devopsy.kinsta.cloud

Author: Mike Vizard

  • Latest eBPF Advances Are Harbingers of Major Changes to IT

    Latest eBPF Advances Are Harbingers of Major Changes to IT

    The open source community advancing the extended Berkeley Packet Filter (eBPF) gathered at a virtual eBPF Summit today that featured a demonstration of eBPF being used in a Windows environment. eBPF enables applications to run within a sandbox in the Linux microkernel.

    Microsoft has signaled its intent to employ eBPF within Windows like the latest version of Linux already does today. That capability makes it possible to, for example, run networking, security, observability and storage software closer to the kernel to dramatically improve performance versus running that software in user space.

    Liz Rice, chief open source officer for Isovalent, a provider of networking software based on eBPF, said that while it’s clear eBPF will have a major impact on IT, the transition to eBPF won’t be a single event. Instead, it will be more of an evolutionary process that will occur as organizations upgrade their operating systems and the various tools and applications they employ.

    The eBPF Foundation, an arm of the Linux Foundation, was formed to expand the use of eBPF across all operating systems. Members of the eBPF Foundation include Facebook, Google, Isovalent, Microsoft and Netflix.

    In effect, eBPF changes the way operating systems are designed. It bridges the boundary between kernel and user space by enabling developers to combine and apply logic across multiple subsystems that were historically completely independent. That approach enables, for example, a security tool to scale to the point where it can identify threats at much higher levels of throughput at a time when brute-force cyberattacks are overwhelming existing cybersecurity tools.

    Similarly, networking, storage and observability tools should be able to run at much higher levels of scale. That’s especially critical for DevOps teams embracing observability platforms that need to dynamically process massive amounts of data in near-real-time.

    Less clear is the degree to which eBPF might one day drive convergence across distinct categories once multiple tools and applications run at the microkernel level.

    IT organizations would be well-advised to ask their vendors when they plan to support eBPF as they plan their upgrade cycles. It’s not likely IT teams are going to want to upgrade every tool and application that can benefit from eBPF all at once. In fact, updates to these applications that don’t support eBPF might even be postponed in the knowledge that a much larger and arguably more critical update is on the immediate horizon.

    In the meantime, as the number of organizations running the latest versions of Linux continues to increase, more hands-on experience with eBPF will be gained. IT teams may not need to concern themselves with what is occurring in the microkernel of the operating systems, but they should at least understand how eBPF ultimately helps reduce the total cost of running IT and how it makes the Linux microkernel more programmable. Those IT teams, however, will soon discover how stark a difference in performance there will be.

  • Nitric Adds Support for Additional Languages to IaC Alternative

    Nitric Adds Support for Additional Languages to IaC Alternative

    Nitric today announced it has added support for the Go and Kotlin programming languages to its application framework. The framework automatically creates code to provision infrastructure based on the way the code used to write an application has been developed.

    Rak Siva, vice president of engineering for Nitric, said that approach eliminates the need to rely on developers using infrastructure-as-code (IaC) tools to configure platforms.

    Nitric previously supported JavaScript, Python and C# along with frameworks such as Express, Fastify and Nest.js to enable infrastructure to be automatically configured based on an intent expressed in the codebase enabled by a software development kit (SDK). In effect, Nitric infers how to optimally configure infrastructure. DevOps teams can then choose to either rely on the configurations created by the Nitric framework or customize it to add support for their own policies, said Siva.

    While IaC tools have played a major role in streamlining the application development and deployment process, they are also the root cause of many cloud security incidents. Developers that use these tools typically have limited cybersecurity expertise, so the probability that cloud infrastructure will be misconfigured in a way that cybercriminals can exploit is high.

    Nitric is attempting to take the concept of managing infrastructure-as-code to the next logical level by automating the process so it can be consistently applied and managed, said Siva. That approach provides the added benefit of improving the overall developer experience by eliminating a task that most developers view as a means to a larger end, he added.

    It’s not clear how much of the cloud infrastructure that DevOps teams are relying on to build and deploy applications is misconfigured, but given the varying levels of skill among developers, there are very few organizations that have not encountered a cloud security issue. The challenge is not so much the security of the underlying platforms as it is the shared responsibility model relied on to secure these platforms. Cloud security platform providers assume that organizations that programmatically invoke infrastructure have the expertise required to securely provision it. However, very few organizations can achieve that goal 100% of the time, which results in organization having to make considerable investments in additional tools and platforms to monitor and enforce cloud security policies.

