devopsy.kinsta.cloud

Author: Mike Vizard

Cisco Moves ACI Strategy Forward

Cisco is advancing its hybrid cloud computing strategy with release of version 5.0 of Cisco Application Centric Infrastructure (ACI), a software-defined networking (SDN) that can be deployed on cloud platforms or networking equipment deployed in an on-premises IT environment.

The latest version of Cisco ACI adds support for a transit gateway between virtual private cloud (VPC) instances on the Amazon Web Services (AWS) cloud to provide a more efficient means of routing traffic across east-west and north-south cloud computing environments.

Cisco is also extending the networking services it provides for the Microsoft Azure cloud to include VNET peering within the Azure Virtual Network, shared service deployments, additional service automation functions.

Via ACI 5.0, IT teams are now provided a centralized view of cloud resource inventory within AWS and Microsoft Azure along with status indicators and a set of wizards to simplify configurations.

Cisco also has deepened the level of integration between Cisco ACI and Kubernetes as well, to increase the level of scale that can be achieved in IT environments based on platforms such as VMware vSphere.

Finally, Cisco has added support for role-based access control (RBAC) in multi-tenancy environments along with two-factor authentication (TFA) capabilities enabled by the Cisco DUO platform. Cisco also added a more flexible policy construct, dubbed Endpoint Security Group (ESG), that can be employed to group endpoints based on L3 attributes and apply contracts between ESGs.

Srinivas Kotamraju, senior director for product management for Cisco ACI, said the latest update to the SDN platform provides IT teams with the equivalent of many of the same networking services that Cisco historically has provided in an on-premises IT environment.

Cisco has been making the case for a hybrid cloud computing approach to delivering network services that enables IT teams to manage those services via a central console. Rather than having to manage networking services provided by each cloud service provider, Cisco ACI makes it possible to deploy the same SDN across multiple clouds and on-premises IT environments. Cisco contends that approach ultimately serves to reduce the total cost of delivering networking services by both centralizing management and making it easier to automate the management of networking services across multiple IT environments.

There are two primary ways Cisco exposes those networking services. DevOps teams can take advantage of application programming interfaces (APIs) to programmatically invoke ACI services. Alternatively, Cisco provides network managers access to a graphical user interface (GUI) through which they can access a command-line interface (CLI) to configure a specific router or switch.

Kotamraju said with the rise of DevOps the number of organizations giving developer programmatic control over networking services continues to rise. It’s too early to say to what degree NetOps and DevOps teams might ultimately converge; however, Kotamraju said finding ways to meld those two groups is being discussed more frequently within many IT organizations as applications become more distributed.

Of course, the biggest challenge when it comes to achieving that goal will be more cultural than technical. However, as networking services become more accessible via APIs, it’s now more a question of when and how than if.

June 3, 2020
Atlassian Unfurls Bevy of DevOps Updates

Atlassian today made a dozen updates to its DevOps portfolio as part of an effort to better unify workflows spanning disparate tools.

Suzie Prince, head of product for Bitbucket at Atlassian, said the latest updates are intended to enable DevOps teams to streamline workflows without requiring everyone in the organization to standardize on the same set of tools.

Updates to the Atlassian DevOps portfolio include DevOps Automation Triggers, which makes it possible to create automation to keep development activities synchronized, such as reassigning issues surfaced in the Jira project management application from Atlassian to code review or sending a message to a Slack channel.

The Bitbucket repository from Atlassian has also been updated to make it easier and faster to review code changes after a pull request. New features such as a consolidated list of tasks, integrated Jira issue creation and activity feed filters make it possible for developers to complete their code reviews faster and juggle multiple pull requests at once, said Prince. A Your Work dashboard in Bitbucket Cloud has also been expanded to include assigned Jira issues.

The Atlassian VS Code integration is also being made available to make it easier for developers who use the Microsoft integrated development environment to more easily track and visualize Bitbucket Pipelines.

A Code Insights in Bitbucket Cloud has also been added to bring scanning, testing and analysis tools into the code review process, including Mabl for test automation and Sentry for automated monitoring. Bitbucket is also now providing integration with Snyk scanning tools to make it easier to discover vulnerabilities.

