►
From YouTube: Velocity or Governance: Why not both? - Fatih Degirmenci, EricssonSpeakers: Fatih Degirmenci
Description
Velocity or Governance: Why not both? - Fatih Degirmenci, Ericsson
Speakers: Fatih Degirmenci
CD enables organisations to produce high quality software more rapidly, enabling them to bring new services to market faster and be ahead of the competition. Teams frequently push their code which goes through CD pipelines, getting deployed to production. However, CD is not without its challenges and governance is one of them. Deploying changes to production without ensuring they adhere to rules, regulations, and laws could expose organisations and their users to issues with security, privacy, and compliance. Regardless of the size or the industry, Policy Driven CD is a critical topic that enables organisations to deliver software with speed by allowing enforcement of policies within their pipelines so security, regulatory, and compliance issues are identified and remedied earlier. This talk will introduce policy topic with examples from various industries such as telecom and finance.
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
A
Hi
all
thank
you
for
joining
session
last,
your
governance.
Why
not
vote
my
name
is
fighter
mangy.
I
work
for
ericsson
as
a
developer.
I
also
co-chairs
fashion
test
group
interpreted
within
countries
the
foundation
during
this
session.
I
will
talk
about
what
governance
is,
how
it
can
be
applied
in
software
development
projects,
how
the
velocity
can
be
achieved
while
applying
governance
and
how
con
positron
continues.
There
could
help
achieving
governance
without
sacrificing
diversity.
A
So
if
you
look
at
colonizing
software
development,
it
is
not
entirely
different
from
how
guarance
is
defined
in
the
dictionary
governance
is
one
of
the
key
mechanisms
in
organizations
to
ensure
that
the
software
development
projects
align
various
aspects
and
what
those
aspects
are.
One
of
them
is
security,
the
other
one
is
laws
and
regulations
and
finally
business.
A
So
the
software
development
projects,
organizations
working
with
software
development
projects
need
to
align
with
these
aspects
to
ensure
they
don't
exploit
end
users,
security
risks.
They
follow
local
or
global
laws
and
regulations
which
could
be
industry,
specific
or
generic
and
finally,
to
satisfy
business
requirements.
A
To
make
this
a
bit
more
relevant
to
our
day-to-day
lives,
if
you
think
about
the
latest
technologies
and
methodologies
that
have
been
developed
within
communities
or
in
various
industries,
you
will
notice
that
these
new
technologies
and
methods
delivering
tremendous
advances
in
various
industries
and
increasing
the
pace
of
innovation.
So
we
are
getting
new
services
new
features
all
the
time
much
faster
than
before,
and
one
of
the
key
aspects
of
this
is
the
speed.
A
A
So
if
you
think
finance
industry,
I'm
sure
most
of
you
have
applications
installed
on
your
smartphones,
doing
financial
transactions
and
you
have
accounts
on
certain
apps,
but
you
don't
have
to
visit
a
bank
office
or
talk
to
clerk
on
in
the
office.
You
just
install
the
application,
create
an
account,
submit
your
photographic
id,
and
then
you
get
you.
You
got
your
account
set
up
in
few
minutes,
then
you
were
able
to
transfer
or
receive
money
without
any
issues,
and
obviously
this
is
very
simple
comparing
to
how
the
things
were
before.
A
But
since
everything
is
done
or
software-
and
you
simply
pass
your
personal
details
to
someone
else
with
your
money,
you
want
to
be
make
sure
that
your
details
and
your
money
are
safe
and
it
is
not
stolen
by
some
hacker
somewhere
else.
So
the
organization
providing
you,
this
type
of
financial
service
or
applications
must
make
sure
that
they
adhere
to
certain
security
rules,
laws,
regulations,
aspects.
A
The
next
example
is
healthcare,
as
no
most
of
the
healthcare
institutions
are
doing
their
transactions
online,
and
it
is
critical
that
the
healthcare
information,
private
individuals
are
not
exposed
and
not
accessed
by
unauthorized
people.
It
is
critical
that
these
health
institutions
attune
to
security
rules
and
regulations
similar
to
finance
institutions,
maybe
even
more
strictly
and
finally,
telecom
and,
for
example,
you
are
having
an
emergency
and
you
will
need
to
call
112
or
911..