    As more organizations focus their efforts on securing software supply chains, many of them will be revisiting how cloud infrastructure is provisioned. In fact, one of the reasons platform engineering is gaining traction as a DevOps methodology is to improve the developer experience and strengthen application security.

    Cultural change, of course, is difficult. IaC tools such as Terraform are deeply embedded within many DevOps workflows, so any alternative approach to provisioning infrastructure will require time to take hold. However, as regulations that hold organizations more accountable for application security become increasingly more stringent, it’s now a question of when rather than if change will come to how cloud infrastructure is provisioned.

  • JFrog Extends DevOps Reach to Manage and Secure AI Models

    JFrog Extends DevOps Reach to Manage and Secure AI Models

    At its swampUP 2023 conference, JFrog today added additional security capabilities to its continuous integration/continuous development (CI/CD) environment as well as making it possible to manage machine learning models within the context of a DevOps workflow.

    The latest edition of the JFrog Software Supply Chain Platform adds an integrated static application security testing tool (SAST) to scan source code alongside the existing JFrog Xray tool for scanning binaries.

    JFrog has also added an Open-Source Software (OSS) Catalog to the JFrog Curation service to make it simpler for DevOps teams to discover specific packages that have been determined to be secure. JFrog is also adding Release Lifecycle Management (RLM) capabilities that enable aggregating software artifacts into an immutable software package that serves as the single source of truth as multiple iterations of an application are developed. JFrog RLM uses anti-tampering systems, compliance checks and evidence capture to collect data and insights to ensure the immutability of signed binaries.

    Finally, ML Model Management capabilities, available in beta, are being added to the platform to make it possible to store AI models, run AI models from Hugging Face, a provider of open source AI models, as a proxy in cache via an application programming interface (API) and apply DevSecOps best practices to govern, secure and ensure licensing compliance.

    JFrog CTO Yoav Landman said that as DevOps teams become more familiar with AI models, it’s becoming increasingly clear they are managed like any other software artifact incorporated into a DevOps pipeline. He noted that the approach provides the added benefit of helping to ensure AI models have not been poisoned by malicious data and prompts that would deliberately cause a hallucination.

    Most AI models today are created by data scientists using machine learning operations (MLOps) best practices that each organization defines. In some instances, those processes include what is known as a feature store that enables data scientists to track which components are being used at any given time. However, once a model is completed, it needs to be integrated into an application—a process that, from a DevOps perspective, is best facilitated by storing an AI model in a Git repository alongside other components that need to be managed.

    It’s still early days as far as the convergence of DevOps and MLOps practices are concerned. Going forward, as it becomes apparent almost every application will be invoke some type of AI model, the need to integrate these workflows is becoming a more pressing concern.

    It’s now only a matter of time before AI models become a pervasive element of the software development life cycle as they are continuously retrained and updated. It will generally fall to DevOps teams to manage the deployment and updating of those AI models in collaboration with the data science teams that train them. The immediate challenge, of course, will be to bridge the significant cultural divide between two very different types of IT professionals.

  • Survey Surfaces Spike in Generative AI Usage Across IT

    Survey Surfaces Spike in Generative AI Usage Across IT

    A survey of 800 DevOps and application security operations (SecOps) leaders published today found nearly all (97%) are making use of generative artificial intelligence (AI).

    Conducted by the market research firm Sago on behalf of Sonatype, the survey found that beyond writing code, a full 45% of the 400 security operations professionals have already embedded generative AI into their workflows compared to 31% of the 400 DevOps professionals.

    Security operations teams also reported greater time savings than their DevOps counterparts, with 57% saying generative AI saves them at least six hours a week compared to only 31% of DevOps respondents that saw the same benefit.

    The top benefits cited by security operations teams is increased productivity (21%) and faster issue identification/resolution (16%) compared to faster software development (16%) and more secure software (15%) cited by DevOps professionals.

    It’s still early days as far as embedding generative AI in workflows is concerned, but it’s clear the ability to write code faster is trumping concerns about the increased number of vulnerabilities that might find their way into application environments. The most widely used generative AI platforms are trained on a massive corpus of data that includes code of varying quality. As such, a lot of the code generated by a general-purpose AI platform will likely have as many errors, including vulnerabilities, as the code used to train it.

    The level of faith organizations will place in that code will be heavily influenced by use cases. A script used to automate DevOps workflows that are not externally facing may be one example of where a general-purpose AI platform can boost productivity. In other instances, code that contains vulnerabilities that find their way into a web application might be much more problematic.
    Despite those concerns, however, the survey finds nearly three-quarters (75%) of all respondents feel pressure to use generative AI.

