devopsy.kinsta.cloud

Author: Mike Vizard

  • Netlify Extends JAMstack Reach to Edge Computing

    Netlify Extends JAMstack Reach to Edge Computing

    Netlify, at its JAMSTACK CONF VIRTUAL event today, announced Netlify Edge Handlers, which make it possible to extend a Git-based workflow to edge computing applications.

    Company CEO Matt Biilmann said Netlify Edge Handlers, available in beta, puts the primitives in place for deploying serverless web applications based on a JAMstack software architecture that employs JavaScript, application programming interfaces (APIs) and markup languages, otherwise known as JAM, to isolate front- and back-end components of an application.

    A Git-based approach will also enable DevOps teams to extend workflows to edge computing applications that can be deployed on any number of platforms, he said. As an extension of a Netlify platform written in a modern Rust programming language, Netlify Edge Handlers makes it possible to build and launch web applications and websites based on a JAMstack architecture from within a continuous integration/continuous delivery (CI/CD) environment.

    Prior to the availability of Netlify Edge Handlers, building and deploying web applications on edge computing platforms required extensive coordination across teams, the creation of detailed edge logic with many dependencies and deviation from standard web development best practices, Biilmann said. Now, developers can write simple JavaScript that builds and deploys to the network edge in a way that enables simplified A/B testing, custom authentication and API aggregation, he noted.

    Developers also can build and manage edge logic from preview to production, including deploying those applications via the existing Netlify multi-cloud network.

    More application code is being pushed out to the edge because many organizations are now processing and analyzing data closer to where it is created and consumed, as part of their digital business transformation initiatives. Web applications that execute closest on a node to the user eliminate or reduce roundtrip request and response flows with the client.

    Biilmann also noted that because those applications are employing a platform developed using Rust, they are also inherently more secure.

    There may come a day when there are more application workloads collectively running at the edge than there are on cloud computing platforms. However, if that goal is ever to be achieved, it needs to become easier for developers to build those applications. Given the fact those applications are also likely to be targeted by cybercriminals, it’s critical to ensure those applications are as secure as possible.

    In the wake of the economic downturn brought on by the COVID-19 pandemic, many organizations have accelerated digital business transformation initiatives, many of which depend on edge computing platforms. The only way to achieve that goal, however, is to make it possible to build these applications using JavaScript tools that most developers of web applications have already mastered. Otherwise, organizations will need to invest in training developers to master another framework for deploying edge computing applications. That would require time they might not have.

    Regardless of the path forward, a massive wave of edge computing applications soon will stretch the boundaries and limitations of whatever DevOps processes organizations have in place today.

  • Oracle Launches Observability Platform

    Oracle Launches Observability Platform

    Oracle, at its online Oracle Live event today, unveiled the Oracle Cloud Observability and Management Platform, which combines newly added logging, log analytics, database management, application performance monitoring, operations insights and service connector hub services with existing Oracle monitoring, notifications, events, functions, streaming and operating system management capabilities.

    Dan Koloski, vice president of product management for Oracle, said the Oracle Cloud Observability and Management Platform provides IT organizations with access to a unified observability platform running on the Oracle Cloud Infrastructure (OCI) service that, in keeping with best DevOps practices, offers more context than traditional monitoring tools.

    In addition to being able to observe applications deployed on Oracle infrastructure, on-premises or in the cloud, the Oracle Cloud Observability and Management Platform interoperates with Slack, Grafana, Twilio, PagerDuty and other platforms to enable organizations to craft end-to-end DevOps workflows, Koloski added. Oracle is also working toward making it possible to import and export data to open source Prometheus monitoring platforms, noted Koloski.

    Oracle Cloud Observability and Management Platform employs machine learning algorithms to automatically detect anomalies and enable remediation in near-real-time. The company has also automated the instrumentation process to the point of one-click agent deployment, he added.

    Koloski said IT organizations are moving to rationalize a raft of tools to monitor silos of applications and infrastructure that historically were employed with mixed success. An observability platform provides more context by unifying all those tools in a way that makes it easier to troubleshoot the overall IT environment, he noted.