A
You
want
that
call
to
go
to
the
emergency
services.
You
don't
want
that
call
to
drop.
You
don't
want
to
get
visit
on.
You
just
want
that
call
to
happen,
and
certain
rules
and
regulations
ensure
that
this
always
happens
and
the
common
theme
across
all
these
different
industries,
and
perhaps
even
more,
is
that,
yes,
we
can
bring
new
services
new
features,
hence
to
our
users
much
faster
than
before.
But
this
doesn't
mean
we
can
neglect
security,
rules,
laws
and
regulations,
while
keeping
business
aspects
in
mind.
A
But
some
of
you
may
think
that
or
may
work
in
organizations
that
some
or
all
of
the
checks
are
done
manually
and
compliance
is
checked
by
humans,
and
if
this
is
the
case,
this
obviously
slows
things
down
because
you'll
finish
your
coding,
you
build
your
container,
which
everything
is
ready
to
be
pushed
to
production.
But
if
you
need
to
get
a
human
to
review,
what
we
have
done,
things
may
be
slower
than
how
it
could
be
if
automation
was
in
place.
A
So
now
we
can
look
at
velocity.
We
already
talked
about
velocity
in
software,
but
look
at
velocity
from
cambridge
dictionary.
Sd
is
the
speed
at
which
an
object
is
traveling,
which
is
obvious.
But
if
we
look
at
this
in
software
development,
it
is
not
very
different
from
what
is
described
in
dictionary.
A
Velocity
is
about
how
quick
a
new
feature
under
box
fix,
reaches
to
the
production
to
the
hands
of
end
users,
and
this
depends
on
the
pace
of
innovation
and
thanks
to
the
innovation,
we
can
create
new
functionality
to
hand
into
our
users
with
the
quality
built
in
and
obviously
some
of
these
things
may
look
like
they
could
slow
things
down.
For
example,
you
generate
new
features,
you
get
that
into
production,
but
in
order
for
that
thing
to
get
into
production,
you
have
to
ensure
that
it
must
pass
certain
quality
checks.
A
But
again
this
is
at
the
same
time
an
enabler
such
as
quality
checks.
If
you
send
a
problematic
code
to
production
as
fast
as
also
without
ensuring
the
quality
is
in
place,
then
this
may
actually
slow
things
down
when
you
catch
those
issues
in
production
or
it's
kind
of
velocity
depends
on
quality
as
well.
A
A
If
I
have
to
to
fill
in
some
spreadsheet
for
marking
some
compliance
issues
as
done,
then
it
obviously
take
away
the
no
fun
from
my
job
and
it
may
hit
my
happiness
and
I
may
reduce
my
productivity
and
make
my
my
experience
worse
than
how
it
was
before.
So
we
must
make
sure
that
we
put
enough
focus
on
developer
experience,
productivity
and
happiness
to
ensure
innovation
and
speed.
A
A
How
these
things
could
go
hand-in-hand
together,
without
forgetting
one
or
without
priorities
in
one
or
the
other?
Obviously
we
may
have
times
we
need
to
prioritize
certain
things
over
others,
but
there
must
be
a
balance
that
all
these
things
get
needed
attention
at
all
times
and
in
this
case
policies
could
be
helpful
because
policies
are
principles
to
guide
our
decisions.
A
If
you
open
wikipedia
and
if
you're
typing
policy,
you
will
get
this
definition
policy
is
a
deliberate
system
of
principles
to
guide
decisions
and
achieve
rational
outcomes
adopted
by
governance
by
the
dividend
organization.
So
policies
are
essentially
things
the
government's
body
uses
to
achieve
desert
and
racial
outcomes,
and
this
brings
us
back
to
what
policies
are
again.
Policies
are
business
decisions.
A
A
Property
of
policies
is,
they
must
be
enforceable,
measurable
and
auditable
like
if
you
create
set
of
policies,
but
if
you
can't
enforce
them,
then
there
is
no
point
having
those
policies,
because
all
the
time
people
will
stop
taking
care
of
them
and
they
will
start
neglecting
those
policies.
So
you
have
to
be
able
to
enforce
those
policies.
A
In
addition
to
be
able
to
enforce
those
policies,
you
must
be
able
to
measure
the
outcomes
of
those
policy
enforcement.
