devopsy.kinsta.cloud

Author: Mike Vizard

  • Traceable Secures Apps Using Distributed Tracing

    Traceable Secures Apps Using Distributed Tracing

    Traceable this week announced it is making available under an early access program a namesake platform that combines distributed tracing and machine learning algorithms to better secure applications.

    Fresh of raising $20 million in funding, Traceable CEO Jyoti Bansal said the goal is to leverage distributed traces generated via open source Hypertrace agent software to capture streaming data to which machine learning algorithms can be applied to better secure microservices.

    Bansal, who is also the founder and former CEO of AppDynamics, said this approach leverages software engineering techniques and principles to address application security issues both before and after an application is deployed.

    As part of this effort, Traceable has developed TraceAI, a machine learning engine that has been trained to identify application security issues.

    Once those issues are discovered, developers will be able to apply policies to remediate vulnerabilities using Hypertrace agent software, he said.

    In effect, Traceable is applying many of the principles of application performance management (APM) platforms to securing applications. However, rather than simply aggregating and analyzing data, Traceable has added a streaming engine to collect massive amounts of cybersecurity data in real-time that is analyzed by machine learning algorithms to determine, for example, when and how data might be exfiltrated via an application programming interface (API).

    As the number of microservices that are deployed in enterprise IT environments increases, the number of API endpoints that can be compromised does as well. By adding open source Hypertrace agent software to microservices, Bansal said it becomes possible to leverage distributed tracing to better understand the context in which how business logic embedded within a microservice is being compromised. That context also serves to enable development teams to remediate that issue by either updating or replacing a microservice.

    While the rise of best DevSecOps practices has increased collaboration among developers and cybersecurity teams, Bansal said application security remains largely a software engineering challenge. Application development teams need to find a way to instrument agents to address application security issues within their code instead of relying on overlays deployed by network engineers, he said.

    Most cybersecurity professionals would nod their heads in agreement with that principle. However, it may take cybersecurity teams some time to get used to the idea that they might not need to be as involved with application security as they are today. In fact, the amount of time spent looking for the root cause of any vulnerability is likely to be substantially reduced.

    In the meantime, it’s apparent a primordial soup of agent software, distributed traces, machine learning algorithms and streaming data engines is coming together in a way that will transform application security. It may be a little while longer before the catalyst that converts all those elements into a widely employed platform arrives. However, it appears it’s now more a question of when rather than if there will be a major advance in application security that could take DevSecOps processes to a much higher level.

  • Collibra Employs Microservices for Data Management

    Collibra Employs Microservices for Data Management

    Collibra has launched a Collibra Data Intelligence Cloud based on a microservices architecture that promises to alter the way data is managed in enterprise IT environments.

    Jim Cushman, chief product officer for Collibra, said its approach sets the stage for leveraging microservices to create data workflows made up of reusable components. In fact, there may come a day soon when some data sets are accessed and managed as a reusable microservice, he said.

    The Collibra Data Intelligence Cloud provides a catalog for managing metadata that, in addition to making it possible to build workflows, ensures the integrity and security of data being accessed and stored. End users can then analyze that data using a wide variety of third-party tools, said Cushman.

    At the same time, Collibra enables metadata ingestion from data sources such as data lakes and data warehouses, which means IT teams don’t have to move all the data they need to manage into Collibra Data Intelligence Cloud to create a workflow.

    Collibra is also making available a beta version of its Data Matching tool for qualified customers. That tool identifies duplication within a data source and how that data might overlap with other data sources.

    Finally, Collibra has added a data scoring component to its catalog to identify the most relevant data sets; provide enhanced support for third-party business intelligence (BI) and extract, transform and load (ETL) tools; and strengthened rights management capabilities to make it easier to enforce compliance requirements.

    Cushman said the goal is to provide organizations with an easier approach to storing and organizing trusted data. As the amount of data an organization collects grows, so, too, does the opportunity for conflicting data to be incorporated in applications. The Collibra Data Intelligence Cloud creates an opportunity to make data universally available to applications without requiring them to copy it, he said, noting that approach reduces not only the amount of data that might be in conflict as data sources are updated but also the amount of infrastructure that would have been required to process and store duplicate data.

