devopsy.kinsta.cloud

Category: Continuous Delivery

Continuous delivery is a software engineering discipline that allows organizations to consistently develop and release quality software at a rapid pace. It is achieved by automating the software development lifecycle, enabling tasks such as development, testing and release to occur concurrently and continuously.

Does Platform Engineering Make DevOps & DevSecOps Irrelevant?
For those of us old enough to remember, the DevOps movement came onto the scene somewhere around 2007/2008. Its proponents railed against the traditional software model at the time, which called for the developers who wrote the code to be organizationally and functionally separate from those who deployed and supported the code. The reasoning behind the movement is that these siloed teams, concerned only with their own objectives, resulted in botched releases, significant delays, poor communication and, ultimately, unhappy customers. It took a few years to gain traction, but when Gartner got on board with the concept in 2011, adoption soared, and Agile development practices like automated build and test and continuous integration and delivery became the new norm.

Security and Compliance Join the Mix

Agile, DevOps and its promise of continuous integration and continuous delivery … well, delivered. Development and operations teams were finally on the same page, each able to see a current phase’s end goal, providing the flexibility to make changes and improvements along the way, speeding the delivery of quality software. Unfortunately, in these early years of DevOps success, security and compliance generally remained siloed. That silo resulted in security being an afterthought—stuck near the end of the application development life cycle. Consequently, security took the blame for release-delaying bottlenecks.

The year 2014 was notable for an exponential increase in security breaches compared to the year before. According to an article in Security Week, 2014 marked the year that, for the first time, one billion records were compromised in more than 1,500 notable data breaches, an increase of 80% from 2013. Home Depot, JP Morgan Chase and eBay were among the many exposed to attackers. Given these and other high-profile breaches, it was time to re-evaluate development processes and give security and compliance a seat at the table.

With research by Microsoft and others showing that 80% of security breaches were related to configuration errors, the concept of DevSecOps, putting security front and center in the Agile development process, ensures that assets are configured correctly in the first place, providing continuous compliance by running constant scans to identify configuration drift.

This approach can be extended beyond the data center to any cloud to any edge, where even applications can be managed and checked against compliance and security standards. You can even extend a single DevSecOps compliance framework to cloud native assets including Kubernetes and public cloud services.

Today, it is safe to say that the term “DevOps” is likely losing its relevance, but “DevSecOps” is alive and well, as long as the organization embraces the cultural, people and process changes necessary for success. Tools and technology are essential to DevSecOps, as is adopting a culture that security is everyone’s responsibility. That culture requires instigating a security-first mindset among teams as well as implementing essential automated security testing tools.

What About Platform Engineering?

Platform engineering has recently captured interest and is now generating considerable buzz due to its focus on building and operating self-service internal developer platforms (IDPs) for software delivery and life cycle management. The platform is supported by layered services or tools, created and maintained by a dedicated product team, designed to support the needs of software developers by essentially stitching together components to create a frictionless developer experience.

As Gartner says, “Platform engineering is an emerging technology approach that can accelerate the delivery of applications and the pace at which they produce business value.” In fact, Gartner expects “[t]hat by 2026, 80% of software engineering organizations will establish platform teams as internal providers of reusable services, components and tools for application delivery. Platform engineering will ultimately solve the central problem of cooperation between software developers and operators.”

In that context, platform engineering certainly builds upon the Agile concepts of DevOps and DevSecOps. Looking deeper at DevOps/DevSecOps and platform engineering shows that they both share many characteristics, while they can also be combined in a way that provides greater benefits to organizations that think about them in tandem. It is easy to see the integral link between platform engineering and DevSecOps and the broader infrastructure management landscape. For example,
- Developer Experience and Productivity – DevSecOps extends experience and productivity support beyond the developer to IT Ops, security and compliance.
- Automation – Automating infrastructure configuration as well as compliance tasks using a policy-as-code approach is the lynchpin of DevSecOps. Platform engineering provides the opportunity to extend automation to the other parts of the development lifecycle.
- Self-service – This is another common concept where platform engineering can build off of the automation and services-oriented approach that DevSecOps uses to not only enable developer self-service for code/test/deploy, but also to enable developers to be more proactive and effective in the security/compliance realm.
- Accelerate Value – Accelerating value is the focus of any tech enabler, from platforms to tools and processes.
From an Agile development approach supported by DevOps/DevSecOps and extending now to platform engineering, the end game is all about speeding delivery of high-impact applications with continuous updates that are highly resilient, reliable and secure. Given the synergies and the pressure on organizations to rapidly deliver applications while combatting cyberthreats, any platform engineering effort should ensure that DevOps/DevSecOps plays a central role.

