Solution Brief. Enterprise Git Adoption with CollabNet TeamForge

Transcription

1 Enterprise Git Adoption with CollabNet TeamForge

2 2 Enterprise Git Adoption with CollabNet TeamForge The choice of a modern source control management (SCM) technology for a world class development organization is a critical business decision. It affects the long term ability of organizations to succeed in a highly competitive business climate, enabling them to deliver highquality software quickly and consistently. Leading enterprise development organizations worldwide increasingly believe that Git, the world s leading distributed version control system (DVCS), represents an opportunity for speeding up the development process. However, the decision of your enterprise organization to adopt Git as a corporate SCM standard is not merely a technical concern. It also has a major impact on the business performance of your organization. In order to effectively address the challenges of Git adoption, organizations should set the bar high by handling Git as a strategic investment and as an intelligent, active infrastructure component that improves overall business performance. While many Git solutions claim preparedness for enterprise ready Git deployment, these claims should be carefully evaluated to ensure that the chosen Git implementation does not create long term problems. There are a few fundamental requirements that your strategy must address to make Git a viable SCM choice for a modern enterprise: y Security and standards compliance y Scalability of Git infrastructure y Support and enablement of best practices y Manageability y Governance Understanding the above key requirements as well as their impact on your business is very important. It will help you to choose an implementation of Git that is ready for enterprisescale deployment and will enable your development team to achieve business agility without compromising on vital aspects of modern enterprise. 2

3 3 CHALLENGES OF ENTERPRISE GIT ADOPTION Insufficient native access and audit controls in Git Git was designed for the needs of open source projects, specifically Linux. It can reliably track who authored a change and who can add changes to a repository. While sufficient for most open source projects, this design consideration left out many of the inherent security controls of centralized version control tools, such as Subversion (SVN), which is currently used by the enterprise. This realization often comes as a shock to security and compliance officers in large companies once they discover the risks associated with migration from centralized legacy SCM to Git. Loss of a true canonical repository Limiting write access at the repository level creates an inherent motivation for developers to create more copies of the repositories (the concept known as forking ). When users with read only access to a repository need to make changes to the code, they have to mirror or fork the existing repository to a new one. This not only explodes the disk space requirements and associated infrastructure costs but also causes intellectual property protection concerns. Once mirrored, each clone of the original repository has new access controls outside the purview of the canonical repository. This opens unexpected opportunities for intellectual property leakage through many different vectors that were never considered. Heterogeneity of modern enterprise development infrastructure As long as hybrid SCM is still the norm, there is a need to manage Git and SVN simultaneously not only within the enterprise but also at the individual project level. However, most Git solutions in the market today ignore this need completely and do not provide any management or governance for anything except Git itself. As a result, organizations often experience difficulties articulating their SVN/Git infrastructure coexistence strategy or face an all or nothing migration dilemma. Avoiding disruption of existing business processes Large companies are very sensitive to deregulation permitted by Git s powerful branching capabilities as it potentially may cause a lot of changes in the company s existing software delivery lifecycle management processes, causing disruption to automated integration, build, and delivery infrastructure investments. These concerns are legitimate, and stakeholders across the organizations need to have a means to preserve existing investments and replicating the company s current business processes. 3

4 4 Need to maintain highly distributed, federated repositories While the use of a central master repository (also referred to as a golden, canonical, or blessed repository) is easier to manage, Git does not mandate this approach. For the enterprise, however, federated deployments pose a serious risk of intellectual property or data loss. With dozens or hundreds of servers, it becomes challenging to locate code or enforce strategies for backup, disaster recovery, or failover. ENTERPRISE GIT SOLUTION: TEAMFORGE CollabNet TeamForge (CTF) is the industry s most complete open application lifecycle management (ALM) platform that enables and streamlines enterprise adoption of the most popular open source development tools. With TeamForge, enterprise development organizations can accelerate application development and delivery by connecting teams via collaboration architecture, implement an open ALM platform supporting tools of their choice, and benefit from flexible process templates that can be continuously improved and reused, all with complete end to end traceability and reporting. TeamForge enables companies to gain strategic value from agile, continuous delivery, and DevOps initiatives and to achieve business agility (BA). 4