    Organizations have been struggling with data management since the dawn of IT. That’s become a more pressing issue as more organizations seek to turn data into a strategic asset that drives digital business transformation initiatives. However, those initiatives are often derailed because so much of the data is either conflicting or simply too stale to be relevant. Collibra is making the case for a single platform to bring order to what historically has been a chaotic process.

    It’s not clear to what degree organizations will be focusing more on data quality and management in the months ahead. In the wake of the economic downturn brought on by the COVID-19 pandemic, it’s clear digital business transformation has become a necessity. The challenge is that unifying how data is managed in any enterprise requires a massive amount of political capital. Each business unit within an enterprise IT environment tends to guard its data privileges jealously.

    However, as microservices make it possible to make the business a lot more agile, the day when organizations finally confront their longstanding data management issues may finally be at hand.

  • Google Taps AMD for Confidential Computing Service

    Google Taps AMD for Confidential Computing Service

    Google Cloud, at a Google Cloud Next 2020 Online event, announced it is making available in beta Confidential VMs, a new service that represents the cloud service provider’s first foray into the realm of confidential computing.

    Based on second-generation EPYC processors from AMD that provide access to an embedded Secure Encrypted Virtualization (SEV) capability, Confidential VMs encrypt data while it is being processed.

    At the same time. Google unfurled Assured Workloads for Government, a service also in beta through which the company will ensure workloads are run in a specific location to meet government requirements.

    Sunil Potti, general manager and vice president of cloud security for Google Cloud, said Confidential VMs will complement existing secure cloud computing services that already isolate workloads and encrypt data at rest. Google has also invested in creating a zero-trust security model dubbed BeyondCorp that ensures access controls are strictly enforced, he noted.

    Google Cloud is following Microsoft Azure into the realm of confidential computing, which is being enabled by new classes of processors from AMD and Intel. Both Microsoft and Google Cloud are founding members of the Confidential Computing Consortium, an arm of The Linux Foundation which also includes Alibaba, ARM, Baidu, IBM, Intel, Red Hat, Swisscom and Tencent.

    Amazon Web Services (AWS) has yet to join the consortium or outline its approach to confidential computing. It already offers Nitro Enclaves through which it isolates compute environments to securely process sensitive data within their Amazon EC2 instances. Nitro Enclaves is based on the Nitro Hypervisor technology that AWS developed to provide CPU and memory isolation for EC2 instances. AWS for several years now has been making a case for “encrypt everything,” which has yet to become the default setting in most IT environments.

    It’s not clear to what degree IT organizations will embrace confidential computing services. There’s a clear need to secure data. However, many organizations may decide that paying extra to encrypt data while it’s processing may be one extra layer of security too many. There will always be financial services firms and government agencies that will prefer to encrypt data on an end-to-end basis. However, many organizations will be weighing the security benefit of those services against the cost and potential impact processing encrypted data in memory might have on applications.

    It’s also now only a matter of time before servers configured with processors that support the processing of data become available in on-premises IT environments. Many IT teams may decide that because of compliance requirements sensitive data still needs to processed within an on-premises data center.

    Of course, cloud security concerns go well beyond merely how data is encrypted. Most often, the biggest issues when it comes to cloud security is misconfigurations. Encrypting data might render any data inadvertently exposed useless. However, IT teams are just now coming to terms with best DevSecOps processes. Confidential computing services may have a role to play in enabling IT teams to achieve that goal, but it may be a while before the processors on which confidential computing depends are employed widely across an extended enterprise.

  • Sentry Adds Application Performance Monitoring to Platform

    Sentry Adds Application Performance Monitoring to Platform

    Sentry has extended the reach of its agentless monitoring platform to now track performance issues in addition to surfacing errors in code.

    Company CEO Milin Desai said IT organizations can now consolidate the number of monitoring platforms they employ to reduce their overall costs. Previously, the Sentry platform only identified errors in applications. The Sentry platform, he said, now provides a more holistic view of the overall health of JavaScript and Python applications without requiring IT teams to install and manage agent software in every application.

    Performance monitoring tools now make it possible to dynamically track application response times based on latency and throughput data. IT teams can analyze slow response times, increases in transactions and error rates to diagnose and fix all performance issues.

    IT teams can also set thresholds that generate alerts if performance metrics fall past a predefined tolerance level. IT teams can also drill down into transaction details within tracing waterfalls to visually highlight application programming interface (API) call times that are taking longer than expected.

