Blog
Automating iOS App Development with CI/CD Pipelines with macOS Build Servers
As part of our series on building iOS apps, we will walk through configuring a build server for doing so. This build server can also be used for building macOS apps as well.
This write up is intended to not solve all your CI/CD issues for building apps for iOS, but more of a "bare bones" build server that will help you scale your DevSecOps pipelines for mobile.
To be up front about this, automating builds on macOS has a few pain points. In the pursuit of building a more secure OS, macOS can tend to be on the difficult side for build automation.
For instance, configuring a "headless" build server with FileVault enabled is impossible at this point. So, you cannot VNC into a server sitting in a server rack without doing so locally. Setting up an "auto login" via macOS with FileVault also will not work, because FileVault does not allow that. So, one must take these issues into account.
Without logging in, you cannot (in this instance of this build server) run the GitLab Runners.
So, options can be limited depending on what you are attempting to do. To work around this, you may want to have your macOS boot volume not encrypted and store all your data in an encrypted volume. This will enable the macOS build server to book and auto-login to enable jobs to run.
For GitLab, you need no ingress point to access the build server, only egress to ping your GitLab repo. So, one could drop this box in a private subnet that has some outbound egress and be somewhat comfortable with the security around it.
Automating a lot of these steps hasn't been easy, there are a lot of password and confirmation prompts that require a user to do something.
Cross Account DynamoDB Access
We at Monkton use DynamoDB a lot for storage. It is extremely fast and scalable. A lot of the work we do is in AWS GovCloud, so this post will be geared towards that, but easily portable to other regions. We spent some time digging around and being frustrated trying to get this to work and wanted to share lessons learned to avoid those headaches.
Defining the need
We are helping build a new set of services, part of our multi-account architecture is a centralized "Identity SaaS" service. While we have micro-services available in that account to read/write to the "Identity SaaS" service DynamoDB, we opted to read/write directly to it, for other trusted services and accounts. This was simply a performance choice on our end to speed things up. We wanted to avoid creating a HTTPS request, waiting for it to do its thing in DynamoDB, and return—when we could do it directly using the same logic.
Many considerations
Part of how to configure this is understanding where and what services we will be using. For this project, we are using Lambda and ECS Fargate to deploy backend services. For the purposes of this demo, we are looking at Fargate, but lessons apply to Lambda as well. Part of that is following "Best Practices" and deploying these services into VPCs with private subnets.
Automated Testing of iOS Apps in CI/CD Pipelines (Part One)
This is a multipart series we are putting together to walk through automation of DevSecOps for mobile solutions. We are going to focus on iOS, but much of this is applicable to Android as well. Our goal is to leverage GitLab as the CI/CD engine and other services like AWS Device Farm, SonarQube, and NowSecure for testing. Finally, the app should pre-stage by self publishing to Apple's App Store for TestFlight publishing.
For as many mobile solutions that exist out there, the write ups and documentation that exists to automate testing, specifically UI testing is substandard to say the least. This post will lay out some of the techniques we leverage to automate the testing of mobile apps (iOS specifically) to perform fully automated UI testing.
iOS Testing in AWS Device Farm
We leverage AWS Device Farm to implement testing—the capabilities of Device Farm are fantastic, the difficult bit is the practical application of documentation.
Again, everyone talks about automated testing, but who is actually doing it?
We'll dive into AWS Device Farm later.
ICYMI: How to Sell Your Digital Transformation Vision
Why do we need change? What is the problem we are solving, and who is it being solved for? What does change look and feel like to you? Clear and succinct communication is not only necessary for executive leaders, but also necessary for others to be champions for your vision. Read this blog from Monkton to learn more about how to sell your digital transformation vision.
Automatically configuring AWS GovCloud Accounts
This technical article will walk through a CloudFormation template that will create a Step Function that creates AWS GovCloud accounts with AWS Organizations and automatically links them. Our end goal is to simply submit a JSON package like this:
{
"email": "some-email@example.com",
"name": "The Account Name"
}
And generate the AWS Organization and link them. This is a rather manual process if you do it by hand.
