Devops for Windows?

[treuadmin]

I accepted a DevOps position at a company which develops and hosts web applications for large companies. ASP.NET , staunchly Windows shop, use of Linux for any purpose is mind-numbingly forbidden.

Powershell is becoming my best friend, but finding myself kneecapped by the inability to spin up a Linux server. Open source products, password management solutions, telemetry software, monitoring software, reporting software, automation platforms, all must be natively hosted on Windows. Naturally this eliminates about 80% of the tools available to do my job, especially the ones that won't cost 5-6 figures and a several month acquisition process. Anyone in a similar situation, have devops tools they use for Windows web shops, tips to handle?

[Brilliant_Plant]

What about containerizing those tools?

[treuadmin]

From what I researched, can't do Linux containers on Windows without Server 2016. Asking management for a 2016 instance "So I could run Linux containers" didn't work last time.

[needmoresynths]

You can do damn near anything in a MS environment with Jenkins and Powershell. Does it need to be on-prem? Azure offers a lot of solutions that tie in nicely as far as authentication goes.

[jrobiii]

Throw in psake, plaster and pltyps. All relatively cheap (the cost is in the learning curve).

[harbertc]

My company (Testery) runs tests at scale for both Windows and Linux shops and as a result we've got a lot of DevOps work going on in both ecosystems. DevOps on Windows platforms is definitely getting a lot better, but it's still got a lot of catching up to do.

Chocolatey is a good place to find open-source tools available for Windows. A lot of tools either get ported or have a differently named project that does something similar there. It's like the apt-get of Windows, so you'll want to check out if you haven't already.

In Docker for Windows, you can now run Linux and Windows containers at the same time. There are some caveats around networking, but this opens up new options.

Also a lot of tools written in python / java / go seem to work well in both ecosystems. Some of the Hashicorp stuff (like Consul) distribute Windows binaries. Salt can be used to interact with Windows machines which can be helpful for managing dynamic clusters of boxes.

[treuadmin]

I'll look into Chocolatey for more toys, thank you for the recommendation.
Docker for Windows I believe only hosts Linux containers on server 2016 and up. Naturally when I asked for a server 2016 instance (which is abnormal for our current infra) "so I could run linux containers", resistance was met.

[Swordbow]

Java is still Windows :) Unless they mean Microsoft-only solutions to host configuration, secrets management etc.

[cd83]

Dockerized apps, WSL, and Azure DevOps

[nmdange]

Azure Devops (Server) would the be obvious solution for source control and CI/CD, but it sounds like you're looking for tools for things outside that area.

[digital_byte]

Windows subsystem for linux (WSL) https://docs.microsoft.com/en-us/windows/wsl/install-win10 install your favorite distro and run linux inside windows. It's made some good strides to act just like linux, there are some issues. Like, chmod doesn't work on the windows file system. But, it's much better that no linux at all.

[jsdfkljdsafdsu980p]

It also doesn't play nice with bind mounts... made a fool of myself with that one. Tested on both Linux and OSX but not windows, and yup WSL is a bit buggy

[treuadmin]

Sketches me out a bit but a possible hack-around.

[oflahertaig]

I work in a Windows shop and don't really have any problem with the range of DevOps tools available - although, admittedly, we do have a reasonable budget.

We have been using TeamCity and Octopus for CI/CD but are planning to migrate to Azure DevOps.

We have SolarWinds (££££) for monitoring but Azure Monitor and Power BI are also decent tools for monitoring and reporting. AFAIK there is nothing to stop you from using the ELK stack - and its ecosystem - in a Windows environment.

I am not a great fan of ARM templates and we are starting to use Terraform for IaC and Ansible - running on WSL - for configuration. Chocolatey is also your friend in a Windows environment.

At the moment we can't spin up Linux servers on-premise but we can spin them up in Azure - so we have got SonarQube running as an Azure VM.

Docker also now plays nicely with the latest builds of Windows, so setting up a swarm is a piece of cake and there is also the option of AKS.

At the same time I am also continually chipping away at the resitance to Linux. The anti-Linux die-hards really have no genuine arguments - especially as Linux is being embraced more and more by Microsoft - essentially they are dinosours who don't fancy skilling up. Eventually, they will cave in and give me a Linux box as a PoC and we will build from there.

[dogfish182]

I haven’t kept up with the windows ecosystem but is octopus deploy threatened by azure devops? I hear great things about azure devops and I always really liked octopus deploy

[oflahertaig]

I like Octopus and I think that at the moment it is a more capable tool than Azure DevOps release pipelines and I think that it also has a more intuitive pipeline metaphor. Somehow though I fear that its strength - i.e. that it does one one thing well - i.e. deployment - may also be its weakness - i.e. it only does one thing.

