devopsy.kinsta.cloud

Category: DevOps Culture

Logz.io Leverages AI to Identify Anomalies in Real-Time

Logz.io this week revealed it has added a real-time anomaly detection capability to its observability platform that makes it simpler to correlate the impact IT events will have on business processes.

This capability is based on artificial intelligence (AI) models trained using historical data collected via the Logz.io Open 360 platform.

Logz.io CTO Asaf Yigal said this addition to the Open 360 platform enables DevOps teams to employ machine learning algorithms to identify anomalies in mission-critical processes that warrant further investigation. Armed with insights that go beyond simple IT infrastructure consumption metrics, it becomes possible to significantly reduce mean time to resolution, he added.

Logz.io has been embedding AI models within its platform since last year. Still, this latest capability will enable organizations to further bridge a divide between IT and the business that has long plagued many organizations, noted Yigal.

The ultimate goal is to make it simpler for DevOps teams to instantly identify any anomalous application behavior that represents a risk to the business, including cybersecurity events, he added.

The AI capabilities that Logz.io has been steadily adding to its observability platforms are largely transparent to DevOps teams, said Yigal. Instead, Logz.io is embedding multiple types of AI models into its platform that can be invoked in much the same way any other capability is provided, he added. DevOps teams are not necessarily going to need to build their own models to take advantage of AI to observe application behavior at scale, noted Yigal.

The goal is to surface those capabilities consistently at a level of cost organizations can afford, added Yigal.

It’s not likely AI will replace the need for DevOps teams any time soon, said Yigal. After all, there is a reason AI models are referred to as co-pilots versus an automatic pilot, he noted.

It’s not clear to what degree organizations today can correlate the impact an IT event is going to have on the business. But as organizations continue to realize how dependent they are on applications to drive digital processes, the need to bridge the historic divide between IT and the rest of the business has become more urgent. In fact, many of the product and brand champions that organizations now rely on to manage a business unit often have a background in DevOps.

Of course, business professionals that are steeped in IT are still relatively rare but as advances in AI continue to make it simpler to understand how complex application environments function the number of users of an observability platform will naturally expand beyond IT. The challenge is presenting each stakeholder with a view into the IT environment that meets their specific requirements.

It may take a yet before the divide between IT and the rest of the business is permanently bridged but with each passing year it gets narrower. The challenge and the opportunity now is making sure everyone on both sides of that divide understands the art of the possible today that only a few short years ago would have seemed impossible to achieve.

March 1, 2024
New Relic Streamlines Observability Data Management

New Relic this week made available a live archives capability that provides instant access to historical logs for up to seven years and eliminates the need to rehydrate, reload, re-index or move data.

At the same time, the company also announced its observability platform is now integrated with infrastructure and observability tools provided by Sentry Software to help IT teams reduce costs and collect additional sustainability metrics alongside logs, metrics and traces.

Jemiah Sius, senior director of developer relations for New Relic, said overall, New Relic is moving to make it simple to analyze and store telemetry data regardless of when it was collected. For example, rather than requiring historical data to be accessed via a cold storage service in the cloud, the New Relic platform now makes that data available directly within the database that is at the core of its observability platform.

That approach also provides the added benefit of not incurring ingress and egress fees for moving data in and out of cloud storage services, noted Sius.

IT teams can simply create a New Relic Query Language (NRQL) to identify which logs to route to a live archive in as little as 30 seconds without having to add an additional log collector.

The overall goal is to make it simpler to investigate incidents faster, given the urgency that is created whenever there is an outage or audit request that needs to be immediately addressed, noted Sius. That’s critical because DevOps teams are always for time, he added.

In general, New Relic is reducing the overall toil associated that many DevOps teams encounter today when managing telemetry data. Rather than being confronted with a complex set of data engineering tasks, telemetry data from multiple applications and infrastructure platforms can automatically be collected, analyzed and stored.

It’s still early days as far as the adoption of observability platforms is concerned, but there is already no shortage of options. The challenge is that in addition to logs, metrics and traces, IT teams are now starting to also track cost and energy consumption metrics. Observability platforms provide the means to centralize telemetry data that is only going to increase in volume as more applications are deployed. The challenge has been framing the queries needed to surface meaningful insights. Fortunately, with the rise of generative artificial intelligence (AI) tools that make it simpler to create queries, the overall level of skill required to invoke an observability platform is dropping. In effect, generative AI is making it possible to democratize DevOps best practices.

