devopsy.kinsta.cloud

Author: Veronica Haggar

  • WhiteSource Rebrands as Mend, Introduces Industry-First Automated Remediation with the Mend Application Security Platform

    Company focuses on automation to dramatically reduce the software attack surface and the application security burden for developers

    Tel Aviv, ISRAEL and Boston, USA – May 25, 2022 – WhiteSource, a leader in application security, today announced the change of its name to Mend. The company is also launching the industry’s first automated remediation for custom code security issues as well as integration of Mend Supply Chain Defender (formerly WhiteSource Diffend) in its JFrog Artifactory plugin, all within the Mend Application Security Platform. Mend secures all aspects of your software, providing automated remediation, prevention, and protection from problem to solution versus only detection and suggested fixes.

    With revenue up 800% over the past three years and enterprise net retention at 127% in 2021, the company added 350 new customers in the last year. Mend has over 1,000 customers including more than 25% of the Fortune 100 and is focused on investing its latest round ($75 million series D announced in April 2021) into its overall growth as it expands beyond the Software Composition Analysis (SCA) market. This includes the move into supply chain security through its acquisition of Diffend in April 2021 and the acquisitions of SAST startups Xanitizer and DefenseCode in February this year. The company’s strategic acquisitions and its unique automated remediation technologies have enabled it to deliver the Mend Application Security Platform. Combining automated remediation for static application security testing (SAST) with Mend’s existing ability to do this for software composition analysis (SCA), the platform is the first to automatically find and fix application security holes involving both open source and custom code.

    “Attackers are increasingly targeting applications as the weakest link to go after organizations, and at the same time, pressure to deliver software faster has never been higher. Organizations face undeniable tension to do both, better,” said Rami Sass, Co-founder and CEO of Mend. “Mend breaks the tradeoff between security and development delivery timelines by providing a solution that automates the reduction of the software attack surface while removing most of the burden of application security, allowing development teams to deliver quality, secure code, faster.”

    Mend’s Automated Remediation for SAST

    Offering automated remediation for both open source and custom code, providing exact fixes for each line of code, the Mend Application Security Platform enables any level of developer to easily write quality, secure code. Prior to this advancement, leading application security products could, at best, provide training materials and examples to support developers with researching fixes for each security issue they encountered. This inefficient process forced developers to choose between security and meeting deadlines. The Mend platform delivers automated remediation for both SCA and SAST, presented directly in the developer’s repository, for easy integration into the developer workflow. With Mend, developers don’t have to sacrifice security for speed.

    Mend Supply Chain Defender Integration with Artifactory Plug-In

    Integration of the Mend Supply Chain Defender — a solution that detects and blocks malicious open source software — into the Mend platform plugin for the Artifactory registry allows enterprise customers using JFrog Artifactory as a private repository manager to prevent malicious open source software from entering their code base. Using a single installation of Supply Chain Defender, enterprises can protect all projects involving JavaScript or Ruby with a centralized policy enforcement and auditing point. All results are displayed for open source and custom code in a custom or third-party code repository for a single view inside the developers’ native environment.

    “Whether open-source or proprietary code, the application security industry has mostly focused on vulnerability detection and management. Mend has an interesting approach of automating the remediation of code vulnerabilities,” said Josh Johnson, Manager of Solutions Architecture, Defy Security. “While the company is announcing this new name, as a partner of Mend, we are excited for it to further its commitment to solving code-based security challenges with automated-remediation. Defy Security looks forward to seeing Mend extend automation for closing security gaps.”

    Learn more about automated remediation for SAST and the Mend Supply Chain Defender and more details on the story behind the company’s new name, Mend, on our blog.

    About Mend

    Mend, formerly known as WhiteSource, effortlessly secures what developers create. Mend uniquely removes the burden of application security, allowing development teams to deliver quality, secure code faster. With a proven track record of successfully meeting complex and large-scale application security needs, the world’s most demanding software developers rely on Mend. The company has more than 1,000 customers, including 25 percent of the Fortune 100, and manages Renovate, the open source automated dependency update project. For more information, visit www.mend.io, the Mend blog, and Mend on LinkedIn and Twitter.

