devopsy.kinsta.cloud

Category: DevOps in the Cloud

Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

LinkedIn

Well
Raleigh-Durham-Chapel Hill, North Carolina
Principal DevOps Engineer – Team Lead
$180,000 to $200,000

CareerBuilder.com

Apple
Cupertino, California
Cloud DevOps Engineer – Enterprise Systems
$138,900

Indeed.com

General Dynamics Information Technology
Indianapolis, Indiana
Capado Salesforce DevOps Engineer
$116,000 to $174,000

SimplyHired

John Hancock
Boston, Massachusetts
Senior DevOps Engineer
$109,000 to $138,000

Dice.com

IT Trailblazers
Houston, Texas
DevOps Lead
$100,000 to $120,000

August 14, 2023
Mezmo Simplifies Management of DevOps Telemetry Data

Mezmo has added additional capabilities to streamline the flow of telemetry data within DevOps workflows as part of an effort to make it simpler to surface insights and reduce the total cost of observability.

The company has also added integrations with more data sources to the Telemetry Pipeline platform, along with controls that make it simpler to optimize data storage and usage. For example, an Events-to-Metrics Processor capability identifies and extracts metrics from logs to make them easier for third-party tools to consume.

Mezmo CEO Tucker Callaway said these additions collectively make it simpler to surface insights that will make DevOps workflows more efficient. Previously, the company added capabilities such as rollback and redeploy, sequential parsing, error history management and data sample management to enable DevOps teams to manage telemetry data more efficiently.

In effect, Mezmo is making it easier to apply engineering best practices to the massive amounts of telemetry data generated across DevOps workflows, he noted.

No one knows for certain if all that data will require the addition of data engineers to DevOps teams, but as DevOps continues to evolve, it’s clear there is a need to cost-effectively manage data at scale. DevOps teams that embrace observability are quickly discovering that storing logs, traces and metrics for an extended amount of time can quickly become cost prohibitive. Naturally, there’s a lot more sensitivity to those costs during challenging economic times.

In theory, of course, various forms of artificial intelligence should automate data engineering best practices, but in the meantime, there simply isn’t enough data engineering expertise available. The need for a platform to optimize the flow of telemetry data across DevOps workflows is becoming more acute.

It’s not clear how quickly DevOps teams are embracing observability, but it’s clear that relying on predefined metrics to monitor IT environments is no longer sufficient. DevOps teams need to be able to query telemetry data to, for example, identify bottlenecks created by dependencies between microservices. Resolving those issues can’t be slowed down by a lack of data to query. Most problems can usually be traced back to a recent update to an application, but there are always going to be some issues that require access to historical data. That historical data should be quickly and easily available, especially since application downtime directly equates to lost revenue for many organizations.

Observability, regardless of cost, is rapidly becoming a requirement for DevOps teams’ success as application environments become more complex in the cloud-native era. Dependencies between the microservices that make up those applications are too difficult to track and analyze without the aid of an observability platform. The challenge is not every observability platform provider is equally concerned about how much it costs to store all that data. Striking the right balance between the amount of telemetry data collected and the cost of storing it has become a much larger concern.

August 10, 2023
Google’s Shiny New AI Dev Environment — the ‘Experimental’ Project IDX

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Google’s full-stack, browser based development environment in the cloud. It’s not just a Copilot clone, but aims to help you “get an app from zero to production.” (more…)

August 10, 2023
DevOps Download: What to Know About Life in the Cloud(s)
According to the 2022 Flexera State of the Cloud Report, 89% of cloud customers now use multiple cloud hosting providers. Nearly nine out of 10 might sound high, but it tracks with the anecdotal evidence we’ve seen. For varied and good reasons, companies are spreading their usage across multiple hyperscalers rather than putting all their eggs in one basket.

In this article, I’ll take a look at what life in the cloud(s) looks like today. Along the way, I’ll examine the value that companies and their DevOps teams can derive from this approach, the challenges to be aware of, use cases for making the multi-cloud move and more.

What is Multi-Cloud?

Multi-cloud is a type of cloud strategy approach where an organization uses computing services from at least two cloud providers to run their applications. Instead of a single-cloud stack, these environments include two or more public or private clouds, or a combination of both. With multi-cloud, you can have an application running on Google Cloud Platform (GCP), another in Amazon Web Services (AWS), and maybe one on premise for hard-to-move applications.