Like
do
you
achieve
the
desired
outcomes,
and
you
can
only
do
that
by
measuring
things
and,
finally,
you
must
be
able
to
audit
your
policies
like
do
we
have
the
right
policies
in
place
or
do
we
have
the
authenticity
of
those
politi
policies
who
created
those
policies
and
how
those
policies
are
maintained
and
the
type
of
policies
developers
can
apply
this
type
of
approach
to
ensure
that
they
can
prevent
defects?
A
Another
thing
to
highlight
here
is
that
sometimes
people
talk
guidelines
while
they
talk
about
policies
and
vice
versa,
but
there
is
a
big
difference
between
guidelines
and
policies.
Guidelines
are
suggested
behavior,
for
example,
when
you
pass
the
other
side
of
the
street.
You
look
at
left
your
left,
your
right
and
your
left
and
your
passes.
There
is
no
car,
but
there
is
no
one.
Assuming
there
is
no
police
in
place.
There
is
no
one
that
enforces
you
to
look
left
and
right.
A
You
can
still
pass
the
road
you
may
have
you
know
an
accident,
but
you
can
pass
the
other
side
of
the
road.
So
that
is
a
guideline,
but
when
it
comes
to
policies
they
are
actually
enforced,
they
enforce
expected
behavior
and
if
the
system
doesn't
demonstrate
expected
behavior
the
policies
could
be
enforced
and
blocking
that
certain
thing
to
pass
through
that
gate.
A
Another
thing
to
highlight
here
is
that
the
policy
and
technology,
because
when
again
people
talk
about
policies,
the
conversations
tend
to
end
up
on
specific
technology,
selections
like
this
framework
for
streamer
or
that
policy
engine,
but
in
essence
policies
are
defined
by
by
businesses.
So
they
are
the
things
that
businesses
define
for
their
organizations
and
technology
is,
are
the
things
that
deal
with
the
implementation.
A
So
you
can
have
the
coolest
technology,
but
if
you
don't
have
policies
defined,
then
that
technology
doesn't
provide
any
value
or
you
may
have
policies,
but
you
have
no
way
to
enforce
those
within
your
software
development
process
and
then
you
again
don't
get
all
the
benefits
from
payment
policies.
So
these
two
things,
policies
and
technology
must
go
hand
in
hand
and
they
should
be
enablers
for
each
other.
A
Now
we
talked
about
what
governance
is,
what
velocity
is
and
what
are
the
you
know,
policies
that
could
help
ensuring
governance
is
adhered
with,
an
organization.
Let's
look
at
sample
contents
data
pipeline
in
this
pipeline.
You
can
see
there
are
three
teams:
they
each
develop
one
micro
service
and
they
follow
the
usual
contents
that
your
pipeline.
They
commit
their
code
to
source
code
management
systems
and
their
code
is
gated
in
pre-merge.
A
So
they
must
pass
that
called
analysis
unit
test,
build
and
dependency
scanning
in
order
for
that
commit
to
be
merged,
their
main
branch
and
once
they
pass
those
checks,
pre-merged
activities
and
once
they
get
approved
from
their
peers
as
part
of
peer
review
process.
That
called
and
support
main
branch
in
their
repository,
and
once
the
code
is
available,
the
in
the
main
branch
in
repository
it
triggers
set
of
post,
merge
activities,
and
this
could
well
be
building
content
images
running
some
small
tests,
doing
performance
tests
and
find
a
security
analysis.
A
And
again
this
is
yet
another
gate,
and
if
the
artifacts
that
are
built
as
part
of
postpartum,
actually
the
most
cosmetic
merged
activities,
pastel
gates,
they
end
up
on
container,
which
is,
for
example,
and
from
there
they
are
rolled
out.
Production
in
different
regions
such
as
americas
and
eu,
and
the
country
pipeline
doesn't
end
once
the
artifacts
hit
production.
A
We
have
additional
activities
within
production,
such
as
kind
of
development
and
a
b
testing,
and
if
you
look
at
these
things
place,
they
are
all
policies
in
a
sense.
Some
of
them
are
more
explicit,
such
as
security,
analysis
and
others
are
the
usual
things
we
are
doing
like
static
qualities,
design
units
tests,
but
they
are
all
there
to
enforce
certain
behavior
and
certain
level
of
quality
for
any
code
contribution
and
without
meeting
those
expectations.