  • JFrog Integrates with ServiceNow to Improve Software Security Vulnerability Response Times with “ServiceOps”

    New JFrog Xray Integrations with ServiceNow Lightstep Incident Response and Spoke Help IT and SRE Teams Proactively Secure the Software Supply Chain with Real-Time, Cross-Department Visibility & Team Activation for Security Incidents

    Sunnyvale, CA and San Diego, CA, May 26, 2022 — (swampUP 2022) – JFrog Ltd. (“JFrog”) (NASDAQ: FROG), the Liquid Software company and creators of the JFrog DevOps Platform, today unveiled new integrations for JFrog Xray with ServiceNow’s Lightstep Incident Response and Spoke products for IT Service Management. Available immediately, the JFrog Xray integrations with ServiceNow (NYSE: NOW) provide IT leaders with real-time insights on security vulnerabilities and compliance issues to quickly engage necessary team members from across the organization for more immediate response and remediation.

    “Successfully securing the software supply chain at the speed of business is a team sport, requiring efficient, cross-team collaboration for timely security incident remediation,” said Shlomi Ben Haim, Co-Founder and CEO, JFrog. “Our integration with ServiceNow aims to change the relationship between developers and the rest of the business, so they can maintain the speed and frequency of releases, while avoiding downtime and loss of trust from end customers.”

    The new integration enables IT teams to proactively address security issues before they become major concerns. The combination of JFrog Xray and ServiceNow delivers a robust software composition analysis (SCA) tool that can quickly scan binaries for vulnerabilities and license compliance issues, then share those insights with the appropriate parties across the organization. The JFrog Xray-ServiceNow solution is unique in that it helps DevOps engineers, site reliability engineers (SREs), IT system administrators, and others, more securely build, deploy, run, and monitor applications effortlessly, in a single view. It also enables real-time security alerts and insights with assigned actions across all the tools, people, and processes needed for timely resolution.

    JFrog Xray & ServiceNow: Delivering Incident Response & Enterprise-wide Workflow Design for Security Incidents

    Identifying and effectively responding to malicious attacks must transcend business units and operational functions. By improving real-time insight, collaboration, and communication amongst and between enterprise security and IT teams, the JFrog Xray-ServiceNow integrations ensure swift responses to emerging security threats.

    The JFrog Xray integration with Lightstep Incident Response enables developers, SREs, and Security Administrators to:

    • Monitor, collect and respond to license compliance and security vulnerabilities impacting the software supply chain across all stages of the software development and release lifecycle.
    • Streamline vulnerability response by pulling-in the right team members across the organization for faster remediation.

    The JFrog Xray Spoke for ServiceNow allows IT operations staff to:

    • Generate violation reports, create ‘ignore rules’, re-scan builds, add custom item properties, and more.
    • Automate workflows that meet audit demands and avoid penalties for improper use of code segments obtained from the open-source community.
    • Identify problems earlier in the application development pipeline and incorporate change management solutions.

    For more information on the new JFrog Xray integrations for ServiceNow Lightstep Incident Response, read this blog or solution sheet.  Further details on the JFrog Xray integration with Spoke can be found in this blog. You can also connect with JFrog and ServiceNow solution experts during swampUP 2022 taking place in San Diego, May 25 – 26, 2022. For more information and to register, visit https://swampup.jfrog.com/.

    About JFrog

    JFrog Ltd. (NASDAQ: FROG), is on a mission to power all the world’s software updates, driven by a “Liquid Software” vision to allow the seamless, secure flow of binaries from developers to the edge. The JFrog Platform enables software creators to power their entire software supply chain throughout the full binary lifecycle, so they can build, secure, distribute, and connect any source with any production environment. JFrog’s hybrid, universal, multi-cloud DevOps platform is available as both self-managed and SaaS services across major cloud service providers. Millions of users and thousands of customers worldwide, including a majority of the Fortune 100, depend on JFrog solutions to securely manage their mission-critical software supply chain. Once you leap forward, you won’t go back. Learn more at jfrog.com and follow us on Twitter: @jfrog.

    ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries.

  • DevOps/Cloud-Native Live Boston: Get Certified, Network and Grow Your Career

    DevOps/Cloud-Native Live Boston: Get Certified, Network and Grow Your Career

    DevOps and cloud-native technologies are changing the application development landscape, accelerating the pace of innovation and transforming the way organizations develop, deploy and employ modern software. The DevOps/Cloud-Native Live! event is coming to Boston on May 25 to provide attendees with all the knowledge and tools they need to succeed in the world of DevOps and cloud-native computing.

