devopsy.kinsta.cloud

Author: Mike Vizard

  • Sauce Labs Acquires AutonomIQ to Advance App Testing

    Sauce Labs Acquires AutonomIQ to Advance App Testing

    Sauce Labs is acquiring AutonomIQ, a provider of a scriptless test automation platform based on machine learning (ML) algorithms.

    Matt Wyman, chief product officer for Sauce Labs, said the acquisition of AutonomIQ will play a critical role in enabling Sauce Labs to push testing further left toward developers and, ultimately, “citizen testers” that are becoming part of the DevOps testing tool chain.

    The acquisition of AutonomIQ comes on the heels of the company announcing its intent to acquire API Fortress, an application programming interface (API) testing platform provider. Terms of neither acquisition were disclosed.

    Wyman said the rise of DevOps coupled with an increase in the volume of applications being developed using low-code tools are the primary drivers of a need to shift testing further left. As more citizen developers are building applications, they require access to a testing platform that doesn’t require them to know how to write scripts to test applications, said Wyman.

    The AutonomIQ platform employs machine learning to understand, for example, natural language descriptions of test cases or captured mouse clicks. It then generates synthetic data and test cases that can self-heal when an application changes, said Wyman.

    That approach to testing is more feasible in software-as-a-service (SaaS) environments, where a custom application based on a platform such as Salesforce, ServiceNow, Workday, Oracle or SAP doesn’t tend to change as radically as an application being built from the ground up, Wyman said. Those classes of applications will still require either developers or a dedicated team of testers to build tests using scripts, said Wyman.

    In fact, Wyman said testing those applications is becoming more challenging in the age of microservices. The API Fortress acquisition addresses that issue, because microservices are dependent on APIs to communicate with other microservices, said Wyman. In general, Wyman said Sauce Labs is now moving beyond being focusing only on functional testing of user interfaces.

    It remains to be seen how quickly testing will move to the left. Developers are being held more accountable for the quality of their applications, so testing integration within the application development process has increased. This has led to application testing becoming more tightly integrated with continuous integration/continuous delivery (CI/CD) platforms. Less clear is to what degree those efforts might have reduced the burdens of a dedicated application testing team that typically evaluates applications after they have been constructed.

    Exactly where and how citizen testers are being incorporated into those processes is also unclear. In theory, citizen testers can bring more business process expertise to the testing process. Getting individuals with that level of expertise to make time to participate in application testing while an application is being built can be a challenge.

    Regardless of approach, however, it is already apparent that machine learning algorithms, along with other forms of artificial intelligence (AI), will play a much larger role in application testing in the coming months and years.

  • CNCF Graduates Open Policy Agent Project to Manage Compliance as Code

    CNCF Graduates Open Policy Agent Project to Manage Compliance as Code

    The Cloud Native Computing Foundation (CNCF) announced this week that the Open Policy Agent (OPA) project, which many IT teams are employing to manage compliance as code, has officially graduated.

    Torin Sandall, co-founder of the OPA project and vice president of open source at Styra, whose compliance management platform is based on OPA, said formal recognition of OPA alongside other CNCF projects, such as Kubernetes, should help further adoption of the open source project that first took shape in 2016.

    Now being advanced under the auspices of the CNCF, the open source agent created by the OPA project is increasingly being incorporated into a wider range of compliance and security platforms. At the same time, more developers are starting to manage compliance as code across a wider range of applications. The ultimate goal is to make it easier to meet compliance requirements using a declarative framework so that responsibility for implementing compliance policies shifts further left toward developers.

    OPA uses a general purpose engine for enforcing policies that uses a set of rules that developers embed within applications using the Rego language. OPA has gained traction among cloud native application developers because it provides a means to enforce policies across a wide range of microservices.

    Sandall said going forward, the primary focus of the OPA project should be to develop and share as many integrations as possible. There are many instances where a use case for OPA has been created, but development teams simply don’t know that use case exists. As a result, many IT teams are attempting to employ compliance as code to address an issue that others have already solved, Sandall said.

    During its time as an incubation project managed by the CNCF, the security special interest group (SIG) within the CNCF conducted two external OPA security audits. The OPA project has also defined a security vulnerability disclosure process and a security response team.