This CloudFormation template provides two main components:
A configured S3 bucket and KMS key that enable child AWS Organizations to pull from the bucket
A Step Function that automatically creates and links AWS organizations
This script is intended for creating AWS GovCloud accounts, but can be modified for creating standard AWS accounts. Note, this will create the requisite commercial AWS accounts that GovCloud accounts are tied to.
We have included this notice because this CloudFormation template is deployed into the root AWS GovCloud account you own.
NGINX Auto Configure from S3
This technical article will break down how to automatically configure a custom build of NGINX (using Alpine Linux) that runs in Fargate.
Why? Well, we want to enable encrypted data in transit through the stack of the AWS Fargate solution we are deploying. Our entry point is an AWS Application Load Balancer accepting traffic on port 443 for TLS communication. We have an ACM certificate stored in our Account that we have referenced and use to configure that.
From there, we have a Task running in a Service/Cluster within Fargate. This task is a RESTful Web Service. Our desire is not to configure that task to process TLS itself, due to unnecessary changes to the Containers.
So, what we will do is leverage NGINX as a reverse proxy and use S3 to automatically configure NGINX on the fly as the Container is launched! We accomplish this by extending the NGINX Alpine Linux container, adding a script to download the configuration from S3 upon launch, and voila done.
Mobilizing for USDA Inspectors
Upon entering a grocery store, the general public is typically not pondering whether they feel protected by the safety, efficacy, and security of the food supply presented to them, but that is in fact what the FDA is responsible for. When it comes to meat, labels now inform us of how the animal was fed, the conditions they were raised in, and a myriad of other miscellaneous facts that manufacturers capitalize on in order to gain consumer loyalty. However, when dealing specifically with field-based meat inspectors, how data is generated is never a thought – not even an afterthought.
Having so many nuanced compliance regulations within agriculture, mobility means always knowing what is necessary to complete inspections. USDA inspectors are the prime example of hurry up and wait—whether it be improper paper documentation, waiting for a form sign off, or lag time in getting meat over the border because of regulatory laws, inspectors need mobile apps to simply know how to do their job. Mobile solutions provide clarity on when, where, and how meat inspections can occur safely and securely, while still getting the product to its end destination in a timely manner.
Mobilizing for Pilots
There are people who fly planes, and those who don’t. The non-pilot folk likely assume that any given pilot has the ability to simply show up for work, ready and able to fly on a moment’s notice. While that notion isn’t entirely false, the simplicity of tinkering with a few levers and checking the weather before takeoff is a made-up narrative generally regarded as false.
The truth of the matter is that an Air Force pilot quite literally steps into a time machine when she or he enters an aircraft. Imagine for a second you’re a pilot. You’ve got your clean and pressed flight suit on; possibly a new pair of aviator sunglasses to block out the harsh rays; the ascent up the airstairs toward the entrance of the aircraft has been made where the wind is blowing just right to, wait for it…blow away over 100 pounds of your paper-based aeronautical and flight regulation charts to the ground below. Not exactly the Top Gun moment you envisioned.
Mobilizing During Disaster
When disaster strikes, the most precious resource is time–time to assemble, act, and mobilize with skillful efficiency. Speed is imperative to improve everything from field reporting, data collection, and damage assessments. With weather and climate changes in constant fluctuation, organizations must be prepared to handle a diverse array of potential disasters. Fire drills are introduced in elementary school, but what about explosions, chemical spills, hurricanes, floods, and extreme weather–what’s the plan then?
It’s generous to assume that employers are even 50% equipped to handle catastrophic events like earthquakes, tornadoes, hurricanes, and even snow or ice storms. Most companies have disaster preparedness plans, but when disaster strikes who is going to remember to open the locked drawer with the stuffed filing cabinet full of outdated, paper-based manuals/posters/flip books/building diagrams etc. Trick question–no one!