    There is also a Transaction Summary View that sorts transactions based on slowest duration time, related issues and the number of users having a slow experience. IT teams can also track specific critical transactions in addition to gauging how users react to new code pushed to production.

    A Root Cause Analysis tool makes it possible to identify and drill down into differences in characteristics between outliers and normal performing transactions.

    Finally, a tracing capability makes it possible to identify the exact database query that caused an error or performance issue.

    Desai said Sentry requires developers to add only five lines of code to their application. As such, developers can take advantage of Sentry without requiring the help of IT teams to manage agent software. In some cases, however, DevOps teams are standardizing on Sentry because it enables performance and error monitoring to be pushed further left toward developers, who are in the best position to address an issue, he said.

    As applications and IT environments become more complex in the age of microservices, there is obviously a greater need for instrumentation. The debate is how best to go about achieving it. Many DevOps teams now find themselves managing a raft of agent software alongside every application that is deployed. Over time, the weight of all that agent software starts to impact DevOps processes.

    In the meantime, IT teams continue to spend more time looking for the root cause of an issue once a problem is surfaced than they do actually fixing it. As applications are developed in larger numbers, thanks in part to the rise of DevOps, it becomes more critical to resolve application issues faster. Otherwise, application developers will wind up spending most of their time debugging applications versus writing new code, which obviates the whole reason for investing in DevOps processes in the first place.

    Observability, of course, is a core tenet of DevOps for that very reason. The challenge is making sure observability is provided in the least frictionless way possible.

  • HPE Acquires Silver Peak to Gain SD-WAN

    HPE Acquires Silver Peak to Gain SD-WAN

    Hewlett Packard Enterprise (HPE) announced its intent to acquire Silver Peak, a software-defined wide area network (SD-WAN) platform provider, which will be incorporated into its Aruba Networks subsidiary.

    Keerti Melkote, president of Intelligent Edge for HPE, told industry analysts the $925 million acquisition will eventually lead to edge computing devices all being managed via the same cloud framework regardless of physical location.

    Aruba Networks has been making a case for unifying the management of wired and wireless networking in branch offices via a cloud management platform. The acquisition of Silver Peak will extend the reach of that framework to SD-WANs, which are becoming more widely employed to connect both remote offices and end users working at home to applications running both in the cloud and in the local data center.

    In the wake of the COVID-19 pandemic, the number of employees working from home and needing direct access to applications has exploded. Rather than employing virtual private networks (VPNs) to connect all those home offices to a local branch office, it’s more efficient and secure to connect those working at home to applications residing in both the cloud and on-premises IT environments via SD-WANs.

    HPE claims the total addressable market for networking services aimed at various edge computing use cases is north of $32 billion, which includes both SD-WANs and wireless and wired networks deployed in the branch office.

    Silver Peak currently has more than 1,500 customers and in its last fiscal year generated $132 million in revenue. The challenge HPE and its Aruba Networks subsidiary will face is most SD-WANs that have been deployed thus far use appliances that were acquired by internal IT teams. Increasingly, however, SD-WANs are being consumed as a managed service. Aruba provides customers access to a cloud console to manage networks deployed in remote offices. It’s not clear how many internal IT organizations moving forward will want to manage remote networks versus relying on a managed service provider (MSP).

    Of course, HPE and Aruba can opt to provide a managed service. However, they will need to build out the points of presence (PoPs) to deliver a managed SD-WAN service—something many MSPs, especially telecommunications providers, and cloud service providers have already done.

    Longer-term, it’s also not clear to what degree wireless 5G services will eliminate the need for not just wired networks, but also wireless local area networks (LANs) in branch offices. Some IT organizations may conclude the cost of a 5G cellular service is less than the total cost of managing a LAN.

    There is, of course, no absolute when it comes to networking. However, if more employees are working from home for the foreseeable future, the dynamics of networking at the edge will never be the same. Developers especially will need to take into account a whole different level of network latency dynamics when deploying applications. The irony is that as applications become more distributed, the management of the networks on which they depend is becoming more centralized.

  • OpsRamp Adds Synthetic Monitoring to AIOps Platform

    OpsRamp has extended the capabilities of its namesake AIOps platform to include synthetic monitoring capabilities alongside existing tools for monitoring end user experiences.