While the term DevOps and, to some extent, DevSecOps, sound a bit dated and irrelevant and could maybe use a new moniker, the evolving role they are certain to play as platform engineering gains a foothold are not to be underestimated.
August 31, 2023
Grafana Labs Delivers Open Source Code Profiling Tool

Grafana Labs this week released version 1.0 of an open source tool that collects data about an application’s code to aid debugging, troubleshooting and optimization efforts. The tool makes it simpler to identify the specific lines of code driving a process or task within an application.

Ryan Perry, engineering director for Pyroscope at Grafana Labs, said Grafana Pyroscope 1.0 combines a tool acquired last year from a company he led with Grafana Phlare, a code profiling tool that Grafana Labs previously developed. The combination of the two tools provides a more precise code-tracking capability with an underlying database that is designed to scale horizontally, he added.

For example, Grafana Pyroscope 1.0, which supports extended Berkeley Packet Filtering (eBPF) running on Linux systems, can now ingest, store and query workloads from any project of any size. Grafana Pyroscope 1.0 has already been used to profile more than 50,000 application instances at a rate of more than 6,000 unique profiles per second.

The code profiling tool was added to Grafana Cloud Profiles, the hosted continuous profiling tool that Grafana makes available as a service, earlier this month.

While the primary use case for Grafana Pyroscope is to troubleshoot applications, organizations are also using it to identify and then remove dead code within an application as part of a larger application modernization initiative, noted Perry. As updates to applications are made over several years, organizations frequently find that subsets of the application code are no longer needed, said Perry.

The goal going forward is to add support for features such as flame graphs in GitHub pull requests, canary deployments, profile-guided optimization (PGO), integrating profiling with load testing tools such as Grafana k6 and integration with visual editors such as VS Code.

In addition, Grafana Labs is committed to working with the OpenTelemetry project led by the Cloud Native Computing Foundation (CNCF) to ensure Grafana Pyroscope remains aligned with the OpenTelemtry effort to develop an OTel-native profiling tool. Grafana Pyroscope 1.0 will provide the ability to ingest data from that tool and contribute client-side instrumentation capabilities the company has developed.

Grafana Labs is also working toward improving client-side software development kits (SDKs) to add more real-time agent management features, such as sampling controls, ad hoc profiling capabilities and alternative instrumentation options.

Finally, Grafana Labs plans to improve eBPF integration for languages such as Python, Java and .NET.

DevOps teams naturally spend a lot of time trying to optimize application performance and troubleshooting issues that arise long after an application is initially deployed. Code profiling tools are emerging as a tool that makes it much simpler to aggregate metrics, logs and traces and surface actionable insights that make debugging and troubleshooting applications much less tedious. The challenge is finding the time to identify and proactively address potential issues before they become another incident to manage.

August 31, 2023
Google Adds App Modernization Tools to Generative AI Platform

Google this week added automated refactoring capabilities to the generative artificial intelligence (AI) tools it makes available to write code on Google Cloud.

In addition, Duet AI for Google Cloud is now integrated with Google’s Apigee API Management and Application Integration services. This makes it possible to design, create and publish application programming interfaces (APIs) using simple natural language prompts.

These additions to the preview of Duet AI for Google Cloud were announced at the Google Cloud Next 2023 conference and are scheduled to be generally available later this year. The new capabilities promise to reduce the time and effort required to modernize applications.

For example, DevOps teams can now convert code written in C++ into Go and migrate that application to Cloud SQL, the managed relational database service that Google provides. Via a natural language interface, these tasks are launched via a prompt from directly within a development environment.

Priyanka Vergadia, a developer advocate for Google, told attendees these capabilities will reduce the need to rely on consultants to migrate applications and take up much less time. In addition, the overall quality of the code should improve using large language models (LLMs) that have been trained using code written by Google developers and best practices defined by Google software engineers.

Organizations will save time and effort because the need for developers to understand how existing application code was constructed is eliminated, she noted.

Google has also started to work with select enterprise IT teams to allow Duet AI to incorporate knowledge from their libraries and codebases to generate more context-aware code suggestions.