    This in-person event will bring together DevOps luminaries and cloud-native experts to discuss some of the hottest topics in the industry today, share valuable insights and offer hands-on training to all attendees to help them future-proof their careers and stay ahead of the competition.

    DevOps/Cloud-Native Live! Boston features a stellar lineup of speakers, including:

    • Tracy Bannon, software architect and DevOps advisor at Mitre Corporation
    • Andi Mann, CTO at Qumu
    • Joshua Corman, former chief strategist, CISA COVID-19 task force and founder of I am the Cavalry
    • Elizabeth Lawler, founder and CEO at AppLand
    • David Owczarek, former SRE manager at Adobe Sign
    • Daniel (Dan) Kirsch, managing director and principal analyst at Techstrong Research

    At the conference, attendees will have the opportunity to meet these leaders and speakers, exchange ideas and information with like-minded peers, attend educational sessions and get certified by completing upskilling sessions. These upskilling sessions are designed to help both new and seasoned engineers hone their skills, adapt for future growth and improve operational efficiency.

    Joshua Mazgelis, cloud architect and senior sales engineer at Progress will be conducting a hands-on training session on “Cloud Agility with Chef.” In this session, attendees will learn how they can improve cloud security and compliance without sacrificing agility and how to use Chef software to detect, correct and automate remediation of security vulnerabilities across the infrastructure.

    Check out our interview with Joshua Mazgelis below for a sneak peek of what to expect from the “Cloud Agility with Chef” upskilling session.

    [videopress oyeKYTnR]

    The agenda for DevOps/Cloud-Native Live! Boston features a mix of topics, including technical sessions, lively discussions and case studies covering digital transformation, DevOps principles, Kubernetes, cloud-native tools, DevSecOps, API security, monitoring and observability, ITIL v4 and more.

    There will also be two amazing onsite giveaways:

    • Attendees will have a chance to win a pair of tickets to a Red Sox versus Yankees game (Terms and conditions apply).
    • Attendees will get a chance to snag free tickets to a pre-release private viewing of “Top Gun: Maverick” (First come, first served).

    By visiting the expo hall, attendees will also be able to interact with sponsors and receive valuable content. Breakfast, lunch and coffee will be offered to all attendees as well.

    To see the full agenda and to register, please visit the DevOps/Cloud-Native Live! Boston website.

  • Appstellar Is Now an AWS Consulting Partner!

    Appstellar is excited to announce that we have joined the Amazon Partner Network as an AWS Consulting Partner. With this partnership, we aim to continue building software products safely on the cloud!

    We’re excited to announce that we’re officially part of the Amazon Web Services Partner Network (APN)!

    Moreover, we at Appstellar, as a leading cloud service and DevOps service provider in Kosovo, are happy to share that we’re the first company founded and headquartered in the country to become an AWS Partner.

    APN is Amazon’s global community of partners who leverage AWS to build best-in-class software solutions. It consists of professional services organizations with a demonstrating track record of successfully delivering AWS solutions and an extensive pool of certified and experienced AWS technical consultants.

    As an AWS Partner, we support clients in maximizing the value of all that AWS offers and accelerating their journey to the cloud. APN enables us as a partner to provide innovative solutions, solve technical challenges, and deliver value to our and AWS’s mutual customers.

    Appstellar is currently in hyper-growth mode. In the past 6 months, we’ve grown our team by 122%! Moreover, we’ve signed multiple new client deals, expanded in new industries of operation (like fintech and healthtech), and also moved to new office spaces. In addition to our AWS partnership, Appstellar has also become a CNCF member and a Kubernetes Certified Service Provider. With these partnerships, we look forward to accelerating our growth even further and taking on projects we love to work on.

    Why work with an AWS Partner Company like Appstellar?

    Amazon Partner Network (APN) is uniquely positioned and powered to help customers take full advantage of AWS’s offering in their cloud journey. We as an AWS partner help our customers to grow and scale their businesses on what is known as one of the most advanced cloud ecosystems.

  • Appstellar Is Now a Kubernetes Certified Service Provider and Silver Member of CNCF and Linux Foundation

    Appstellar is excited to announce that they are now a CNCF Silver Member, Kubernetes Certified Service Provider (KCSP), and a Linux Foundation Silver Member.

