{"id":383048,"date":"2024-06-29T04:39:28","date_gmt":"2024-06-29T04:39:28","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=383048"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T04:39:28","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=383048","title":{"rendered":"Reverse DevOps, an invitation to project \u00abBell\u00bb<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n
<\/figcaption><\/figure>\n

Typical DevOps handles code deploys in a single direction: from Dev to PROD, from lower environments to higher environments, and for this there are many well known solutions like Jenkins, Terraform, Octopus. But in the opposite direction the situation is not so good.<\/p>\n

Yes, in many companies there are home-grown processes to copy databases from higher environments to the lower ones (with hiding\/removing sensitive data) to reproduce problems, found on PROD. However, in complex scenarios an access to PROD is needed to find the root cause. Developers need at least logs. And in the Enterprise world it’s all depend on the level of paranoya<\/s> how sensitie the information is.<\/p>\n

In the worst-case developers have no access to PROD at all (even temporary and audited), and they are told rumors (lol) about what happens there. As an option, there might be a Teams of Webex meeting with 20+ participants with screen sharing, and a developer has at least a chance to tell where to click. Needless to say, such meetings are very ineffective.<\/p>\n

With a better luck developers can obtain a temporary access to production using different tools. One example could be CA PAM<\/a>, but such solutions (with any type of Remove Desktop Access) have significant drawbacks and they typically provide all-or-nothing access.Potentially, they can ruin the production while typically to investigate a problem they need just read-only access, and there is no such thing as «read-only access» in Remote Desktop. Even for databases, where there is an explicit read-only role, there is a problem:<\/p>\n

<\/figcaption><\/figure>\n

Because of what you see in a second like, when working with production you have copy\/paste functionality disabled in Citrix or RDP session, and this is making your work a real nightmare.For example, if you have a useful query which is used to show you some technical data, you can’t copy\/paste it into production, because copy\/paste is disabled completely.<\/p>\n

The mission of the project is to create a safe access method to the higher environments, combining easy friendly interface and interactivity with the full audit of all operations and controlled manner of what users can do and what they can’t.<\/p>\n

The project is called Bell -Action at a distance<\/a>, and a bearded guy on the logo is John Steward Bell,<\/a> you know him if you had ever heard about the Quantum Entanglement.<\/p>\n

<\/figcaption><\/figure>\n

What is already done<\/h2>\n

The project is fully functional and is used in a company where I currently employed. This is a project site is here<\/a> I will not repeat what you can find there, I just wanted to highlight few moments.<\/p>\n

Project is open source. Powershell is used to develop modules, and server itself works on Windows server, even there are no hard dependencies on Windows. Even Powershell can be used on *nix, but any other *nix scripting language can be used as well. But we expect a help form community to port it to *nix smoothly.<\/p>\n

The development is very easy and fun<\/a> — like making something from LEGO. Like in Jenkins, initially server is ‘blank’ — in Jenkins you start from creating yout own jobs, in Bell you write you own modules, or download the existing modules and adjust them to specifics of your environment. The following modules are ready:<\/p>\n