In addition to writing code, Google is making a case for also using Duet AI in Google Cloud to monitor performance and troubleshoot IT issues by identifying correlations across application environments. For example, natural language prompts can be translated into PromQL queries to analyze time-series metrics. Duet AI can also provide intuitive explanations of complex log entries in Logs Explorer for easier root-cause analysis and provide suggestions for how to fix issues that surfaced in an error reporting tool.

Duet AI is also incorporated into the Google BigQuery service to help developers write SQL and Python code to access and analyze data. It can generate full functions and code blocks, auto-suggest code completions and explain your code and SQL queries. Via a single SQL statement, a query can connect tables with the foundational AI models Google makes available via its Vertex AI service.

At the same time, IT teams can optimize prompts using BigQuery Studio tools, perform text analysis or generate new attributes to enrich a BigQuery data model. Duet AI also enables IT teams to generate vector embeddings in BigQuery to create semantic searches and recommendation queries.

It’s not clear whether generative AI capabilities will automate entire DevOps and DataOps workflows just yet, but many of the tasks that once required automation scripts will soon be automated by AI models embedded within DevOps platforms. The challenge and the opportunity is to determine how to make those capabilities available to drive DevOps workflows at unprecedented scale.

August 30, 2023
CDF Report: Steady Growth in Number of Jenkins Jobs Run

The Jenkins project that operates under the auspices of The Continuous Delivery Foundation (CDF) reported this week that over a two-year period, usage of pipelines grew 79%, with total workloads defined in the continuous integration/continuous delivery (CI/CD) platform growing 45% over the same period.

Based on analysis conducted from June 2021 to June 2023, the report found the number of jobs defined increased from 27,105,176 jobs to 48,625,398 jobs per month. The number of all jobs defined on Jenkins increased from 50,785,205 to 73,746,418 jobs per month (45%).

Sacha Labourey, a member of the governing board for the CDF and chief strategy officer at CloudBees, a provider of commercially supported instances of the open source Jenkins CI/CD platform, said it’s clear that more applications are being constructed by more organizations than ever using DevOps workflows.

At present, the CDF reported there are now more than 600 active contributors to the Jenkins project. That level of support has made it possible for Jenkins to become a standard CI/CD platform. DevOps teams know there is a substantial open source community they can count on for support, said Labourey.

The challenge now is how to centrally observe DevOps workflows to accelerate application development while at the same time giving developers more freedom to innovate. Platform engineering principles represent an opportunity to achieve that goal, as long as developers still have an opportunity to innovate and collaboratively address bottlenecks in DevOps workflows as they occur.

The platform engineering team should be observing processes and proactively making recommendations and define a set of guardrails that ensure DevSecOps best practices are followed, he added.

Otherwise, application developers are likely to view platform engineering as another effort by centralized IT teams to take power away from the developer, noted Labourey.

Striking that balance is especially critical as the number of cloud-native applications being built and deployed alongside classic monolithic applications has significantly increased, he added. DevOps teams need to be able to centralize observability of what are two distinct styles of application development that tend to occur at a significantly different pace from one another, Labourey said.

Hopefully, advances in artificial intelligence (AI) will make it easier for DevOps teams to strike the right balance between management and innovation. In the meantime, however, as the pace of application development continues to accelerate, each DevOps team will need to determine how best to evolve their existing workflows. That’s especially critical at a time when economic headwinds are requiring organizations to find ways to increase existing developer productivity rather than hire or contract additional developers.

In the meantime, it’s apparent that DevOps, as a methodology for building and deploying applications faster, is here to stay. The next major challenge is finding a way to achieve that goal at levels of scale that require automation everywhere from the network edge to the cloud.

August 30, 2023
VS Code for Mainframe: The Enterprise Developer Tipping Point

Optics matter. At a recent industry conference, a university lecturer reconfirmed what many in attendance already knew, “3270 [green screens] scare off the young generation of developers.” No matter how state-of-the-art the platform or mission-critical the applications, perceptions are formed largely based on optics, and green screens are not a good look.

Beyond optics, though, a new option offers the promise of a more normalized developer experience (DevX) and DevOps productivity across platforms, along with the staffing flexibility it brings. In short, Visual Studio Code (VS Code) is a big step toward breaking down the mainframe silo.

VS Code’s extensible, ‘any language, any platform’ design makes it the perfect tool for mainframe developers and with the free and open Code4z extension pack, VS Code is mainframe-ready. Developers are now using VS Code for mainframe AppDev just like their peers, taking advantage of the extraordinary ecosystem and the other many benefits that have made it a runaway success.