    It’s not clear whether chief compliance officers within enterprise IT organizations have developed an appreciation for OPA. In theory, many compliance issues could be avoided if organizations mandated using OPA – or another approach to managing compliance as code – within their applications. Those compliance issues, of course, are multiplying as the number of compliance mandates expand globally. The challenge is that most compliance teams don’t have much visibility into the application development process.

    In the meantime, as DevSecOps processes continue to mature, it seems almost inevitable they would expand to include compliance mandates, most of which only exist to ensure some base level of security is present. Of course, developers may not want to be responsible for compliance mandates. However, the sooner compliance issues are addressed in the development process, the less likely they are to become DevOps’ problem when deployed in a production environment.

  • Lightstep Delivers Next Generation Observability Platform

    Lightstep Delivers Next Generation Observability Platform

    Lightstep this week announced general availability of a Change Intelligence observability platform based on a time-series database that is capable of processing a trillion events each day.

    Ben Sigelman, Lightstep’s CEO, said as IT environments become more complex, thanks to the rise of microservices and cloud-native computing platforms, existing monitoring and observability tools will not be able to keep pace with the rate of change in what have become highly dynamic IT environments.

    While AIOps promises to address that complexity by employing machine learning algorithms to analyze IT environments and surface recommendations, Sigelman said there will always be the need for observability platforms that enable IT teams to discover the root cause of an issue in a way that surfaces the insights needed to fix the problem in real-time.

    The Lightstep database was built by the same team that created Monarch, the globally-distributed in-memory time series database system that Google employs to monitor its applications and systems. Lightstep’s database makes it possible to collect metrics, in the form of distributed traces, at a level of scale that allows IT teams to analyze events across a distributed IT environment made up of both monolithic and microservices-based applications, said Sigelman.

    Lightstep is the latest entrant in an already crowded field of observability platforms, all seeking to consolidate the wide range of monitoring tools IT teams have used for decades.

    The challenge IT teams face is that each of those monitoring tools is focused on a narrow range of platforms. IT teams often lack context when an issue arises, and wind up trying to correlate reports from multiple monitoring tools in the hopes of discovering the root cause of an issue. Observability platform providers are making the case for a single platform that correlates application and infrastructure events in a way that makes it easier for IT to fix issues faster.

    Observability, of course, has been a core tenet of DevOps for years. The tools for achieving that goal, however, have been cumbersome to implement and maintain using legacy application performance management (APM) platforms. Most of those platform providers, have rolled out what are positioned as next-generation observability platforms. Now, IT organizations will need to decide if they want to maintain investments in existing platforms versus moving to one of the raft of upstarts looking to dethrone APM incumbents.

    The startups are counting on a massive expansion in demand for observability platforms. IT organizations have tended to limit their usage of APM platforms to mission-critical applications due to cost and the challenges associated with maintaining the agent software needed to collect metrics from each application. Modern observability platforms have automated much of the metrics collection process, while open source software promises to make metrics collection more affordable..

    The challenge, of course, is that many organizations are already struggling to manage complex IT environments, and can’t necessarily wait for that open source software to mature.

  • CloudBolt Software Aims to Bridge DevOps and IT Divide

    CloudBolt Software Aims to Bridge DevOps and IT Divide

    CloudBolt Software today released a Winter update to its cloud management platform that aims to bridge the divide between DevOps teams and traditional IT administrators.

    IT administrators can now employ the CloudBolt platform to invoke the open source Ansible framework for automating IT processes and workflows using a graphical user interface (GUI) surfaced via a OneFuse Ansible Tower module.

    Additionally, the OneFuse Scripting module will now make it possible to automate script creation for anyone who creates a script using, for example, Terraform, and package that script in a way that IT administrators can invoke via a graphical tool.

    Jeff Kukowski, CEO of CloudBolt Software, said the goal is to make it easier for IT teams across the organization to reuse code created by a DevOps team. OneFuse provides IT with a codeless integration tool. In addition to the core cloud management platform, CloudBolt Software also provides access to a Kumolus service that enables IT teams to optimize cloud costs and provides additional governance capabilities such a generating an audit trail.