Available in a preview mode is an automated change management capability across Jira Service Desk Cloud and Bitbucket Pipelines that can be used to pause CI/CD processes, create a change request in Jira Service Desk and trigger deployment once it is approved.

A Risk Assessment Engine in Jira Service Desk Cloud also allows IT teams to score the risk of a change and automatically approve and deploy low-risk changes. A Change Management View has also been added to Jira Service Desk Cloud to streamline approvals for high-risk changes by pulling all of the relevant information together in traceable change requests.

Atlassian has also tightened integration between its Opsgenie incident management software and Bitbucket Cloud to centralize alerts and filters. Via an Incident Investigation Dashboard, members of a DevOps team can look at the deployment that happened right before the incident, add it as a potential cause, and contact the developer who made the change if it needs to be rolled back.

The company has also extended integrations with Slack and Statuspage to facilitate both members of DevOps teams and external stakeholders.

Finally, Atlassian is making available a resources hub to make it easier to share DevOps best practices, templates and guides.

Prince said it’s not ever going to be feasible for most organizations to standardize on one set of DevOps tools. The goal should be to enable organizations to construct DevOps processes in ways that allow developers to employ whatever tool is their favorite at the moment. Only then will organizations get developers to buy into a DevOps process that doesn’t necessarily change the way they are most comfortable working, she noted.

The challenge, of course, is often getting IT leaders to be as equally comfortable with what, from their perspective, might be an experiment in controlled chaos.

June 2, 2020
Chef Extends IT Automation Reach

Chef, at its online ChefConf 2020 event today, launched Chef Compliance and Chef Desktop as well as additional enhancements to the tools it provides for application deployment automation.

John Wyss, vice president of product for Chef, said Chef Desktop enables IT teams to write their own configuration and compliance requirements as human-readable code using YAML files to manage and secure entire fleets of endpoints via a centralized console. It includes pre-written configuration code and curated content that can be employed to both audit and harden desktop operating systems.

IT teams will now avail themselves of a zero-touch process for enrolling and provisioning endpoints while at the same time automating software deployment and management, Wyss said. That includes being able to enforce security policies using configuration profiles, data encryption and system updates.

Chef Compliance, meanwhile, is built on top of Chef InSpec, an open source framework for testing and auditing applications and infrastructure. Chef Compliance takes Chef InSpec further by including tools to automatically audit IT environments based on the specifications defined by the Center for Internet Security (CIS) and Security Technology Implementation Guide (STIG).

Those audits can then be applied to automate the remediation process without having to write code if IT teams so choose, said Wyss. The goal is to provide DevSecOps teams with a unified language for managing security and compliance, he added.

Finally, Chef has updated Chef Enterprise Automation Stack to include analytics to filter and update views for disconnected services and receive real-time health-check messages and status alerts. Chef has also added rapid rollback, package cleanup and layered container support, and has made it easier to manage package settings and deploy packages across multiple platforms.

Collectively, these capabilities should make it easier for DevOps teams to reduce process friction across the entire DevOps life cycle.

In the wake of the economic downturn brought on by the COVID-19 pandemic, interest in IT automation is on the rise. Many organizations are either freezing IT headcount or, worse, yet, reducing the size of their IT staff. At the same time, IT environment is becoming more complex, especially if most employees continue to work from home. IT teams now need a common set of tools for managing not only application deployments on servers or in the cloud but also endpoints. Ultimately, that approach should also go a long way toward reducing the total cost of IT.

In fact, in the wake of the downturn more organizations than ever are receptive to automating IT processes. What was once viewed as potentially an existential threat to the existence of the IT staff has become the only way to manage IT at scale, at a time when cutbacks are broad-based. Organizations that don’t find a way to automate the management of IT are likely to incur significantly higher costs than those that do. Arguably, the issue is no longer what to automate and when, but rather how much and how soon, as both applications and the end users accessing them become ever more distributed.

June 2, 2020
Survey Surfaces Tension Between Software Speed and Quality

A survey of 600 software professionals at organizations with more than 1,000 employees published today by OverOps, a provider of software analytics tools, finds the need to ensure quality still trumps the need for speed within most organizations.

According to the survey results, 70% of respondents say quality is their paramount concern and they would rather delay a product road map than risk a critical error impacting their users. More than half of the survey respondents (53%) said they encounter such critical or customer-impacting issues in production at least one or more times a month. Two out of three survey participants report spending at least a day per week troubleshooting issues in their code, with 30% spending anywhere from two days to a full week.