As a result of paper-based inefficiencies, there is often a lack of resources and preparedness to understand or much less handle what to do when disaster strikes. Beyond taking steps to empower employees to be better prepared for how to respond to disasters, it is incumbent that organizations like FEMA and The Red Cross are readily equipped with the resources and technology to respond with agile authority.
Hazards behind healthcare
Everyday millions of people make appointments to see their doctor or nurse for miscellaneous reasons. Sometimes it may be an emergency and other times it may be a routine checkup, but how often do we consider what the scheduling and charting process looks like for them? Do they suffer from aches and pains due to the behind the scenes patient charting, prescription filling, emails, office tasks, etc.? In a word—YES.
Pre Covid-19, the shift towards online and app-based appointment booking was already happening, but now it is paramount as in-person staff is reduced and access is granted towards those regarded as essential. Many would argue they do not receive enough face to face time with their healthcare provider, and with staffing down that situation is not about to change. The question now becomes if improvements are being made toward the patient experience, why can't the same be true for those truly essential doctors and nurses? If we've said it once, we've said it 101 times—Getting data to the point of use, to either consume or generate is the power of secure mobility.
The Impact of UI: Employee Satisfaction
Modern enterprise understands both the business and economic advantage to happier employees. Where digitally defiant organizations may have placed all the focus on external growth, a bulletproof business strategy is one centered around secure mobility as a tool to increase employee satisfaction and productivity in an effort to achieve long-term goals.
The Impact of UI: Rapid Results
K-I-S-S, as in the clever acronym for “keep it simple stupid”, (not the classic rock band) is never more relevant than when it comes to mobile technology. Think of the user interface (UI) on a mobile device as exposure therapy – the more you expose primary functions to users, the more engagement and overall usage. In an effort to reduce user confusion and achieve rapid results, obvious UI is often the best UI.
The Impact of UI: User Centered Design
Implementing a mobile application as a solution can feel daunting at times, but why? For many, it comes down to the myriad chains of communication between end user and developer. Call us crazy, but we believe in hearing the needs of who the app is intended for from day one, and then building. With the end user being the target audience, our approach is to listen to what their issues are and solve them—simple.
Always Design For The End User And Their Needs
One of the easiest ways to get nowhere fast is to assume you know what the problem is instead of asking. Always ask your target audience for guidance on how you can help solve their biggest problems. What is preventing them from completing their task? You wouldn’t suggest Uber to someone who is looking for a music streaming platform. Same goes for design—Identify the end user’s problem first, then design based off of their needs.
The Impact of UI: Enabling Action
After security, arguably the most important component of a mobile device is the user interface ("UI"). When implementing a mobile application as a solution, consider the following: Is it easy for the end user to operate? Can a task be completed from start to finish without difficulty? Is information presented in a way that incites action? All of those need to be answered with a resounding yes. The key differentiator between a good and a great UI is enablement – A great UI enables action, in turn creating rapid results that are achievable and repeatable. You didn’t need a user manual to use Facebook, Twitter, or Uber, why should your business apps be different?
Mobile connectivity has reached a precipice in 2020 with Covid-19 showing that the future of mobility is now. There is no longer a question of if, but when the universal shift to cloud computing occurs. In the wake of Coronavirus, the world has come to a halt leaving government and the private-sector with only one option—adapt.