    Other capabilities added in the Winter release include deeper cost optimization analysis for VMware vCenter and Microsoft Azure environments, support for the latest release of VMware vRealize and additional C-level dashboards and reports.

    As the number of workloads deployed in production environments increases, there is going to be a greater need for some form of détente between DevOps teams and traditional IT administrators. Site reliability engineers (SREs) can typically manage a much wider range of workloads than an IT administrator. However, SREs are both expensive and hard to find and retain. IT organizations will need to find a way for IT administrators that, at best, have limited programming skills, to pick up some of the slack.

    Those IT administrators can play a critical role in minimizing the number of misconfigurations arising from provisioning IT infrastructure as code. Misconfigurations as a result of developer mistakes are rife across the cloud, and IT administrators are more inclined to check for these than are developers who are racing to deliver their next application.

    The truth is, there are a wide range of tasks that DevOps teams would just as soon see managed by IT administrators, especially if a script or runbook that addresses common issues has already been created. The trick is making that script or runbook easily accessible.

    In the meantime, IT organizations are racing to keep up with complexity in IT environments, often by applying automation at scale in a way that is both repeatable and well-documented. Whether IT professionals like it or not, the days of writing automation scripts and failing to document them are coming to an end. The real issue is ensuring that what does get automated actually works as expected, each and every time a script is applied.

  • AppDynamics Partners With Cisco to Secure Application Runtimes

    AppDynamics Partners With Cisco to Secure Application Runtimes

    AppDynamics today announced its agent software, which it provides as part of its observability platform, now has the ability to enforce application security policies.

    Developed in collaboration with the security business unit of parent company Cisco, the Cisco Secure Application offering, available from AppDynamics, can detect attacks, identify deviations in application behavior and block attacks automatically.

    Gregg Ostrowski, a regional CTO for AppDynamics, said the goal is to make it simpler for IT teams that employ AppDynamics for monitoring and observing their IT environments to also embrace DevSecOps best practices. In effect, IT teams can now piggyback security for application runtimes on their existing investment in AppDynamics, Ostrowski said.

    The AppDynamics approach provides the added benefit of easy integration with the Cisco security tools to improve collaboration between DevOps and cybersecurity teams, Ostrowski said. Security details correlated with the application topology make it easier to share context in a way that identifies the actual business relevance of any security event, he added.

    As organizations accelerate digital business transformation initiatives, Ostrowski said the need to embrace DevSecOps best practices is becoming more urgent. The level of risk attached to these types of projects is significantly higher than with previous generations of applications, Ostrowski said.

    While most organizations appreciate the need for greater application security, there’s a debate about how best to achieve that goal. There’s general agreement that developers need to be more involved. However, shifting responsibility for application security to the proverbial left often comes at the expense of developer productivity. AppDynamics is making a case for enabling IT teams, that may already rely on its application performance management (APM) platform, to enforce policies defined by the cybersecurity team.

    Of course, there’s still a need to provide developers with the tools required to write more secure code in the first place. The debate is over how involved in the cybersecurity management process developers need to be after applications are deployed in a production environment.

    Arguably, the goal should be to enable both teams to accomplish their respective tasks in a way that doesn’t require a constant stream of meetings and updates. In the event a vulnerability is discovered, it’s critical for security teams to determine the threat level that vulnerability represents. Otherwise, remediation of that vulnerability will be just one more item in a long list of patches that developers are already working on.

    Regardless of approach, there are now myriad ways to improve overall application security. In effect, the same defense-in-depth approach that IT organizations have relied on to secure network perimeters can now be applied to application security as applications are both constructed and deployed. The most significant challenge is not so much finding the tools required to improve application security, as defining the processes through which best practices can be consistently applied.

  • Oracle Includes GraalVM Support in Java SE Subscription

    Oracle Includes GraalVM Support in Java SE Subscription

    Oracle announced today it is adding a GraalVM Enterprise virtual machine for building Java applications to Java SE Subscription at no additional cost.