5 5 TeamForge embeds Gerrit, a powerful Java based open source Git server and a web based code review tool, and enhances it by providing a powerful management framework for Git. Gerrit was initially developed by Google to host Android open source platform (AOSP) codebase. Since its inception, Gerrit has been adopted by many open source communities and enterprises worldwide and is currently the most widely used code review and permissions management framework for Git. TeamForge makes Gerrit (Git) ready for large scale deployments and easy adoption by the enterprise. ROBUST DISTRIBUTED REPOSITORY MANAGEMENT With TeamForge, there is always a master repository the one truth for development teams. Centralized management ensures the integrity and security of code throughout the development and delivery process. Using TeamForge to secure and manage Git repositories lets enterprises maintain all the flexibility that Git provides, without losing out on governance and intellectual property (IP) protection. The fact that the administration approaches in Git and SVN are radically different increases the value of a solid, unified administration model that makes the coexistence of Git and SVN possible in diverse environments without skyrocketing the operational costs. A scalable, hybrid friendly, economical administration model must also provide support for hundreds of simultaneous projects across thousands of Git and SVN repositories. ENSURING SECURITY AND COMPLIANCE Scalable role-based access control (RBAC) TeamForge roles govern access to all the tools used in the development process, including Git/ Gerrit and SVN. Role based access to Git can be granted across all repositories within TeamForge, all repositories hosted on a server, all repositories within a project hierarchy, all repositories within a project, all branches within a repository, or it can be confined to a specific branch. This comprehensive control extends from all users inside your enterprise to guests and even anonymous users. You can quickly and easily grant site level access to your architects across all repositories or allow guests to clone a single shared repository. Git history protection Enterprise software organizations need to prevent code, branches, and repositories from being accidentally or purposely deleted by using a powerful Git history rewrite command (push f). History rewrite may cause a situation when all the previous changes would no longer show up in Git s change history. Some Git solutions on the market offer features for disabling the history rewrite command altogether. However, native history rewrite capability is important and inherent in Git design, so simply blocking it is not a good approach even when history rewrite is disabled, users can still remove branches in Git without keeping any history. Rather than disabling the powerful rewrite history feature, TeamForge offers a unique capability to retain control over it. With TeamForge, companies can use history rewrite for the right reasons, while still potentially maintaining the appropriate level of auditability and compliance, which is essential for any enterprise. 5

6 6 End to end ALM access management and provisioning Organizations using both Git and SVN in parallel can use the same TeamForge roles and permissions for setting up SVN and Git projects. With TeamForge, all the applications integrated into the ALM process follow the same access model and are centrally managed in one convenient place, making it much easier to ensure that users access is provisioned and de provisioned in a timely fashion and in accordance to their roles in the projects. Fine grained permissions management TeamForge s fine grained permissions are based on Gerrit s industry leading permissions management framework for Git. Since Gerrit was designed and optimized specifically for Git, it not only allows you to control read and write permissions, but it also gives you more control over individual branch permissions. Gerrit allows you to define up to 28 different permissions categories at the branch level. TeamForge adds value to the powerful, yet complex, Gerrit permission model by clearly and consistently mapping Git permissions to TeamForge roles. With TeamForge, project administrators no longer have to be exposed to the complexity of Gerrit s permission model. TeamForge offers predefined repository categories, leaving an opportunity for power users to finetune Gerrit access rights if required. Team Forge s powerful RBAC follows the least privilege model and is used to manage access down to the individual branch level, including both read and write permissions. You can enforce who can create new branches, use push f, push plain tags/annotated/ signed tags, forge author/committer, merge commits, and more. Tamper proof auditing To avoid gaps in audit trails or loss of data integrity, TeamForge permanently registers and archives every code change and command, creating a complete, detailed audit trail. 6

