual
obligations.
We
need
to
have
authorization,
identification
and
entitlements.
We
need
to
look
at
the
data,
confidentiality,
data,
residency
and
data
sovereignty,
just
to
explain
the
difference.
A
Data
sovereignty
is
whose
data
it
is
so,
for
example,
I'm
a
singer
I'm
a
permanent
resident
in
Singapore,
but
I'm
doing
banking
in
Hong
Kong
or
in
London.
So
it's
a
bit
more
complex
and
then
the
outsourcing
obligation
and
the
right
to
audit.
So
we've
created
kind
of
this
pipeline.
If
you
will
so,
we
want
to
have
compliance
specifications
which
are
your
DSL
in
terms
of
obligations
that
you
want
to
do.
We
define
our
acceptance,
tests
and
I'll
walk
in
a
few
seconds.
What
I
mean
by
acceptance
test?
A
What
we
do
is
we
have
this
environment
definitions,
because
while
we
want
to
be
very
secure
in
production,
we
also
want
to
promote
these
definitions
from
dev
SITC.
I
u8ee
pre
prod
prod,
so
we
could
have
multiple
environment
definition
and,
as
you
go
into
very
complex
banking
software,
it's
actually
like
a
platform,
so
you
treat
it
as
a
pipeline
and
then
every
change
he
triggers
a
build
and
is
being
audited
now
I
want
to
go
back
into
the
code.
Testing
history,
so
acceptance
test
is
nothing
new.
A
If
not
it's
actually
the
thing
that
changed
the
way
we
do
software.
So
if
you
remember,
we
used
to
have
a
separate
team
called
quality
assurance
who
would
do
just
the
manual
testing?
And
if
you
look
now
we
have
a
separate
compliance.
We
have
a
separate
audit.
We
have
a
separate
regulatory
all
of
those
teams
working
on
paperwork.
Well,
we
used
to
have
that
back
in
the
days
where
they
would
just
write.
The
business
analyst
would
write
specification.
A
Your
domain
architect
would
write
some
specification
and
would
just
be
paperwork
passed
in
and
really
the
the
change
in
the
industry
was
when
they've
introduced
TDD.
That's
driven
development
testing,
where
you
would
collaborate
on
a
feature
with
the
business
analyst
and
subsequently
the
product
manager
to
understand
what
is
actually
needed
and
what
are
the
tests
that
need
to
pass
in
order
to
demonstrate
that?
A
Actually,
the
feature
is
done
and
then
subsequently,
why
you
had
is
behavioral
driven
development
and
BDD,
where
we
kind
of
had
the
ubiquitous
language
where
we
would
just
write
features
in
cucumber
or
anything
that
is
Gerren
style.
So,
ideally,
the
workflow
looks
like
this,
so
you
have
a
feature,
so
you
write
an
acceptance
test
that
acceptance
test
fails.
Then
you
start
writing
a
suit
of
unit
test,
which
is
test
scenarios
that
need
to
be
passed
in
order
for
that
feature
to
be
accepted.
A
So
you
start
implementing
unit
test
by
unit
test
and
you
actually
have
the
reporting.
So
you
don't
need
to
feel
clarity,
time
sheets
or
whatnot
is
a
Cubs
and
then,
as
the
unit
tests
are
being
done,
the
feature
would
be
working
and
it's
green.
And
if
you
remember
TDD,
you
also
need
to
have
that
cycle
of
red
green
refactor.
A
Okay
and
the
next
change
in
the
industry,
as
everyone
is
moving
to
the
cloud,
is
that
concept
of
flexible
infrastructure.
So
you
have
concepts
of
developers,
sandbox
Inc.
You
have
cloud
dev
test
labs,
which
are
very
much
like
integration
between
a
bank
and
maybe
a
provider,
maybe
an
incubator
or
all
of
those
fintax.
Then
you
have
continued
ization.
A
The
concept
of
moving
to
micro
services
rather
than
Monell,
is
really
extracting
services
from
your
d24
or
terminals
or
wealth,
big
wealth,
corporate
management
applications,
and
you
really
want
to
have
outer
scaling
because
we
live
in
a
mobile
world.
So
you
don't
know
where
you
will
have
a
spike
in
to
access
and
obviously,
if
it's
a
financial
service,
you
need
to
think
about
resilience.
You
don't
want
your
banking
to
go
down
on
the
last
day
of
the
month
when
you're
paying
the
the
salaries.
A
So
if
you
look
at
the
infrastructures
code,
there's
a
great
book
by
Keefe
Morris
and
what
he
says
is
he
had.