    Donald Smith, senior director of product management from the Java Platform Group at Oracle, said GraalVM Enterprise provides developers with a high-performance application runtime, built on Oracle Java SE, that includes a compiler that accelerates Java application execution. That’s critical as developers look to build microservices-based applications employing microservices that tend to be latency sensitive, Smith said.

    The first stable release of GraalVM arrived last fall. It consumes less memory, and enables Java applications to spin up faster by taking advantage of capabilities such as a just-in-time compiler. GraalVM Enterprise adds a native image utility that compiles Java and JVM-based applications ahead-of-time (AOT) into self-contained native executables. That approach only includes the classes and libraries needed to run the application, which reduces the size of the binary that gets generated.
    Including GraalVM Enterprise in the Java SE Subscription make it easier for Java developers to switch to that Java virtual machine (JVM) to build microservices rather than having to learn another language, Smith said.

    Smith said most organizations will continue to build monolithic applications at the same time they’re attempting to construct microservices. The Java SE Subscription makes it possible for developers to employ different JVMs depending on the type of application being constructed or updated, Smith said. A survey of 560 developers conducted by Oracle last month finds nearly half (48%) are already employing GraalVM to build microservices using Java.

    How much will organizations rely on Java to build microservices, given all the other programming language options available? That’s up for debate. However, being employed in the enterprise for more than 25 years, the number of developers that know Java well is substantial. Rather than waiting for those developers to become proficient in another programming language, there’s a natural tendency for organizations to want to stick with a familiar language. Each additional language introduced to build applications also tends to complicate DevOps processes in a way that can increase the total cost of IT.

    At the same time, however, the number of developers that know how to develop applications using everything from JavaScript to Go is also increasing. Oracle, via ongoing investments made in the OpenJDK project, is moving to make sure Java stays relevant at a time when the number of programming languages being employed has never been greater. For what it’s worth, GraalVM is designed to support multiple programming languages, including JavaScript.

    It’s unlikely Java will fade into obscurity any time soon. IT organizations have a vested interest in embracing next-generation JVMs, if for no other reason than making Java applications more efficient, regardless of how they are built.

    It’s also worth mentioning that frameworks – such as Quarkus from Red Hat – that enable Java-based microservices to run natively on Kubernetes clusters already rely on GraalVM. In some cases, developers may wind up employing such a framework without realizing it relies on GraalVM. In other cases, the challenge will be getting developers to opt for GraalVM as their JVM of choice when so many of them have routinely used the same JVM for more years than they care to admit.

  • CloudBees Appoints New CEO to Drive Next Level of DevOps Growth

    CloudBees Appoints New CEO to Drive Next Level of DevOps Growth

    CloudBees announced today the appointment of Stephen DeWitt as its new CEO, taking over from Sacha Labourey, who will become chief strategy officer.

    Labrourey said after leading the company for the past 10 years, and after a banner year that saw the company generate more than $100 million in revenue, the time was right to appoint a new CEO to take the company to next level. The move also allows Labourey more time to focus on product development.

    Stephen DeWitt
    Stephen DeWitt, CloudBees CEO

    DeWitt most recently served as chief strategy officer for Automation Anywhere, a provider of a robotic process automation (RPA) platform. DeWitt previously served as the CEO of WorkMarket, a labor automation platform for enterprises, Azul Systems, a provider of platform for running Java applications and Cobalt Networks, a provider of Linux servers.

    Without committing to a specific initial public offering (IPO) date, DeWitt said the ultimate goal is to put the processes in place that will enable CloudBees to grow to $200 million in revenues and beyond.

    Achieving that goal will also require tighter integration across what has become a diverse portfolio of DevOps platforms, DeWitt said. The challenge is providing IT organizations with all the benefits of that integration without locking them into any specific component, DeWitt added.

    Going forward, DeWitt said IT teams should expect to see CloudBees invest more in artificial intelligence (AI) to further automate DevOps processes. There are many low-level DevOps tasks that could be automated using machine learning algorithms to reduce the level of friction DevOps teams often encounter.

    Becoming a $200 million company, however, is more difficult than becoming a $100 million company, DeWitt said. Not only does the company have to put the processes in place to grow, but CloudBees today faces more viable competition than it did when it first pioneered the adoption of DevOps best practices.