Nevertheless, organizations continue to invest DevOps (58%) to accelerate application development. Among those organizations, continuous integration (54%) and continuous delivery (42%) platforms were the top priority.

Other areas of investment include microservices/containers (45%), static analysis (37%) and dynamic code analysis (27%).

Nearly half of respondents (45%) said pressure to move fast was one of their top software quality challenges. More than half of respondents (59%) said they release new code/features anywhere from bi-weekly to multiple times a day.

Despite investments in DevOps, however, a quarter of participants also said that over 40% of critical production issues are first reported by end users or customers rather than internal systems.

OverOps CTO Tal Weiss said the survey makes it clear there needs to be more focus on software quality. The challenge organizations face is finding a way to achieve that goal while still accelerating the rate at which code is delivered. Too many organizations are measuring the lines of code delivered without taking into account how often they run into issues in production environments because of the quality of the code deployed.

Of course, whenever a project falls behind one of the first places any organization looks to make up ground is by reducing the amount of time allocated to testing. However, many organizations are also integrating testing within CI/CD platforms to make sure critical testing processes are not skipped in the name of making a deadline.

It’s not clear whether software being deployed today is any higher or lower in quality than software developed using legacy waterfall approaches. As long as humans write code, there will always be issues. Proponents of DevOps will argue that deploying smaller amounts of code more frequently helps mitigate that issue. If errors are discovered, it’s easier for DevOps teams to not only roll back that smaller update but also more quickly discover the source of any issue. Sometimes that issue may have more to do with the platform the code is being deployed on than the code itself.

Regardless of the approach to developing software, there is clearly more at stake than ever. As organizations embrace digital business transformation the quality of any software update can have a major impact on the business. The challenge is first eliminating as many of those disruptions as possible and then, secondly, minimizing their potential impact on the business as quickly as possible.

June 2, 2020
Cloudian Adds Object-Based Storage Platform Monitoring Tool

Cloudian today added a monitoring and observability tool to its object-based portfolio of appliances for storing unstructured data in on-premises IT environments.

Jon Toor, chief marketing officer for Cloudian, said HyperIQ provides access to analytics and health checks that enables predictive maintenance, enhances security and optimizes storage utilization. Cloudian is also pledging to extend the reach of HyperIQ in the future to other IT infrastructure via connectors.

HyperIQ comes in the form of a virtual machine that IT teams download and install on-premises. A free HyperIQ Basic version comes with pre-configured dashboards. HyperIQ Enterprise comes with support and access to more advanced analytics features and is licensed by capacity at 0.025 cents per GB per month.

Cloudian is also providing integration to multiple notification channels, including Slack, OpsGenie, Kafka and PagerDuty, to share alerts based on parameters IT organizations define in HyperIQ. In addition to pre-configured dashboards, IT teams can also leverage more than 100 data panels to drill into user or storage data at a more granular level.

Toor said HyperIQ will become the foundation upon which Cloudian will also start to add AIOps capabilities to its platform. Based on machine learning algorithms, HyperIQ will enable Cloudian to collect the data required to train those algorithms, he said.

Cloudian has been making the case for a distributed storage system that enables IT teams to globally manage appliances via a single user interface. As modern applications have become more complex, the need to access unstructured data stored within on-premises IT environments has become more pronounced.

The challenge IT teams face is they don’t have enough staff available to manage each of those systems locally. In the wake of the economic downturn brought on by the COVID-19 pandemic, that issue has only become further exacerbated. Many IT organizations are either trying to reduce the size of their IT staff or limit the number of additional full-time employees they hire.

At the same time, the amount of unstructured data an organization needs to store continues to grow. While much of that data can be stored on public clouds, a wide variety of global compliance regulations require much of that data to be stored in an on-premises IT environment.

Given how distributed that data is, there is a clear need for deeper levels of analytics that ultimately should enable the management of distributed storage systems to be more automated. Many IT organizations have already significantly automated the management of storage systems within a local data center. The challenge now is to automate distributed systems residing in multiple geographic regions.