He
has
a
great
presentation
which
is
from
the
Iron
Age,
where
you
can
pick
a
bare-metal
to
the
cloud
age
and
the
gist
of
it
is
infrastructures
code
is
treating
configuration
system
the
same
way
as
we
used
to
treat
source
code
for
applications.
So
you
have
source
code
management,
you
apply
TDD,
you
apply
continuous
integration,
refactoring
another
extreme
programming
practices
and
especially
useful
for
making
sure
changes
to
infrastructure
are
thoroughly
tested.
A
So,
if
you
remember
previously,
there's
nothing
bad
if
you
upgrade
your
database
all
right
how
many
times
that
triggered
a
major
major
failover
and
a
call
on
the
Saturday
or
Sunday.
So
what
we
use
this
we
use
terraform.
We
really
like
the
graph
theory
behind
terraform,
where
you
kind
of
create
modules
and
you
have
a
template
of
your
infrastructure.
So
let's
take
a
simple
treat
your
application,
so
you
would
have
your
what
web
service
behind
the
web
load
balance
that
you
have
your
web
application
services.
You
have
an
application
load
balancer!
A
You
have
your
application
service,
you
have
a
database
and
usually
it
should
be
with
replicas
now
the
good
part
about
it
is.
If
you
start
for
my
applied
graph
theory,
the
dependency
is
being
honored
and
actually
you
start
implementing
from
the
far
back.
There's
no
reason
to
stand
up
your
web
load
balancer.
A
If
your
database
is
not
up
and
it's
very
useful
when
you
start
applying
that
flexible
infrastructure
about
which
I've
talked
earlier,
because
then
you
can
treat
infrastructures
code
and
you
can
provision
those
def
test,
labs
and
whatnot
environments
at
the
snap
of
a
finger
within
minutes.
It's
no
longer
that
procurement
process.
So
what
we
did
is
we
very
much
looked
at
their
form
as
a
way
for
us
to
promote
pipelines.
So
we
had
a
template
for
our
development.
We
had
a
template
for
staging
and
production,
and
the
application
code
is
very
much
the
same.
A
So
what
you
have
you
have
an
artifact,
then
the
infrastructure
is
the
one
that
changes
artifact
should
be
audited
and
should
not
change.
If
you've
done
a
release
in
development,
you
should
just
push
it
to
production
and
you
should
have
your
tests
that
verify
that
the
infrastructure
abides
by
the
rules
that
you
set
up.
So
if
you
deploy
it
in
Singapore,
it's
a
if
you
deploy
it
in
UK,
its
PRA.
If
you
deploy
it
here,
I,
don't
recall
the
name
of
the
regulator,
but
you
cannot
deploy
it
on
a
cloud.
A
It
needs
to
be
on
Alibaba
here
away
right.
So
lessons
learned
if
I
would
just
summarize
I
would
see,
eliminate,
duplicates
entry
of
information
and
ensure
consistency,
streamline
approval
process
to
ensure
all
regulatory
requirements
have
been
reviewed.
Transparency
of
information
and
approval
process
centralized
IT
Oh,
which
is
more
of
a
server
infrastructure.
Farm
Service
middleware,
centralized
inventory
of
third
party
to
identify
a
concentration
risk.
So
if
all
the
banks
gone
to
AWS
cloud,
I,
don't
think
that's
a
safe
path.
A
You
should
definitely
mitigate
the
risk
and
deployed
us
many
clouds
as
possible,
centralized
information
for
audit,
rather
than
making
this
one-year
effort
where
auditors
come,
and
then
everyone
is
working
on
a
three-month
process
to
grab
all
the
information
that
the
auditors
ask.
You
actually
have
a
continuous
process,
we're
like
okay,
this
is
the
Jenkins
build,
or
this
is
the
inspect
test,
or
this
is
the
terraformer
everything.
Is
there
it's
audited?
We
do
it
on
a
daily
basis.
We
build
that
resiliency
and
that
know-how
now,
if
I,
would
go
into
continuous,
come
to
compliance.
A
Here's
a
code
that
I
am
trying
to
promote
so
I'm
on
a
mission
to
change
the
way
we
do
compliance.
So,
given
a
code
repository
and
a
set
of
approved
design
patterns,
when
a
new
valid
design
specification
file
is
committed
and
the
file
is
analyzed
against
approved
patterns,
then
the
design
is
approved
and
future
releases
can
go
to
the
pre-production
environment
or
production
like
environment.
A
Can
you
imagine
this
with
financially
regulated
environment?
