devopsy.kinsta.cloud

Author: Mike Vizard

IBM CTO Sees Bright Future for Java in 2018

Significant advances in microservices written in Java, as well as tighter coupling between Java applications and containers, are set to transform the way most organizations build and deploy Java applications by the end of the year.

IBM Java CTO John Duimovich, as part of five Java predictions for 2018, noted that The Eclipse Foundation has taken over the development of MicroProfiles, a baseline platform definition that optimizes Enterprise Java for a microservices architectures, and the EE4J project, an effort to create standard application programming interfaces (API) for Java runtime. This, he said, will make it much easier to build next-generation Java applications using programming tools based on the Eclipse integrated development environment (IDE).

In some instances, those applications will take the form of a microservice that gets deployed using a Java runtime. In other instances, those applications will be deployed using containers such as Docker. Duimovich said it’s not only a matter of time before containers and runtimes including Java will become more tightly coupled. That will result in more consistent memory management and easier wiring between Java constructs and containers. For example, Java applications will be able to determine automatically how much memory is available to any given container. That’s critical because the reason most containers fail is they exceed available memory limits, he said.

Duimovich also predicted that Kotlin will be the next big variant of Java to be adopted in the enterprise. Concise coding syntax plus interoperability with other instances of Java have already made it popular for many developers. Now that Kotlin can be used to build applications for devices running Android, this year will see much broader usage of Kotlin to build greenfield applications, Duimovich said. However, he added, it won’t be too long before other variants of Java start employing similar concepts.

Related Content:

Hopes and Fails in DevOps 2017

DevOps Chat: Microservices & Containers – Mastering the Replatforming of the IT Infrastructure

Other major Java predictions for 2018, Duimovich noted, will be optimization of Java runtimes for serverless computing frameworks and a more regular six-month release cycle for incorporating new functions in Java. The rise of serverless computing frameworks will also result in more Java applications being deployed on public and private cloud services, he said.

Duimovich noted that, from a practical perspective, a Java runtime is simply another type of container. The challenge facing DevOps teams will be determining when and where to use Docker containers instead of traditional Java runtime to deliver an application. Whatever the outcome, it’s unlikely any IT organization will standardize on one approach to the exclusion of all others.

The increased rate of Java innovation can be attributed to an Oracle decision made last fall to place Java Enterprise Edition under the auspices of the Eclipse Foundation, said Duimovich. At the same time, IBM moved to open-source its implementation of a Java virtual machine. This has resulted in something of a Java Renaissance, as more developers and organizations are contributing expertise via the Eclipse Foundation.

There’s no shortage of programming language options available these days. But in many cases, if Java is able to build modern applications, then it’s probable many developers will continue to use Java rather than take the time to learn something new.

— Mike Vizard

February 6, 2018
Mirantis CEO Charts Hybrid Cloud Path Forward

Adrian Ionel is back at the helm of Mirantis as CEO at a time when the shift to hybrid cloud computing is tantalizingly close to being an everyday IT reality.

Adrian Ionel, Mirantis CEO

Ionel is one of the original co-founders of Mirantis, which provides a curated instance of OpenStack and Kubernetes cluster software alongside a suite of services to manage them on behalf of a customer. Ionel replaces Alex Freeland, who will remain on the board of directors of Mirantis.

The decision to shift leaders is being driven by the need for Mirantis to grow more rapidly at a time when IT organizations soon will be moving toward unifying the management of multiple clouds, said Ionel.

While Mirantis owes its existence to OpenStack, the company has been rapidly developing Kubernetes expertise that is at the heart of a recently unfurled managed hybrid cloud computing service. Ionel said the rise of Kubernetes provides a unique opportunity to manage private and public cloud services based on Kubernetes via a central control plane.

The challenge Mirantis will face in achieving that goal is the reluctance IT organizations historically have shown when it comes relinquishing control over their IT environments to a third party. In addition, an already fierce number of rival managed service providers (MSPs) also are moving to embrace Kubernetes.

Ionel said most IT organizations underestimate the complexity of managing multiple clouds. As more of them come to that realization, the number of organizations looking to rely more on external expertise to deploy modern microservices-based applications on Kubernetes should increase substantially. To facilitate that transition, Mirantis has crafted a hybrid Kubernetes service that can be invoked programmatically by developers. A crucial factor driving that decision will be increased awareness of the perils of being locked into a specific public cloud service provider. In fact, Ionel noted that many IT organizations today underestimate how easy it is to become entangled by proprietary application programming interfaces (APIs) on a public cloud service such as Amazon Web Services (AWS).

