devopsy.kinsta.cloud

Category: Continuous Testing

Continuous testing is the process of executing automated tests as part of the software delivery pipeline to obtain immediate feedback on the business risks associated with a software release candidate.

Innersourcing Open Source Principles in the Enterprise
Software development has experienced a seismic shift in recent years, with open source becoming the heartbeat of innovation. A full 90% of enterprise IT leaders say their organization is using open source, according to a Red Hat report. Leading this transformation is GitHub, the ubiquitous platform that not only jumpstarted the open source movement but has also been quietly transforming how enterprises approach development at large.

But it’s not just tech companies trumpeting the open source creed—academics are on board, too. A paper recently published by the University of Georgia found a hard-to-dismiss correlation between open source innovation and overall business success. “We find a significantly positive association between GitHub activity and future realized net income, suggesting that open innovation is a strong predictor of future earnings,” according to the report.

I recently met with Chris Reddington, senior manager of developer advocacy at GitHub, to dive into how and why open source is becoming essential for enterprise innovation. According to Reddington, the once-dominant proprietary information mindset is shifting, with open source cultural principles now permeating most companies, a practice also known as innersource. Put simply, open source is now cool in the enterprise.

Bridging the Open Source-Enterprise Divide

GitHub’s close ties to the open source space have allowed them to illuminate the parallels between the open source and enterprise worlds. Reddington noted that, nowadays, open source and enterprise aren’t really separate communities but rather intertwined facets of the same software ecosystem. This movement is represented by the open source program office (OSPO) becoming more commonplace in large organizations.

For an example of innersource in practice, take Porsche, who recently announced the Porsche FOSS Movement to guide internal common values and development principles around open source. We’ve also seen similar large-scale commitments to open source values at Walmart, Spotify, Facebook and others.

Open source clearly isn’t just for startups—large companies are increasingly seeing an advantage in both using open source software and sharing their own open source components. The growing investment and maturation of OSS initiatives are positive strides, as it’s important to the stability of the free open source software (FOSS) ecosystem as a whole that those using software contribute back to its maintenance, especially to core packages the world depends upon.

The Power of Innersource

The study from the University of Georgia brings to light how enterprises increasingly recognize the need to work in sync with their developers and customers to remain competitive. This is a testament to the evolving nature of development—an industry that’s embracing a “team sport” mentality instead of a siloed approach, explained Reddington. And as enterprises align with open source principles, they are discovering the power of innersource, he said. “Innersource is a development methodology where engineers build proprietary software using best practices from large-scale open source projects, like Kubernetes or Microsoft’s Visual Studio Code,” GitHub explained.

Reddington elaborated on two key elements of this approach:
- Breaking down silos: The traditional organization-centric structure of projects is being replaced by a more transparent and collaborative approach. Innersource encourages transparency and asynchronous communication, tearing down barriers that previously inhibited efficient collaboration.
- Engaging responsibly: Reddington emphasized the significance of enterprises giving back to the open source community. Whether through sponsorships, allocating time for engineers to contribute, or open sourcing their projects, companies can foster symbiotic relationships where they benefit from and contribute to the open source realm.
Essentially, by adopting innersource principles, enterprises foster an environment that promotes collaboration and knowledge sharing, thus enabling innovation to flourish across teams and projects.

Balancing Open Innovation and Proprietary Software

One of the most intriguing aspects of this transformation is finding the equilibrium between open innovation and proprietary software. Reddington acknowledged the necessity for businesses to generate profits, which inherently stems from delivering value.

While reinventing the wheel may be tempting, Reddington highlighted the importance of recognizing existing solutions and incorporating them into ongoing projects. This pragmatic approach maximizes efficiency and enables teams to focus on the unique, value-generating aspects of their work.

Organizations should also consider what software of their own could be open sourced. From a business perspective, this most likely won’t be the “crown jewels,” said Reddington, but ancillary components that others could benefit from. For example, had it not been for Google open sourcing Kubernetes, Lyft open sourcing Envoy Proxy or Facebook sharing GraphQL, we would not have these standard components for all to use.