    As IT environments become more complex, thanks mainly to the rise of microservices and containers across hybrid cloud computing environments, Koloski said a new approach to managing IT is required. Advances in observability in the form of distributed traces are also creating a need to shift IT monitoring platforms to the cloud, as the amount of data that needs to be analyzed steadily increases, noted Koloski.

    With the launch of Oracle Cloud Observability and Management Platform, Oracle is also signaling that database management is being incorporated into DevOps processes, Koloski said.

    IT teams today still spend a fair amount of time in “war rooms” trying to ascertain the root cause of an application performance issue. Observability platforms promise to reduce the amount of time IT teams need to spend trying to determine the root cause of those issues. Most of the time it only takes a few minutes to fix an issue that an IT team may have spent weeks trying to uncover.

    Of course, embracing an observability platform doesn’t necessarily mean an IT organization has embraced best DevOps practices. However, because observability is a core tenet of DevOps, it does mean a lot more IT teams will be further down that path.

  • CircleCI Brings Insights to CI/CD Platform

    CircleCI Brings Insights to CI/CD Platform

    CircleCI has added an Insights dashboard to its namesake CI/CD platform that makes it easier to surface metrics such as duration, mean time to recovery and throughput change over time as part of an effort to optimize DevOps workflows.

    The Insights dashboard makes it easier to discover, for example, which jobs are failing, which workflows are failing tests and which workflows are taking the longest to process. DevOps teams can also gain visibility into credit spent, throughput, success rate and mean time to recovery.

    CircleCI CTO Rob Zuber said that while it’s relatively easy for a single developer to ascertain issues with a build, the Insights dashboard shines a light on how an issue is creating a cascade of issues throughout a development project. The Insights dashboard also makes it easier for managers to track the interdependencies that exist between software projects, notes Zuber.

    After nine years CircleCI now has more than 1 million users employing its CI/CD platform. A recent report published by the company shows 80% of workflows running on its platform finish in less than 10 minutes. The company also reports that the adoption of its integration modules, dubbed orbs, has increased 200% since becoming available in 2018. There are now more than 1,900 orbs listed in the registry, with more than 58,000 organizations using orbs within their CI/CD pipelines. Strategic partners include Hashicorp, Plandek, Salesforce and others.

    Competition among CI/CD platform vendors is intensifying. It’s unclear, however, if CI/CD platforms will continue to expand in ways that subsume additional functions or if much of the focus is going to be on further integrating CI/CD platforms with other platforms and tools as part of a software development strategy that revolves around best-of-breed tools and platforms. Regardless of approach, more organizations will be embracing best DevOps practices to cope with software development projects that require more discipline to successfully build, deploy and maintain. The issue now will be determining which CI/CD option to standardize on.

    Overall, Zuber noted software development in the last few years has become more complex with the rise of microservices and containers. Complexity is increasing because the way one problem is solved tends to create others, he said. The challenge now is to find ways to provide more visibility into complex software development environments, as over time more artifacts and platforms span both monolithic and microservices-based application development projects, noted Zuber. In fact, that challenge is driving many organizations that have already embraced one CI/CD platform to reconsider their options as software development becomes more challenging.

    It may be a while before most organizations are able to exercise as much control over software development as they might like. However, the one thing that is certain is no one can manage what they can’t see.

  • Survey Surfaces Lots of DevSecOps Friction

    Survey Surfaces Lots of DevSecOps Friction

    A survey of 560 application security professionals and software developers in North America and Western Europe conducted by WhiteSource, a provider of tools for securing open source software, finds there’s a long way to go before most organizations can claim to have fully implemented best DevSecOps practices.

    Only 20% of respondents said their organization had a mature set of DevSecOps practices in place, while 62% said they were improving. Only 18% described their organization’s approach to DevSecOp as being “immature.”

    There is considerable disagreement concerning how long those efforts have been underway. While 60% of security professionals said they have had an application security program in place for at least a year, just over a third of developers (37%) said they are aware of an application security program running for longer than a year inside their organization.

    Regardless of the length of the program, nearly three-quarters of all respondents (73%) said they feel forced to compromise on security.

    Among application security professionals the top DevSecOps challenge identified was vulnerability prioritization (41%), followed by lack of application security skills (35%), budget (34%), lack of cooperation between developers and security teams (31%) and scanning performance (31%). Less than a third (31%) have a formal process in place to prioritize vulnerabilities.

