FINOS OSSF NY 2020 - DevOps Mutualization SIG Meeting Report

[robbkeayes]

Date

Wednesday 10 NOV 2021

Day 2 of the Open Source Strategy Forum New World Stages, 340 West 50th St, NY

https://events.linuxfoundation.org/open-source-strategy-forum/

Untracked attendees

Name	Firm	Comment

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• [x] Convene, welcome
• [x] Review of Nov 9th OSSF Day 1 agenda and SIG members meeting
• [x] Lean Coffee discussion of SIG related topics
• [x] Invitation to attendees to join the SIG
• [x] Adjourn

Decisions Made

None

Action Items

• [ ] Contact new members

WebEx info

None, this meeting was held in person

Dial-in

None, this meeting was held in person

Github Repo: https://github.com/finos/devops-mutualization/

Mailing List: Email devops-mutualization+subscribe@finos.org to subscribe to our mailing list

[robbkeayes]

Review of Nov 9th OSSF Day 1 agenda and SIG members meeting

Robb Keayes provided a brief summary of the highlights of the OSSF Day (Nov 9th), relevant to the SIG, for those who could not attend

• Keynote - New FINOS members welcomed, discussion of Linux Foundation membership
• Talks - many topic of interest to the SIG
  • DataBricks joins FINOS, provide Lakehouse product
  • TuxCare - joins FINOS, provides live security patching product
  • Symphony Open Source announces new 'BDK' Bot Framework
  • Regulatory - discussion of FINOS open regulation work, aim to standardize, reduce work duplicated by member firms, with aim to attract regulators to contribute directly to the standards, rather than engaging each back separately
  • HyperLedger - discussion of Blockchain at JPM, with Christine Moy (JPM) and Joseph Lubin (co-founder of Ethereum)
• Legend - Data Modelling tool from GS
• Morphir - Logic Modelling tool from MS, newly contributed
• Open Source Readiness - accelerator for OSS projects

[robbkeayes]

Lean Coffee

We held a lean coffee - https://agilecoffee.com/leancoffee/

The aim of the lean coffee format is to engage members to propose topics of most interest to the SIG, and to discuss them freely, with no agenda, and no one leading the discussion. This usually results in a lively discussion with many ideas and opinions contributed, that often goes in unexpected and interesting directions. It results in participants feeling engaged, heard and inspired. And they are a lot of fun, with a lot of new learning.

The format we used

• solicitation of topics
• very brief review of each topic
• voting and prioritization of topics
• discussion of most popular topics in turn

Topics Discussed

"Reference Architecture for DevOps Audit/Compliance" and "What does good (DevOps) look like?"

• Discussion around what a "good" DevOps toolchain that can automate Audit and Compliance checks
• A "DevXOps" approach would work well, along the lines of DevSecOps, which standardizes Security checks.
• Automated Audit and Compliance checks can act as gates, to ensure each change passes the checks, and is in compliance without each change needing to be specifically (often manually) tested.
• It was noted that automation of these steps can also enable "fast tracking" of changes, due to the reduced risk of the change, which can allow changes to be quickly or automatically passed through the CAB
• The group agreed that the SIG proposing a Reference Architecture would be useful to most member firms

"Tools Integration" and "(Tools) Selection, Support and EOL"

• How to choose an appropriate toolchain (set of tools), and preferred techniques for integrating them
• Each firm tends to have it's own toolchain, though there are some "best of breed" tools used widely
• The reference architecture discussed previous could be helpful in framing the problem
• It was noted that an open integration standard might be helpful here as well, something the SIG may wish to look into

"How to change culture?"

• The age old question of how to move Waterfall/ITIL based thinking to adopt Agile/DevOps principles
• It was agreed that is a hard problem, that challenges most firms' DevOps initiatives
• Success often requires grassroots (bottom up) enthusiasm, and management (top down) support, with real funding and resourcing. Asking teams to adopt DevOps "in their spare time" rarely succeeds at large firms.
• Evangelization, Coaching and Communities of Practice can be very helpful here, adopting the "train the trainers" approach required to grow the culture organically
• Dojo's can also be a good option - See https://itrevolution.com/book/getting-started-with-dojos/

Attendees agreed that the Lean Coffee format worked well, and resulted in a lively and enjoyable conversation, and that we may want to try it again in the future.

Finally, the SIG discussed net steps for the SIG. It was agreed that tackling the Reference Architecture proposal would be a good starting point, and would allow the SIG to produce something tangible, for contributing to the wider community.