Open Source Movements: Past, Present, and Future

Over the last decade, we’ve seen significant, more institutional maturation around open source projects. Reddington pointed to the Cloud Native Computing Foundation (CNCF) as a standout. He specifically noted Kubernetes-based Event Driven Autoscaler (KEDA) as a cool project to help scale Kubernetes containers based on the number of events needing to be processed.

He also underscored the surge of interest in generative AI, evidenced by projects like GitHub Copilot. It will be curious to see how AI assistants incorporate open source at their core, such as open foundational models and community-supported datasets.

Potential Setbacks To The Open Source and Innersource Movement

In the dynamic realm of enterprise-scale software development, nurturing innovation can be a complex endeavor. Innersource principles are one way to change the attitude toward development, making it more efficient, collaborative and aligned to the current and future developer experience expectations.

Yet, this isn’t to say we haven’t had some setbacks recently that could threaten the progress the OSS community has built. For example, HashiCorp recently abandoned its open source license around Terraform in favor of a business source license (BSL). There is also an increasing number of supply chain-related attacks that threaten common open source libraries.

Gazing Into the Future

As Reddington aptly summarized, we’re still in the early days of this transformative journey. The developer community’s inclination for experimentation will undoubtedly drive the solutions to the most pressing challenges in open source. And with enterprise adoption on the rise, the future promises more cohesive collaboration, broader adoption of innersource principles and continued innovation driven by open source values.

Interestingly, we’re seeing more synergy between open source and enterprise domains, which used to feel like separate realms entirely. And it will be interesting to see how businesses continue to balance transparency and proprietary value into the future. No matter what, the lines between them are blurring, enabling companies to harness the power of innersource for enhanced collaboration and innovation.
September 21, 2023
Survey Surfaces Major Observability Challenges

A recent survey found the biggest obstacles to observability were the pace of technology change, IT blind spots and the complexity of modern applications. The survey polled 300 IT professionals to identify the biggest challenges they faced in achieving observability. The accelerating pace of technology change (72%) topped the list, followed by IT blind spots and the growing complexity of modern applications (58% each), and lack of funding (52%).

The survey, conducted by SolarWinds, also found the typical enterprise suffered nine brownouts or outages every month, each of which lasted around twelve hours. The full cost of outages and brownouts averaged $13.7M annually for these enterprises, according to the SolarWinds report.

Jeff Stewart, field CTO and vice president, global solutions engineering at SolarWinds, said the survey makes it clear that a lack of observability is having a material impact on businesses. Organizations are now moving beyond monitoring predefined metrics to embrace observability platforms that make it simpler to investigate the root cause of issues that adversely impact businesses; these businesses are more dependent on IT than ever, he added.

In fact, the primary reason organizations are investing in observability is to improve their customer experience (96%), enable faster innovation (71%), reduce time spent solving (71%) and detecting (60%) issues and improve operational efficiency (55%), the survey found.

While it’s still early days as far as achieving observability is concerned, a lot of progress is starting to be made as organizations realize that complex IT environments require a different management approach. IT teams can no longer afford to navigate multiple monitoring tools in what often turns out to be a vain effort to prevent brownouts and downtime, noted Stewart.

In addition, many IT teams are becoming increasingly aware that the telemetry data collected via an observability platform provides the foundation for infusing IT operations with artificial intelligence (AI) capabilities, he added. The ultimate Holy Grail is to one day achieve autonomous operations, noted Stewart.

There is, of course, no shortage of observability platforms, but Stewart contends that providers of monitoring tools such as SolarWinds are in the best position to help IT teams make the observability transition. Rather than ripping and replacing a monitoring platform, a more seamless transition that results in less disruption is preferable, he noted.

Regardless of approach, observability platforms that enable IT teams to launch queries across complex distributed computing environments are becoming a necessity. Distributed computing environments often have more dependencies than IT teams can manually track. It’s only a matter of time before the most talented DevOps professionals start to migrate to organizations that provide them with the management tools and platforms required to succeed. Otherwise, the stress of managing a complex IT environment will only result in higher rates of burnout among DevOps professionals.