    We at Appstellar, are thrilled to announce we’re now a CNCF Silver Member, Kubernetes Certified Service Provider (KCSP), and a Linux Foundation Silver Member! Read more about it on the CNCF new members announcement.

    This is a big milestone that demonstrates Appstellar’s expertise as a cloud and DevOps solutions provider helping customers embark on their Kubernetes and cloud-native journey. A lot of work has been done to get here, so we’re super proud and excited to finally receive the KCSP badge.

    Since focusing our services strictly on cloud software development and DevOps solutions, we’ve implemented Kubernetes practices for multiple clients in industries such as fintech, healthtech, and others. Having said that, the KCSP certification will help show Appstellar’s extensive expertise in supporting organizations to move to a cloud-native platform.

    As a Kubernetes Certified Service Provider with Cloud Native Computing Foundation, Appstellar will continue to offer Kubernetes support, consulting, and professional services for businesses and organizations wanting to migrate to cloud technologies, or improve their existing cloud infrastructure.

    On the other hand, as a member of the CNCF and the Linux Foundation, Appstellar commits to expanding the Kubernetes and cloud-native ecosystem and bridging the gap between developers and operations.

    “We’re proud to be the first Kubernetes Certified Service Provider in Kosovo and the Westerns Balkans” say Co-Founders of Appstellar – Rozafe Llalloshi and Mehmetali Shaqiri.

    As for Appstellar, we are currently in hyper-growth mode. In the past 6 months, we’ve grown our team by 122%! Moreover, we’ve signed multiple new client deals, expanded in new industries of operation, and also moved to new office spaces.

    In addition to these partnerships, Appstellar has also become an AWS partner. With these partnerships, we look forward to accelerating our growth even further and taking on projects we love to work on.

    Here’s to continued success!

  • Jellyfish Launches Industry’s First Comparative Benchmarking Tool for Engineering Leaders

    Jellyfish Benchmarks Adds Anonymized Third-Party Performance Data; Allows Engineering Leaders to Set Productivity Goals Informed by Insights into Cross-Industry Standards of Excellence

    Boston, MA, May 18, 2022 — Jellyfish, the pioneer of Engineering Management Platforms (EMPs), today announced the launch of Jellyfish Benchmarks, a way to add context around engineering metrics and performance by introducing a method for comparison. With the industry’s only in-app benchmarking capability, Jellyfish customers can now understand how they stack up against peers on a percentile basis across numerous metrics on the organization, division, group or team level.  

    Despite having more access than ever to engineering data, the complex nature of modern software engineering means that strategic decisions can lack proper context. Engineering teams may be performing well historically, but without a threshold to compare against — one that represents the very best engineering team across different industries — engineering leaders lack insight into whether their decisions are enabling their organization to achieve elite performance. Jellyfish Benchmarks solve this problem by providing customers with means for comparison from anonymized cross-industry datasets.

    “At Jellyfish, our longstanding goal has been to support customers in building the highest-performing engineering teams possible,” said Andrew Lau, CEO of Jellyfish. “Today, we achieved yet another milestone by offering engineering leaders a trustworthy and expansive set of benchmarks derived from Jellyfish’s unrivaled customer base, providing the most comprehensive thresholds to measure against in the engineering industry.”

    Metrics-Based Engineering Management Is Here

    Engineering teams who opt in will have their data anonymized and added to the benchmarking Jellyfish customer pool. For every metric defined as important to an engineering organization, customers can access a visualization comparing their performance on a percentile basis for a given metric in comparison to their peers or against their own organization — truly an industry first. 

    Among the key metrics being announced with Jellyfish Benchmarks are those focused on allocation, delivery, productivity, collaboration – including key metrics within the DevOps methodology. Allocation benchmarks allow teams to understand how their resource investments compare to other engineering organizations. Delivery can be benchmarked using metrics such as cycle time, productivity using metrics like issues resolved, and collaboration using metrics such as PR reviews. New benchmarking capabilities also enable DevOps teams to track against the DORA metrics – including deployment frequency, lead time, mean time to recovery, and change failure rate.