    Bhanu Singh, senior vice president of engineering and DevOps for OpsRamp, said the Summer 2020 Release of the software-as-a-service (SaaS) platform adds synthetic monitoring that not only identifies bottlenecks across multi-step transactions but also correlates transaction performance such as page responsiveness and page timeouts with business metrics such as conversion rates and completion rates.

    By combining synthetic and end user monitoring capabilities, OpsRamp is effectively reducing the total cost of monitoring at a time when many organizations are under increased pressure to reduce costs, noted Singh.

    The OpsRamp Summer 2020 Release also improves monitoring with transaction latency breakdown for each step that contributes to user experience issues.

    It also adds visualizations for event correlations enabled by machine learning algorithms, support for HTTP response header logging for web performance insights and the ability to customizable transaction steps to provide more context.

    The OpsRamp Summer 2020 Release also adds 22 monitoring integrations for Amazon Web Services (AWS), including AppStream, Cognito, EventBridge, GuardDuty, Lex, OpsWorks and SageMaker.

    OpsRamp has added alert integrations with AppDynamics, Microsoft Systems Center Operations Manager, Sumo Logic and Sysdig. In addition, OpsRamp can now consume Sysdig events.

    Finally, OpsRamp is making it possible to access alert sequencing explainers that describe how the machine learning algorithms work. Alert sequence policy status shows model training progress at each stage of the event management life cycle.

    Singh said this latter capability is critical if IT teams are to gain confidence in AIOps platforms such as OpsRamp. In the wake of the downturn brought on by the COVID-19 pandemic, the need for AIOps has never been more pronounced. IT organizations are now under more pressure than ever to automate IT operations as part of a larger effort to reduce costs.

    The challenge they face is IT environments have arguably never been more complex. In many IT environments, the level of complexity is no longer feasible to manage IT processes manually. Automating IT processes is challenging because in most cases the IT environments have been customized extensively. AIOps presents an opportunity to employ machine learning algorithms to learn how each application environment functions and then automate it based on best practices.

    At this juncture, it’s more of a question of the degree to which IT organizations will be relying on AIOps. It may be a while before IT teams gain confidence in AIOps tools. However, with each passing day, machine learning algorithms become a little bit smarter. They may never have the intelligence of a human IT administrator; however, they never forget what they learn, require time off or quit to take another job.

    On the downside, of course, is that should machine learning algorithms make a mistake, the potential damage to an IT environment could be significant given the level of scale machine learning algorithms operate on. As such, IT organizations will always be well-advised to make sure the appropriate level of human supervision is always available.

  • Micro Focus Extends AI Testing Tools Reach

    Micro Focus Extends AI Testing Tools Reach

    Micro Focus has extended the capabilities of a family of Unified Functional Testing (UFT) testing tools infused with artificial intelligence (AI) to include support for both web-based and mobile applications.

    In addition, UFT testing tools will now allow a single script to automatically run on multiple platforms and browsers, eliminating the need to create multiple scripts for each platform.

    A crowdsourced feedback mechanism to improve recognition of objects such as a new widget has also been added to improve the AI model embedded in Micro Focus testing tools ability to recognize unique user interface paradigms.

    Finally, Micro Focus is making available an AI software development kit (SDK) and natural language processing (NLP) engine that makes it possible for both technical and non-technical users to create tests.

    Archie Roboostoff, product director for Micro Focus, said the natural language capability will make it possible to include end users of an application more easily in the functional testing process.

    As the responsibility for testing continues to shift left, he said, it’s become more important to automate as much of the functional testing process as possible. Developers and end users typically don’t have the time or often the expertise needed to build these tests.

    The challenge organizations face is the more application code they build and deploy, the more time they often spend on debugging applications. Many organizations wind up diverting resources from application development projects just to keep pace with the rate at which applications are now being built and deployed, noted Roboostoff.

    The paradox is that diversion of resources conspires to constrain the rate at which any additional applications are built. AI can play a critical role in breaking that logjam by reducing the time need to surface issues faster, said Roboostoff.

    At the same time, Micro Focus UFT tools further streamline the testing process by applying the AI capabilities it developed for mobile applications to web-based applications, he added.