To
actually
do
these
deploys
in
a
in
a
day,
because
you
see
all
the
public
releases
that
financial
services
are
on
the
cloud
where
there's
like
some
risk
calculation,
which
doesn't
really
care
about
the
data
all
right,
so
we
just
spin
up
computing
instances,
I'm
gonna
skip
here
and
again.
If
you
go
to
cloud,
bear
mind
that
as
an
evolving
infrastructure
or
beat
coupe
con
beat
kubernetes,
you
will
not
have
a
hundred
percent
of
your
applications
to
be
you
on
kubernetes.
A
Similarly,
how
it's
very
hard-
and
it's
been
30
40,
50
years
journey
to
migrate
from
mainframe,
and
it's
still
the
case.
You
still
have
your
core
banking
into
mainframe
IBM
sold
that
business,
but
is
still
making
money
out
of
the
consultancy.
So
you
really
need
to
understand
and
the
trade-off
between
what
do
you
get
from
an
infrastructure
as
a
service?
What
your
scaling,
in
this
case
it's
an
operating
system.
If
you
go
to
container
system,
then
you
have
the
images.
A
So
you
have
the
scale
of
a
containers
and
very
much
like
what
is
my
golden
image
and
if
you
do
it
very
well
on
kubernetes,
then
your
next
problem
is:
how
do
you
manage
all
those
golden
images
which
are?
The
last
count
was
like
500
platform-as-a-service.
Again,
it's
good
to
have
the
application,
but
then
you
get
too
lost
in
to
what
is
action,
application
and
function
itself.
So
the
analogy
is
very
much
like
what
would
you
define
car
as
a
service?
It's
probably
much
better
if
you
look
at
in
that
way.
A
So
if
I
came
here
in
a
Shanghai,
I
didn't
bought
a
house
or
a
garage
or
a
car
I,
actually
called
the
taxi
or
I
told
the
hotel
tax.
The
hotel
car
to
pick
me
up
from
the
airport
in
Singapore
is
very
expensive
to
actually
own
and
have
a
car
because
they
have
licenses
and
you
pay
the
starting
prices
about
a
hundred
twenty
thousand
or
renault
clio.
So
again,
it's
not
feasible,
so
you
much
rather
go
by
grab
ubirr,
which
has
been
acquired
by
grab.
A
Let's
keep
this
okay.
So
that's
very
much
like
one
of
the
open
source
project
that
I'm
currently
working
with
chef,
terraform,
Hoshi
Corp,
where
what
we
did
is
we
wrote
the
inspect
provisioner
for
terraform,
so
we
actually
can
run
inspect
profiles
on
to
our
infrastructure.
We
can
tag
servers
saying
that
okay,
this
is
an
application,
server,
Tomcat
or
JBoss,
or
this
is
a
wealth.
A
This
is
a
mobile
and
we
can
start
tagging
those
resources
and
actually
we
can
generate
a
lot
of
interesting
part
and
we
worked
and
it's
actually
currently
of
the
source
and
it's
working
where
we
take
the
terraform
state.
So
for
those
who
is
not
familiar
with
terraform,
it's
a
Hoshi
corp
DSL,
which
is
abstracting
your
confirmation
as
uriah
rams,
and
what's
the
analogous
for
Google
Cloud
and
basically
looks
at
the
infrastructure
and
then
says,
I
need
to
have
this
V
PC
I
need
to
have
this
load.
A
Bus
I
need
to
have
these
resources
and
service
and
then
creates
the
tests,
and
then
you
are
able
to
run
testing
against
the
infrastructure
to
make
sure
that
actually,
what
is
running
in
production
is
what
I
need
to
have,
because,
as
you
get
this
api's,
what
you
need
is
just
a
rock
to
come
in
and
just
trigger
an
API
call
and
boom
you're
dark.
You
no
longer
have
a
cache
management
solution
on
the
Internet,
so
what
you
want
to
do
is
if
you
want
to
go
even
more
advanced.
A
Is
you
start
looking
at
the
Packer,
which
is
another
hash,
equal
solution?
Where
what
you
do
is
you
have
a
builder
that
builds
a
packet
packages,
images
for
as
your
AWS
Google
OpenStack,
you
name
it.
Then
you
have
provision
as
the
provisions
can
be
chef
and
Sibyl
bash,
whatever
you
want
to
how
to
provision
an
image
and
then
you
have
cost
provisioning,
and
then
you
build
docker
images,
VirtualBox,
VM
or
AWS
dc-3,
and
ultimately
you
build
an
application
image
and
then
in
terms
of
why
you
want
to
do
with
those
application
images.