For the immediate future Ionel said Mirantis expects to see most instances of Kubernetes to be deployed on top of virtual infrastructure. Use of Kubernetes on bare-metal systems is confined largely to application development, he said. But as Kubernetes continues to mature, Ionel noted it’s only a matter of time before IT organizations will be deploying more instances of Kubernetes running on both virtual machines and bare-metal servers. That, of course, will further add to the complexity that needs to be navigated.

Ionel said rivals underestimate just how healthy the current Mirantis business is as use of OpenStack continues to increase. AT&T, for example, has now deployed more than 10,000 nodes employing instances of OpenStack provided by Mirantis, he said.

New CEOs don’t usually magically transform a company by their mere presence. But in the case of Mirantis, the opportunity for Ionel to turn potential in real growth is higher, for no other reason than he doesn’t have to first learn how the company operates.

— Mike Vizard

February 5, 2018
Shippable Extends Scope and Reach of CI Service

One of the attributes of building a continuous integration (CI) platform on top of Docker containers is that it’s highly portable. Shippable is making good on that promise by delivering versions of its namesake CI platform that can be employed on Mac OS X, CentOS and Windows platforms as well as to the Ubuntu distribution of Linux.

In addition, Shippable is make available a beta release of an analytics module that promises to improve overall DevOps efficiency.

Manisha Sahasrabudhe, vice president of product management for Shippable, said the company’s namesake CI platform for managing application release cycles now supports every type of platform commonly employed in a DevOps environment.

DevOps teams can now run jobs across multiple operating systems that share access to the same GitHub or Bitbucket repositories. The latest release of Shippable also provides those teams with the ability to granularly allocate a pool of available resources for each job running, Sahasrabudhe said.

Other new capabilities include support for custom scripts and images, as well as the ability to run tasks inside or out of a container.

Finally, Sahasrabudhe said DevOps teams can now also make of an analytics add-on module that DevOps teams can employ to identify bottlenecks, for example, and track various key performance indicators. The analytics module is intended to help organizations move more rapidly down the DevOps maturity curve.

Individual organizations are move down that maturity rate at significantly different paces. But when it comes to DevOps, Sahasrabudhe noted the larger the organization is the more chaotic IT tends to be. Because Shippable is made available as a software-as-service (SaaS) application, the company is in a unique position to enable organizations to compare how they are performing various tasks compared to the rest of the Shippable customer base. Those same organizations are also keenly interested in what’s holding up application development. They may not necessarily be able to eliminate a bottleneck, but deeper insights into the overall process should enable the organization to plan better, Sahasrabudhe said.

For example, organizations typically have a choice of programming tools at their disposal. Analytics could be applied to inform them as to how well any specific programming tool is being used to build specific applications by not only that organization, but also the entire Shippable customer base in aggregate, Sahasrabudhe said. Further on, Shippable also expects to be able to apply both machine and deep learning algorithms to the data its collects to provide even more predictive analytics, he said.

One of the primary reasons many organizations are starting to shift all kinds of management platforms into the cloud is to create a central repository of knowledge that can be easily accessed from anywhere in the globe. Most application development projects today are highly distributed endeavors. Hosting the tools needed to manage those projects enables developers to continue working locally on their own code, while still giving the organizations insights and control over the overall project.

Analytics provided via the cloud is not a substitute for a project manager. But it does provide a means for everyone across the organization, including business leaders, to have a much firmer grasp of the realities of modern application development.

— Mike Vizard

January 31, 2018
Red Hat Rises to Data Management Challenges

Red Hat is moving to reduce or eliminate many of the manual tasks DevOps teams routinely encounter via a beta release of an update to Red Hat Enterprise Linux (RHEL) that addresses multiple data management issues related to DevSecOps and DataOps.

Steve Almy, principal product manager for RHEL, said version 7.5 of RHEL adds support for integration between the Ansible IT automation framework that Red Hat now bundles in the RHEL operating system and OpenSCAP, a security auditing tool originally developed by the National Institute of Standards and Technology (NIST). OpenSCAP provides IT administrators with a baseline of security settings to compare with the current state of their Linux deployment. They then can invoke the declarative Ansible framework to automatically resolve any of those issues raised by the OpenSCAP audit, said Almy.