Per my previous article, Git for Mainframe: Back to the Future, combining VS Code with Git (i.e., editor and source interfaces) makes the experience complete.

So how does Code4z make VS Code mainframe-ready? Let’s explore the answers from a functional perspective.

Editing & Debugging

Mainframe is closely associated with core languages like COBOL, Assembler and JCL, which are often ignored in the world of modern tooling. With VS Code’s extensible framework, however, incorporating these languages is simple and seamless.

The Language Server Protocol (LSP), which was developed for VS Code, is now an open standard also used by the next generation of browser-based editors, providing a degree of future-proofing. LSP extensions provide a rich editing experience with a wide range of popular features including IntelliSense, which offers capabilities like syntax checking, verb formatting suggestions and variable name completion.

Code4z offers LSP extensions for COBOL and High Level Assembler (HLASM) while additional extensions are available for languages like JCL, REXX, Db2, and Easytrieve. The extensibility of this technology has already been used to extend syntax awareness to specific language dialects.

Similar to LSP, the Debug Adapter Protocol (DAP) provides a native interface and layer of abstraction for debug services. Code4z’s debugger extension facilitates the debugging of CICS and batch COBOL programs, an integral part of the end-to-end experience.

Access & Security

Mainframe applications, the lifeblood of many businesses, require rock-solid security throughout the entire SDLC. Code4z leverages Zowe, the award-winning open source framework that extends mainframe security and access controls to tools like VS Code. The Zowe Explorer extension, built on the Zowe CLI, provides access to data sets, jobs and USS files and developers also use it to issue TSO and MVS commands and to submit JCL. Zowe Explorer is packaged with Code4z as is a data editor for mainframe data sets including VSAM. This extension is built on Zowe Explorer, again leveraging the extraordinary extensibility. A Zowe Explorer for CICS is also available.

Similarly, developers can access a rich and growing set of conformant Zowe CLI extensions via the terminal and scripting.

Access to SCMs tools is also supported. In addition to VS Code’s native Git integration, there are extensions for Endevor, ChangeMan ZMF, and related tools.

DevOps Automation

Since my introductory article a few years ago, Z is for Zowe – the Open Path to Mainframe DevOps, Zowe has enjoyed wide adoption with 69% of surveyed sites either currently using or planning to use it within the year.

With mainframe teams now using Zowe to adopt modern shift-left practices, scripts for scanning, building, deploying and testing can be run manually by developers from VS Code, in addition to automatic triggers from code commits. This flexibility further empowers developers to own their code throughout the SDLC and beyond.

With VS Code, mainframe developers can be equipped with more self-service capabilities like Db2 schema provisioning to accelerate the testing process. With capabilities like these, developers can remain in the VS Code experience focused on editing rather than being distracted by low-value infrastructure activities, like requesting and waiting for DBA action.

Playing the Long Game

While VS Code is the dominant tool today—almost 3 times as popular as its closest competitor according to Stack Overflow with the lead growing—what is the long-term opportunity?

Demand for a modern, enterprise-aligned experience spans many domains, from increasing productivity to backfilling retiring staff. Elevating team morale and future-proofing vital mainframe assets ensure this adoption trend will only increase.

But tools change. Browser-based editors and in-the-cloud collaboration are gaining greater acceptance and the AI-assist excitement is palpable. Bringing mainframe developers onto an enterprise platform ensures mainframe teams will be able to benefit from the same advances as distributed peers. Enabling VS Code and its cloud equivalents demonstrates a commitment to the long-term success of these applications and by reducing the idea-to-production cycle, product owners become champions.

While not all mainframe developers will embrace VS Code, especially those close to retirement, the vast majority will, as we have experienced within our Broadcom engineering organization. The bottom line is that VS Code makes them even more productive, as illustrated in Confessions of a Career ISPF Programmer.

Many of today’s developers are proficient with multiple languages (i.e., polyglot) so picking up an additional language like COBOL becomes less daunting if everything else—editor, repo, DevOps processes, etc.—is familiar.

Getting Started

For a closer look at the many free and open Code4z extensions, check out the Developer Cockpit, which simulates a COBOL/Db2/CICS developer configuration. And read From VS Code to Mainframe Developer Cockpit for more detailed use cases.

Most importantly, try it! Code4z is available on the VS Code Marketplace.