Reliance on object-based storage systems to manage unstructured data within local data centers is still a relatively new phenomenon. Cloud storage service providers have been making use of object-based storage systems for the better part of a decade to manage massive amounts of data. Now internal IT teams are starting to follow suit. It’s not likely object-based storage systems will completely replace file-based storage systems anytime soon. However, the opportunity to automate the management of modern object-based storage systems may be far greater.

June 2, 2020
BMC Software Closes Compuware Deal, Sets Course

BMC Software today announced it has formally completed its acquisition of Compuware as part of an expanded effort to modernize mainframe environments.

Bill Miller, president of ZSolutions at BMC, said now that the deal has been closed the combined companies will be able to more tightly integrate Compuware’s Topaz application development and deployment platform with the BMC Automated Mainframe Intelligence platform, as part of an Autonomous Digital Enterprise (ADE) initiative based on ongoing investments BMC is making in AIOps.

Chris O’Malley, CEO of Compuware, said that level of integration will, for example, make it easier to automate the deployment of database and provisioning of mainframe resources using tools from BMC within a set of DevOps processes optimized for mainframe environments.

The goal is to make the mainframe just one more target platform on which DevOps teams can build and deploy applications faster, added O’Malley. That’s becoming a bigger requirement in the wake of the economic downturn brought on by the COVID-19 pandemic, he said, as organizations prioritize digital business transformation initiatives that will inevitably require updates to mainframe applications.

Rather than increasing technical debt by duplicating existing capabilities, O’Malley said more organizations will look to modernize mainframe applications to make them more accessible to a wide variety of front-end applications.

The rate at which IT organizations that deploy applications on mainframes have been adopting DevOps has been uneven at best. Mainframe applications are often considered to be among the most mission-critical in the enterprise. Therefore, IT teams have relied on waterfall processes to build and deploy mainframe applications in a more deliberate fashion.

At the same time, however, the use of Linux on mainframes has increased considerably in the last several years. The applications deployed on Linux operating systems on the mainframe frequently employ the same DevOps processes to deploy applications on Linux running on distributed computing systems.

BMC’s ambitions, of course, far exceed the mainframe. The company has a portfolio of tools for managing both distributed computing and mainframe platforms. During the economic downturn, BMC is betting many IT teams will be under increased pressure to reduce the total cost of IT by centralizing the management of mainframes and distributed computing systems, among other moves.

Of course, BMC is not the only IT vendor with similar ambitions. IBM and Broadcom, which acquired CA Technologies, are moving down a similar path. IT organizations will need to determine which providers enable them to best streamline management processes.

In the meantime, it remains to be seen how much organizations remain committed to the mainframe. It’s generally not feasible for most organizations to move a transaction processing application running on zOS into the cloud. However, it doesn’t necessarily follow that those IT organizations will continue to invest in building and deploying new applications on mainframes instead of making them more accessible via application programming interfaces (APIs).

Regardless of the strategy adopted, however, it is not likely that after being around for more than 50 years, mainframes will be disappearing anytime soon.

June 1, 2020
PagerDuty Looks to Streamline IT Incident Management

PagerDuty has added more automation and analytics capabilities into its portfolio of incident management tools, at a time when organizations are looking to significantly reduce the total cost of IT.

Jonathan Rende, senior vice president of product at PagerDuty, said the general release of Intelligent Triage advances the level of AIOps that can be applied to incident management by eliminating a raft of manual tasks.

Intelligent Triage aggregates signals from more than 375 monitoring, observability and ticketing tools, which are then grouped based on relationship and elevated depending on the impact on the business. That level of contextual data makes it possible for IT teams to increase productivity while dramatically reducing alert fatigue, said Rende.

At the same time, PagerDuty is adding support for integration with Microsoft Teams alongside existing support for Slack. IT teams are increasingly relying on these collaboration tools to process requests for help from end users, he noted.

In some cases, IT teams are communicating with one another via these media or employing built-in tools embedded in the PagerDuty incident management platform. In either case, workflows across IT teams are now occurring in near real-time, said Rende.

Finally, PagerDuty is adding a Dynamic Service Directory to give DevOps teams a central knowledge base that identifies owners and experts for each service and their associated run books, in addition to making available a mobile status dashboard to allow remote teams to collaborate more effectively when incidents arise. That capability is especially critical at a time when many IT staffs continue to work from home as part of the effort to combat the COVID-19 pandemic, said Rende.