    The number of organizations adopting DevOps best practices is not only increasing, but organizations that have implemented continuous integration/continuous delivery (CI/CD) platforms also are employing them more widely. Instead of only being employed by pockets of development teams, entire enterprises are now using DevOps best practices and standardizing on a CI/CD platform. Many of those decisions are being driven by the need to accelerate digital business transformation initiatives in the wake of the economic downturn brought on by the COVID-19 pandemic.

    As the application development stakes rise, C-level executives are also getting more involved in application development and deployment decisions, DeWitt said. Those executives not only want to accelerate the rate at which applications are built and deployed, they also want greater visibility into processes that now have a direct impact on revenue streams, DeWitt said.

    It remains to be seen just how quickly DevOps platform providers, as a whole, will grow, but with more venture capital pouring into the sector by the day, there is no shortage of fuel to throw on the proverbial DevOps fire.

  • HashiCorp Expands Managed Services Offerings

    HashiCorp Expands Managed Services Offerings

    HashiCorp today announced the general availability of its Consul service mesh as a managed service on the HashiCorp Cloud Platform (HCP) along with a beta release of a managed instance of HCP Vault, a secrets management platform, on HCP.

    HCP is currently hosted on the Amazon Web Services (AWS) platform, on which the company is making available its complete portfolio as a managed service. In the longer term, HashiCorp plans to make its managed services available on all the major cloud platforms.

    Chris Kent, director of product marketing for HashiCorp, said despite the growing number of open source service mesh alternatives, many organizations would prefer to employ a service mesh provided by a single vendor that they didn’t have to provision and maintain. HashiCorp’s Consul service mesh provides a lightweight alternative that enables service-to-service networking and security via connection authorization and encryption and spans both Kubernetes clusters and virtual machine platforms using the mutual Transport Layer Security (mTLS) protocol.

    Applications can then employ sidecar proxies in a service mesh configuration to establish TLS connections for inbound and outbound connections without ever having to directly interface with Consul itself.

    HashiCorp is making the case for Consul at a time when internecine warfare is raging between proponents of open source service mesh platforms such as Istio, Linkerd and Kuma. The Consul service mesh provides an alternative that is simpler for developers to incorporate across both microservices-based applications running on a Kubernetes cluster and legacy monolithic applications running on virtual machines, Kent said. In contrast, Istio and Linkerd are designed solely for use in Kubernetes environments.

    It’s still the early days of service mesh adoption. In addition to simplifying application traffic routing between services, one of the other benefits of service mesh is that it provides a layer of abstraction above lower-level network application programming interfaces (APIs) and protocols that is more accessible to developers. As developers become more familiar with service meshes, the ability to programmatically include network and security operations within a DevOps workflow will grow. HashiCorp is collectively positioning Consul and Vault as foundational components for creating a zero-trust architecture.

    In the meantime, each IT organization will need to determine which type of service mesh makes the most sense for their environment. In many cases, organizations may find themselves employing multiple service meshes to address different use cases. Regardless of which they choose, service meshes will soon become a permanent fixture in the proverbial solar system around which IT services revolve.

    HashiCorp claims that more than 2,000 organizations signed up to participate in the HCP Consul and HCP Vault beta programs. That level of interest suggests interest is growing in consuming IT as a service rather than as a platform that requires deployment by an internal IT team. It remains to be seen the degree to which organizations will prefer to consume those services directly from a vendor, versus a cloud service provider or third-party IT services provider.

  • Atlassian’s Shift to the Cloud Gets Underway

    Atlassian’s Shift to the Cloud Gets Underway

    Atlassian today announced the general availability of Cloud Enterprise, a cloud-based service through which organizations can mix and match the company’s various offerings under a single subscription.

    The company has signaled its intention to shift toward cloud services for months; now, the initial Cloud Enterprise subscription will cover the company’s Jira Software, Confluence and Jira Service Management offerings.

    Bala Venkatrao, head of product for Enterprise Cloud at Atlassian, said the goal is to make it more cost efficient for organizations to consume the company’s software versus merely acquiring a license to deploy software in an on-premises IT environment.