It may be a while before observability platforms are pervasively employed across IT environments, but as it becomes clear that brownouts and downtimes result in a decline in revenue, business leaders will understand what’s required to maximize profits. In many cases, the answer will be an observability platform that surfaces the insights needed to proactively manage modern IT environments.

September 20, 2023
Oracle Previews Latest Java 21 Innovations

Oracle today made generally available a Java 21 edition and provided early access to more than 15 proposed enhancements to the Java development kit (JDK).

Those enhancements were announced at an Oracle CloudWorld 2023 conference, including support for virtual threads to improve overall throughput and adding support for a vector application programming interface (API) that makes it simpler to build Java applications that involve artificial intelligence (AI) models.

Georges Saab, senior vice president of Oracle Java Platform and chair of the OpenJDK governing board, said the goal is to streamline access to the latest innovations that will be added to future versions of Java.

Specifically, via Project Amber, JDK 21 delivers improvements such as support for string Templates, record Patterns, pattern Matching for switch, unnamed Patterns and variables and unnamed classes and instance main methods.

In addition to the Vector API, Project Panama adds a Foreign Function & Memory API. Project Loom, in addition to virtual threads, adds scoped values and structured concurrency support.

There is also a more efficient garbage collection mechanism being proposed.

Oracle is committing to offering long-term support for Java 21 for at least eight years to encourage organizations to start working with this version of Java today. Oracle is also making available a Java Playground, an online sandbox on the Oracle Cloud Infrastructure (OCI) service where developers can create Java code using this edition without needing a local runtime or integrated development environment (IDE).

In general, Java has been experiencing a renaissance after more organizations began contributing to projects once the core platform became available under an open source OpenJDK license. In fact, the Java community is now adopting many concepts pioneered in other programming languages. That enables organizations to, for example, drive digital business transformation initiatives that depend on the modernization of legacy applications. As part of those efforts, the rate at which Java applications are being deployed in the cloud has substantially increased.

Despite the number of alternative programming languages, many enterprise IT organizations remain committed to Java. Rather than opting to retrain developers, it’s simply been more cost-effective to enable developers to continue to build applications using a programming language they already know.

Many organizations are currently in the process of shifting to Java 17. It’s not clear how many organizations will skip Java 17 and jump to Java 21 from previous versions of Java, but it’s clear Oracle is committed to making the lag time between moving from previous versions of Java to Java 21 much shorter.

Most organizations will find themselves continuing to deploy Java applications everywhere from the network edge to the cloud. These applications will be written in a programming language that has persevered for more than two decades and continues to evolve and mature for the next era of application development.

September 19, 2023
Buildkite Acquires Packagecloud to Streamline DevOps Workflows

Buildkite Pty Ltd today revealed it has acquired Packagecloud as part of an effort to tightly integrate package management tools with its continuous integration/continuous delivery (CI/CD) platform.

Buildkite CEO Keith Pitt said the goal is to reduce the level of friction that exists between providers of third-party package management tools and CI/CD platforms that DevOps teams are today required to address themselves.

There is no shortage of package management tools used to configure, install and update software, but the level of integration between these tools and CI/CD platforms has not historically been very high. The acquisition of Packagecloud will result in a package manager becoming a first-class citizen within the context of a CI/CD platform, said Pitt.

Buildkite will maintain the existing support Packagecloud provides for platforms such as Jenkins, but the acquisition will streamline DevOps workflows and improve overall developer productivity, he added.

In the months ahead, Buildkite will also add a range of tools to better enable DevOps teams to achieve that goal, said Pitt. In addition, the company plans to add tools to streamline the management of compliance processes as regulations pertaining to application development are becoming more stringent, he added.

It’s not clear how much IT organizations are reevaluating their CI/CD platforms to improve developer productivity, but platform engineering as a methodology to centralize the management of DevOps workflows is gaining traction. Those efforts promise to reduce the total cost of implementing DevOps at scale and improve developer productivity by making the scaffolding required to build applications more readily accessible. Today, too many developers are spending time managing developer environments rather than writing actual code.