And stay tuned for additional Code4z extensions in the pipeline. There’s never been a more exciting time to be a mainframe developer!

August 30, 2023
Styra Makes Source Code Available for Enterprise Edition of OPA

Styra is now making the enterprise edition of the Open Policy Agent (OPA) available under a source license that enables IT teams to modify or change the underlying code as they see fit when integrating it with other applications.

Enterprise OPA is a drop-in replacement for OPA, agent software for implementing policy-as-code that is already available under an open source license. Styra’s enterprise edition provides access to a version that provides better performance, native integrations for a suite of data sources and additional capabilities such as policy decision analysis.

Previously, Enterprise OPA was only available in either a binary or container format. While these formats enable Enterprise OPA to be widely used, they limited it from being built directly into applications for performance optimization because no access was provided to source code.

Chris Hendrix, director of product management for Styra, said the source license also provides organizations with an assurance that they will be able to continue to modify Enterprise OPA in much the same way as they modify the open source edition.

It’s not clear how many DevOps teams are managing policy-as-code within their pipelines, but as application security regulations become more stringent, it’s only a matter of time before most of them do so in one way or another. Styra’s approach relies on a Rego programming language that some DevOps teams have found challenging, however. To make it simpler, the company is working on a low-code approach that would help make Enterprise OPA more accessible, said Hendrix.

In addition to encouraging more DevOps teams to use Enterprise OPA under a source license, Syra is clearly moving to make it more attractive to replace existing instances of OPA with a more robust implementation licensed from the company. No one knows how many instances of the open source edition of OPA advanced under the auspices of the Cloud Native Computing Foundation (CNCF) are running in production environments. But as those applications become more complex, the need for deeper levels of integration enabled by a faster version of OPA becomes more apparent.

OPA enables developers to programmatically embed compliance controls without waiting for a compliance team to make them available. That ultimately makes it simpler to ensure that the proper controls have been implemented before an application is deployed in an on-premises IT environment. That capability also makes it easier to document which controls have been applied to make any audit less time-consuming.

Shifting responsibility for compliance controls to the left also enables DevOps teams to better understand which controls address specific regulatory mandates incorporated into most applications versus which controls might be specific to a specific regulation. Armed with those insights, it then becomes simpler to incorporate policy-as-code within a DevSecOps workflow.

Hopefully, more applications running in production environments will soon be secure by default. Naturally, one of the first places to start is by making sure the compliance controls needed to achieve a baseline level of security have been pervasively implemented.

August 28, 2023
Driving DevOps Excellence: Implementing SLOs for Your DevOps Team

In today’s fast-paced world of software development, when continuous deployment and frequent releases are the norm, DevOps teams are essential to facilitating smooth communication between development and operations. In a blog post on LinkedIn, I talked about the importance of service level objectives (SLOs) for the testing team to improve the overall product quality. On top of that, let’s look at how adding SLOs to your DevOps team can improve productivity, dependability and client happiness.

The Role of SLOs for DevOps Teams

• Aligning DevOps Goals with Business Objectives:

SLOs help DevOps teams coordinate their efforts with business objectives. The DevOps team can concentrate on delivering real business value by setting precise performance indicators, such as deployment success rates or infrastructure provisioning timeframes.

• Promoting Collaboration and Accountability:

By implementing SLOs, several stakeholders—including development, operations, quality assurance and business teams—are encouraged to work together. Over each stage of the software development life cycle, this shared responsibility promotes a sense of ownership and accountability.

• Driving Reliability and Stability:

SLOs play a key role in ensuring the stability and dependability of the system. You can be sure that your services consistently fulfill client expectations when your DevOps pipeline adheres to defined SLOs.

• Proactive Issue Mitigation:

Monitoring and alerting systems are used together with SLOs. The DevOps team could avoid service outages and downtime by aggressively identifying possible problems and resolving them before they become more serious by regularly monitoring important indicators.

• Data-Driven Decision Making:

Decision-making is driven by quantitative data. With the help of such indicators, the team is able to identify bottlenecks, prioritize improvements and streamline processes based on quick feedback.

Now, let’s explore some key areas where DevOps teams can set SLOs to improve their performance:

1. Continuous Integration (CI):
SLO: “xx% of builds complete within Y minutes.”
Measurement: Monitor build times and queue times regularly.
Action: Optimize CI infrastructure and configurations to meet the SLO.