In a similar vein, Red Hat is also making it easier to securely unlock Network Bound Disk Encrypted devices at boot-time while adding time-stamping and synchronization needs with the addition of failover with bonding interfaces for Precision Time Protocol (PTP) and Network Time Protocol (NTP).

Additionally, to reduce data management headaches, Red Hat is now embedding support for data deduplication and compression software based on technology it gained by acquiring Permabit last year. The goal is to enable IT organizations to perform those tasks on data running on the server before it is ever stored on a disk, said Alby. In many cases, that may eliminate the need to acquire, deploy and manage separate data deduplication and compression software for the storage system. That approach also serves to indirectly benefit DataOps, an emerging discipline through which many organizations are trying to modernize the management of data and the pipelines employed to feed that data into applications.

Other additional management capabilities being added to RHEL 7.5 include an easier-to-use cockpit administrator console for managing storage, networking, containers and other services, and a “known-good” bootable snapshot to help speed recovery and rollback after patching software.

Almy said Red Hat is focusing more on eliminating much of the friction that gets in the way of enabling IT administrators to accomplish more tasks in a specific amount of time. The goal is not to eliminate the need for IT administrators, but rather to eliminate tasks that conspire to make managing IT more time-consuming than it need be. Much of that Red Hat strategy is anchored around an Ansible automation framework that doesn’t require IT administrators to know how to program to automate the management of underlying IT environment.

It’s not clear just how much ease of data management impacts IT decisions. All things being relatively equal, however, IT administrators in the agile programming age are trying to manage more workloads than ever. Most organizations are not adding additional IT operations staff mainly because it’s hard to find and retain them. That means make sure existing IT administrators are more efficient than ever by embracing IT automation whenever and wherever possible to streamline DevOps processes.

— Mike Vizard

January 29, 2018
Flexera Extends Scope of Open Source Scanning Tools

Now that many IT organizations have adopted an open source-first mentality to acquiring new software, tracking their dependency on all the various modules they are employing is becoming more challenging with each passing day. To help IT organizations track both usage and dependencies of open source software, Flexera has updated the FlexNet Code Insight software to continuously scan the network for open source software and highlight any known security and compliance issues.

Based on code Flexera gained when it acquired Palamida in 2016, FlexNet Code Insight is now easy to navigate using a single dashboard, says Jeff Luszcz, vice president of product management at Flexera. Its capabilities span high-level package analysis to more detailed analysis that detects when snippets of open source code are being used within a third-party application regardless of build dependencies, sub components, source code, modified source code and binaries and even Docker containers being used.

In addition, this release of FlexNet Code extends the integration Flexera provides to continuous integration servers and third-party build tools to automate scans during the software development process. IT organizations also can create their own custom plug-ins, says Luszcz.

FlexNet Code Insight can identify 13 million open source components and supports more than 70 extensions. That includes integration with data from the National Vulnerability Database and security vulnerability assessment software developed by Secunia Research, which Flexera acquired in 2015.

Luszcz says FlexNet Code Insight is a natural complement to the tools Flexera already provides for tracking use and dependencies between instances of commercial software. The difference now is a steady increase in the rate enterprise IT organizations are now depending on open source code, which changes more rapidly.

Flexera is not the only vendor these days focusing on identifying open source software (OSS) vulnerabilities and associated compliance issues. But it does uniquely provide tools spanning both commercial and open source software. That capability is especially appealing to senior IT executives who would prefer to rely on a single vendor to provide both classes of tools, says Luszcz.

While there’s currently a lot of enthusiasm for open source software in the enterprise, Luszcz says many IT leaders don’t appreciate some of challenges that lie ahead. Most open source software is made up of modules provided by different developers working within the confines of an open source project. Updates to that software to address, for example, a security flaw are not easily propagated throughout the ecosystem. In fact, Luszcz says that very issue lies at the heart of recent security breaches that occurred at Equifax.

Having a local repository to keep track of what software is being used simply isn’t enough, Luszcz says. IT organizations need an end-to-end approach for monitoring all the updates made to that software regardless of where it originates.