The challenge, of course, is convincing developers—who tend to jealously guard their tool prerogatives—to embrace a platform engineering methodology and cede control over the development environment to a centralized team.

One way or another, developer productivity needs to improve as more organizations encounter economic headwinds. Developers are the most expensive resource any organization has, so improving the rate at which high-quality code is created will always be imperative, noted Pitt.

Today, organizations depend on software to drive revenue. Investors are assessing senior leaders within those organizations on their ability to deliver quality software in a timely fashion. Each new application and subsequent software update now has a direct impact on the profitability of the organization. As such, tolerance for legacy approaches to building software that require more time and effort is dropping.

The issue, as always, is that switching from one software development platform to another is an expensive proposition, so many organizations may find themselves supporting a mix of legacy and modern platforms. The challenge becomes defining the pace at which that migration occurs as new applications are created and legacy applications are continuously updated.

September 19, 2023
What DevOps Teams Should Know About Phishing and the Supply Chain

The DevOps pipeline is a critical component in any organization, and it has broader implications that can affect other organizations as well. Some of the biggest cybersecurity breaches of recent years were supply chain attacks, in which attacks infiltrated the development systems of one organization to break into the systems of its customers downstream. Needless to say, this had catastrophic consequences for the organization under attack.

According to Deloitte, 91% of cyberattacks begin with a phishing email, and supply chain attacks are no exception. By understanding this common threat and preventing it, DevOps organizations can significantly improve their resilience to these attacks. Of course, phishing awareness and prevention should come as part of a broader cybersecurity program that addresses additional supply chain risks.

What is Phishing?

Phishing is a method used by cybercriminals to trick you into revealing sensitive information. They do this by creating a replica of a legitimate website or email and asking you to provide personal information such as passwords, credit card numbers, and social security numbers.

Phishing attacks can take various forms. Some of the most common include email spoofing, where the attacker sends an email that appears to be from a trusted source, and website spoofing, where the attacker creates a fake website that looks identical to a legitimate one.

Regardless of the method used, the goal is the same: To trick you into providing sensitive information. Phishing is a serious threat to both individuals and businesses. It’s not just about losing money; it can also lead to identity theft, damage to your reputation, and even legal consequences. Get more background in this detailed blog post about phishing prevention.

Implications of Phishing for the Software Supply Chain

Entry Point for Larger Attacks

The supply chain is a prime target for phishing attacks. This is because it provides an entry point for larger attacks. For example, a phishing attack on a supplier could compromise their security, allowing the attacker to infiltrate organizations that use their software downstream.

This kind of attack can have devastating consequences. It could lead to the theft of sensitive information, disruption of operations and even compliance risks.

Information Theft

Information theft is one of the most significant risks associated with phishing attacks on the supply chain. When a supplier falls victim to a phishing attack, the attacker can gain access to a wealth of valuable information belonging to the supplier and, in some cases, to its customers or partners. This could include everything from financial data to proprietary business information.

The loss of such information can have severe implications. It could lead to financial loss, damage to the company’s reputation, and legal consequences.

Disruption of Operations

Another significant risk associated with phishing attacks on the supply chain is the potential for disruption of operations. A successful phishing attack could compromise a supplier’s systems or the systems of organizations that rely on that supplier, leading to downtime and delays in the supply chain.

This kind of disruption can cause significant damage to a business. It could result in lost sales, damage to customer relationships and even the potential for business failure.

Compliance Risks

Lastly, phishing attacks on the supply chain can lead to compliance risks. Many industries are subject to strict regulations regarding data security. If a phishing attack leads to a data breach, the companies involved could face hefty fines and penalties.

Additionally, a data breach could damage a company’s reputation, making it harder to do business in the future.

Practical Steps to Secure the DevOps Pipeline

1. Implementing Security Awareness Training

The first and most crucial step in countering phishing risks is implementing security awareness training. This involves educating all team members about the various forms of phishing attacks and how to recognize them. Interactive sessions, workshops and webinars can be very effective in conveying this knowledge.