    The company is also making controls available that enable governance of user and change management via a centralized admin hub. Administrators can assign users to instances, configure security policies and monitor usage trends through the hub. There are also built-in integrations with third-party identity-as-a-service providers, to enable administrators to automate provisioning and de-provisioning.

    Administrators can also set up and customize multiple application instances; they can keep data pinned to different regions to customize those instances with specific marketplace applications or configurations for compliance purposes.

    Finally, a marketplace will allow IT organizations to expand the number of applications they consume from Atlassian and its partners. A smart links and app switcher capability for Jira and Confluence Cloud enable easy collaboration across different instances of Atlassian applications.

    Atlassian currently has more than 194,000 customers, so it may take some time to transition the existing installed base to this model. In the meantime, Atlassian is pushing as many new customers as possible toward a cloud platform that makes it easier for Atlassian to keep customers current on the latest release of its software. Atlassian plans to support up to 20,000 users per application instance by later this year.

    Venkatrao said while the Atlassian portfolio is frequently consumed by individual end users, the Cloud Enterprise offering is designed to appeal to CIOs, and other senior level executives, that want to centralize billing for application services now accessed via the cloud. That approach will make it easier for large organizations to take advantage of discounts they may qualify for as overall usage increases, Venkatrao said.

    While Atlassian may be a little late to the software-as-a-service (SaaS) application game, Venkatrao noted that the Cloud Enterprise platform will make it simpler for Atlassian to apply AI to the metadata it will collect. Atlassian has already leveraged AI to improve document search within Confluence and Jira, in addition to employing predictive analytics to surface recommendations for including personnel on a project.

    It may be a slow transition to the cloud for Atlassian, but that transition is clearly underway.

  • Tidelift Secures Open Source Software Supply Chains

    Tidelift Secures Open Source Software Supply Chains

    Tidelift today announced the general availability of a platform dubbed Tidelift catalogs, through which enterprise IT organizations can more effectively manage their open source supply chains.

    Donald Fischer, Tidelift’s CEO, says the Tidelift catalogs platform enables IT teams to curate, track and manage open source components that have been vetted and adhere to compliance requirements by Tidelift. The company is working directly with the maintainers of those open source projects to compensate them for making that additional effort, said Fischer.

    Developers can reliably pull components spanning common language frameworks like JavaScript, Python, Java, Ruby, PHP, .NET and Rust, with more programming environments to follow, added Fischer. Those components are made available via a Tidelift Subscription service.

    Fischer said Tidelift is going beyond merely scanning open source components for vulnerabilities. The company is ensuring that when developers access versions of open source components, those versions comply with specific sets of policies, said Fischer. As a part of that subscription service, Tidelift monitors components for vulnerabilities as they are discovered, and works with maintainers to implement updates as needed.

    While many organizations are starting to employ DevSecOps best processes, Fischer said the discovery of an issue involving open source components often comes far too late in the process. The Tidelift catalog approach ensures there are no last-minute surprise that are only discovered just before an application is about to be deployed in a production environment.

    Securing software supply chains has become a higher priority since it was revealed that cybercriminals successfully inserted malware into an application update made to network monitoring software provided by SolarWinds. That malware subsequently rippled across IT environments involving multiple corporate entities, as well as several Federal agencies.

    Of course, securing a software supply chain doesn’t happen overnight. Most IT organizations don’t have the processes and platforms required to vet open source components and frameworks. Tidelift is betting most of those organizations would prefer to subscribe to a service, rather than set up that infrastructure themselves. However, for organizations that require in-house monitoring of all the elements of their application development platform, Tidelift will make an on-premises edition of its platform available.

    As organizations become more dependent on software, the potential impact malware can have on their operations can be extensive. Organizations of all sizes should expect to be fielding inquiries from customers, suppliers and partners concerning the level of rigor being applied to their software development processes. In effect, they are going to demand to know the provenance of the software they are being asked to implicitly trust. In many cases, those inquiries will provide the incentive to accelerate adoption of DevScOps best practices.

    The days when organizations blindly used software with little regard to its origins are coming to a close. That doesn’t mean reliance on open source software is necessarily going to decline; however, it does mean application development teams will be held more accountable for the open source components they rely on.