7 7 SCALING GIT Load balancing and high availability Enterprise ready Git solutions need to handle thousands of users, thousands of repositories, and hundreds of continuous integration (CI) servers that work with them. No solution can handle the entire load of human and CI users polling for updates on a single server. TeamForge can distribute load across multiple Git servers in a single, connected, and centrally managed and governed deployment without having to stage isolated, siloed servers with different user accounts, projects, and permission setups. Replicating Git repositories The distributed nature of Git does not remove the need for managed replication. Replication is not only useful for backup and load balancing purposes it can also be used to speed up access to repositories in case of geographically distributed teams. TeamForge offers advanced replication features, including fine tuning configuration options that control what to replicate, how to map repository names, when to trigger sync programmatically, and more. Moreover, TeamForge synchronizes access rights across all replicated servers so that the same access control and governance rules apply, including the ability to remove a repository from a replica. CODE QUALITY AND CODE REVIEW Integrated code reviews Code reviews often become bottlenecks in the release pipeline. TeamForge s integration with Gerrit automates the code review process, establishing and enforcing quality gates in tandem with Git. Rather than only managing source versioning and change tracking, Gerrit with CollabNet s quality 7

8 8 gates and special CI automation features transforms your enterprise s SCM into an active, intelligent component used to codify and constantly refine your best development practices. With TeamForge and Gerrit, developers can always stay in their favorite environment for every step of the code review process. This provides both advanced review workflows and branch based permissions. Gerrit is built on top of the Git version control system, providing access control and permissions management with various granularities (read, write, and delete permission on branches). It also deeply integrates with CI tools, such as Jenkins, the Java based open source continuous integration tool with over 300 plugins. Quality gates for Gerrit Every project has different policies defining when code can be pushed into production. The quality gates ensure that all conditions regarding code quality and compliance are met before a commit can be merged into your master branch and trigger a pipeline that will eventually promote it into production. CollabNet s quality gate wizard for Gerrit is a feature that comes with a collection of predefined policies. It lets users graphically design their own unique quality gates. If you know how to define filter rules, you will be able to setup the code quality wizard just as easily. Four eye peer review, legal approvals of copyright file changes, senior staff signoff, feature acceptance criteria regardless of what your code quality gates may look like, we can show you how to enforce them without having to write a single line of code. 8

9 9 Support for CI tools Increasingly, agile teams aim for CI, meaning the codebase is built and run after every change. TeamForge with Gerrit integrates with industry leading CI tools (such as Jenkins). When a developer submits patches for review, Jenkins automatically compiles the project with the supplied patch for code review, runs the test suites, and then reports the status of code compilation and tests to Gerrit. WHY CHOOSE TEAMFORGE? Full control over permissions management TeamForge supports access controls at multiple levels: site, server, project hierarchy, project/product, repository, and branch. Other commercial Git implementations only offer protection at project/ product and repository levels. The permissions can be clearly mapped to TeamForge roles, making it possible to enforce the most rigorous access policy, according to your specific enterprise need. At the same time, it simplifies manageability of the environment by removing the need to implement the same roles at every level. 9

10 10 Least privilege access model TeamForge with Gerrit is the only solution in the market that offers a user access model based on the least privilege access principle, which has become a de facto standard for enterprise deployments where security and compliance are significant concerns. Framework of choice for mobile development Gerrit is required to develop code for the Android OS. TeamForge provides a powerful management framework around Gerrit, making it ready for the Android development of an enterprise. Built in replication support for Git Your enterprise has to maintain rigorous backup, load balancing, and high availability standards for your infrastructure to support business continuity. The embedded Gerrit offers extensive out of thebox replication support. 10

11 ABOUT COLLABNET CollabNet helps enterprises and government organizations develop and deliver high-quality software at speed. CollabNet is winner of the 2016 Best of Interop Award and the Best in Show winner in the ALM and Development Tools category of the SD Times 100 for 13 consecutive years, recognizing TeamForge for its innovation. Also a gold winner of the 2016 Golden Bridge Awards, CollabNet offers innovative solutions, provides consulting and Agile training services, and proudly supports more than 10,000 customers with 6 million users in 100 countries. For more information, please visit COLLABNET, INC Shoreline Court, Suite 300 South San Francisco, CA TEL: FAX: info@collab.net WEB: blogs.collab.net twitter.com/collabnet linkedin.com/company/collabnet-inc facebook.com/collabnethq google.com/+opencollabnet CollabNet, Inc. All rights reserved. CollabNet is a registered trademark. The names of other companies and products herein are trademarks or registered trademarks of their respective owners. SB-TFSCM