Of course, when it comes to open source software there really is no going back. Lusczs notes that as far as compliance and security are concerned, the proverbial genie is already out of the bottle. The only question now is how to marry OSS tools to DevOps processes to make living with that open source genie a lot easier for all concerned.

— Mike Vizard

January 23, 2018
CA Technologies Survey Uncovers DevSecOps Challenges

When it comes to infusing security concerns into a DevOps culture, most organization still have a very long way to go. A global survey of 1,279 IT leaders conducted by the market research firm Freedom Dynamics on behalf of CA Technologies finds more than half of respondents (58 percent) cited existing culture and lack of skills as hurdles to being able to embed security testing and evaluation within software development processes. Only 24 percent strongly agreed that their organization’s culture and practices supported collaboration across development, operations and security.

More challenging still, less than a quarter of respondents strongly agreed that senior management would sacrifice time to market to make sure there is sufficient time to assess and repair software security vulnerabilities.

Chris Wysopal, CTO for the Veracode portfolio of security testing tools CA Technologies acquired last year, said the survey results make it clear many organizations are still wrestling with the concept of DevSecOps. Many of them may be far along the path to building a culture around DevOps, but more often than not, security teams haven’t been included in those processes, says Wysopal.

Because security teams are not included, many organizations wind up incurring substantial costs by having to address a much broader number of security updates to applications running in production environments. Organizations that have shifted security to the left as part of more comprehensive approach to DevSecOps discover and eliminate many more security issues during the development process.

Wysopal said the survey bears out those conclusions. The survey finds the top 34 percent of respondents who report their organizations have been able to fully integrate security into their software development life cycles view security as an enabler of new business opportunities. These organizations typically exhibited 50 percent higher profit growth and 40 percent higher revenue growth. They are also 2.6 times more likely to have security testing keep up with frequent application updates. Wysopal conceded there’s no direct correlation between better security and better overall corporate performance. But at the very least, the results indicate that organizations that invest more time in DevSecOps are not adversely impacting financial performance.

Organizations that embrace DevSecOps not only ship higher-quality software that reduces total cost of application ownership, they also typically are in a much better position to absorb the application update impact of unexpected security events such as Spectre and Meltdown flaws being discovered in processors. Because of the need to patch these flaws, most application update processes are now being stressed across the entire IT industry.

It remains to be seen what impact the need to quickly address these flaws will have on adoption of DevSecOps. Wysopal noted the old way of addressing security issues during a waterfall-based approach to application development simply don’t work in the age of agile development. IT security teams now need to work hand in glove with application developers. The challenge now, Wysopal said, is getting the leaders of those organizations to come to terms with the impact that change may have on the pace at which software is developed. But given the critical role software now plays in critical business processes, organizations soon will come to appreciate the need to better balance the speed of application development speed against all the potential risks involved.

— Mike Vizard

January 23, 2018
CloudHealth, ParkMyCloud Partner to Contain Cloud Services Costs

Much of DevOps these days focuses squarely on managing application workloads in the cloud that can easily spin out of control from a cost perspective simply because developers frequently forget to turn functions off when they are not being used. To enable DevOps teams to more proactively manage cloud resources, CloudHealth Technologies, a provider of cloud management service, has formed a strategic alliance with ParkMyCloud, a provider of governance tools for cloud services that can be employed to enforce IT policies.

CloudHealth Technologies CEO Tom Axbey says the rise of multi-cloud computing is aggravating an already-complex DevOps management challenge in the enterprise. Integrating the two services will make it simpler for IT organizations relying on the CloudHealth service to manage and monitor clouds and execute an action such as turning off virtual machines using the capabilities enabled by ParkMyCloud.

CloudHealth primarily provides insights into how various cloud computing platforms are being employed. The partnership with ParkMyCloud provides a mechanism through which that intelligence becomes more actionable.

In general, IT organizations more than ever are finding themselves struggling with trying to manage multiple stacks of computing. In addition to running multiple platforms inside an on-premises environment, organizations increasingly are distributing application workloads across multiple public clouds to either take advantage of a specific service or prevent themselves from becoming locked into a single provider. As those workloads become more distributed, many IT organizations now find themselves swiveling between different management frameworks. Rather than manage those environments in isolation, Axbey says CloudHealth Technologies in collaboration with ParkMyCloud is making a case of a more unified approach.