    There’s also considerable disagreement over whether an application security champion gets designated. Many application security professionals said they have one (60%), while only 40% of developers agreed. The survey also finds well over one-third of developers said their organizations (37%) don’t provide any secure code training. A mere 22% of developers said their organizations provide training regularly with another 20% reporting they have tools that allow for “ongoing independent training.” In contrast, only 27% of application security professionals said their organization does not offer secure code training.

    Lilach Aviad, director of product marketing at WhiteSource, said the survey makes it apparent there are still lots of gaps when it comes to DevSecOps. Most organizations have embraced the concept but are still a long way from unifying workflows to better prioritize which vulnerabilities to address first.

    Priorities are even fundamentally different when it comes to what features are most important in an application security tool. Application security professionals prized integration (48%) most of all, followed by accuracy and ease of use ties at 39%. Developers, in contrast, leaned toward accuracy (25%), followed more closely by integration (22%) and ease of use (21%).

    Overall, the survey found the most widely employed application security tools are penetration testing, web application firewalls and application programming interface (API) gateways. The acquisition of these tools is most often justified to achieve either vertical industry regulations (25%) or industry standards (22%).

    In general, Aviad noted when it comes to security there is still a lot of resentment among developers. Too often security tools have been selected by application security professionals with little regard to how those tools might fit within the context of a larger DevOps workflow, he said.

    Obviously, it’s going to take time and effort for most organizations to merge workflows and culture. The good news is that process has begun in a lot of cases. Less clear is exactly how long it will take to complete.

  • Cloudflare Expands Range of CDN Alternatives to the Public Cloud

    Cloudflare Expands Range of CDN Alternatives to the Public Cloud

    Cloudflare, a provider of a content delivery network (CDN) based on more than 200 data centers, this week announced it has made available a Durable Objects capability in beta that makes it possible to run stateful applications across a distributed serverless Cloudflare Workers service.

    Company CEO Matthew Prince said Durable Objects provide a truly unified approach to managing storage and state that ensures low application latency across the CDN service.

    Cloudflare this week also launched API Shield, which employs client certificate-based identity and strict schema-based validation using hosted public key infrastructure (PKI) that only allows application programming interfaces (APIs) with known behavior and identities to access the CDN service.

    The company also added a Cron Triggers tool that enables IT teams to schedule jobs on Worker nodes rather than always having to make HTTP requests.

    Finally, Cloudflare this week added a free Cloudflare Web Analytics tool and a free Cloudflare Radar tool that allows IT teams to view global traffic and security trends across the internet as they happen using data gathered from a network that touches more than 25 million internet properties in more than 100 countries.

    As applications become more distributed than ever thanks to the rise of edge computing, there is a growing need to deploy stateful applications that process data closer to where it is generated and consumed. Rather than IT teams having to manually deploy those edge computing platforms, Cloudflare has been making a case for a serverless computing platform that enables IT teams to leverage platforms it manages on their behalf.

    A Durable Object, in the case of Cloudflare, is an instance of a class that can be written in any programming language. Each object has a unique identifier and exists in only one location. Any Worker running anywhere in the world that knows the object’s ID can send messages to it. Durable Objects can have persistent state stored on disk. Each object can also maintain a consistent copy of the state in memory to eliminate latency. The in-memory object will be shut down when idle and can be re-created later on-demand.

    The Cron Trigger tools provide IT teams with more control over how they consume capacity on the Cloudflare CDN, added Prince.

    The Cloudflare CDN ultimately provides a lower-cost alternative to cloud services for deploying edge computing applications that gives IT teams more control over where and when application workloads run, Prince said.

    In the age of COVID-19, the days when IT organizations dispatched IT staff to physically install and update physical infrastructure may be coming to an end. There’s no real need to incur the cost or put IT staff at risk of contracting the virus. The issue now is determining whether to employ a cloud service provider or rely on any one of several CDN options that have historically been employed to optimize web applications.

    Regardless of the path chosen, the ability to remotely deploy any type of application on IT infrastructure resources has never been greater or easier.