Ultimately, existing DevOps teams should be able to manage highly distributed application environments without having to hire and retain a small army of additional software engineers. The issue is that, in many cases, the size of the overall code base is increasing rapidly as developers take advantage of various generative AI tools to help them write code faster. Hopefully, advances in AI will arrive soon enough to enable DevOps teams to cope with all that code before DevOps teams are inevitably overwhelmed.

March 1, 2024
Observe Inc. Adds Tool for Exploring Distributed Traces

Observe Inc. this week added a Trace Explorer tool to its namesake observability platform that makes it simpler to search, analyze and visualize billions of traces.

Traces are being used with greater frequency to track how resources are being invoked across increasingly distributed computing environments. That capability provides DevOps teams with a level of insight into workflows that goes well beyond the logs and metrics that almost every IT team routinely collects.

Observe Inc. CEO Jeremy Burton said the challenge now is providing IT teams with tools that make it simpler to affordably manage traces at scale to reduce mean time to remediation (MTTR). The Observe platform enables IT teams to store the traces they run in a data lake from Snowflake for 13 months versus other platforms that only store a trace for a few days, which then requires IT teams to rerun the same trace multiple times each time they launch an investigation.

The overall goal is to encourage DevOps teams to launch more investigations to improve application performance by making traces readily available using low cost S3 storage from Amazon Web Services (AWS) that is accessed via the Snowflake data lake that makes it simpler to apply artificial intelligence (AI) to telemetry data.

That approach makes it economically feasible for DevOps teams to not just resolve an incident but also provide the level of investigation required to accurately identify its root cause, said Burton. Because the cost of storing telemetry data is so high, DevOps teams that employ other observability platforms are not able to thoroughly investigate incidents because they lack access to telemetry data that their organization decided not to store because of cost concerns, he added.

Most organizations are still mastering the nuances of observability platforms that enable them to query telemetry data that, in addition to being easier to collect using open source OpenTelemetry agent software, is also increasing in volume thanks to the rise of microservices-based applications. Each microservice now generates its own telemetry data that needs to be analyzed and stored. As microservices make application environments more complex, the need for tools to analyze all that telemetry data becomes more pronounced.

As businesses become more dependent on software to operate, it’s now more than apparent that legacy approaches to monitoring IT metrics are no longer sufficient, said Burton.

It’s not clear how quickly organizations are adopting observability platforms, but there is already no shortage of options. Given the current state of funding for startup companies in the IT industry, IT teams would be well-advised to research the level of funding the providers of these platforms have before deciding which vendor to rely on, noted Burton. Last year, Observe Inc. raised an additional $50 million in funding.

Regardless of the observability platform selected, the one thing that is certain is that observability platforms infused with AI are changing the way IT is managed. The issue IT teams often encounter now is convincing the organization to fund the acquisition of these platforms at a time when budget resources in many organizations are already being stretched thin.

March 1, 2024
How Much Testing is Too Much?

We have reached an interesting point in the automation of IT in general and testing specifically. Our tooling now allows us to generate a list of all of the possible permutations of a given test set. This is interesting because we can generate all of the possible permutations of a given test. We can also automatically run all of the tests so generated. And we can automatically filter those results, only raising what needs greater attention to a human for evaluation.

And that’s not necessarily a good thing.

Nothing is free. Nothing. In the case of pervasive testing that goes beyond the wildest dreams of the most stringent QA manager, it costs a lot. The CPU cycles and storage space to create, execute, evaluate and notify the volume of tests we are talking about is exorbitant and unlikely to be adopted by your average organization. Truth is, it is unlikely to be adopted by any organization, but there is always some corner case, so I’m being a little vague to keep the conversation focused on the technical issues.

Testing vendors are already working on filtering tools to test only what has changed in the product, but this implies that, at a minimum, this level of testing should not be applied when testing is most needed–during initial development. I might be bringing my baggage along, but I personally prefer focused and curated testing to a firehose that is always on. It doesn’t take much imagination to see a scenario where a full-on automated test filtering tool is off just a little bit, and we get flooded with alerts that are not necessarily false positives but that include information we don’t want to see and consume man-hours needlessly.

Like everything in our recent past, this process will be rolled out too early and then will get tweaked and fixed on the fly, with you and I paying for the privilege of being beta testers, in fact, if not in name. So, I strongly advise caution in adopting new testing automation. I’m super excited by the possibility that all application testing can get the attention it deserves. Still, I am not at all interested in being the experiment on the way to that panacea. So watch the space, listen to other tech folks, and pay attention to how it is working out for them. We have had a tiny percentage of test coverage for so long that waiting for the early adopters to work out the kinks is not going to cause too much additional risk.