Another vital aspect of security awareness training is teaching employees how to respond to suspected phishing attempts. They should know the steps to take, such as not clicking on any links in a suspicious email, reporting the incident to the IT department and deleting the email.

2. Deploying Anti-Phishing Tools and Technologies

While awareness and education are critical, they are not enough on their own to protect against phishing attacks. This is where anti-phishing tools and technologies come into play. These tools can help detect phishing attempts and prevent them from reaching the intended targets.

There are several types of anti-phishing tools available, including email filters that detect and block phishing emails, browser add-ons that warn users when they attempt to visit a phishing website and AI-based tools that can recognize even sophisticated phishing attempts.

3. Incorporating Security into the Software Development Life Cycle (SDLC)

Incorporating security into the software development life cycle (SDLC) is another crucial step in countering phishing risks. This means considering security at all stages of software development, from planning and design to coding, testing and deployment.

Security should be a primary consideration when designing software systems. This includes designing systems to be resilient to phishing attacks, for example, by using secure coding practices to prevent common vulnerabilities that phishers can exploit.

During the coding and testing stages, it’s crucial to conduct regular security audits and vulnerability assessments to identify any potential weaknesses that could be exploited by phishers. Any identified vulnerabilities should be promptly addressed.

Finally, during the deployment stage, it’s vital to ensure that all software components are securely configured and that any security patches or updates are applied promptly. This can help prevent phishing attacks that exploit software vulnerabilities.

4. Regular Phishing Simulations and Drills

Finally, conducting regular phishing simulations and drills is an excellent way to test the effectiveness of your phishing prevention measures. These simulations involve sending mock phishing emails to employees to see how they respond. The results can provide valuable insights into areas where further training or technical measures may be needed.

Phishing drills should be conducted regularly and should cover various phishing techniques. The results of these drills should be shared with all team members, along with feedback and recommendations for improvement.

Phishing simulations should also be used to test the effectiveness of your anti-phishing tools. If a significant number of mock phishing emails get through your defenses, this could indicate that your tools are not effective and need to be updated or replaced.

Conclusion

In conclusion, the integrity of DevOps pipelines—and, by extension, the entire supply chain—is increasingly under threat from phishing attacks. This is a grave concern given the potentially devastating implications ranging from data theft, operational disruption, legal consequences and considerable compliance risks.

However, organizations can proactively safeguard their DevOps pipelines by fostering a security-conscious culture underpinned by regular training and awareness programs. Deployment of state-of-the-art anti-phishing technologies and the integration of security at all stages of the SDLC can further strengthen defenses.

Additionally, regular phishing simulations and drills can be instrumental in testing and enhancing the resilience of these measures. The war against phishing is continuous and staying one step ahead of the threat requires constant vigilance, innovative strategies and robust technical defenses.

September 19, 2023
Summit Highlights Open Source Software Security Progress

More than a year after the Open Source Security Foundation (OpenSSF) summit kicked off an initiative to better secure open source software-based software supply chains, a lot of progress has been made—but much work remains to be done.

The OpenSSF this week hosted a Secure Open Source Software (SOSS) Summit 2023 event in Washington, D.C., during which it made available a Secure Open Source Software Vision Brief 2023. The brief describes the various efforts being made to improve open source software security, including, for example, providing maintainers of open source software projects with free DevSecOps tools.

This week, the Cybersecurity and Infrastructure Security Agency (CISA) also published an Open Source Software Security Roadmap that defines its role in providing more visibility into how open source is being used and the associated risks.

However, it’s not clear how much maintainers of these projects are embracing DevSecOps workflows. Many projects are led by a handful of maintainers that often lack the time and skills required to ensure the components they employ have not, for example, been compromised by malware that might find its way into downstream applications.

Sonatype CTO Brian Fox said the focus of the summit’s participants will be on education and securing public code repositories. While there is a lot of focus on maintainers, he added that there is not enough attention to all the organizations that have not updated open source components within a software build with known vulnerabilities. Many IT teams are reluctant to upgrade components for fear of breaking applications with complex dependencies, but the amount of code that is potentially insecure is massive. “There’s a huge mountain to climb,” he said.