Homes—our service members deserve better
Most are familiar with the ubiquitous slogans from our nation’s branches of service: "The Few, The Proud", "Born Ready", or "Aim High, Fly-Fight-Win." Television commercials do a great job marketing the resolve and steadfastness of service men and women working tirelessly at their craft—piloting Black Hawks, traversing mountains at the tactical edge, servicing F18s on aircraft carriers. However, something is conveniently left out of that narrative—the staggering amount of service members subjected to horrendous base housing living conditions. By horrendous, think black mold climbing up and down walls causing chronic headaches debilitating service men and women from doing their respective jobs, think rat droppings falling from the ceiling. Yes, the fine folks in charge of DoD marketing really were not, "Born Ready" or trying hard to "Aim High", by bringing light to what is now beyond a base housing crisis. Homes are in disrepair, falling apart, plagued with mold, rodents, and the list goes on. Besides the endangerment of service members (which is inexcusable as is), it is their families who suffer the most. These are the folks relegated to the physical home in which their living conditions are causing more harm than not. This goes beyond being a housing crisis and a major health concern affecting thousands of our service members and their families. This issue impacts our nations readiness.
What is my job, really?
Over the past decade, "follow your passion" has become a ubiquitous phrase that for many, induces nausea. With the rise of social media and Facebook, anyone and everyone is constantly bombarded with others’ so called "passions" through excessive and egregious photo sharing. So let’s assume you are not a traveling blogger on assignment in Machu Picchu assessing the best sherpa service - Does that mean your job lacks purpose? Not at all. On the contrary, following opportunities and developing skills can lead to passion for just about anything.
More than ever people are craving contribution, and by implying that to be happy and successful a passion must be followed, that information is as useful as the original food pyramid or suggesting a lobotomy. It’s just nonsense. So how does one go about being happy and finding real value with their on the job contributions? It starts with businesses truly defining their purpose - What is your reason for existing? Why is your software unique? What value are you providing your customers? A powerful purpose statement gives workers the chance to embrace the big picture vision, induces inspiration, and motivates them to go above and beyond what is required of their job duties.
CI/CD with AWS Lambda and GitLab
When we wanted to start blogging for Monkton and Mission Mobility - we could not settle on blogging software we liked. Medium has issues in preventing users from reading your posts. WordPress is a security disaster. Blogger is too expansive.
Our goal wasn't to write an heavy piece of blogging software, but something that was nimble and we could control.
More so, we wanted to leverage Amazon Web Service Lambda - AWS's Serverless Platform as a Service. Our bill for hosting this blog in Lambda, at the high end, will be a crazy $1.05 a month.
AWS Lambda
We have built our Blog leveraging .NET Core 2.1 and AWS Lambda. Lambda enables developers to deploy Serverless code without having to manage infrastructure. From scratch, the blog can deploy in a total of two minutes. Two minutes.
Tactical Edge with Snowball Edge
There have been a few tactical edge cloud computing devices appear over the past couple years, but because of Amazon Web Services dominance, the Snowball Edge "Cloud in a Box" is undeniably the market leader. With its storage capacity up to 100TB, 52 vCPU/GPU, and 208GB of memory, every Edge device can transport data at speeds faster than the internet, and for organizations that do work at the edge, this device has enough horse power to do virtually anything—you can build a cluster with 5+ SBE and maintain 99.999% data durability. But how does the Snowball Edge Work?
How the Snowball Edge Works
The SBE is ordered via the CLI (Command Line Interface) or the Web Console. Before you can order a SBE, you must (should) define at least one AMI to use with it. We generally choose Ubuntu because it has the most options available. Our typical distribution involves simply installing Docker CE to run containers within the SBE.
Migration to GitLab
We at Monkton began working closely with the GitLab federal team late in 2018. We chatted with their fantastic federal sales and SA teams and decided to “pull” (har har) GitLab into the Mission Mobility offering.
People many still get confused by GitLab… Everyone was probably more familiar with GitHub that got acquired by Microsoft earlier in 2018. But that is quickly changing.
We were big GitHub users, but with GitHub, you only get part of the equation. We had to string together Jenkins to perform several functions. It became a headache on some levels to manage it all.
GitLab for us, has become so much more. Besides source control, the continuous integration and continuous delivery (CI/CD) that GitLab offers integrated into its product are unmatched.
We are now even using GitLab to house our HR information, Board Meetings, the whole gamut.