As a couple of glaring scenarios have recently reiterated, high-tech vendors are more than happy to do to you in the age of recurring revenue rather than for you. Use caution; make sure that any test automation tool you use aligns with your corporate goals and that the ones you hold subscriptions to are not rolling out massive test automation behind your back. Know your product, and pay attention to any changes in release or license—now more than ever.

And keep rocking it. Soon, we will have effective 100% or near 100% coverage in testing; just don’t rush it. Let the work mature and keep your eyes focused on serving your customers the best product you can without adopting bleeding-edge ideas that might create liability via technology or implementation immaturity. Your customers should thank you, but far too many won’t, so I will for them. Be they internal or external, those who use your systems owe you big thanks for the quality and massive uptime they take for granted.

February 28, 2024
Securing the DevOps Pipeline: Tools and Best Practices

The DevOps pipeline refers to the set of practices and tools designed to automate and integrate the processes between software development (Dev) and IT operations (Ops) teams. This pipeline facilitates continuous integration (CI), continuous delivery (CD) and rapid deployment practices, aiming to shorten the development life cycle and provide continuous delivery with high software quality.

The DevOps pipeline typically includes planning, coding, building, testing, releasing, deploying, operating and monitoring, enabling teams to develop and deploy software more efficiently and with fewer errors.

By automating workflows and integrating various development and operational activities, the pipeline supports the rapid iteration of software releases. This not only accelerates the pace of software development but also ensures that quality and performance standards are met throughout the application’s life cycle.

Due to the critical nature of the DevOps pipeline, security is becoming a top priority. Some of the most devastating cyberattacks in recent years were related to breaches in DevOps pipelines, which led to global-scale supply chain attacks.

The Need for Security in DevOps

DevOps, by its very nature, encourages speed and efficiency. However, this drive for rapid software development and deployment can sometimes overlook the critical aspect of security. That’s why it’s essential to weave security into the fabric of the DevOps pipeline, an approach known as DevSecOps. By doing so, we can ensure that security isn’t an afterthought but an integral part of the development process.

Incorporating security into the DevOps pipeline offers multiple benefits. First, it helps identify and rectify security vulnerabilities early in the development process, reducing the risk of security breaches. It also fosters a culture of shared responsibility, where the development, operations and security teams work together toward the common goal of creating secure software.

Tools for Securing the DevOps Pipeline

Securing the DevOps pipeline requires a set of tools that align with the DevOps philosophy of automation and continuous improvement. Let’s explore some of these tools.

Static Application Security Testing (SAST)

SAST, also known as white-box testing, is a tool that helps locate security vulnerabilities in the codebase without executing the application. It makes it possible to identify issues early in the development process, even before the code is run.

SAST works by analyzing the source code, bytecode or binary code, looking for patterns that might indicate a security flaw. The strength of SAST lies in its ability to pinpoint the exact location of the security vulnerability in the codebase. This makes it easier to fix the issue, thus saving time and resources.

Dynamic Application Security Testing (DAST)

DAST, a type of black-box testing, involves testing the application in its running state. It’s designed to find security vulnerabilities that can’t be spotted during static analysis.

DAST works by simulating attacks on the application and observing its response. It can identify security issues like cross-site scripting (XSS), SQL injection and security misconfigurations. The beauty of DAST is that it views the application from an attacker’s perspective, thus providing a real-world assessment of its security. However, DAST can’t identify vulnerabilities in the source code and relies on the application being in its running state for testing.

Software Composition Analysis (SCA)

Software composition analysis (SCA) is designed to provide visibility into the open source components used in the software. It helps identify any security vulnerabilities, licensing issues or outdated libraries in the open source components.

SCA works by creating a bill of materials (BOM) that lists all the open source components used in the software. It then compares this list against various databases that track open source vulnerabilities. If a match is found, SCA flags the component, allowing the developers to take necessary actions.

Endpoint Detection and Response (EDR)

Endpoint detection and response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. EDR tools continuously monitor endpoint and network events and record the information in a central database where further analysis, detection, investigation, reporting, and alerting take place.

EDR is like a surveillance system for your DevOps pipeline. It keeps an eye on endpoint activity, and if it detects a potential threat, it alerts developers and security staff. EDR is not just about detection; it also provides tools for responding to security incidents. It helps isolate affected systems, block malicious activities and even roll back systems to their pre-attack state.

Container Security Tools

In a DevOps environment that increasingly relies on containerization, container security cannot be overlooked. Container security tools provide a means to enforce security policies and protect containerized applications.