The challenge is determining which code to upgrade first in a way that will have the most impact in terms of improving application security, added Fox.

Shawn Ahmed, chief product officer for CloudBees, also noted that organizations should evaluate the DevSecOps processes being applied by maintainers of open source software projects. CloudBees, for example, reviews the plugins provided by the open source community for the Jenkins continuous integration/continuous delivery (CI/CD) platform for vulnerabilities every month, he noted.

It’s also critical for organizations that consume open source software to contribute code to improve the security of open source software, added Ahmed. Too many organizations are focused on open source software security without devoting resources that would help resolve the issue. he added. “We need to make sure open source software is not a vulnerability threat,” said Ahmed.

Moran Ashkenazi, chief strategy officer (CSO) and vice president of security engineering for JFrog, said on the plus side, there is a lot more awareness of open source software security issues since the disclosure of a zero-day vulnerability in the Log4j shell tool widely used to manage logs in Java applications. But added that this issue is not going to be resolved overnight. “That was a wakeup call,” she said.

Tapabrata Pal, vice president of architecture for Fidelity Investments, noted that the fundamental problem is that cybercriminals have become more adept at injecting malware into software supply chains, so no one knows whether their application environments might be compromised. “It’s a serious issue,” he said.

It’s not known whether the open source software that many developers routinely incorporate into their applications might contain vulnerabilities that could be exploited, but the level of technical debt that has accrued over the last several decades is considerable. The issue is finding a way to address it without becoming overwhelmed by the enormity of the task.

September 14, 2023
CloudBees CEO: State of Software Development is a Disaster

CloudBees CEO Anuj Kapur told attendees at a DevOps World event today that with developers spending only 30% of their time writing code the current state of software development in enterprise IT organizations is a disaster.

After more than 14 years of effort, the promise of DevOps—in terms of being able to accelerate the rate at which applications are being deployed—remains largely academic, said Kapur. In fact, the effort to shift more responsibility for application security further left toward developers has only increased the amount of cognitive load and reduced the amount of time available to write code, he noted.

However, with the rise of generative artificial intelligence (AI), an inflection point that will dramatically increase the velocity at which applications are being built and deployed has arrived, said Kapur. The challenge will be achieving that goal without increasing the cognitive load on developers. That cognitive overload results in 70% of developers’ time not being productive within organizations that often hire thousands of developers, he noted.

Despite all the DevOps issues that need to be addressed, AI advances promise improvement. The overall DevOps market is still relatively young, given the current level of adoption, said Kapur. “We continue to believe the market is early,” he said.

Today, CloudBees took the wraps off the first major update to the open source Jenkins continuous integration/continuous delivery (CI/CD) platform to have been made in the past several years. At the same time, the company also unveiled a DevSecOps platform based on Kubernetes that is optimized for building and deploying cloud-native applications based on portable Tekton pipelines. That latter platform provides the foundation through which CloudBees will, in the months ahead, apply generative AI to software engineering to, for example, create unit tests on the fly and automate rollbacks.

In addition, DevSecOps capabilities will be extended all the way out to the integrated development environments (IDE) to reduce the cognitive load of developers.

The overall goal is to reduce the number of manual processes that create bottlenecks that make it challenging to manage DevOps at scale.

Criticism of the level of developer productivity enabled by DevOps compared to other development approaches needs to be tempered, said Tapabrata Pal, vice president of architecture for Fidelity Investments, because it still represents a significant advance. There is still clearly too much toil, but the issues that impede the pace at which developers can effectively write code tend to be more cultural than technical, he added.

Organizations are not inclined to automatically trust the code created by developers, so consequently, there is still a lot of friction in the DevOps process, noted Pal.

In theory, advances in AI should reduce that friction, but it’s still early days in terms of the large language models (LLMs) that drive generative AI platforms and their ability to create reliable code, he added. That should improve as LLMs are specifically trained using high-quality code, but in the meantime, the pace at which substandard code might be generated could overwhelm DevOps processes until AI is applied there as well, said Pal.