    It’s not likely AI will eliminate the need for humans to test applications anytime soon. However, there are many routine issues that regularly manifest across different application development projects. As developers test more of their own code before it is officially promoted within the context of a DevOps process, it should be possible for development teams to rely on AI tools to surface issues they can address long before anyone knows they even existed.

    As is the case with every AI tool, an IT organization will need to gain confidence in the AI model embedded within any testing tool. The more AI tools are exposed to code, the more accurate they become.

    Regardless of the level of comfort with AI, it’s apparent application testing needs to become more automated. In the wake of the economic downturn brought on by the COVID-19 pandemic, most organizations will not be in a position to throw more bodies at application testing. The issue, of course, is most organizations have never been more dependent on applications to drive revenue at a time when most individuals are working and shopping from home more than ever to help contain the spread of COVID-19.

    The difference between success and failure during this so-called “new normal” will often come down to the level of testing applied to the applications on which many businesses are now almost solely dependent.

  • DevOps Deeper Dive: Google Roils Open Source Community

    DevOps Deeper Dive: Google Roils Open Source Community

    Google this week agitated the bulk of the open source community by launching the Open Usage Commons consortium to protect the trademarks of open source projects, starting with the Istio, Angular and Gerrit projects it launched.

    Launched in collaboration with SADA Systems and some independent contributors, the stated goal of the Open Usage Commons is to help open source projects assert and manage their project identity through programs specific to trademark management and conformance testing.

    Istio is a service mesh that runs on top of Kubernetes, while Angular is a web application framework. Gerrit is a code collaboration tool.

    Unlike previous open source projects that Google played a major role in developing such as Kubernetes, Google has yet to contribute these three projects to an open source consortium. That decision has members of the open source community now questioning Google’s commitment to open source software.

    In fact, IBM, which launched the Istio project in collaboration with Google, this week said the Open Usage Commons does not meet the level of open source governance IBM expects. Originally, IBM said the expectation was that Istio would be contributed to the CNCF once it achieved a level of maturity. That contribution would include Istio intellectual property and the trademark. Now IBM is encouraging Google to reconsider its Open Usage Commons approach.

    If Google continues to hold on to the intellectual property rights for open source projects such as Istio, those projects will become little more than a community project that Google exercises control over, said Priyanka Sharma, general manager of the Cloud Native Computing Foundation (CNCF), which oversees the ongoing development of Kubernetes, among other open source projects.

    “It’s not in the spirit of open source,” said Sharma. “I don’t think you can even call it open source.”

    Other open source initiatives will be hesitant to build on top of projects such as Istio if the intellectual property belongs to a single vendor, added Chip Childers, executive director of the Cloud Foundry Foundation (CFF). The trademark is never the main issue, he said.

    “The trademark is only part of the consideration,” said Childers.

    In the case of Istio, the decision to launch Open Usage Commons might also draw more attention to a Service Mesh Interface (SMI) project being advanced under the auspices of the CNCF. That interface promises to make it easier to rip and replace one service mesh for another.

    In the meantime, Google may be trying to maximize its investments in open source projects that until now have tended to benefit rivals more. In terms of consumption of cloud services based on Kubernetes, Google is a distant third at best to Amazon Web Services and Microsoft.

    In general, there are more open source projects than ever. However, some of the entities that launch those projects have complained that cloud service providers simply turn those projects into cloud services in a way that consumes most of the revenue opportunities any open source project might generate.

    Google now appears to be exacerbating those tensions further by trying to retain control over the open source project it leads, while selling services based on other open source software projects. It’s not clear to what degree this rift might drive a wedge between multiple open source factions. Google with this move may just drive more members of the open source community into the arms of AWS and Microsoft. However, for the moment at least, none of the projects covered by the Open Usage Commons trademarks are so critical that they could not be replaced by any one of several alternative projects that are truly open source.

  • CNCF Looks to Increase Open Source Sandbox Projects

    CNCF Looks to Increase Open Source Sandbox Projects

    The Cloud Native Computing Foundation (CNCF) today announced it has simplified the process it employs to enable open source software to become a sandbox project managed under its auspices.

    Priyanka Sharma, general manager for the CNCF, said the organization is looking to increase the number of open source projects that make up the cloud-native ecosystem. While the CNCF is best known for its efforts to govern the development of Kubernetes, the organization’s mission spans a wide range of cloud-native technologies. Many of those projects are now applicable to both microservices-based and monolithic applications that can be deployed in the cloud or in an on-premises IT environment.