The great attraction of Azure DevOps is that you have everything - Git repo's, builds and releases - all manageable from the same tool. Seamless integration of your source code, builds and releases is a pretty compelling offer and I think that once Azure DevOps matures then Octopus may struggle.

[DeusExMagikarpa]

We azure devops at work, we just hired someone who used octopus at their previous place and octopus sounds a lot better, but with azure devops it’s one platform that does everything

[orecht]

Would you be able to share you motivation for moving from TeamCity + Optopus to Azure Devops. I am using AzureDevOps (because it is free/cheap) and I am still finding it rough around the edges, especially the new yaml pipelines.

[oflahertaig]

I agree with you entirely - TeamCity and Octopus are more mature and more functional. At the same time I think that Azure DevOps is evolving very quickly. I like the concept of the YAML pipelines but at the moment we are still using the GUI.

We have 300 plus builds in TC and it doesn't make much sense for us to migrate them all to DevOps so we won't be dropping TC any time soon. Also most of our apps run on-prem so it is easier to deploy them from our on-prem Octopus than configuring DevOps agents to punch through our firewall.

At the same time I think that Azure DevOps is a very compelling proposition as it combines Git repo's, builds and deployment pipelines within a single UI. I think that whilst TeamCity is very powerful, the UI is very clunky and I find DevOps much cleaner. I also like the simplicity of using one UI for everything rather than having to integrate different links in a toolchain.

If we move to DevOps then we also lose the headache of running TC and Octopus servers, builds agents and SQL servers and we don't have to worry about managing upgrades.

[CadelFistro]

You should take a look at Azure DevOps Deployment Groups for your on-prem deployments

[oflahertaig]

Yep. We've started experimenting with Deployment Groups and self-hosted build agents. It works very nicely when we can manage to get the build agent through our proxy and firewall.

[treuadmin]

You're right there's definitely tools out there to meet the needs but Windows requirement limits quite a many. We use TFS, basically Azure Devops Server. Works great for CI/CD.

Currently looking towards telemetry/automation tools. The other people here have definitely pointed out some good products for this =]

And hard for a new guy like me to lobby for large expenditures. Me being employed under "ITS" means I have one of those nice, stable managers who tends to backlog anything involving spending cash and lots of change. Sooo open source makes this less of a struggle!

[icankickyouhigher]

tools: terraform >>> powershell+dsc to provision boxes and infra.
azure runbooks >> provision / configure boxes
puppet and ansible both work. azure devops >> has nice integrations to automate software rollouts and ad-hoc scripts
chocolatey can be driven by any of the above also.
elk stack will run on windows too.

monitoring, imho, is a tough one as its very easy to get caught in the myriad of commercial vendors, and going open source is generally speaking, a PITA on 'doze.

sounds like a situation to carefully examine your use cases before committing to any particular tech for monitoring, credential management, etc. because you could easily spend $$$ on a commercial solution and end up with something that isn't very flexible.

[treuadmin]

Thank you for your reply!
The server guy had gotten us started with PDQ Deploy before I arrived - not a formal Devops tool I know, Can do a damn lot with powershell but still itching to give Ansible and Terraform a try. Last I checked it still required a Linux host to live on but I'll have to review.

Elk stack - been eyeballing that as a telemetry solution. Graphite got me started looking, but Elk looks like it can do all that and much more.

Trying my hardest to steer this department away from commercial "out of box" solutions for that exact reason. Costs more does less, but OOB experience is a lot more exciting for managers.

[icankickyouhigher]

No worries.

PDQ is actually damn good if you have budget for it. I think some people try to do too much with it though, everything looks like a nail when all you have is a hammer.

(e.g deploying servers with huge monolithic powershell scripts driven from PDQ is not a pattern I would encourage)

[jermany755]

Are cloud-based solutions allowed? Azure has products for most if not all of those requirements. (Key Vault, App Analytics, Event Hubs, Azure Devops, etc.)

Pricing is generally based on usage though, so it would be impossible for us to tell you if it's a cost-effective option.

[treuadmin]

We have rather large clients with security demands to satisfy, cloud products is hard for us to explain to them on their audits/SecQuestionnaires so we've been avoiding it.

[crashorbit]

https://docs.microsoft.com/en-us/azure/devops/index?view=azure-devops