There are three kinds of cloud setups. Single cloud is when workloads run solely on one environment. Hybrid cloud entails overlapping workloads across multiple clouds, such as operating the same programs on different providers for business continuity purposes. The final setup is planned multi-cloud, which disperses applications and usage across providers along specific lines, like having compute intensive applications with one provider and data analysis applications with another.

Got a Preference?

Make no mistake, using multiple cloud providers is more complex than a single host, but as its popularity shows, the benefits can carry more weight. Foremost, that’s because an organization gains the flexibility to create a best of all worlds situation, based on factors like the following:
- Operational preference: Users may like different features from different providers, and splitting types of use can yield the ideal setup. For instance, a customer may run compute on AWS but want their business intelligence and machine learning on GCP. In this deployment, the front-end app could gather the needed information, then send the data to the other provider for analysis and ML.
- Regulatory requirements: Certain workloads may require data storage in specific regions, but not all cloud vendors have multiple “regions” in each country. Companies that want to use the cloud can set up a “multi-region” environment by having one region on AWS and a second region on GCP within the same country.
- Cost savings: Cloud providers offer different savings plans. For a savvy user, structuring a flexible program can take advantage of each to significantly reduce costs. It’s also a great way to avoid the pitfalls of lock-in and can make it easier to go elsewhere should a provider lose your trust.
- Failsafe Options: Outages happen, so companies needing 24/7 access to apps will sometimes run portions redundantly on two hosts to ensure smooth operations. For example, a retail app may run on GCP and AWS with live failover between them. That way, if one goes down the other can kick in without noticeable downtime.
Not Without its Challenges

The benefits to running a multi-cloud setup are clear, but there are some challenges as well. A carefully planned multi-cloud setup can save money, but a careless approach will duplicate operations and cost. It also leaves companies vulnerable to mistakes that can lead to significant overrun, especially for hybrid cloud operations, which can be extremely complex. Specialists must be well versed in FinOps principles and experienced at writing modern applications that can scale and work across regions and clouds, to ensure success in a multicloud approach.

Coming to Terms

You’ll undoubtedly come across a lot of new ideas and terminology when researching cloud setups. Here’s a few of the more crucial ones to become familiar with as you plan strategy.
- Lift and shift: This refers to cloud-to-cloud migration, in other words, taking what you have in one cloud and putting it in another, whether it is private to public or public to public.
- Move and improve: This usually refers to migrating while making a small change to take advantage of a public cloud feature. For instance, you could be using open source Kubernetes on premise but want to move to a managed version. Eliminating management of Kubernetes would require a minor change but it improves operations greatly.
- Cloudbursting: On premise offers hard limits to capacity. For companies able to anticipate business peaks, cloudbursting can scale workloads to an on-demand public cloud for a short period. For example, a retailer who operates on premise may cloudburst on Black Friday in order to handle a volume increase.
- High Availability: The goal of this is to eliminate single points of failure by enabling users to continue working even if one of the IT components that an applications depends upon fails.
- Disaster Recovery: Clouds offer solutions to help an organization restore critical systems and data after a disaster strikes. Recovery comes in three “heat levels”: Cold is for data backup only, warm restores operations in several hours, hot is for near-instant resumption of cloud operations.
People and Processes

The most important considerations for operationalizing multi-cloud are people and processes. Providers pump out new services fast, and not only can it be difficult for staff to keep up, it can be demoralizing when they’re unable to. Allowing time to succeed, fail and learn is key, and larger companies might consider designated specialists for each platform.

When it comes to processes, management and security are highly customizable, but it requires deep knowledge to get them right. Operating via infrastructure as code rather than ClickOps is a must. The latter is a time consuming approach that requires selecting options in a provider menu and introduces both operational and security risks in the form of configuration drift.

Life in the Clouds

Multi-cloud brings strong benefits to DevOps. Organizations can get the right infrastructure balance based on their needs. Distributing workloads can reduce the impact of outages and bolster resiliency. There’s greater opportunity for cost savings, and scaling is simple. Ultimately, multi-cloud operational enhancements can result in more reliable and innovative solutions, which delivers on the mantra of DevOps itself.
August 10, 2023
Most Organizations Benefit From a Mature Cloud Strategy
Today’s cloud adoptions are wide and varied. Large enterprises are composed of vast, hybrid multi-cloud strata, often incorporating legacy technology acquired at various times and haphazardly equipped from department to department. But a fractured cloud approach can leave IT wanting in terms of shared automation and standard security policies.