    Key changes to the sandbox process include a simplified submission process using an application that asks the project owners how their project fits as part of the cloud-native ecosystem. Applications are listed in a spreadsheet available publicly for comment, with review by the Technical Oversight Committee (TOC) scheduled on a bi-monthly cadence. The existing Special Interest Group (SIG) recommendation and TOC sponsorship requirements for sandbox projects have been replaced by a simple vote for acceptance by the TOC.

    There are currently 31 sandbox projects being developed under the auspices of the CNCF. The new process for approving sandbox projects has already been applied to 11 of them. Each sandbox project has signed over the rights to the intellectual property for that project to the CNCF, which then attempts to attract more developers to participate in the ongoing effort to increase the adoption of that project.

    In some cases, CNCF projects will compete with one another for acceptance. The CNCF is committed to not becoming a “king maker,” said Sharma.

    Obviously, the CNCF is not the only organization trying to advance the adoption of open source software. In addition to The Linux Foundation, of which the CNCF is a part, there are older organizations such as the OpenStack Foundation and the Eclipse Foundation, which, to varying degrees, compete with one another to become the entity through which open source projects are governed.

    The number of open source projects being launched has increased exponentially in recent years as IT vendors transform their business models. Many now contribute their core software to an open source project in the expectation that increased adoption will lead to demand for commercial support services.

    That shift in many ways has led to a change in terms of how innovative software is brought to market. Not too long ago open source software was viewed primarily as a way to create the free equivalent of an existing operating system or database. Today, the bulk of emerging software in the enterprise starts out as open source projects.

    Much of that transition began when more IT organizations adopted “open source first” approaches to IT in the wake of the economic downturn that began in 2008. As the current downturn brought on by the COVID-19 pandemic deepens, it’s probable the preference for open source software is only going to increase in the months and years ahead.

  • Oracle Extends Managed Cloud to On-Premises

    Oracle Extends Managed Cloud to On-Premises

    Oracle today announced it will make available as a managed service in on-premises IT environments all of the software it currently provides access to on Oracle Cloud.

    In addition, Oracle is making available Oracle Autonomous Database on Exadata Cloud@Customer, which brings a managed database service to the Exadata servers optimized to run Oracle databases. Oracle also announced it has certified Siebel, PeopleSoft and JD Edwards applications for Oracle Autonomous Database along with the availability of Oracle Autonomous Data Guard, a managed high-availability and disaster recovery service that ensures near-zero data loss (RPO) and instant recovery times.

    Vinay Kumar, senior vice president for cloud engineering in North America at Oracle, said while cloud service provider rivals have made some services available in on-premises IT environments, Oracle will be the first to deploy a full range of software-as-a-service (SaaS) applications via an Oracle Dedicated Region Cloud@Customer service.

    Priced starting at $500,000 per month, Kumar said the Oracle Dedicated Region Cloud@Customer service is intended to appeal to organizations that because of compliance requirements need to deploy applications in an on-premises IT environment but still want to be able to treat IT as an operational expense.

    Kumar also noted in the wake of the COVID-19 pandemic there are more organizations that would prefer to rely on a service to remotely manage Oracle applications rather than having to set up and manage the networking infrastructure necessary to let IT staffs manage those applications from home.

    Like existing Oracle Cloud services, Kumar said Oracle applications can be deployed on virtual machines, bare-metal servers or Kubernetes clusters. In some cases, Oracle expects IT teams will opt to deploy some applications on-premises while also taking advantage of the existing Oracle cloud services.

    It’s not clear to what degree organizations will shift to relying on vendors to provide managed services versus ether deploying and managing applications themselves or relying on managed services provided by third-party IT services firms. Historically, less than 20% of all IT is consumed as a managed service. However, in the wake of the economic downturn brought on by the pandemic, it’s expected more organizations will prefer to treat IT as an operational expense. Oracle is now making it possible to make that decision regardless of where its applications are physically deployed.

    As applications become consumable as a service anywhere the distinction between what constitutes a cloud service running locally versus in data center owned by some other entity will start to dissipate. Many workloads that make the same application are likely to be running in different locations based on the sensitivity of the data being processed. Regardless of the path forward, the days when “the cloud” applied to only some external service are finally coming to an end.