Cost optimization is becoming a much bigger issue, adds Axbey, because IT organizations are discovering that the more workloads deployed on public cloud services, the greater propensity there is to simply let run those infrastructure resources that appear to have a nominal cost. But by the end of a monthly billing cycle, it’s not uncommon for IT organizations to incur a significant expense for a set of services no one was actually using.

CloudHealth Technologies and ParkMyCloud are not the only IT vendors eyeing this opportunity. But Axeby says CloudHealth Technologies has already substantially differentiated itself by providing end-to-end visibility across multiple clouds.

It remains to see how and when IT organizations will evolve to deal with the inherent challenges associated with multi-cloud computing. Many of them are just now getting their arms around mastering DevOps on a single cloud. Each cloud computing environment presents its own myriad set of interfaces and services that must be monitored and managed. Unless IT organizations have a way to centrally manage all those cloud services, the total cost of IT increases with each additional platform added to the environment—not only are more tools required, but each tool needs to be mastered by someone on the DevOps team.

In theory at least, one of the primary reasons to move application workloads to the cloud was to reduce costs. But without some ongoing supervision, moving to the cloud can be anything but less expensive.

— Mike Vizard

January 17, 2018
SolarWinds Acquires Loggly to Add Analytics to DevOps Portfolio

An ongoing SolarWinds effort to drive down the cost of implementing DevOps has been extended by acquiring Loggly, a provider of log analytics software provided as a cloud service.

Christoph Pfister, executive vice president of products at SolarWinds, says the Loggly service rounds out a portfolio of DevOps offerings spanning application and infrastructure monitoring, website monitoring and log management software.

In keeping with the company’s overall DevOps strategy, SolarWinds will provide access to Loggly at substantially less cost than rival log analytics platforms such as Splunk, Pfister says. Pricing for the Loggly service starts at $99 per month. In contrast, other log analytics platforms charge IT organizations based on the amount of data being analyzed, which results in many of them limiting the amount of log data they analyze because of cost concerns.

IT organizations have been making major investments in log analytics to more proactively discover anomalies indicative of either potential application performance issues or security breaches. The more log data being analyzed, the more accurate the analytics being applied to those logs becomes. The goal should be to make data science capabilities as broadly available as possible, says Pfister.

Next up, Pfister says SolarWinds will be working on unifying the user interface experience between Loggly and the rest of its DevOps portfolio. In addition, SolarWinds is examining whatever opportunity there may be to bundle various cloud services together in a single suite of offerings, says Pfister.

Log analytics has emerged as a foundational component of both DevOps and, by extension, digital business transformation. Developers are keenly interested in being alerted to events that might have a potential impact on their applications before they occur. IT operations teams, of course, are relying on analytics to enable them to be more proactive when it comes to making sure IT infrastructure resources are continuously available. At the same time, business users are discovering that log analytics can provide them insights into events that are indicative of how, for example, end users are employing new capabilities that have been added to a website.

While most IT administrators have a lot of experience hunting through logs looking for specific events, the sheer volume of data in those logs prevents most of them from gleaning anything that approaches actionable intelligence. Advanced analytics applications provide the means through which all the log data being collected becomes more valuable to the business.

As it becomes more affordable for more IT organizations to apply monitoring and log analytics, the number of IT organizations embracing DevOps practices should increase. Having access to tools, of course, is only one part of the equation. But most organizations wind up backing their way into DevOps, starting with tools that provide them additional capabilities and insights. Once they master those tools they begin to apply the knowledge and insights they gain to implement more sophisticated DevOps processes. For many IT organizations, however, the cost of acquiring those tools to get started down the path to DevOps has simply been too high.

— Mike Vizard

January 16, 2018
Plutora Brings Order to Application Testing Chaos
One of the reasons application testing doesn’t occur as often or extensively as most IT organizations desire is because managing multiple simultaneous testing projects is complex. To help simplify the management of applications testing at scale, Plutora has updated Plutora Environments, its continuous delivery management platform, which now includes an ability to manage the availability, usage and configuration management involved in testing applications at scale.

Jeff Keyes, director of marketing, says Plutora Environments now provides a single repository through which all application testing can be managed, including identifying and provisioning available IT infrastructure resources.