These tools offer functionalities like image scanning, runtime protection and network segmentation. Image scanning helps identify vulnerabilities in the container images. Runtime protection monitors the container’s activities in real-time, looking for any signs of compromise. Network segmentation allows for isolating containerized applications, thus limiting the blast radius in case of a security incident.

Best Practices for Securing the DevOps Pipeline

Integrate Security Early (Shift Left)

The concept of ‘shifting left’ in DevOps refers to integrating security measures early in the development process. Instead of treating security as an afterthought, it becomes a part of the software development life cycle from the get-go.

Implementing security early allows us to identify and address potential vulnerabilities before they become a significant issue. It saves us time and resources by preventing security breaches instead of responding to them. Besides, it fosters a proactive approach to security, emphasizing prevention over remediation.

SAST and DAST are useful in integrating security early. SAST tools analyze code in its static state to identify vulnerabilities, while DAST tools test applications in their running state to detect security flaws.

Automate Security Processes

Automated security scans can be incorporated into the continuous integration/continuous delivery (CI/CD) pipeline. Each time a code push occurs, these scans are triggered, allowing for immediate feedback on potential security issues. Automated scans can detect a broad range of vulnerabilities, from code defects to configuration errors.

Configuration management tools like Chef, Puppet, Ansible and Terraform can help manage configurations and enforce security policies. They ensure that all systems are configured correctly and consistently, reducing the risk associated with manual configuration.

Regular Security Audits and Compliance Checks

Regular security audits and compliance checks are essential in securing the DevOps pipeline. They provide an opportunity to review and update security measures, ensuring they are effective and up-to-date.

Security audits should be comprehensive, covering all aspects of the DevOps pipeline. They should evaluate security controls, identify potential vulnerabilities, and recommend remedial measures. Compliance checks ensure that security practices align with relevant regulations and standards.

In conclusion, securing the DevOps pipeline requires a holistic approach that integrates security into every aspect of the development process. It involves shifting security left, automating security processes, conducting regular audits and compliance checks and fostering a culture of collaboration.

February 27, 2024
Forget Shift Left: Why ‘No Shift’ is the Future of Software Innovation

The evolution of DevOps, continuous testing, DevSecOps and site reliability engineering (SRE) practices has always been aimed toward increasing efficiency, safety and speed in software development and deployment processes. The “shift left” strategy has been a cornerstone of this evolution, emphasizing the integration of testing and security practices early in the development life cycle to catch and fix issues sooner, thereby reducing costs and improving quality. However, with advancements in automation, AI, machine learning technologies and deployment strategies like feature flags, a “no shift” strategy is emerging as a compelling alternative. This strategy argues for the feasibility of developing and testing directly in production, thus potentially bypassing the traditional development-to-production delivery pipeline. Here, we’ll compare the “shift left” and “no shift” strategies, examining their strengths, weaknesses and how the latter could address its challenges.

Key Concepts

Shift Left: This strategy involves integrating testing, security and operations concerns early in the software development process. The goal is to detect and fix issues earlier, which is less costly and less time-consuming than doing so later in the life cycle. It emphasizes early and frequent collaboration among cross-functional teams.
No Shift: Contrary to “shift left,” the “no shift” strategy involves using advanced technologies and practices to safely develop and test within the production environment. This strategy leverages real-time data, feature flags for controlled rollouts, AI for predictions and anomaly detection and robust automation to ensure that changes can be made directly in production without compromising stability or security.

Shift Left Strengths and Weaknesses

Early Issue Detection: Catches bugs and vulnerabilities early in the development cycle.
Cost Efficiency: Reduces the cost of fixing issues by catching them early.
Enhanced Collaboration: Encourages cross-functional team collaboration from the start.

Shift Left Weaknesses:
Initial Slowdown: Integrating testing and security early can slow initial development efforts.
Complexity: Requires significant effort to integrate and automate various tools and practices.

No Shift Strengths and Weaknesses:

Real-Time Feedback: Offers immediate feedback from real users and production data.
Speed: Potentially faster delivery by eliminating the traditional staging/testing phase.
Innovation: Leverages cutting-edge AI and ML technologies for predictive analytics and anomaly detection.

No Shift Weaknesses:
Risk in Production: Higher initial risk of impacting users with bugs or security issues.
Complexity and Overhead: Requires sophisticated feature flagging, monitoring and rollback mechanisms.