Thomas Haver, master software engineer for M&T Bank, added that while assisted AI technologies will have a major impact, it’s not reasonable to expect large organizations to absorb them overnight. Patience will be required to ensure advances are made in ways that are both secure and sustainable, he added. In some cases, organizations may opt to build their own LLMs to achieve that goal, noted Haver. “You should not expect to change on a dime,” he said. “It will take time to see the fruits of our labor.”

While many DevOps challenges need to be resolved, the benefits continue to outweigh the cost and effort required to succeed. The hope is that, with the help of AI, the return on those investments will continue to accrue.

September 14, 2023
JFrog swampUP: Keynotes and What’s Next

At the sold-out JFrog swampUP conference this morning, the event’s keynotes were headlined by JFrog CEO Shlomi Ben Haim and co-founder and CTO Yoav Landman. The theme was “next”—what’s next for DevOps and what’s next for developers.

Of course, there are several answers, but cutting to the chase, it seems security is job one. Developers are squarely in the crosshairs of the bad guys, and protecting them and their code is top priority at JFrog. To do so requires shifting security even further left into the integrated development environment (IDE) itself. Landman demonstrated new functionality in the JFrog Xray scanning and remediation solution’s IDE and emphasized the difference between quality assurance and quality testing.

CEO Ben Haim took a higher-level view, looking at the issues facing organizations as they seek to develop more, develop faster and do so more securely. He also reinforced the themes hit on by Landman. Overall, the message from both co-founders was that the amount of code being deployed continues to increase exponentially. The need to go faster while being more secure is greater than ever, and JFrog has adopted that as the company’s mission, Ben Haim and Landman said.

Audience enthusiasm was high, and despite growing to almost 1,000 employees, many of whom have been on board for less than a year, the culture at JFrog remains a constant focus. Landman and Ben Haim reiterated that the company is committed to their customers and their community.

That community was well represented, with all three of the major cloud providers exhibiting in the expo area, as well as a good mix of other DevOps providers like CloudBees (whose own DevOps World Roadshow kicked off today). Additionally, some of the new channel partners, such as IT Methods, also exhibited.

Beyond the keynote, other JFrog presenters in the morning keynote sessions included the leadership of the Artifactory team and senior leadership of the security team.

JFrog leaders were not the only ones on the agenda at swampUP. A leading games company presented a demonstration of their use of JFrog for CI/CD pipelines. One of the big three cloud providers presented a session discussing whether AI will replace developers (spoiler alert: The answer is no). Additionally, frequent devopsy.kinsta.cloud contributors Tracy Ragan and John Willis also presented throughout the day. Our own Will Willis will be recapping some of those highlights.

All in all, it was a return to normalcy for swampUP. This event felt much like previous swampUPs that occurred before the COVID-19 pandemic began. The event was sold out with over 400 attendees, which tracks with what we’ve seen at other in-person events recently.

JFrog has grown and matured but continues to emphasize what has made the company successful. We’re excited to see lots of new features for developers and DevOps practitioners to explore.

September 14, 2023
CloudBees Unfurls Dual CI/CD Strategy at DevOps World Event

During a DevOps World event, CloudBees took the wraps off the first major update to the open source Jenkins continuous integration/continuous delivery (CI/CD) platform made in the past several years.

At the same time, the company also unveiled a proprietary DevSecOps platform based on Kubernetes that is optimized for building and deploying cloud-native applications based on portable Tekton pipelines.

Shawn Ahmed, chief product officer for CloudBees, said the updates to Jenkins make it possible to horizontally scale Jenkins controllers while at the same time ensuring high availability. The latest update also provides a workspace caching mechanism to simplify sharing them across multiple jobs in a way that significantly reduces the amount of compute and storage resources consumed, he added.

CloudBees also added a Baseline capability to the Jenkins repository to improve startup times without causing build storms.
Collectively, those capabilities will increase the number of jobs that can be simultaneously executed to improve overall productivity, said Ahmed.