  • VMware Looks to Meld IT and Security Operations

    VMware Looks to Meld IT and Security Operations

    VMware has acquired SaltStack as part of an effort to unify IT and security operations management. The announcement was made during the online VMworld 2020 conference this week.

    SaltStack has developed an open source IT automation platform to automate IT operations. In recent months it has been extended to also address security and compliance management.

    At the same time, VMware released a bevy of updates to its security portfolio, including VMware Carbon Black Cloud Workload. That offering combines vulnerability reporting with workload hardening software for both legacy platform and microservices-based applications deployed on Kubernetes clusters. It also includes elements of AppDefense, which VMware developed to harden workloads running on VMware vSphere platforms.

    VMware also announced VMware NSX Advanced Threat Prevention, which combines NSX Distributed IDS/IPS with malware detection software and network traffic analysis (NTA) technologies acquired from Lastline Inc.

    Finally, VMware announced it has committed to reselling a secure web gateway from Menlo Security as part of the VMware SD-WAN portfolio and formed an alliance with Zscaler to manage security as a service.

    SaltStack provides VMware with an IT automation framework that can be applied across multiple clouds running virtual machines and containers. The current vRealize IT automation framework is optimized for instances of VMware vSphere.

    Tom Corn, senior vice president for the Security Business Unit for VMware, said VMware’s entire approach to security is predicated on making it easier for IT operations teams rather than cybersecurity professionals to implement security controls. There are simply not enough cybersecurity professionals available to implement cybersecurity controls when DevOps teams are rolling out and updating application workloads multiple times a week, he said.

    Cybersecurity teams will continue to define what controls will need to be put in place, but it will be left to the IT operations teams to implement those controls in much the same way responsibility for application security is now also being shifted left as part of best DevSecOps practices.

    Corn said it’s clear IT security is a team sport that requires greater collaboration among IT operations teams, developers and cybersecurity professionals. VMware has been investing in security technologies with an eye toward making it easier for IT operations teams to automate security operations in much the same way any other IT task is being automated, he noted.

    That convergence isn’t going to occur overnight. There are many challenges including culture. Many cybersecurity professionals view IT operations and developers as being equally responsible for many of the root causes of a cybersecurity breach. It may be a while before cybersecurity teams have enough confidence in the ability of IT administrators and developers to proactively address cybersecurity issues before and after applications are deployed in production environments.

    Of course, there’s no alternative. The days of waiting two months or more for a security review as part of a waterfall development process are over. Security, like it or not, needs to become as agile as the rest of IT.

  • Twilio Expands Scope of Cloud Services Portfolio

    Twilio Expands Scope of Cloud Services Portfolio

    Twilio today at its online SIGNAL 2020 conference launched Twilio Video Web RTC Go, a free toolkit that makes it easier to embed video within an application, and exposed an Event Streams application programming interface (API) through which the management of streams of messaging and voice can be centralized using the Amazon Kinesis platform.

    At the same time, Twilio debuted Twilio Frontline, a mobile application that enables all incoming and outgoing customer conversations occurring over any channel or medium to be sent to a single application running on an IoS or Google Android device.

    Finally, Twilio also launched Microvisor, a turnkey connectivity and device management platform for developers building and updating internet of things (IoT) applications.

    Quinton Wall, senior director of developer marketing at Twilio, said Twilio Video Web RTC Go will play a critical role in enabling organizations to take control of digital business applications that now typically include a video stream. Rather than having to rely on a video service provided by Zoom, for example, an organization can provide an interactive video experience under their own brand by invoking application programming interfaces (APIs) that connect applications to Twilio Video running on the Amazon Web Services (AWS) cloud.

    In a similar vein, Twilio Frontline enables organizations to also take control of the communications channels that end customers are likely to employ. It may not be feasible to require every customer to employ a specific communications channel but at the very least all communications occurring over WhatsApp, SMS/MMS, webchat and other channels can be centralized, noted Wall. The Events Stream API, which will be expanded to include other processing engines other than Amazon Kinesis, enables developers to apply that same capability within their own applications.

    Twilio is also making it easier to build and deploy applications in IoT environments via a Microvisor platform through which Twilio provides constant monitoring of vulnerabilities and applies security patches to both IoT devices and any associated cloud components. Developers can also debug and update devices remotely and push out code updates as often as they see fit.