A
It's
up
to
you!
It's
your
process.
You
have
a
choice
of
flexibility
or
simplicity,
so
if
your
concept
of
a
mutable
image,
it's
actually
operating
system,
middleware
an
actual
application,
artifact,
that's
very
safe
in
production,
because
there's
no
drift
between
development
to
production.
It's
an
immutable
object,
it's
very
much
like
a
container,
but
if
you
apply
to
a
OpenStack
or
to
a
VM
on
too
easy
to
AWS,
that's
even
more
comfortable,
more
powerful.
A
What
you
can
do
cloudy
neat,
where
your
provision,
everything
and
you
still
call
it
immutable,
but
then
it's
it's
up
to
you,
how
you
do
the
trade-off
and
I'd
like
to
have
a
few
more
slides.
Let
me
skip
this,
so
why
do
you
want
to
automate?
Well
basically
so
back
to
the
discussion
about
my
flight
here
to
Shanghai,
when
I
tried
to
call
the
call
center,
which
was
in
India
and
I,
tried
to
explain
all
of
the
things
and
what's
happened?
Well,
they
follow
the
policy.
A
I
didn't
get
the
result
because
they
just
have
a
system
that
gives
you
an
access.
Now,
if
you
can
codify
that
system,
it's
no
longer
up
to
any
interpretation.
So
if
I
call
John
Sam
Michael
Rajat,
they
all
interpret
that
policy
and
you
might
have
different
results,
depending
on
whom
you
have
on
the
call
how
lenient
or
how
stringent
they
are.
That's
not
the
same.
When
you
have
a
system,
you
call
a
system
on
a
Friday
on
a
Monday
on
a
Christmas
is
the
same
result.
It's
repeatable!
It's
auditable.
It
doesn't
matter.
A
If
I
had
my
lunch,
if
I
had
my
tea,
if
I
am
rushing
to
to
pick
up
my
children,
so
you
should
set
up
these
guardrails.
You
have
continuous
monitoring.
You
have
continuous
assessment,
you
set
up
audit
and
compliance
and,
more
importantly,
you
go
back
to
the
original
reason.
Why
do
you
build
software?
It's
not
just
to
build
a
paperwork
process
around
it.
It's
very
much
about
change.
How
do
you
manage
change
and
change
not
just
in
computer
systems
but
more
in
terms
of
how
do
I
educate
my
customers?
A
So
if
ten
years
ago,
everyone
was
very
accustomed
to
go
to
a
branch,
and
now
you
give
them
a
mobile
phone
and
they
are
expected
to
do
all
their
banking
from
that
mobile
phone.
But
then
you
go
to
so.
If
your
singapore-based
and
there's
an
OTP
in
Singapore,
you
go
to
London
and
immediately
it's
not
recognized
because
guess
what
you
don't
have
access
the
firewalls
are
not
configured.
A
There
is
a
lot
of
things
that
we
need
to
mature
as
a
industry
in
terms
of
the
controls,
library,
the
frameworks
and,
more
importantly,
how
do
we
treat
compliance
going
forward?
So,
for
me,
is
the
same
as
I've
seen
probe
like
15
years
ago,
where
we
no
longer
have
a
quality
assurance
team
that
is
dedicated
to
doing
testing
testing
has
become
part
of
the
core
team.
Everyone
is
doing
testing.
The
same
goes
about
compliance
and
governance
because
they
are
setting
up
rules
for
you
as
a
customers.
A
So
it
doesn't
matter
if
I
work
in
financial
services
I'll
still
have
to
buy
a
insurance
product
or
a
travel
or
a
ticket.
So
by
investing
into
automated
tools
you
make
sure
that
those
policy
are
being
respected
and
us
customer
are
given
the
rights.
So
without
so
my
contacts,
it's
my
LinkedIn
and
down
below
is
my
twitter
handle
at
surger
audio.
Thank
you
very
much.
A
A
Again,
I
would
like
to
give
you
the
message
that
it's
about
improving
the
flow
of
customer
value.
Alright,
so
it
doesn't
matter
if
you
do
see
ICD
or
you
to
Jenkins
fields.
Nobody
pays
you
for
how
many
Jenkins
build
you've
done
successfully
or
how
many
containers
you
run.
It's
really
like.
Do
you
have
a
working
software?
Does
it
work
by
the
specification?
Does
it
meet
the
criteria
and
we
follow
the
audit
so
make
sure
you
do
continuous
integration
contains
deployment,
release
management
and
automated
testing
and
just
improve.
Thank
you
very
much.