CloudBees has also added a Pipeline Explorer tool in the cloud-based edition of Jenkins that enables DevOps teams to visually debug and troubleshoot pipeline jobs. That tool will also provide the foundations for self-healing and artificial intelligence (AI) capabilities that CloudBees plans to add to the Jenkins platform later this year and into 2024, added Ahmed. For example, AI tools will surface suggestions on how to fix a problem in a pipeline, he noted.

The DevSecOps platform, meanwhile, leverages Tekton pipelines to provide DevOps teams with more granular control over how pipelines can be orchestrated, said Ahmed. It also provides access to GitHub Actions-style domain-specific language (DSL), support for feature flagging, security, compliance, pipeline orchestration capabilities, analytics and value stream management (VSM) tools that can be deployed by an internal IT team or accessed via a single or multi-tenant managed cloud service.

Those built-in capabilities will make it simpler for platform engineering teams to centrally manage building and deployment of cloud-native applications by enabling developers to self-service their own engineering requirements via an internal developer platform (IDP), said Ahmed. The overall goal is to provide a more integrated approach that breaks down software engineering silos that exist in many existing DevOps workflows, said Ahmed.

Each DevOps team will need to decide for themselves to what degree to move forward using Jenkins to build and deploy applications versus opting for a more modern alternative in the form of the DevSecOps platform. CloudBees, however, is committed to providing plug-ins and integrations across both platforms to enable DevOps teams to protect their investment in existing tooling, noted Ahmed.

The status of Jenkins X, an open source CI/CD platform based on Kubernetes that CloudBees previously donated to the Cloud Delivery Foundation (CDF), is not immediately clear. Regardless of the approach, however, there is a clear opportunity to revamp DevOps workflows by upgrading Jenkins or switching to a more modern platform such as DevSecOps. The challenge, as always, is determining the pace at which any such transition might be made.

September 14, 2023
JFrog Launches New Channel Partner Program

At JFrog’s swampUP event in San Jose, California, the company launched its Global Channel Partner Program. The program, led by Kelly Hartman, VP of alliances and partners, is JFrog’s first formal program to work with the channel to bring its DevOps and DevSecOps solutions to market.

Rather than the traditional pyramid model, Hartman, who was formerly at AWS, has designed a flatter program; partners can choose to work with JFrog in a co-selling arrangement, as a traditional reseller or as part of JFrog’s government sales partners. Partners can choose which type of relationship they want to use on a case-by-case, deal-by-deal basis. This gives them lots of flexibility.

This program is a sign of JFrog’s continuing evolution from a startup to a public company. Several of the founding channel partners in the program weren’t surprised at the announcement; the feeling was, as Mike King of IT Methods said, “They have been knocking on this door for some time.” Hartman added that the goal was not to make JFrog a 100%-channel company. Rather, the aim is to have as much business run through the partners as JFrog’s customers want while keeping the emphasis on the JFrog customer base.

The program is primarily aimed at DevOps consultants worldwide, rather than the larger integrators, JFrog said. The DevOps consultant market is broadly fragmented, and made up of numerous sized companies – from one to two-person operations all the way up to 1,000+-person organizations, such as IT Methods.

Hartman said she is learning from her past experience at AWS and other organizations. She has not crafted a traditional program with tiers and marketing development funds; instead, much of what partners need is built into a self-service portal, including a campaign in a box and social media kits.

IT Methods is an ideal partner for JFrog, King said. They offer a fully-managed SaaS, single-tenant platform allowing their customers to manage their DevOps environments. IT Methods supports more than 45 DevOps tools and its major clients are large enterprises. They have offered JFrog via their platform for six years, but welcome the formal partner program and accompanying certification offered for SMEs. King said he was pleasantly surprised at the JFrog program’s maturity, considering it is a new program. He added that joint lead generation and closing capability and partner enablement offerings would put JFrog “at the head of the class.”

The JFrog channel partner program joins their existing technology partner and cloud partner programs. In fact, Hartman said they are working with their cloud provider partners to source new channel partners.

It was an exciting new development in what promises to be a gangbuster swampUP here in San Jose. More developments will follow.

September 13, 2023