2. Continuous Deployment (CD):
SLO: “xx% of deployments are successful.”
Measurement: Track deployment success rate.
Action: Improve the deployment process to meet the SLO and reduce deployment failures.

3. Infrastructure Management:
SLO: “xx% of infrastructure is provisioned within Y minutes.”
Measurement: Monitor infrastructure provisioning time.
Action: Optimize infrastructure provisioning scripts to meet the SLO.

4. Monitoring and Logging:
SLO: “DevOps tools and system uptime should be at least xx%.”
Measurement: Monitor the availability of the DevOps pipeline, deployment system and other tooling, including monitoring and logging systems.
Action: Ensure high availability for DevOps tools and components.

5. Artifact Management:
SLO: “Artifact retrieval time should be less than x seconds on average.”
Measurement: Monitor artifact retrieval time and availability.
Action: Optimize artifact storage and distribution mechanisms.

6. Testing and Quality Assurance:
SLO: “Code must have at least xx% unit test coverage.”
Measurement: Track test coverage regularly.
Action: Encourage developers to write more tests.

7. Security and Compliance:
SLO: “xx% of compliance checks must pass.”
Measurement: Monitor the results of compliance checks.
Action: Ensure necessary security measures to meet the compliance SLO.

8. Standardized Tools Selection:
SLO: “xx% of teams must use the approved CI/CD tools stack.”
Measurement: Track the percentage of teams using the approved tools stack.
Action: Encourage teams to adopt standardized tools and provide necessary training and support.

9. Training and Skill Development:
SLO: “xx% of team members should undergo relevant DevOps training annually.”
Measurement: Monitor training completion rates.
Action: Provide training opportunities and resources to help team members enhance their skills.

Initially, teams should baseline which percentage values to track by observing the current state. In the event they don’t have the bandwidth to baseline, start with any reasonable arbitrary number over a period of time, and it will be automatically refined.

Implementing service-level objectives empowers DevOps teams to focus on delivering reliable and high-performing services that meet user expectations. By setting clear performance and reliability targets, teams can proactively identify and resolve issues, leading to improved collaboration, efficiency and overall user satisfaction.

SLOs are not rigid constraints but are a means to drive continuous improvement and foster a culture of excellence within the DevOps ecosystem. As organizations strive to keep up with the ever-changing demands of the digital world, embracing SLOs is a crucial step toward achieving DevOps excellence and ensuring a competitive edge in the market.

August 25, 2023
VMware Preps Generative AI Assistants to Automate IT Workflows

At its VMware Explore 2023 conference today, VMware previewed what will become a suite of intelligent assistants that use generative artificial intelligence (AI) to automate the management of a wide range of IT tasks.

Krish Prasad, senior vice president and general manager for cloud infrastructure at VMware, said VMware will eventually build out assistants for managing individual platforms such as VMware vSphere and the integrated VMware Cloud Foundation (VCF) platform through which the company aggregates those offerings into a single platform.

VMware is creating those assistants, also known as co-pilots, using multiple large language models (LLMs) that the company uses to train AI models using code written by site reliability engineers (SREs), said Prasad. That approach ensures that the recommendations being made along with the code generated are of the highest quality, he added.

That approach will enable IT teams to identify configuration drift that might be adversely impacting performance or that could create a cybersecurity risk, for example, noted Prasad. The first of those assistants is being made available in beta for VMware Tanzu, a platform based on Kubernetes. VMware is also building an assistant for its NSX virtual networking software that analyzes security events to generate policies and rules that can be applied to firewalls in real-time as threats are identified.

It will then be up to each IT team to decide whether to implement those recommendations. Over time, it’s clear that the management of IT infrastructure is going to become increasingly automated as confidence in those recommendations increases, he added. In fact, the ultimate goal is to fulfill the promise of ‘lights-out’ IT management, said Prasad.

In effect, advances such as these will lead to the democratization of DevOps workflows as it becomes simpler to manage IT infrastructure at scale. IT organizations will be able to invest more resources in building and deploying applications rather than hiring specialists to manage IT infrastructure, noted Prasad.

In fact, the pace at which applications are built and deployed should dramatically increase in the months ahead, Prasad predicted.

The rise of generative AI creates a unique opportunity for IT teams to become more relevant than ever to their organizations. It will soon be possible to build and deploy a wide range of distributed applications capable of processing and analyzing data at the point where it is created and consumed.