Overcoming No Shift Weaknesses

To mitigate the risks and challenges associated with the no shift strategy, organizations can adopt several practices:

• Robust Feature Flagging: Implement a comprehensive feature flagging system to control feature releases and perform gradual rollouts.
• Advanced Monitoring and Observability: Utilize AI-driven monitoring tools to detect anomalies and issues in real-time.
• Automated Rollbacks: Develop mechanisms for quick rollback of changes that cause issues in production.
• User Segmentation: Test new features on subsets of users to minimize potential negative impacts.

How Platform Engineering Can Facilitate ‘No Shift’

Platform engineering, combined with AI-assisted development tools, plays a pivotal role in enabling and facilitating a successful no shift strategy in software development. This combination creates a robust, flexible and intelligent infrastructure that supports the seamless development, testing and deployment of applications directly in production environments. Here’s how these components work together to make no shift a reality:

1. Automated Environment Provisioning

• Platform engineering creates standardized, self-service environments for developers, reducing the setup time and complexity traditionally involved in preparing production-like environments.
• AI tools can predict and automatically adjust resources based on the application’s needs, ensuring optimal performance without manual intervention.

2. Intelligent Continuous Integration/Continuous Deployment (CI/CD)

• AI-assisted development tools analyze code in real-time to predict potential integration and deployment issues, recommending fixes before the code is merged or deployed.
• Platform engineering ensures that CI/CD pipelines are scalable, secure and resilient, incorporating AI insights to streamline workflows and decision-making processes.

3. Advanced Monitoring and Observability

• Platform engineering provides a backbone of monitoring tools that collect vast amounts of operational data.
• AI tools leverage this data for predictive analytics, anomaly detection and automated root cause analysis, enabling teams to preemptively address issues before they impact users.

4. Enhanced Security Posture

• AI-assisted tools continuously scan for vulnerabilities and anomalous behavior within the codebase and the production environment, offering real-time alerts and automated patching or mitigation strategies.
• Platform engineering integrates these tools into the development life cycle, ensuring that security is a paramount concern handled efficiently and without disrupting the flow of development.

5. Feature Flag Management and A/B Testing

• Platform engineering facilitates the implementation of feature flags and A/B testing frameworks, allowing developers to roll out new features gradually and safely.
• AI tools analyze user interactions and feedback with new features in real-time, offering insights that help decide whether to roll back, continue or expand the rollout of a feature.

6. Scalability and Performance Optimization

• AI-assisted tools can predict load patterns and automatically scale resources up or down as needed, ensuring that applications remain responsive under varying loads.
• Platform engineering ensures that the infrastructure supports dynamic scaling and performance optimization, making it possible to maintain high performance and availability even as demands change.

Conclusion

The debate between “shift left” and “no shift” strategies highlights the dynamic nature of software development methodologies. While shift left has been effective in improving software quality and security, the no shift strategy, with its emphasis on real-time feedback and rapid deployment, presents an attractive alternative in an era dominated by automation, AI and ML technologies.

By leveraging the strengths of platform engineering and AI-assisted development tools, organizations can effectively implement a no shift strategy. This approach not only accelerates the development cycle but also significantly reduces the risks associated with deploying directly into production. It fosters a culture of innovation, allowing developers to rapidly iterate on and refine their applications in real-time, based on actual user feedback and data-driven insights. The synergy between platform engineering and AI creates a solid foundation for a resilient, efficient and adaptive software development life cycle.

Despite the initial risks and complexities, the no shift strategy’s potential for faster innovation cycles and its ability to leverage real-world data make it a compelling choice for organizations willing to invest in the necessary tools and practices to mitigate its weaknesses. As these technologies continue to evolve and mature, it’s likely that the no shift approach will become increasingly feasible and popular, potentially overtaking shift left as the preferred strategy for forward-thinking organizations seeking to maximize speed, efficiency and innovation in their software development processes.

devopsy.kinsta.cloud · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 27, 2024
404: Role Not Found – Generative AI’s Impact on DevOps Jobs
Many DevOps professionals are wondering if generative AI will be a friend or foe, even as DevOps remains at the forefront when it comes to onboarding new technologies. Our DevOps communities have been enabling and fostering the collaborative cultural shift and evolving roles and responsibilities of software professionals. In this article, we explore the impact of generative AI in key DevOps roles and explain how to prepare ourselves for the shift.

Let us start by highlighting the basic roles and their broad areas of responsibility so we begin with a common vocabulary.