In general, IT organizations are looking to automate incident response whenever possible to both minimize costs and potential disruptions. Businesses are more dependent on IT services than ever. However, as more applications are deployed the nosier the IT environment becomes. Discerning which alerts are stemming from the same root cause issue becomes more relevant as organizations either limit headcount or even look to reduce it during a time of widespread economic uncertainty.

Of course, regardless of the state of the economy, most IT professionals would rather not have to waste time on manual tasks that don’t add a lot of value to the business. Most IT professionals need to free up more time to achieve more pressing goals. Every minute spent on chasing down an alert that winds up being yet another wild goose chase just piles on more stress.

Advances in automation and AIOps have been coming at a steady pace for the last several years. The adoption of these new capabilities to manage incidents has been uneven at best. In the wake of the economic downturn brought on by the pandemic, it’s now more a question of how soon IT organizations will be tapping into these capabilities to streamline the management of IT. After all, many IT managers are going to conclude there’s no sense in letting a good crisis go to waste.

June 1, 2020
Report: Debugging Efforts Cost Companies $61B Annually

Undo, a provider of a software failure replay platform, this week published a report in collaboration with a Cambridge Judge Business School MBA project that estimates 620 million developer hours a year are wasted on debugging software failures, at a cost of roughly $61 billion.

The report also notes software engineers spend on average of 13 hours to fix a single software failure.

According to the report, 41% said identified reproducing a bug as the biggest barrier to finding and fixing bugs faster, followed by wiring tests (23%) and actually fixing the bug (23%). Well over half (56%) said they could release software one to two days faster if reproducing failures were not an issue. Just over a quarter of developer time (26%) is spent reproducing and ﬁxing failing tests.

On the plus side, 88% of respondents said their organizations have adopted continuous integration (CI) practices, with more than 50% of businesses reporting they can deploy new code changes and updates at least daily. Over a third (35%) said they can make hourly deployments.

Undo CEO Barry Morris said the report makes it clear organizations need to be able to record software to reduce the amount of time it takes to find bugs. Unfortunately, even then finding a bug is still a labor-intensive process that can involve analyzing millions of lines of code. In the future, software replay systems will be infused with machine learning algorithms to accelerate the bug discovery process, he noted. As software becomes more instrumented, the observability data and metrics that machine learning algorithms require to detect patterns is becoming more accessible.

In the meantime, while CI has been embraced, the continuous delivery (CD) side of the DevOps equation remains a challenge. Each platform software is deployed on is unique, so most organizations find automating software delivery problematic.

Regardless of DevOps approach, it’s clear there’s still lots of room for improvement when it comes to developing software. Even the most advanced practitioners of DevOps are limited by the rate at which software bugs, including security flaws, can be discovered and remediated. Of course, there may come a day when machine learning algorithms automate much of that process, including determining which types of tests to run. For now, however, many organizations could streamline the software debugging process by recording instances of applications when they are built and when they are deployed. After all, each platform that software is deployed on has attributes that inevitably impact how software on the platform runs.

As software continues to become more complex in the years ahead, challenges associated with debugging applications will only continue to grow. In the age of microservices, the issue that software engineers are trying to troubleshoot might not have anything to do with the code they wrote; rather, the issue emanates from a service they invoked via an application programming interface (API). Whatever the source of the problem, it’s apparent to all a lot of time and money is being wasted on debugging software that could be put to far better use.

May 29, 2020
Report Finds Most Cloud Security Issues Left Unaddressed

Accurics, a provider of a platform for assessing the security of cloud computing environments, has published a report that finds that even once discovered, only 4% of issues reported in cloud production environments are addressed.

Based on research conducted using its platform and other public sources of data, the report also finds 90% of organizations allow privileged users to make configuration changes directly to a cloud infrastructure after it is deployed.

Issues such as open security groups, overly permissive identity access management (IAM) and exposed cloud storage services make up 67% of the most common cloud security issues being uncovered, according to the report.

The Accurics report echoes similar findings published by Unit 42, the cybersecurity arm of Palo Alto Networks, which found more than 199,000 templates have medium-to-high vulnerabilities in use on public clouds.