    There are, of course, already large language models trained on code that has been vetted by software engineers. In the months ahead, the code generated by AI platforms specifically designed for that purpose should significantly improve.

    Sonatype CTO Brian Fox said it’s only a matter of time before IT organizations focus more on ensuring the generative AI platforms are tuned for specific tasks. In the meantime, however, application security may get worse before it gets better, with more than three-quarters of DevOps respondents noting that generative AI will result in more vulnerabilities in open source code. Only 58% of security operations professionals are similarly concerned.

    It will be up to the engineers that make up these teams to bring discipline to code quality practices and make sure the code running in a production environment is of high quality, regardless of how it was created, noted Fox. For the moment, the issue is that AI augmentation is now occurring at a faster pace than the AI advances that should one-day help DevOps teams cope with increasingly larger codebases, he noted.

    Survey respondents are also concerned about who might own the code generated by AI. A total of 40% said developers or the organizations they work for should own the copyright for AI-generated output, and most of them agreed developers should be compensated for the code they wrote if it’s used in open source artifacts in LLMs (DevOps 93% versus SecOps 88%). A total of 42% of DevOps respondents and 40% of SecOps respondents said a lack of regulation could deter developers from contributing to open source projects.

    DevOps and SecOps leads both want more regulation: Asked who they believe is responsible for regulating the use of generative AI, 59% of DevOps leads and 78% of SecOps leads said both the government and individual companies should be responsible for regulation.

    At this point, the proverbial generative AI genie is out of the bottle, so there is no going back. The issue that remains to be seen is how DevOps and security operating teams will adjust to that new reality.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    CareerBuilder.com

    Cognizant Technology Solutions
    Phoenix, Arizona
    Senior DevOps Architect
    $130,000 to $180,000

    Indeed.com

    IBM
    Research Triangle Park, North Carolina
    SAP DevSecOps SME
    $126,000 to $235,000

    Dice.com

    DGN Technologies
    Dallas, Texas
    Azure DevOps Engineer
    $110,000 to $115,000

    SimplyHired.com

    Sabre Systems
    Lexington Park, Maryland
    Cloud Engineer – DevOps
    $106,000 to $134,000

    LinkedIn

    Deloitte
    Miami – Fort Lauderdale, Florida
    Junior Cloud Infrastructure Architect
    $65,000 to $97,000

  • Despite Concerns, AI Increasingly Used to Build Software

    Despite Concerns, AI Increasingly Used to Build Software

    A survey of 1,001 senior technology executives, developers, and security and operations professionals published this week by GitLab finds 67% are working for organizations already using artificial intelligence (AI) to build software, with 60% of those respondents reporting their organizations use it every day. A full 90% said their organizations are either already using or plan to use AI to build software.

    More than half (51%) have already identified productivity as a key benefit, but 32% are also “very” or “extremely” concerned about introducing AI into the software development life cycle (SDLC).

    Those concerns included AI-generated code introducing security vulnerabilities (39%) and whether that code may not be subject to the same level of copyright protection as human-generated code (48%). A full 95% of senior technology executives said they prioritized privacy and intellectual property protection when selecting an AI tool.

    Most organizations will continue to move forward with AI, but nearly two-thirds of respondents (65%) who use or are planning to use AI for software development said their organization hired or will hire new talent to manage its implementation.

    A full 81% cited a need for training to successfully use AI in their daily work, with 75% of respondents saying their organization provides training and resources for using AI. However, a roughly equal percentage also said they are finding resources on their own.

    David DeSanto, chief product officer for GitLab, said it’s already clear that AI will have a major impact on productivity simply because 75% of a developer’s time is typically spent on activities that have nothing to do with writing actual code.

    Less clear is the amount of expertise required to use AI to build software. In some cases, development teams may need to master, for example, prompt engineering to automate DevOps workflows at scale, but in many more instances, it’s likely the DevOps platform will automatically execute the commands required.

    Regardless of approach, it’s clear that as the amount of code being created by developers starts to steadily increase, the need to leverage AI to manage DevOps workflows will become more acute. The challenge is the pace at which developers can leverage AI to write code is, for the moment, exceeding the pace at which it is being embedded into DevOps platforms.

    In addition, organizations must determine whether to converge DevOps workflows with the machine learning operations (MLOps) workflows used to build AI models that are integrated into applications. As more MLOps capabilities are added to the GitLab platform, it will become easier to achieve that goal and enable data scientists to work more collaboratively with DevOps professionals, noted DeSanto. Today, a cultural divide between two distinct IT cultures is slowing down the pace of AI innovation.