Not all organizations have addressed best practices around common areas like CI/CD, resource optimizations, or common policies for multiple clouds. And many teams are just getting the hang of the new cloud-native stack. But studies show that a mature approach to cloud operations can pay dividends in the long run—and this approach hinges on cloud platform teams.

HashiCorp recently released the findings from its third annual State of Cloud Strategy Survey, which surveyed 1,000 technology practitioners on their cloud adoptions. In short, the report discovered that increased cloud maturity equates to increased overall value. Below, I’ll distill the major findings from the report to better understand how cloud-native operations are maturing.

State of Cloud Maturity

Most organizations are moderately increasing their cloud investments. Overall, 56% increased their cloud spending in the last year. Increases were much higher for higher cloud-maturity organizations and stilted for lower-maturity organizations. The findings demonstrate general confidence in cloud adoption, even amid economic uncertainties.

There is also persistent optimism in multi-cloud strategies. In fact, 73% of companies said a multi-cloud strategy helped advance or achieve their business goals. And to successfully accomplish a multi-cloud strategy, respondents ranked security, uptime and availability, infrastructure scalability and regulatory compliance as top factors.

However, there is still a lot of waste in the cloud. Nearly all organizations (94%) said they have avoidable cloud spending. These expenses most commonly stem from areas like over-provisioning resources, idle or unused resources, cost premiums or a lack of expiration date on cloud resources.

Benefits of Maturing Cloud-Native Operations

Overall, there are many reasons for adopting a multi-cloud approach—the report found reliability, cost reduction, security and governance and digital transformation as top motivators. And on average, high-maturity cloud adopters tend to reap the rewards more often, the report found. Some of these top rewards ranged from a stronger security posture to better visibility and increased automation. Furthermore, half of high cloud-maturity organizations reported successfully saving money using multi-cloud.

Most interestingly, perhaps, is that high-maturity cloud adopters said they are better equipped to attract, motivate and retain talent than lower-maturity cloud adopters (74% compared with 48%). It’s generally easier to pull in talent when operating with attractive cutting-edge technologies that look good on a resume.

Spotlight on Platform Teams

Even then, skills shortages remained the top bottleneck in most organizations’ ability to operationalize multi-cloud and set up platform teams. This can be side-stepped by reskilling or upskilling staff, incorporating more consultants or increasing the budget. But the best strategy is to standardize on a common operating model.

In that vein, investments into the platform engineering concept are rising. In fact, 92% of organizations are adopting, standardizing or scaling platform teams. Low cloud maturity firms tend to lag on platformification, most likely due to lacking the necessary skills to build and maintain internal developer-facing infrastructure, like the tools used to measure and improve developer productivity and satisfaction at LinkedIn. Others are still on the cusp of exploring how to implement it.

The idea of platform engineering is still taking root, so it was interesting to see how organizations described the platform teams’ roles and responsibilities. The results showed platform engineers commonly take the reins on everything from architecting solutions to tooling acquisition and internal evangelism. Here are the five top-cited roles for platform teams:
- Develop and standardize a cloud infrastructure strategy (95%)
- Architect cloud solutions (95%)
- Create and distribute cloud management, operational policies and best practices (94%)
- Determine which cloud vendors and/or technologies are used in production (93%)
- Define and measure site reliability (91%)
The Path to Cloud Maturity

In general, companies are still confident about their cloud trajectories. But, getting to a mature multi-cloud state will take work. One area that needs further scrutiny is cybersecurity, as password or credential leakage is now seen as the most prevalent cloud security threat. Organizations will require better DevSecOps best practices to avoid such leaks. That, and certain open source cloud-native tools could also aid security and compliance efforts.

A mature cloud strategy will also require localizing development efforts through shared platforms and increasing infrastructure automation. On that note, 83% of organizations say automation tools are important or extremely important to operationalize their multi-cloud infrastructure. More automation for cloud-native areas like CI/CD, observability and Kubernetes management could also abstract complexity and fill the skills gap.

As the HashiCorp study clearly showed, those organizations that have matured their cloud strategy are far better off because of it. They tend to understand their workflows better and can more seamlessly introduce new automation. Now, it’s only a matter of getting there …
August 10, 2023
Data Management: Cloud Technology or Data Centers?

Traditionally, larger enterprises have relied on in-house server hardware equipment for their data management needs, optimized to run high-performing applications with a certain degree of assured security and reliability.