Made available as a software-as-a-service (SaaS) application, Plutora Environments provides needed governance and control capabilities. Without them, Keyes says, application testing tends to get de-prioritized when developers find it too challenging to quickly access the appropriate resources.

Capabilities added to the latest release of Plutora Environments include the ability to:
- Visually associate new code commits with the features or fixes via a dashboard,
- Ensure accuracy of test coverage across high-velocity tests,
- Trace updated code to specific defects or original requirements, and
- Automatically link change requests to associated test cases.
Keyes notes a large amount of IT infrastructure allocated to testing is being wasted due to a lack of oversight. In many ways, what’s been missing in many DevOps environments is some of the management functionality found it traditional IT service management (ITSM) software, he contends, and the latest release of Plutora bridges that gap within the context of an application testing environment.

Now that developers are being held more accountable for the quality of their applications, demand for access to testing resources will steadily increase, Keyes says. IT organizations then must balance a limited amount of resources against those demands—they may want to shift responsibility for application testing to the left as part of an integrated DevOps process, but to accomplish that goal, they will need to be able to provide developers with access to infrastructure resources for testing purposes on demand. Otherwise, developers will simply opt to continue writing code, even though many of the dependencies on which that code depends has not been tested.

Application testing, regardless of era, regularly gets the short shrift. Developers are almost always falling behind schedule. One of the easiest ways to make up for lost ground is to reduce the amount of time allocated to testing. Some developers even believe agile development methodologies enable them to respond fast enough to any flaw by delivering additional updates—many of which don’t get tested either, because of a lack of time. End users, however, are becoming less forgiving when it comes to application experiences. If an application doesn’t perform as expected the first time, customers are less apt to give that application a second chance, much less a third or a fourth.

Because of that reality, in many organizations there’s more focus than ever on application testing. The challenge is not necessarily creating or running the test, but rather, how best to manage the overall process end to end.

— Mike Vizard
January 15, 2018
Red Hat Survey Sees Broad Adoption of Microservices

A new survey from Red Hat shows the extent to which IT organizations are moving to modernize their IT environments: More than two-thirds of respondents (69 percent) reported they are using microservices for both new applications and re-architecting existing ones.

The survey, which includes responses from 168 IT professionals employing either Red Hat JBoss middleware or Red Hat OpenShift platform-as-a-service (PaaS) software, also confirms that IT organizations are employing a mix of legacy and emerging programming models to build and deploy microservices, says Rich Sharples, director of product management on the middleware team at Red Hat.

Related content: DevOps Chat: Microservices & Containers – Mastering the Replatforming of the IT Infrastructure

For example, Sharples notes, many of the microservices being deployed inside the same organization are being built with both traditional Java programming tools as well as so-called new stacks of software based on containers such as Docker. In fact, a full 87 percent of the respondents are either using or considering multiple technologies to build and deploy microservices, and nearly half the respondents (45 percent) said their organization is committed to “using the right tool for the right task” versus forcing the organization to employ a single technology, runtime or framework.

The top five benefits attributed to microservices are continuous integration/continuous deployment (CI/CD), agility, improved scalability, faster time-to-market, higher developer productivity and easier debugging and maintenance. One-third of respondents (33 percent) said they have achieved two of goals by implementing microservices in the last two to six months.

However, making the shift is by no means easy. The top four challenges associated with making the transition cited by respondents are developing/implementing in-house microservices tooling, reorganizing their organizations, working with vendor subject matter experts/using a vendor as a trusted advisor and purchasing or using a platform/solution.

Microservices clearly are not for the faint of IT heart. Developing and managing a handful is relatively trivial. But managing them at scale can prove daunting to even the most skilled IT organization. Sharples says the most important decision an IT organization can make is determining what application workloads to deploy as a microservice. In many cases, IT organizations will be better off rewriting an existing application that they know how to run than trying to create an application from scratch employing microservices—not only to gain experience, but also to be able to compare the results achieved against what was previously delivered as a monolithic application, he says.

In many ways microservices are the next logical extension of concepts that were pioneered with the advent of service-oriented architectures (SOA) more than two decades ago. The difference now is that microservices tend to be more granular and are often maintained by the developer rather than a centralized IT operations team. Regardless of what level of appreciation an IT organization may have for the history of computer science, the one thing that is clear is microservices are being more broadly adopted than advocates of SOA ever hoped to imagine.

— Mike Vizard

January 12, 2018