    Developers can also reuse any existing embedded code and develop IoT applications in the language and embedded OS of their choice using the TrustZone hardware isolation technology made available by Arm on processors that are widely employed in IoT devices.

    Collectively, Twilio is making a concerted effort to convince developers to programmatically invoke a range of cloud services that are exposed via an API. Rather than employing separate services for each video, audio, text or in the case of IoT application an IT management function, Wall said the goal is to enable developers to spend more time on writing code versus integrating external services.

    In general, the point where applications that don’t include embedded collaboration tools, including video, are considered antiquated has arrived. End users that have become accustomed to using services such as Zoom expect to be able to instantly communicate with the owner of that application or other end users. Twilio provides those capabilities in a way that doesn’t require developers to rely on a service such as Zoom that introduces yet another brand into the application environment, noted Wall.

    It’s too early to say just how capabilities such as video will be surfaced within applications. However, the one thing that is certain is video is now expected to be pervasive both inside and out of application environments.

  • GitHub Delivers on Code Scanning Promise

    GitHub Delivers on Code Scanning Promise

    GitHub today announced it is now making available at no cost the open source CodeQL code scanning tool it gained by acquiring Semmle.

    Justin Hutchings, a product manager at GitHub, said the goal is to further adoption of best DevSecOps practices by making it easy for developers to scan for vulnerabilities as they check code in and out of the GitHub repository. It is also designed to be integrated with either GitHub Actions or an existing continuous integration/continuous delivery (CI/CD) platform to enable DevOps teams to create workflows that include code scans, he said.

    For private repositories, code scanning is part of the GitHub Advanced Security suite of tools GitHub makes available via GitHub Enterprise.

    Code scanning also makes it possible to integrate third-party scanning engines via support for the Static Analysis Results Interchange Format (SARIF), which provides a standard for sharing data between SAST tools via a common application programming interface (API). GitHub has thus far partnered with more than a dozen open source and commercial security vendors to allow developers to run code scanning within their offerings, noted Hutchings.

    GitHub claims since it made CodeQL available in beta last May, it has scanned more than 12,000 repositories more than 1.4 million times and found more than 20,000 security issues involving everything from remote code execution (RCE) and SQL injection to cross-site scripting (XSS) vulnerabilities.

    Developers and maintainers fixed 72% of reported security errors identified in their pull requests before merging in the last 30 days alone, reported GitHub. Hutchings noted those efforts represent a major step forward for DevSecOps, given the fact that industry data shows that less than 30% of all flaws are fixed one month after discovery.

    GitHub, along with the open source CodeQL community, has also created more than 2,000 CodeQL queries that DevSecOps teams can employ to scan code for specific types of vulnerabilities. GitHub also noted there already have been 132 community contributions to the CodeQL open source query set.

    Given how nascent best DevSecOps practices are in most organizations, simply making SAST tools available to developers is often a major step forward for many organizations. The challenge has been finding SAST tools that developers want to employ, said Hutchings. Most SAST tools were designed for security teams rather than developers. CodeQL is designed to surface vulnerabilities in a way that makes it clear where developers need to prioritize their remediation efforts, he noted.

    It’s not clear yet to what degree responsibility for security will shift left toward developers. There will always be a need for cybersecurity teams to verify that the proper controls are in place. However, as DevOps teams assume responsibility for security it’s almost certain they will do so on their own terms. The days when cybersecurity teams select the security tools that developers are expected to employ are now all but over.

  • Adobe Adds Tools for Building Custom Applications

    Adobe Adds Tools for Building Custom Applications

    Adobe this week launched a series of tools intended to make it easier to build custom applications that can be deployed on a serverless computing platform on the Adobe Experience Cloud.

    Announced at the online Adobe Developers Live event, the Project Firefly framework promises to make it easier for developers to build cloud-native applications that leverage the open source Apache OpenWhisk serverless computing framework.

    The Firefly framework will make it easier for developers to, for example, invoke Adobe Analytics capabilities from within a custom application using functions, said Jason Woosley, vice president of developer experience and commerce for Adobe.