Accurics CEO Sachin Aggarwal said that as more organizations embrace infrastructure as code using tools such as Terraform, policy guardrails aren’t being put in place. More troubling still, security assessments seem to be few and far between. That’s especially problematic because cybercriminals now routinely probe every layer of the application stack looking vulnerabilities, he noted. In effect, cybercriminals are assessing cloud applications and infrastructure more frequently than IT teams.

Aggarwal said beyond making sure the appropriate guardrails are in place in terms of overall security posture, organizations need to have confidence in the DevOps processes being adopted. That doesn’t mean cybersecurity teams should put rules in place that slow that application development process down. Rather, tools that surface cybersecurity issues and then provide a method to automate the remediation of any vulnerabilities discovered need to be put in in the hands of IT professionals, he said.

The challenge organizations face is the processes that are employed to secure on-premises IT environments largely don’t translate well to highly dynamic cloud computing environments that assume a shared responsibility approach to IT. Public clouds are obviously popular with DevOps teams that can programmatically invoke resources on demand. However, those teams generally don’t have much cybersecurity expertise. Too often, DevOps teams assume cybersecurity tasks are being handled by a cloud service provider. Of course, the cloud service provider is only securing the services they provide. Any configuration issue is not their responsibility.

The result is as more changes are made to the IT environment, the more likely that mistakes will be made. Catching all those issues without the aid of tools is an unreasonable expectation for any IT organization, much less a DevOps team that may be working beyond the purview of the rest of the IT organization.

No one sets out to create a cybersecurity issue. But in the rush to deploy or update an application it’s easy to overlook a cybersecurity issue. The goal should be to eliminate as many of those mistakes as possible before they are ever made. However, as long as humans are involved, there will be errors. So the next most important thing is to be able to correct those mistakes as quickly as possible without having to disrupt the entire IT environment.

May 29, 2020
Survey Sees Increased Agile Adoption During COVID-19

A report published by Digital.ai, the parent company of CollabNet VersionOne, finds 43% of organizations have increased their reliance on agile application development methodologies in the wake of the COVID-19 pandemic, with 15% saying it has increased significantly in the last 90 days.

The report also notes 33% of respondents say they have increased or expanded Agile adoption in the last 90 days to help manage distributed teams, while 55% said their company plans to increase the use of agile in the next 12 to 14 months.

Based on a pair of surveys conducted prior to and after the pandemic started, the 14th annual “State of Agile” report also finds 60% of respondents credit agile methodologies with having helped increase speed to market, while 58% say it has improved team productivity. Another 41% say they are also better able to manage distributed teams.

Mike O’Rourke, chief research and development officer for Digital.ai, said there is a clear correlation between the ability to manage distributed application development teams and successfully navigating the pandemic now that most application development and deployment teams are working from home.

Many of those teams are also seeing application development deadlines being moved up as organizations prioritize digital business transformation initiatives that now are core to any business continuity strategy.

That shift is also accelerating a shift toward focusing more on business metrics for measuring success as defined by, for example, the Scaled Application Framework (SAFe), said O’Rourke, noting as a result, there’s also a lot more focus on value stream management across the enterprise as business and IT teams work closely together. The survey finds just over half of the respondents report their organization has either already implemented value stream management (VSM) or are planning to do so.

The survey also finds more focus on risk and compliance, with the number of respondents identifying and measuring technical risk prior to deployment increasing 54%, while the importance of automated audit compliance and governance across control points increased 10% year over year.

Perhaps most surprising, the survey finds reducing project cost is cited as an important reason for adopting agile by only 26% of the respondents, a 41% drop from the previous year. The number of organizations focused on release planning decreased by 11%; however, organizations focusing on product road mapping increased 9% over the previous year. The survey also finds slightly more respondents are using automated acceptance tools (3%). Another 12% said they plan to adopt agile project management tools in the future.

It’s not clear whether increased focus on application development might result in bottlenecks when it’s time to deploy those applications. Organizations that have already embraced best DevOps practices alongside agile development methodologies will naturally be in a better position to deploy applications. At the same time, increased focus on digital business transformation is likely to accelerate the adoption of both agile development methodologies and best DevOps practices across the enterprise.

In fact, it’s arguable that organizations that are not able to build and deploy applications adroitly may soon find they are unable to compete at a time when software development has become critical to their survival.

May 29, 2020