Overview of DevOps Roles

DevOps roles are evolving quickly, but PagerDuty outlined six main DevOps roles for modern organizations.
1. The DevOps Evangelist: Responsible for delivering changes, collaborating with dev and ops teams and working toward optimizing flow, enabling feedback and fostering experimentation.
2. The Code Release Manager: Responsible for creating cadence between delivery and deployment of code. This role often requires deep technical expertise to run and maintain the releases.
3. The Automation Architect: Responsible for designing and implementing automated pipelines and reducing manual toil.
4. The Experience Assurance Expert: Responsible for user experience, enabling feedback loops and ensuring superior experience, assessing feature performance and improving end-product usability.
5. The Software Developer & Tester: Developers and testers are responsible for the design and development of the software product. Primary responsibilities are writing code, testing and fixing bugs.
6. The Security and Compliance Engineer: Responsible for the overall security and compliance of the software product. Collaborating with all the above roles to ensure standards and regulations are implemented.
All roles above are expected to work across the value chain to maximize their impact. Note that there are many other roles, including leadership and executive roles, which we have not covered in this article. Next, let’s assess the impact of generative AI on some of these roles.

Adding Generative AI to Every Role

Before diving into the business value of adding generative AI to job roles, let’s build a common vocabulary, starting with defining generative AI. According to Gartner, generative AI can learn from existing artifacts to generate new, realistic artifacts (at scale) that reflect the characteristics of the training data but don’t repeat it. It can produce novel content such as images, video, music, speech, text, software code and product designs.

Automated code generation: AI-augmented code generation tools serve as companions for developers and testers. As an example, GitHub Copilot, developed by GitHub in collaboration with OpenAI, primarily offers predictive code generation and supports multiple languages. Tabnine offers deep learning capabilities and supports around 20 programming languages.

As these and other tools evolve, software developers’ time may be freed up to focus on higher-level, more creative, and innovative thinking and business value-driven development. Some pundits say these code generation tools may be a stopgap in the race to hire developers. It may also result in generative AI-based moderators, a new job role entirely. These moderators would help with exporting or reusing existing code rather than trying to reinvent it.

AI-based release management: Generative AI can also help with release management; from a simplified approach for generating release notes to boosting the productivity of the feature release to setting a precise release cadence, generative AI-based tools are coming to our rescue. For example, Digital.ai introduced predictive decision-making, threat insights and many more features to orchestrate releases. Another example is K8sGPT, a tool for scanning your Kubernetes clusters, diagnosing and triaging issues in simple English. More integration of generative AI is on the way for DevOps tools. Release managers’ roles are at a pivotal point and will evolve with time and new skills to manage real-time releases, integration with several channels of special edition software, classic upgrades and core software releases. They will need to address different customer segments with managed subscription-based, open source versions and take a human-centric approach to software releases.

Security and compliance engineers: DevSecOps firm Jfrog is integrating generative AI capabilities into its Xray and Artifactory solutions. It will automatically detect security flaws, license violations and more early and often. Snyk surveyed more than 400 IT professionals and found the use of artificial intelligence (AI) to write code is creating a security paradox. Generative AI also can be used to simulate malware attacks and identify vulnerabilities. However, this is a double-edged sword as it also can be used to enhance the portfolio of bad actors. That means that security and compliance engineers must increase their focus on regulatory, assessment, audits and validation of generative AI outcomes. Specialist knowledge, decision-making, and ethical evaluation are needed for a strategic approach toward next-generation cybersecurity capabilities.

The automation architect: An automation architect is responsible for decomposing complex tasks and automating them through reusable code. These tasks become more sustainable, with less rework and delays. As an automation architect, generative AI is another tool in the toolset that helps improve efficiency and productivity. Generative AI can help automation architects to scale and allow self-service options for DevOps teams and automate redundant tasks.

Generative AI’s Impact on Key Job Roles

As discussed in the previous section, there are many jobs that will be transformed by generative AI’s influence. Many companies will view generative AI-enhanced tools as a pot of gold where most of the work that requires building templates, infrastructure provisioning, log analysis, reuse or refactoring code can be done with the help of generative AI-enabled tools.
- Short-term skills gap: Software-related skills gaps are everywhere, and organizations need to go beyond reskilling to solve the problem. The role of leaders is key for successfully transitioning into the new era of workforce modeling. DevOps professionals should also look at strategies to improve our productivity by investing in capabilities and tools to fill the skills gap.
- Mid-term talent augmentation: Role disruption is most likely to happen due to generative AI; research and a more structured approach are needed to address the upcoming change. DevOps teams must focus on communication patterns, onboarding of human-machine collaborative models and ensuring performance of the new work models. Copyright, intellectual property (IP), licensing and the use of open source technology will be essential ingredients of mid-term talent augmentation with generative AI.
- Long-term, flexible workforce: Widespread and massive onboarding of generative AI in the long term will require a pragmatic approach to flexible workforce modeling. Task-based frameworks will emerge to guide the flexible orchestration of workforce, roles or even jobs or tasks. Task-based frameworks may mature into capability-driven roles that evolve into a flexible workforce where humans and machines together will deliver the desired business outcomes.
With rapid advancement in generative AI technology, companies will be forced to design new ways of working to keep pace with these changing dynamics. DevOps professionals should see this as an opportunity to get ahead of the curve, assess how generative AI technologies can boost productivity and enhance it with new tools and capabilities.
February 26, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