A
So,
let's
pick
few
of
those
checks
in
sample
contents
data
pipeline
and
again,
on
the
left
hand,
we
have
the
same
themes,
team
abc
and
on
the
right
hand
we
have
the
production
and
the
bottom.
We
have
developers
and
if
you
look
at
the
left
hand
side,
you
will
see
most
of
those
things
or
almost
all
of
those
things
are
things
developers
are
good
developers
are
competent,
they
know
what
code
they
are
contributing
to.
A
They
know
what
kind
of
coil
checks
they
must
pass
in
order
to
get
their
code
merge
the
main
branch
so
they're,
quite
comfortable
with
that
also
block
list.
For
example,
you
may
not
want
to
use
a
certain
dependency
that
doesn't
really
satisfy
licensing
cards,
for
example,
developers
again
they're
competent
in
handling
those
things,
and
if
you
take
a
step
right,
you
hit
post,
merge
activities
and
again
these
things,
such
as
previous
workforce
again
developers
are
no
good
in
these
things
and
they
can
take
all
of
the
care
of
those
things.
A
But
when
you
hit
the
production,
then
things
become
tricky,
because
in
that
case
things
are
actually
running
live
and
there
are
different
types
of
policies.
Enforce
that,
for
example,
day
time
based
policies,
date
based
policies,
regulations
for
day
and
time
type
of
policies,
maybe
organization
has
a
policy
saying
that
no
one
is
allowed
to
push
any
new
change
to
production
friday
afternoon,
because
everyone
is
almost
into
their
weekends
and
no
one
really
wants
to
wants
things
to.
A
As
a
developer,
you
may
have
developed
a
great
new
feature
and
you
want
that
feature
to
be
available
all
around
the
world,
but
maybe
as
a
developer.
You
are
not
very
into
different
laws
and
regulations
that
govern
this
type
of
service
all
around
the
world.
You
may
need
to
consult
the
legal
department
or
you
may.
Your
change
may
be
blocked
from
rolling
out
to
you,
for
example,
because
of
gdpr,
and
your
change
may
be
possible
to
be
rolled
out
to
america's
because
of
different
reasons.
So
again.
A
They
they
are
kind
of.
They
belong
to
different
domains
like
one
set
of
these
checks
could
look
like
they
belong
to
development
and
other
type
of
regulation
policies
could
look
like
they
belong
to
a
more
marketing
or
legal
domain,
but
in
the
end,
everyone
must
be
part
of
this.
Entire
contest
use
delivery,
pipeline
or
software
flow
from
development
to
production,
and
they
should
be
able
to
impact
how
these
policies
are
developed,
created
and
enforced,
and
that
can
be
achieved
by
policy
deliverance
content
story.
A
Again
we
have
the
same
pipeline
here,
but
this
time,
instead
of
individual
developers
dealing
with
or
teams
of
developers
dealing
with
these
policies,
the
policies
could
be
developed,
maintained
and
enforced.
Collaboratively
and
post
framework
helps
in
this
case,
because
if
everyone
uses
a
certain
policy
framework
within
an
organization,
everyone
can
contribute.
Obviously,
some
people
may
not
be
comfortable
working
with
specific
framework,
but
at
least
they
can
make
their.
A
Okay
policy
during
context,
delivery
helps
organizations
to
enforce
policies,
but
what
about
challenges?
Obviously,
like
anything
else,
there
are
challenges
of
because
they're
unconscious
that
way
as
well
and
on
the
one
hand,
some
of
those
challenges
or
soft
or
more
organization
like
chances
are
on
the
other.
We
have
technology
specific
challenges
on
an
organizational
type
of
challenges.
Culture
collaborative
culture
is
important
in
order
to
be
able
to
apply
positive
and
continuous
theory,
because
if
the
organization
is
not
collaborating
on
such
critical
things,
it
is
nearly
impossible
to
achieve
no
covering
broader
scope
of
issues.
A
The
other
thing
is
shared
understanding
in
some
cases.
Yes,
developers
know
why
we
have
those
checks
within
our
pipelines,
but
in
other
cases
developers
may
not
be
aware
of
certain
laws
and
regulations,
and
it
is
important
the
developers
are
taught
about
those
things
as
well,
so
they
gain
some
business
understanding
and
see
what
they
do
and
how
what
they
do
impacts
the
business.