However, the high costs and technical expertise required to manage these solutions effectively often render them inaccessible to startups and emerging businesses. But, as the old saying goes, necessity is the mother of invention.

With the growing demand for cost-effective, efficient data management solutions, the tech industry has witnessed the advent of cloud technology and data center colocation rental services. These alternatives pave the way for startups and small businesses to handle large volumes of data without straining their budgets.

This article will compare and contrast cloud technology and data center services to help business leaders make well-informed decisions about their data management needs and the solutions that can help them.

Understanding Data Center Colocation Services

Data center colocation services offer an enticing solution for companies that require robust data management capabilities without incurring high capital expenditure for securing storage hardware, along with storing and powering them.

Essentially, this solution is like renting a space for your data in a specialized facility. These data centers provide a secure environment with the necessary power, cooling, and physical security for your server, storage, and networking equipment.

In opting for colocation services, companies can leverage state-of-the-art data center infrastructure without the burden of high upfront costs and ongoing maintenance responsibilities associated with owning a private data center. This also allows businesses to focus more on their core competencies rather than the intricacies of data center management.

However, data centers come with their own set of unique challenges. For instance, they often require a certain degree of technical expertise on the part of the business to manage their servers. This means hiring or training staff to handle server management, increasing the overall cost of this solution.

Additionally, data centers’ effectiveness can sometimes be influenced by physical proximity. The closer your operations are to the data center, the better the performance can be. This geographical factor can pose problems for businesses operating in multiple locations or managing data across different data centers.

The Power of Cloud Technology

In contrast to relying on data centers, cloud technology offers businesses of all kinds and sizes immense scalability and flexibility in terms of data management solutions.

As a service that delivers computing infrastructure, software, or storage as a service via a network connection, typically the Internet, cloud technology eliminates the need for physical proximity to servers. It is quickly scalable, both upwards and downwards, as per business needs, ensuring that you only pay for what you use.

Moreover, the ability of cloud technology to integrate various services can simplify business operations and enhance customer engagement. For instance, many businesses are now offering cloud-based text-to-pay systems that allow customers to pay from any device, providing ease of transaction while simultaneously gathering customer data in the cloud.

Cloud services can also provide robust disaster recovery and business continuity solutions. However, businesses often cite concerns about data security and privacy in the cloud. Although most cloud service providers implement best-in-class security protocols, the very nature of the cloud—being an off-premises solution—necessitates a high level of trust in the provider.

AI and Data Management Solutions

If your business relies heavily on AI applications, you must understand how your data management solution supports this need. AI requires high-quality, well-managed data to function effectively. Here, cloud technology often presents an edge over traditional data centers.

Many cloud service providers offer built-in tools and services designed to better facilitate AI implementation, including pre-trained machine learning models and AI platforms as a service. These resources can dramatically reduce the time, costs, and complexity that come with implementing AI, particularly for small to mid-sized businesses without extensive in-house AI expertise.

On the other hand, while data centers might not have these built-in tools, they offer robust performance capabilities for AI workloads and often provide more control over the data, which is vital for sensitive AI applications.

Keep in mind you can turn to other server-based solutions for storing data as well. For example, if your application relies on a significant amount of PDF content to store data and function effectively, hosting those files on a server such as a server-side PDF SDK will allow you to process those documents on the server via an API. This will then allow you to autoamte your document processing and convert large volumes of your PDF files.

Web Hosting Requirements

Your current web hosting requirements can also significantly impact the choice between data center services and cloud technology. Shared hosting services may be sufficient for businesses with low-traffic websites or applications, and if you don’t need to store a lot of data, but as your traffic increases and the website grows, so do your hosting requirements.

Cloud hosting solutions offer excellent scalability, allowing your website to grow with your business. As traffic surges, cloud servers can easily handle the increase, maintaining website performance and user experience.

Conversely, with a dedicated data center, you’re generally limited to the capacity of the server you rent. To increase your capacity, you may need to physically upgrade the hardware, a process that can result in downtime and potential loss of revenue.

Considering Cost Implications

The overall cost of your chosen solution will be a key factor when deciding between data center colocation services and cloud technology. Each service has unique cost structures that can vary between providers, and understanding these can significantly impact your company’s financial health and resource allocation.