CareerBuilder.com

Northrop Grumman
Dulles, Virginia
Consulting Lead: DevOps Engineer
$203,300 to $304,900

LinkedIn

McKesson
Irving, Texas
Cloud Platform Engineer
$140,000 to $175,300

Indeed.com

Sumitomo Mitsui Banking Corp.
Jersey City, New Jersey
DevOps Engineer
$126,000 to $196,000

Dice.com

Qualcomm
San Diego, California
DevOps/Site Reliability Engineer (SRE)
$126,000 to $189,000

SimplyHired.com

Stanford University
Redwood City, California
Enterprise Cloud Infrastructure Engineer
$118,000 to $155,000

devopsy.kinsta.cloud · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 26, 2024
Dell Brings DevOps to Edge Computing Environments

Dell Technologies today updated its edge computing platform this week to make it simpler to programmatically provision infrastructure using DevOps best practices.

Phil Burt, senior director of project management for edge computing at Dell Technologies, said version 2.0 of Dell NativeEdge adds additional declarative blueprints based on YAML files and the Topology and Orchestration Specification for Cloud Applications (TOSCA) framework.

Blueprints for Telit, Litmus and PTC for manufacturing use cases, Deep North for retail, Dell Streaming Data Platform for analytics and Rancher Labs K3s for Kubernetes environments are provided.

Those blueprints make it simpler to either deploy applications on a lightweight operating system that Dell developed optimized for edge computing platforms or any other software stack an IT organization may prefer, he added.

Dell is also adding support for the virtual Trusted Platform Module (vTPM) and UEFI Secure Boot capabilities to apply zero-trust IT principles to edge computing platforms using hardware-based cryptography and secure storage for encryption keys, certificates and passwords.

Finally, Dell is also making available a three-year subscription plan for NativeEdge to lower the total cost of deploying edge computing platforms.

Dell relies on virtual machines it developed for edge computing platforms to deliver software. IT teams can then opt to deploy monolithic applications or container-based applications running on an instance of Kubernetes deployed as an extension of the virtual machine provided by Dell. Those platforms can then also automatically connect to a network to provide the connectivity required.

Regardless of approach, Dell is providing a method to programmatically orchestrate the management of highly distributed edge computing environments, noted Burt.

In the longer term, Dell is also researching how to apply generative artificial intelligence (AI) to the management of edge computing environments using the data its monitoring tools provide, he added.

While edge computing has been around in one form or another for decades, as more organizations start to process and analyze data at the point where it is created and consumed, the number of applications deployed at the network edge has increased substantially. As such, the number of applications that need to be built and deployed at the edge using DevOps best practices is growing exponentially. In fact, managing those workloads is only going to become that much more challenging as more AI models are deployed at the network edge.

Of course, not every workload at the edge is managed by an IT team. For years, many organizations have relied on operational technology (OT) teams that have historically deployed applications at the network using manual processes. Organizations that embrace DevOps practices to automate the deployment of workloads at the edge will naturally have to navigate some cultural issues alongside the technical challenges encountered when programmatically deploying software.

It’s not clear how much software will be running at the network edge in the years ahead, but as the capabilities of the IT infrastructure made available continue to increase, so will the complexity of the applications that will be deployed. The challenge, as always, is going to be finding the best way to manage all that distributed software at what will soon be an unprecedented level of scale.

February 23, 2024
What Does Build Quality Look Like in Software Design?
With rapid developments in artificial intelligence (AI), mobile applications and modern software in the last year, the enterprise software market is expected to grow exponentially. Market revenue is projected to reach $292 billion in 2024, and developers are constantly implementing innovative measures into the software development life cycle (SDLC) to ensure a seamless, high-quality creation process. One of the best ways to achieve this is by leveraging modern build health tools to monitor a multi-faceted project’s overall quality and performance.