The
term
energy,
it
is
important
for
us
as
humans
to
communicate
with
each
other.
It's
important
every
time,
energy
to
achieve
that
best
practice
is
another
aspect.
A
There
are
lots
of
organizations
here
who
successfully
applied
policy
driven
content
to
the
way
and
organizations
should
look
for
best
practice
and
use
on
top
of
those
things
rather
than
coming
things
from
scratch
and
open
source
is
a
great
place
for
finding
such
best
practices.
Focus
organizations
must
put
focus
on
governance
and
policy
during
countries
there.
In
order
for
this
to
be
successful
when
it
comes
technology
aspects,
one
of
the
issues
within
positive
and
conscious
therapy
is
interoperability.
A
There
is
no
standard
with
the
contents
delivery
domain
and
interacting
with
policy
frameworks
is
very
difficult
because
which
content
is
very
technology
you
are
going
to
use
and
which
post
framework
you
are
going
to
use.
Do
they
work
with
each
other?
Well,
are
they
integrated
and
because
of
these
questions,
because
of
these
channels,
this
interoperability
is
key,
and
this
is
one
of
the
things
we
are
working
on
addressing
within
condensed
data
foundation.
Adaptability
is
another
critical
challenge.
It
is
important
that
technologies
are
adaptable
based
on
the
organization's
needs
voice.
A
Development
life
cycle
is
another
important
aspect
like
poison
policy.
S
code
is
something
that
different
projects
or
organizations
are
actually
working
with.
This
could
be
adopted
as
well
to
ensure
policies
developed
and
life
cycle
managed
properly
and
final
third-party
systems
like
you
have
pipeline
technologies,
you
have
post
frameworks,
and
you
may
have
third
party
system
that
may
need
to
interact
with
pipeline
technologies
and
voice
frameworks
as
well,
bringing
us
back
to
interoperability
and
having
some
standards
within
domain.
A
So
what
are
we
doing
to
address
these
challenges?
Conditional
foundation
is
a
place
which
provides
home
for
various
contents
database
technologies
such
as
jenkins,
spinker,
tecton
and
so
on,
and
it
also
provides
home
for
various
special
test
groups
such
as
special
telescope,
interoperability,
specialized
group,
best
practices,
special
interest
group
events,
as
well
as
these
special
test
groups.
It
also
provides
home
for
end
users,
so
you
can
come
and
talk
about
your
use
case
and
challenges
and
work
with
other
students
collaboratively
so
continuously
foundation.
A
Is
there
to
get
these
conversations
happening?
Is
there
to
enable
cross-pollination
and
collaboration
to
address
various
challenges
and
policy
is
one
of
them.
So
if
we
put
projects
maintainers
organizations
and
users
together
with
the
contents
of
their
technologies
and
if
we
bring
contributions
from
policy
type
of
projects,
we
can
address
these
challenges
together.
A
A
So
I'll
wait
for
a
question.
Maybe
I
can
quickly
ask
a
question
myself
like
what
was
the
point
of
this
talk?
Maybe
I
think
the
policy
topic
is
pretty
critical
for
all
types
of
organizations
that
are
developing
software
and
sending
software-based
services
and,
like
many
other
things
in
open
source
communities.
A
I
think
one
of
the
ways
to
achieve
whether
it's
without
sacrificing
governance
or
without
neglecting
rules,
laws
and
regulations
is
to
enable
ways
to
develop,
maintain
and
you
know,
enforce
policies
in
collaborative
manner
and
within
countries
there
foundation.
That
is
one
of
the
things
we
have
been
talking
about,
how
we
can
make
things
easier
for
organizations
to
adapt.
A
How
can
and
we
enable
different
types
of
teams
within
an
organization
to
collaborate
and
contribute
to
policy
enforcement
within
their
organizations.
So
I,
as
I
suggested,
please
check
the
links
on
the
slide.
Slash
should
be
available
on
session
link
and
join
our
meetings
where
we
are
hearing
these
discussions,
and
I
want
to
thank
everyone
for
joining
the
session
and
see
you
next
time
have
a
great
day
everyone
and
have
a
great
rest
of
silicon.