While generative artificial intelligence (AI) has captured the popular imagination, it’s becoming apparent that multiple forms of AI will soon be used together to automate DevOps workflows at levels of unprecedented scale.

Machine learning algorithms, of course, are already used by many organizations to automate everything from analyzing log data to identifying security issues to surfacing patterns in tests made using multiple regression, function and unit testing tools. With the rise of generative AI, it is now possible to automatically generate code and create summaries of reports that multiple stakeholders can more easily understand. Generative AI doesn’t replace the need for previous use cases involving machine learning algorithms. Instead, generative AI makes use of a form of deep learning algorithms to create different types of AI models.

As a result, DevOps workflows will soon be invoking multiple classes of AI models to automate workflows in ways that should enable IT teams to automate processes at unprecedented levels of scale.

August 22, 2023
Why Multi-Cloud Cost Optimization is Harder Than it Looks

If your business is like most businesses that use the cloud today, you’ve gone multi-cloud. Nine out of 10 large companies have already adopted multiple clouds, and IT analysts expect that even more businesses will embrace multi-cloud architectures over the next several years. Now, the challenge facing those companies is how to optimize spending across multiple clouds. Many will find that, despite common narratives suggesting that cost savings are an inherent benefit of multi-cloud architectures, reducing spending when using multiple clouds can be a lot harder than it looks.

This is, fortunately, a challenge that can be conquered easily enough. Keep reading for tips on updating your cloud cost optimization strategy to support multiple clouds.

Multiple Clouds Don’t Guarantee Reduced Cloud Cost

Before diving into strategies for reducing spending when using multiple clouds, let me dispel a common myth about the relationship between multi-cloud architectures and spending.

Contrary to popular belief, using multiple clouds doesn’t guarantee that your business will spend less overall in the cloud, or even make it very easy to do so. Although advocates of multi-cloud strategies often promote the idea that using multiple clouds makes it simpler to find the most cost-effective cloud services because you have a larger menu of offerings to choose from, the reality is that cost-saving is not a common outcome of going multi-cloud.

Sure, in theory, having multiple clouds does give you more opportunities to reduce costs. But in actuality, migrating workloads between clouds typically takes significant time and effort. Given that most mainstream cloud services–like VM hosting and object storage–have been commoditized to the point that there are rarely major pricing differences between them, few businesses are actually going to migrate workloads back and forth between clouds on a frequent basis in order to save a few dollars.

To Reduce Multi-Cloud Spending, Focus on Cloud Provider Relationships, not Workloads

That said, adopting a multi-cloud strategy does place you in a position to reduce overall spending–but it’s not because you can migrate workloads between clouds. It’s because you can leverage relationships with multiple cloud providers to negotiate pricing reductions.

If your teams are actively using multiple clouds, you have a strong ability to negotiate enterprise pricing deals with the providers of each of those clouds. Each provider that you work with will be eager to earn as much of your business as possible, and if they know that your company is already also using a competitor’s platform, they’ll probably be more forthcoming with discounts in exchange for a commitment on your part to run more of your workloads on their cloud.

How to Keep Multi-Cloud Cost-Efficient – but Also Flexible

The caveat is that if you want to retain the flexibility that a multi-cloud architecture nominally provides, it’s important not to over-commit to any single cloud provider. If you do, you may find yourself locked into one cloud for certain workloads due to pricing discounts that you’ve negotiated for those workloads with that cloud provider.

An effective approach for finding the right balance between pricing discounts and flexibility is to decide which percentage of your overall cloud spending you want to avoid tying to a particular cloud. For example, you might decide that it makes sense to commit 30% of your spending to one cloud provider and 30% to another in exchange for pricing discounts that negotiate with each provider. But the remaining 40% of your cloud spending won’t be linked to enterprise agreements with cloud providers, so you’ll be free to spend it in whichever cloud you like.

Maintain Workload Portability to Minimize Multi-Cloud Spending

As you work to optimize multi-cloud spending, strive to adopt portable workload technologies, like containers in place of ones that are harder to migrate between clouds, like VMs.

This is important not just because portable technologies help to maximize the flexibility of your multi-cloud strategy, but also because they give you more leverage when negotiating with cloud providers. The providers realize that some types of workloads are harder to migrate than others, and they’re less likely to offer serious pricing discounts if they know it’s going to be very difficult for you to move your workloads to a competitor.

But if you can say, “70% of what we deploy runs in Kubernetes and can migrate from your managed Kubernetes environment to your competitor’s offering next week,” you’re in a much stronger negotiating position.