Build health tools automate the creation of executable applications from source code and encompass several areas to ensure the stability and health of the software build process. From automated testing to security scanning, developers rely on these tools and processes when defining a modern approach to software development. Before diving into the intricacies of build health quality, it is necessary to grasp the complete significance of the SDLC when attaining the final product in a global marketplace.

The Significance of the SDLC

The SDLC is the process in which developers plan, write, modify and maintain software. This methodology applies to software developed for computers, mobile phone applications, video games and other systems. Adhering to this process allows developers to reach the optimal outcome for the final product. The life cycle includes everything from the planning and brainstorming stage to setting up maintenance and operations after the product has launched. It ensures success by providing a more structured approach to building and developing software. This becomes increasingly important as the software market’s value continues to rise.

Since 2020, the demand for software engineers has doubled. Because it’s essential for business leaders and developers to keep up with the latest trends and innovations, the need for software knowledge will continue to grow exponentially. Currently, software is typically delivered in one of two ways:
- On-premises. End users install and run the software themselves on the desired device. This serves as a more secure delivery method for highly-regulated industries.
- Software-as-a-service (SaaS). This cloud-based method allows end users to access the software online rather than through a traditional download/upload. This enables providers to offer a subscription-based/pay-as-you-go structure for users. The provider is responsible for the hosting and maintenance.
Developers rely heavily on build health tools to ensure a smoothly running life cycle. Build health tools play a huge role in determining a seamless development process.

The Role of Build Health Tools in Modern Software Development

Build health tools essentially fill the gaps in the development process and enhance the software build quality. These tools deliver automated testing methods by creating multiple testing scenarios to ensure full functionality. They help developers see the different data points necessary for garnering a 360-degree view of the software and its status.

The tools also impact resource utilization and response times. Using key performance indicators (KPIs), they monitor the build quality while enhancing build production to ensure it is better than what was previously developed. In that way, it is constantly growing and improving to guarantee the project reaches a smooth and seamless completion for the developer. From there, the tools can create multiple datasets in less time, which significantly reduces overall software development time.

Common Challenges of Build Health Tools in Software Design Projects

There are several challenges with using build health tools. The most common obstacle is that automated tools and testing lack the human touch that comes from developers and their manual work. Although build health tools can perform simultaneous tasks quicker than a more manual approach, they overlook the full spectrum of available resources to improve the build. These tools are so focused on functionality that they fail to incorporate the prior research and available resources that often serve as key building blocks for a successful development project. For this reason, it is important to have developers working in conjunction with build health tools to provide a balance between manual and automated software testing.

Developers can leverage build health tools to seek out the KPIs that determine the software’s quality at a given stage of the SDLC, from initial development and quality assurance (QA) to the final phases of staging and production. Some of these KPIs include:
- Exceptions. Make sure there are no new exceptions from the previous build versus the production stage.
- Test coverage. Ensure that adequate testing is performed on the current build by defining what application programming interfaces (APIs) need to be included for certification, along with the number of executions required.
- Automated data validation. Make sure data is accurate and useful while remaining enforceable by the designated standards.
- API testing. Test the overall interface for smooth performance with trustworthy data to advance the program/project. It is also important to compare performances during different SDLC stages to confirm the status of the API, dependency, database, and functionality.
- Memory/CPU usage. Measure the overall usage of the central processing unit (CPU) and its memory to ensure stability and efficiency.
- Requests per minute. Evaluate the rate at which the software can receive and execute certain requests delivered by the end user to ensure optimal efficiency.
- SQL coding standards. Enforce standards and limitations for the overall coding within the interface by measuring quality, security, efficiency, and sustainability.
While these are only a few of the KPIs detectable with the aid of build health tools, it is essential to note how these tools can benefit a successful software release. Developers can compare the differences between current and prior builds throughout the SDLC to fully gauge any changes, developments, improvements, or downgrades during production to a successful launch.

Current Events and the Future of Build Health Quality for Developers

There are many examples of current organizations effectively leveraging available build health tools for project success. Software developers will continue to adopt new and innovative methods using AI and automation capabilities to ensure more efficient testing and higher build quality.

The future is bright for contemporary software engineering. As unexpected as the AI boom of 2023 was for the tech world, the future of modern software development may hold even more surprising developments. Build health tools are expanding and perfecting the creation process for enterprises and developers worldwide. As build quality improves on the back end, the customer experience for global industries will improve on the front end. The potential for software enhancements and innovations in this way is what makes the journey exciting.
February 22, 2024