    “At Acoustic, our number one goal is to do what we say we will do. We measure progress consistently across our engineering team,” said John Riewerts, senior vice president of engineering, Acoustic. “With Jellyfish’s Engineering Management Platform in place, we are now completing nearly all of our commitments in an agile culture. We’ve seen a 35% increase in our ability to do so. The Benchmarks feature gives us a consistent barometer to gauge our performance against teams in other industries, bringing a more game-like approach to our culture. This culture is massive from a productivity perspective, enabling us to meet marketers’ needs as they orchestrate journeys with highly personalized content with highly performant teams, and Jellyfish is critical to getting us to that point.” 

    “By offering the industry’s only in-app benchmarking, Jellyfish is empowering engineering leaders to use context driven by data to examine the efficacy of their engineering strategy and their team’s operations,” said Krishna Kannan, head of product at Jellyfish. “Jellyfish Benchmarks is available for every metric tracked across teams or the entire organization, helping customers understand how their company compares for the metrics that matter most to their engineering function.” 

    Jellyfish Benchmarks also provide data-driven insights with which to inform and influence non-engineering executives, and thus drive better strategic decisions and more closely align engineering with the wider business. The announcement of Jellyfish Benchmarks enhances the Jellyfish EMP’s current capabilities to measure engineering alignment against strategic business priorities and the performance and operations of engineering teams.

    To learn more about Jellyfish Benchmarks, watch the video demo or visit the Jellyfish website. 

    For press inquiries, please contact jellyfish@batemanagency.com.

    About Jellyfish
    Jellyfish is the pioneer Engineering Management Platform that enables engineering leaders to align engineering work with strategic business objectives. By analyzing engineering signals and contextual business data, Jellyfish provides complete visibility into engineering organizations, the work they do, and how they operate. Companies like Mastercard, Priceline, Zoominfo, and Pagerduty use Jellyfish to optimize the allocation of engineering resources to focus their teams on what matters most to the business. For more information, visit www.jellyfish.co

  • Pull-Based Kubernetes Deployments Moving to GitLab Free Tier

    GitLab will include support for pull-based deployment in the platform’s Free tier in an upcoming release, which will provide users increased flexibility, security, scalability, and automation in cloud-native environments. With pull-based deployment, DevOps teams can use the GitLab agent for Kubernetes to automatically identify and enact application changes.

    “DevOps teams at all levels benefit from utilizing GitOps strategies such as pull-based deployment in their cloud-native environments. By offering this feature in GitLab’s Free tier, we can introduce more organizations to the power and utility of this secure and scalable functionality,” says Viktor Nagy, product manager of GitLab’s Configure Group.

    As an open-core company, GitLab is happy to contribute to the GitOps community and enable the adoption of best practices in the industry.

    What is pull-based deployment?

    Pull-based and push-based deployment are two main approaches to GitOps, an operational framework that takes DevOps best practices used for application development such as version control, collaboration, compliance, and CI/CD tooling, and applies them to infrastructure automation.

    GitOps enables operations teams to move as quickly as their application development counterparts by making use of automation and scalability, without sacrificing security.

    While push-based, or agentless, deployment relies on a CI/CD tool to push changes to the infrastructure environment, pull-based deployment uses an agent installed in a cluster to pull changes whenever there is a deviation from the desired configuration. In the pull-based approach, deployment targets are limited to Kubernetes and an agent must be installed in each Kubernetes cluster.

    “As long as the GitLab agent for Kubernetes on your infrastructure has the necessary access rights in your cluster, you can configure everything automatically, reducing the DevOps workload and the opportunity to introduce errors,” Nagy says.

    Pull-based deployment vs. push-based deployment

    Push-based deployment and pull-based deployment each have their pros and cons. Here is a list of the advantages and disadvantages of each GitOps practice:

    Push-based deployment pros:

    • Ease of use
    • Well-known as part of CI/CD
    • More flexible, as deployment targets can be on physical servers or virtual containers, not restricted to Kubernetes clusters

    Push-based deployment cons:

    • Requires organizations to open their firewall to a cluster and grant admin access to external CI/CD
    • Requires organizations to adjust their CI/CD pipelines when they introduce new environments

    Pull-based deployment pros:

    • Secure infrastructure – no need to open your firewall or grant admin access externally
    • Changes can be automatically detected and applied without human intervention easier scaling of identical clusters

    Pull-based deployment cons:

    • Agent needs to be installed in every cluster limited to Kubernetes only

    How pull-based deployment impacts the Free-tier experience

    Including support for pull-based deployments in GitLab’s Free tier provides a tremendous competitive advantage for smaller organizations, as they can now apply automation in a safe and scalable manner to their cloud-native infrastructure, including virtual containers and clusters. And, for organizations that are trying to get started quickly by minimizing the number of tools in their infrastructure ecosystem, this functionality is included in One DevOps Platform, not as a point solution.