Conclusion

In short, don’t assume that simply adopting a multi-cloud architecture will yield enormous cost savings just because you can easily move workloads from one cloud to another to take advantage of pricing differences. In most cases, you can’t.

What you can do, however, is leverage your relationships with competing cloud providers to negotiate discounted enterprise pricing agreements. And the more portable your workloads are, the better able you’ll be to obtain serious cost savings while simultaneously enjoying the flexibility and agility that multi-cloud architectures stand to offer.

August 18, 2023
How Observability and Explainability Benefit the SDLC

Software systems require continual modification to meet changing requirements, address errors, improve performance and enhance reliability. Yet, maintaining and modifying complex and distributed software systems as they change and grow can present challenges. When systems are designed with observability and explainability in mind, adapting, expanding and troubleshooting software becomes easier and more effective. Observability refers to the ability to discern and monitor software systems’ real-time behavior and performance. This allows developers to identify and fix issues before they become critical. Explainability articulates how and why the software system operates.

Both observability and explainability can contribute to the health of the software development life cycle by improving visibility and transparency, helping developers better understand the system’s overall behavior, and allowing the easy identification of errors, all of which contribute to the software system’s overall stability.

Overview and Benefits of Observability

Observability combines data from various sources, including application performance management (APM) monitoring, infrastructure monitoring, distributed tracing, third-party integrations and machine-language data. The data is then structured and presented in an accessible way. The first step to building an observable workflow is to identify which metrics best measure the behavior and performance of a software system. This will vary based on the specifics of the system. As a software system operates, logs and traces keep track of activities, requests and responses. They can be used to find the causes of errors and performance bottlenecks. Application performance monitoring (APM), infrastructure logs, machine logs and application traces are just a few examples of logs and traces. These records provide the necessary data to create dashboards and visualizations, which can then be presented to organizational stakeholders.

While observability is often compared to software monitoring, which generates data focusing on various metrics related to application performance, it differs from monitoring in several respects. Monitoring tracks raw data related to a few performance metrics. It provides information that is best used by the operations team. Observability uses a large amount of structured data to provide a more robust, accessible picture of the whole system, from front end to back end, that can be understood by employees throughout the organization—even those who do not work in development or lack a technical background entirely.

Advantages of Explainability

Explainability refers to transforming machine data into a clear articulation of how a software system works such that others outside the organization can understand it. This capability empowers developers and users alike by enabling them to understand what a software system does and how and why it does it, providing a deeper understanding of why errors occur and how to fix them. Presenting data in a visual format is often a vital part of explainability.

Explainability is especially important in artificial intelligence (AI) and machine learning (ML) systems, where it constitutes a cornerstone of ethical AI development. Model tracing, which refers to monitoring an ML model as it executes to understand its decision-making process better, is a key component of explainability in ML.

Best Practices and Common Issues With Observability and Explainability

Before adding observability or explainability to the software development life cycle, it is important to revisit software life cycle best practices and examine what kind of data is being generated. Not all data is meaningful or useful in observability and explainability. Structuring and ordering data from logs and traces is time-consuming but vital to correctly analyze and draw conclusions from the data. For optimal results, it is important for traces to be appropriately tagged and named consistently according to conventions.

Additionally, the tools used to implement observability and explainability can be complex. For organizations to achieve maximum benefits from these strategies, it’s important for employees to familiarize themselves with the tools and develop specialized knowledge and skills, which can take time. Finally, there are costs associated with implementing observability and explainability. On one hand, commercial software tools come with licensing costs, which can pose a barrier for small businesses. On the other hand, open source alternatives often do not perform well because they lack the funding and resources required to continuously update and enhance the software.

Harnessing the Power of Observability and Explainability

Observability and explainability have numerous benefits for organizations that use flexible, ever-changing and complex software systems. Any company interested in building smoother-functioning software applications stands to benefit. Though both observability and explainability require upfront investments of time and money, these investments pay off in the form of quicker and easier error correction, with resolution occurring in minutes rather than hours or days, and greater application stability. In customer-facing applications, this results in fewer crashes and a better experience for the user. Increased stability also makes it easier to scale applications without losing performance. As these benefits become more apparent, a significant number of companies will likely develop software solutions that are reliable, cost-effective and accessible. This will increase the adoption of observability and explainability, which will continue to influence the evolution of software systems.

August 16, 2023