Introduction There are many paths we can take in software engineering, but the most common one is to start as a developer. I started as a software developer for a small Costa Rican startup, then moved to a medium-sized US company in Costa Rica, where I had the opportunity to learn DevOps. As of right now, I am in the process of moving to a different country because of a job opportunity. ...
Introduction There’s always that situation where we need to use the same elements, or code, in several places and we want to avoid copying and pasting those elements everywhere because we like to keep it DRY (Don’t Repeat Yourself). That’s where pipeline templates come in handy when facing this dilemma while working with Azure Pipelines. What are Pipeline Templates? Pipeline templates help us define reusable blocks that can be used across as many pipelines as we need, making maintenance easier and less prone to errors. ...
Introduction Shifting-left security is applying security validations to our software development process as soon as possible. Let’s say we have a development process with different steps that run from left to right consecutively. Those steps are: writing the code, creating a build, releasing it to a QA environment, releasing it to a Stage environment, releasing it to the production environment to be consumed by the end-users, and constantly monitoring the app, and the process repeats indefinitely. That’s a common and simple development cycle. ...
Introduction Using Key Vault secrets to store sensitive data is essential to keep it safe. By using secrets we can control who has access to see and manipulate the data stored in them, making sure only the correct people have the appropriate level of access. It is very common to have a pipeline that needs a key, a password, a connection string, or any other type of data that can be considered sensitive and we don’t want anyone seeing or manipulating its value. For these scenarios, most of the time the best solution is to use Key Vault secrets. ...
Introduction Static code analysis is very useful to detect security issues and bad code practices in our projects. SonarCloud is a great static code analysis tool that can be easily integrated into Azure DevOps. It can be used for free in public Azure DevOps projects. Without further ado, let’s get started. Assuming we already have an Azure DevOps organization and a SonarCloud account, the first step is to associate our Azure DevOps organization with SonarCloud. For this, we need to create a Personal Access Token (PAT) in Azure DevOps. ...
Introduction If you are reading this post, you probably are in a situation where you have to use Terraform to manage your cloud infrastructure. But there are existing resources, not created using Terraform, that need to be managed by it. I will show you how to sync your Terraform state with existing resources in Azure specifically. However, the steps to achieve this are virtually the same for other cloud providers. ...
Introduction Using environment variables with Terraform is very easy, but if you are a beginner at it then it can be a little bit tricky. Using them as input variables is fairly simple and the documentation, blogs, and other sources I found online were pretty useful. However, implementing environment variables that the Terraform providers have predefined for their configurations is not explicitly detailed in the documentation. I’ll try to explain as simple as I possibly can for anyone to easily understand how to use them. ...
Introduction Containerized apps have been on everyone’s lips for a while now, and it’s no surprise, they can be very useful. This article will show you how to build and deploy your Dockerized app seamlessly into an Azure App Service. For this guide I have created a demo environment where the Dockerfile is already set up and ready to go, an Azure Container Registry (ACR) has been created (Basic SKU for this demo), I’ll use ACR; however, there are multiple options for container registries that can be used. And the project’s code is allocated in a private Azure DevOps repo. ...
Introduction Classic pipelines are set up using a UI and clicking around, moving through tabs, and choosing between the options the UI shows you. The same definition applies to release pipelines, the difference is that the former are used generally to build applications and the latter to deploy them. On the other hand, YAML pipelines are set up using code on, you guessed it, a YAML file. Azure DevOps has a task assistant that helps you find the tasks you need and add them to the YAML file. ...