    “DevOps teams don’t have to continuously write code for new infrastructure elements – they can write the code once, within a single DevOps platform, and have the agent automatically find it, pull it, and apply it, as well as configuration changes,” Nagy says.

    “Also, with the availability of pull-based deployment in this introductory tier, newcomers to GitLab will immediately be able to modernize application development and reduce the security risk associated with configuring such infrastructure.”

    This blog post contains information related to upcoming products, features, and functionality. It is important to note that the information presented is for informational purposes only. Please do not rely on this information for purchasing or planning purposes. As with all projects, the items mentioned in this blog post and linked pages are subject to change or delay. The development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

  • Pure Storage Boosts Developer Productivity by Expanding the Portworx Portfolio and Making Kubernetes Adoption a Reality

    Portworx portfolio advancements provide more data services than ever before while giving DevOps teams greater control over their workstreams  

    Mountain View, CA, May 16, 2022 – Pure Storage® (NYSE: PSTG), the IT pioneer that delivers the world’s most advanced data storage technology and services, today announced a series of updates to its Portworx portfolio which include:

    • General availability of Portworx Data Services, the industry’s first Kubernetes Database-as-a-Service (DBaaS) Platform 
    • The next generation of the iconic Portworx Enterprise, the complete multi-cloud ready Kubernetes data management platform for running mission-critical applications in production. 

    General availability of Portworx Backup-as-a-Service on AWS, which also supports backup and restore of any Kubernetes services including Amazon EKS, Red Hat OpenShift, Google Kubernetes Engine, VMware Tanzu, and Microsoft Azure Kubernetes Service.

  • LitmusChaos Enhances Developer Experience for Cloud Native Reliability

    In cloud native computing, the applications are expected to be resilient, loosely coupled, scalable, manageable and observable. Because of containerization, there is a proliferation of microservices and they ship quickly. Microservices environments are more dynamic. In such an environment, making applications resilient means deploying the applications in a fault tolerant manner, but it also means building the application to sustain the faults happening on dependent (i.e., upstream/downstream) services and continuing to take appropriate action against the incidence of such a failure. Similarly, quality assurance teams should cover all the fault scenarios to be covered during the CI and CD process. Eventually, Ops teams must continue testing the service for resilience in production by practicing Chaos Engineering. Continuous verification can be and should be practiced at all stages of the product life cycle. 

    Chaos Engineering for Developers

    Cloud native developers follow Curly’s law while developing microservices. This enables modularization and faster shipping of applications, but also necessitates creating a set of well defined conditions in the code to handle various microservices faults, the API responses and the underlying platform such as Kubernetes. While Kubernetes plays a major role in enabling microservices architecture, it also brings certain assumptions that developers should be aware of. For example, the frequency with which pods are evicted or moved around nodes is several times greater then, say, VMs getting moved across in an ESX cluster. In a scaled environment, pod eviction can happen at any time (depending on the load conditions and other environmental factors), but the service should continue to work just fine. 

    A host of chaos tests can be performed during development to build resilience against Kubernetes faults and common cloud native infrastructure application faults. LitmusChaos, which is a cloud native application, provides all the capabilities to practice end-to-end Chaos Engineering. Its chaos experiments are declarative in nature and cloud native developers can add or execute chaos experiments in a cloud native way. The core of Litmus operates on the basis of Chaos CRDs, which makes the practice of chaos for cloud native developers very natural. 

    Chaos Engineering in CI

    Cloud native CI pipelines throw additional requirements for QA teams. They need to test the applications against various features of the cloud native platform functions such as Kubernetes. Kubernetes environments can present various faults such as pod, node and service level faults. In a chaos integrated CI pipeline, chaos experiments are designed to cover all fault scenarios of Kubernetes and other cloud native stack components, in addition to specific application faults

    Apart from being able to execute chaos experiments easily for various different scenarios, quality assurance teams can measure the performance of resilience metrics of the application from build to build. Litmus is such a tool, where resilience metrics are easily compared against the chaos runs against different versions of the system under test. 