    One way or another, DevOps workflows are about to be transformed. The challenge now is determining which tasks and bottlenecks are likely to be eliminated by AI to enable DevOps teams to focus on managing applications at an unprecedented scale.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    LinkedIn

    Icertis
    Phoenix, Arizona
    Principal Azure DevOps Engineer
    $132,000 to $199,000

    SimplyHired.com

    Decision Sciences International
    Remote
    DevOps Engineer
    $130,000+

    Indeed.com

    Hewlett-Packard Enterprise
    Durham, North Carolina
    DevOps Engineer
    $124,500 to $286,300

    CareerBuilder.com

    CACI
    Oklahoma City, Oklahoma
    DevOps Platform Engineer
    $104,200 to $229,200

    Dice.com

    SPECTRUM
    Greenwood Village, Colorado
    DevOps Engineer
    $78,900 to $139,500

  • Broadcom Survey Surfaces Drive to Consolidate Automation Platforms

    Broadcom Survey Surfaces Drive to Consolidate Automation Platforms

    Broadcom this week published a global survey of 535 IT leaders that found more than three-quarters (78%) are moving to consolidate cloud automation tools and platforms. However, thus far, only 8% of respondents said they had completed that effort.

    Overall, the survey also found more than 81% already have multiple cloud automation solutions in place, and 70% noted this issue had created significant challenges, including increasing time to automate (59%), time to report (52%) and time to remediation (52%) and higher costs (49%). In addition, 46% noted it’s more difficult to troubleshoot IT environments, while 41% noted multiple tools increase compliance risks.

    IT teams also find that having multiple automation tools slows down software delivery (37%) and contributes to the over-provisioning of IT environments (32%).

    Aline Gerew, head of automation for the Agile Operations Division at Broadcom, said the multiple islands of automation that have evolved on various cloud computing platforms now need to be centralized to reduce the current level of friction in the cloud. Those efforts need to start with platforms capable of unifying observability across all the platforms employed, she added.

    The amount of consolidation that any IT organization can implement depends on the amount of political capital they have. In many cases, the applications and associated automation tools running in any given environment have been adopted by a department or business unit that exercises a lot of autonomy regarding IT. The issue that creates is multiple tools and platforms increase the total cost of IT. At a time when many organizations are experiencing economic headwinds, the need to reduce the total cost of IT naturally becomes a more pressing concern.

    Rather than consolidate automation tools and platforms, the simpler option is to deploy an automation framework that is designed to be integrated with the various tools and platforms that are already in place, noted Gerew. That approach enables automation to be applied at much higher levels of scale to reduce costs without forcing every arm of an organization to standardize on the same tools and platform, she noted.

    The survey found that, when it comes to cloud automation, the most important consideration factors are operational costs (62%), performance (53%) and operational efficiency (49%).

    Responsibility for cloud automation will naturally vary from one organization to the next, but the survey noted that 67% of respondents currently have a cloud architect on staff and another 33% are planning to hire one.

    That role is increasingly required as organizations find themselves managing a wide range of cloud computing environments, including software-as-a-service applications (57%), legacy applications that have been lifted into the cloud (56%), new cloud-native applications (46%) and legacy applications that have been refactored for the cloud (41%).

    It’s apparent that cloud computing environments are becoming more complex with each passing day. There may come a day when artificial intelligence (AI) helps reduce the level of complexity; in the meantime, IT organizations need to find ways to streamline the management of cloud computing environments. Today, those environments are made up of applications based on a wide range of increasingly divergent architectures as the rate of application deployments exceeds the retirement of legacy apps.

  • Cisco Aligns With Nutanix on Hybrid Cloud Computing

    Cisco Aligns With Nutanix on Hybrid Cloud Computing

    Cisco and Nutanix this week announced a strategic partnership through which the two companies will collaborate to advance hybrid cloud computing.

    As part of that agreement, Cisco is committing to making AHV virtual machine software from Nutanix available from the edge to the cloud, starting with the Cisco Unified Compute Systems (UCS) rack and, soon after, blade servers.

    Jeremy Foster, senior vice president and general manager of Cisco Compute, said via a software-as-a-service (SaaS) platform, Cisco will be able to centrally manage virtual machines from Nutanix alongside the other major virtual machines it already supports.

    In addition, the partnership will enable Cisco to apply multiple forms of artificial intelligence (AI) across a hybrid cloud computing environment, he added.