    Adobe this week also launched React Spectrum, an open source collection of libraries and tools for building interactive applications using the React framework. Based on JavaScript, React Spectrum makes it easier to build front-end interactive applications in a way that scales consistently.

    Finally, Adobe added Adobe Experience Platform Launch Server Side, which makes it easier to collect data via Adobe Web and Mobile software development kits (SDKs).

    Woosley said interest in building custom applications on Adobe Experience Platform has accelerated in the wake of the COVID-19 pandemic. Organizations of all sizes moving timetables for digital business transformation initiatives forward to engage customers online. Those initiatives frequently begin with marketing applications that are extensions of the software that Adobe makes available via its cloud platform, he said.

    Once those applications are built they also typically need to be integrated with any number of back-end systems that act as systems of record for the business. Those tasks have become easier for developers to accomplish using any number of application programming interfaces (APIs) that providers of those platforms expose.

    Most of the digital business applications are being built by professional developers employing best DevOps practices, Woosey said. As the Adobe strategy for enabling developers to build applications evolves, Adobe it evaluating to what degree it needs to embed DevOps capabilities within its cloud platform, he noted.

    The Adobe Experience Cloud platform provides organizations with access to a series of applications that they can extend using Firefly, which eliminates the need to build every custom application from the ground up. As digital business transformation projects become a higher priority, the rate at which organizations need to build and deploy these applications has increased to the point where many of those organizations require a systematic approach based on best DevOps practices to build, deploy and update applications at scale.

    It’s not clear to what degree the rise of digital business transformation initiatives will eventually act as a forcing function for adopting DevOps more widely within organizations. However, given the strategic importance of many of these projects, it appears all but inevitable that most organizations will need to modernize the way applications are built and deployed if they hope to remain relevant. In fact, embracing best DevOps practices is nothing less now than a matter of survival for many of those organizations.

  • Pinpoint Simplifies Managing Remote Dev Teams

    Pinpoint Simplifies Managing Remote Dev Teams

    Pinpoint today added a User Dashboard to its namesake platform for managing software projects that makes it easier for remote developers to stay focused.

    Company CEO Jeff Haynie said the User Dashboard provides developers with a personalized view of their work priorities and schedule for the day. It also provides a means to employ their Pinpoint Profile to highlight personal achievements and engage other engineers on the Pinpoint Platform.

    The Pinpoint platform is designed mainly to identify software development bottlenecks that could delay a project. Most recently, the company added machine learning algorithms and advanced analytics to surface additional insights and recommendations.

    This latest update extends the use of machine learning algorithms via a Recommended Content feed that curates content from blogs, podcasts and other media based on the observed interests of developers. Much like a built-in RSS feed, Recommended Content is an experiment to see whether the platform can save developer time by eliminating the need to scroll through less-relevant news, said Haynie.

    In the wake of the COVID-19 pandemic, he said, many organizations are struggling even more to manage distributed or remote developers. It’s also now much easier for developers to become isolated from the rest of their team. The User Dashboard provides a way to engage developers through the same platform managers employ to track projects.

    While there is no shortage of collaboration tools, Haynie noted they all tend to be tied to a specific DevOps platform. Pinpoint is designed to automate the process of collecting data from multiple tools, which the platform then analyzes to surface potential bottlenecks in the software development process. As software development projects become more complex, there is a need for a tool to visualize how hidden dependencies might upend delivery schedules, he said.

    The User Dashboard now extends that framework out to individual developers, who can view how to prioritize their specific tasks in keeping with a larger set of goals, Haynie added.

    Developers don’t typically have a lot of visibility into how their efforts ultimately impact the organization. In the absence of that information, it can become difficult to stay motivated, especially when working from home. Project leaders are now always going to be able to personally engage each developer every day, especially if members of the development team are located in different time zones.

    The User Dashboard isn’t a substitute for personal interactions, but it does provide a means for developers to quickly learn at a glance what needs to be done next in a way that serves to minimize miscommunications. It’s not all that uncommon for developers to lose valuable time by being told to do one thing when they should have been focused on a different task.

    Less clear is to what degree Pinpoint might be able to flatten management hierarchies within development teams. As a general rule, the fewer managers required the more an organization can allocate funds to hiring developers who, with the aid of the right platform, might one day manage themselves.