    LitmusChaos workflows or scenarios

    Chaos experiments serve as the building units for Chaos Workflows, which string together multiple chaos experiments in any desired order and sequence to inject failure into more than one resource. This allows for the creation of complex, real-life failure scenarios involving several different aspects of the entire application as part of a single workflow, simply using the ChaosCenter web UI. Think of Chaos Experiments as Lego blocks encapsulating failure conditions for a specific target resource. These Lego blocks can be flexibly arranged in any desired order to shape the Chaos Workflow — a conglomeration of failure scenarios tailored to validate your specific SLO requirements. 

    Introducing chaos tests into developer CI pipelines

    LitmusChaos provides the ability to create workflows through chaos center and use them in different ways. For using the workflows in CI pipelines, the easiest way is to store the created chaos test in git. If you configure GitOps in Litmus, the workflows are automatically stored in Git and you can edit the test either directly on git or through the chaos center. Once the test (A YAML manifest) is in Git, you can invoke it in your CI pipeline by creating a kubernetes shell environment and executing

    “kubectl apply -f http://<github.com>/your-repo/your-file.yml” 

    The above commands does the magic of getting your chaos experiment, setting up the execution environment, executing the chaos test and uploading the results/metrics to chaos center.

    Basically, developers can construct their CI.yaml files by inserting “kubectl apply -f <chaostest.yaml> and observe the results in the chaos center. Chaos center provides analytics around historic workflow executions that help to know if the resilience of your application you are developing is increasing or intact assuming that you have provided good chaos coverage.

    Here is an example of how Litmus chaos tests are used on a CI platform, which in this case is Harness CI: https://dev.to/ksatchit/chaos-engineering-with-harness-cicd-pipelines-1dn0

    One can use the Litmus chaos tests in the same way on other CI platforms such as GitLab, CircleCI etc.

  • SlashData: Cloud Native Continues to Grow with More than 7 Million Developers Worldwide

    The global cloud native developer population has grown by 1 million in the last 12 months, according to the Q3 2021 State of Cloud Native Development Report developed for CNCF by SlashData. The company estimates that there are now 7.1 million cloud native developers worldwide. This represents an increase of 51% from our first report with SlashData in May 2020 when there were 4.7 million cloud native developers.

    The cloud native developer population includes 4.8 million developers using container orchestration tools and 4.2 million developers using serverless platforms. These are both up from 4.6 million and 4 million, respectively, since late last year.

    Kubernetes remains stable, but new trends emerge

    At the same time, the usage of Kubernetes has remained relatively stable, increasing by 2 percentage points over the last year. Some 61% of backend developers have used containers in the previous 12 months, with 30% using Kubernetes to orchestrate them. There are now an estimated 5.1 million Kubernetes users globally.

    As we saw in CNCF’s 2021 Cloud Native Survey, there are a few trends driving Kubernetes adoption. For one, larger organizations are more likely to be using Kubernetes. SlashData found that close to one in four developers working for very large enterprises (with more than 5,000 employees) use Kubernetes.

    Another trend from our Cloud Native Survey was the rise of managed services as Kubernetes goes “under the hood.” According to SlashData, the majority of container orchestration tools — including five of the top six most used — are managed Kubernetes solutions. Further, the proportion of developers choosing a single orchestration tool has decreased: 49% of developers who use orchestration tools used only one tool in Q1 2021. Six months later, this has decreased to 46%, with many reporting that they ​​use self-managed solutions in conjunction with vendor-managed services.

    Finally, Kubernetes developers are also more likely to be involved in emerging technologies like Blockchain, edge computing, and 5G.

    Is the consolidation of serverless coming?

    After seeing a slight decline in the last report, the use of serverless tools has increased by 5% from 4 to 4.2 million. However, the way developers engage with serverless products is changing, with developers using fewer serverless tools simultaneously. In Q1 2021, 23% of developers who used serverless used three or more tools. Six months later, this has decreased to 19%.

    Download the report to learn more about Kubernetes and cloud native trends!

    This is our fourth time working with SlashData to gain insights on cloud native development. 

    The report is based on the 21st edition of SlashData’s Developer Nation survey, which was fielded between June 2021 and August 2021 and reached more than 19,300+ developers globally. More than 3,900 survey participants answered questions relating to the development of backend services and the technologies they use.