    Thomas Cornely, senior vice president of product management for Nutanix, said the goal is to provide IT teams with an opportunity to consolidate infrastructure across a hybrid cloud computing environment. In effect, Nutanix and Cisco are working toward converging the control planes across their entire respective portfolios, he added.

    The goal is to enable IT teams to streamline the number of platforms that need to be supported as part of an effort to reduce the total cost of IT, said Cornely.

    The issue that IT organizations regularly encounter is that each platform requires hiring additional IT personnel to manage. At a time when many organizations are encountering economic headwinds, there is a natural inclination to reduce the number of platforms as the size of the IT staff is reduced. Despite advances in automation, IT labor costs still represent the largest overall segment of any IT budget.

    It’s not clear how aggressively IT teams are consolidating IT infrastructure to reduce costs, but after more than a decade of continuous investments in IT, many organizations are discovering they are supporting a wide range of platforms. During a downturn, however, IT teams tend to more aggressively eliminate “snowflake” platforms that require unique skillsets to manage, noted Cornely.

    In the meantime, IT environments are also becoming more distributed as more workloads move to the network edge. Those workloads are not replacing applications running in on-premises or cloud computing environments, so the overall IT footprint will continue to increase. Given the chronic shortage of IT skills, the only way to effectively manage that IT estate will be to rely more on automation frameworks increasingly infused with AI.

    Each IT organization will need to determine for itself what level of automation to embrace, but Cisco is betting most will opt to rely on a SaaS platform provided by a vendor versus building and maintaining an IT management platform themselves. Regardless, legacy approaches that depend heavily on manual processes will increasingly give way to cloud-based platforms that can more easily manage workloads wherever they happen to be deployed.

    The issue now, as always, is funding the transition to new platforms to bring the total cost of IT back under control and eventually pay for themselves.

  • Grafana Labs Delivers Open Source Code Profiling Tool

    Grafana Labs Delivers Open Source Code Profiling Tool

    Grafana Labs this week released version 1.0 of an open source tool that collects data about an application’s code to aid debugging, troubleshooting and optimization efforts. The tool makes it simpler to identify the specific lines of code driving a process or task within an application.

    Ryan Perry, engineering director for Pyroscope at Grafana Labs, said Grafana Pyroscope 1.0 combines a tool acquired last year from a company he led with Grafana Phlare, a code profiling tool that Grafana Labs previously developed. The combination of the two tools provides a more precise code-tracking capability with an underlying database that is designed to scale horizontally, he added.

    For example, Grafana Pyroscope 1.0, which supports extended Berkeley Packet Filtering (eBPF) running on Linux systems, can now ingest, store and query workloads from any project of any size. Grafana Pyroscope 1.0 has already been used to profile more than 50,000 application instances at a rate of more than 6,000 unique profiles per second.

    The code profiling tool was added to Grafana Cloud Profiles, the hosted continuous profiling tool that Grafana makes available as a service, earlier this month.

    While the primary use case for Grafana Pyroscope is to troubleshoot applications, organizations are also using it to identify and then remove dead code within an application as part of a larger application modernization initiative, noted Perry. As updates to applications are made over several years, organizations frequently find that subsets of the application code are no longer needed, said Perry.

    The goal going forward is to add support for features such as flame graphs in GitHub pull requests, canary deployments, profile-guided optimization (PGO), integrating profiling with load testing tools such as Grafana k6 and integration with visual editors such as VS Code.

    In addition, Grafana Labs is committed to working with the OpenTelemetry project led by the Cloud Native Computing Foundation (CNCF) to ensure Grafana Pyroscope remains aligned with the OpenTelemtry effort to develop an OTel-native profiling tool. Grafana Pyroscope 1.0 will provide the ability to ingest data from that tool and contribute client-side instrumentation capabilities the company has developed.

    Grafana Labs is also working toward improving client-side software development kits (SDKs) to add more real-time agent management features, such as sampling controls, ad hoc profiling capabilities and alternative instrumentation options.

    Finally, Grafana Labs plans to improve eBPF integration for languages such as Python, Java and .NET.

    DevOps teams naturally spend a lot of time trying to optimize application performance and troubleshooting issues that arise long after an application is initially deployed. Code profiling tools are emerging as a tool that makes it much simpler to aggregate metrics, logs and traces and surface actionable insights that make debugging and troubleshooting applications much less tedious. The challenge is finding the time to identify and proactively address potential issues before they become another incident to manage.