With data center colocation services, the costs are generally more predictable. You pay a fixed amount based on your rented server space and the bandwidth you use. This stability can be advantageous for budgeting purposes, especially for businesses with steady data usage and processing needs. However, you may also incur additional expenses for any necessary hardware upgrades, maintenance, or increased bandwidth usage.

What’s more, there’s the indirect cost of employing or training staff to manage the servers, plus the potential costs of transportation to and from the data center, particularly for businesses not located near their rented server space. These costs can add up and should be factored into the total cost of operating within a data center.

Cloud services, conversely, operate on a pay-as-you-go model. This solution can be much more cost-effective for businesses with shifting data needs since you can readily scale up or down based on demand, ultimately only paying for the resources you actually use.

Choosing the Right Path for Your Organization

Unfortunately, there’s no one-size-fits-all solution for effective data management. Each business has unique needs, requirements, and considerations that necessitate a carefully tailored approach. When choosing between cloud technology and data center colocation services, business leaders must carefully consider several key factors to determine the right solution for them.

If scalability, flexibility, and AI integration rank high in your data management strategy, cloud technology presents an excellent solution with its on-demand resources and array of built-in tools. On the other hand, data center colocation services provide robust performance capabilities, greater control over data, and predictable costs—features that may appeal to businesses with more consistent data management needs.

Understanding your current web hosting requirements and the potential cost implications of each solution are also crucial elements to consider in your decision-making process. The demand for efficient, secure, and cost-effective data management solutions will only continue to grow as data storage needs expand rapidly.

August 9, 2023
How New Tech Elevates Release Management’s Quality Standards

Release management is a critical discipline within software development and IT operations that focuses on the planning, scheduling, coordination and deployment of software releases. It includes the procedures, plans and methods employed to guarantee that software updates or items are sent to customers in a secure and effective way. Release management’s main objective is to make it possible for software releases to be delivered reliably and smoothly while causing as little disturbance as possible for the company and its users. This entails overseeing a release’s whole lifespan, from preliminary planning through testing, deployment and post-release support.

Challenges in Traditional Release Management

Traditional release management approaches often face several challenges that can hinder the efficient and effective delivery of software releases. These include manual and time-consuming processes, lack of visibility and traceability, complex and fragmented environments, limited collaboration and communication and a lack of effective communication channels and collaboration tools. Manual processes can be time-consuming, error-prone and lead to delays in release cycles. Lack of visibility and traceability can make it difficult to track the status of releases, identify bottlenecks and troubleshoot issues effectively. Fragmented environments can be complex and differ widely from one another, making managing and synchronizing these environments manually challenging and prone to errors.

Limited collaboration and communication can lead to miscommunication, delays and misunderstandings. Traditional release management can lead to silos between development, operations and other stakeholders, hindering efficient coordination. Inconsistent release practices can lead to variations in processes, documentation and quality standards, making it difficult to establish a standardized and repeatable release process. Lack of automation and continuous integration can slow down the release process, increase the chances of human errors and inhibit the ability to deliver frequent, small and reliable releases. Limited scale and adaptability can be addressed by adopting new technology and modernizing release management practices. Automation, continuous integration, deployment pipelines, collaboration tools and standardized processes can help overcome these hurdles and enable more efficient, reliable and quality-driven release management.

Benefits of New Technology in Release Management

Advanced Testing Techniques for Improved Quality Assurance

1. Enhanced speed and efficiency
2. Improved interaction and collaboration
3. Improved stability and quality of software
4. Reduced risk and downtime

Using New Technology: Implementation Techniques

1. Organizational readiness assessment
2. Choosing the correct technologies and tools
3. Developing an all-inclusive release management strategy
4. Embracing the DevOps and Agile principles

The Impact of New Technology on Release Management Quality

Automation: Accelerating Release Cycles and Ensuring Consistency

Automation plays a pivotal role in release management by significantly accelerating release cycles. It reduces manual effort and expedites the delivery of software releases, leading to a faster time-to-market. Automated workflows enforce standardized practices, configurations and environments, resulting in more reliable and predictable releases. Automated testing frameworks and tools enable faster and more comprehensive testing, while continuous integration and automated build processes facilitate seamless integration of code changes. Automation also enables better visibility and traceability, allowing release management teams to track the progress of releases, identify bottlenecks and analyze performance metrics.

Continuous Integration: Early Detection of Issues and Improved Collaboration

Continuous integration has revolutionized software development practices by emphasizing early issue detection and enhanced collaboration. By regularly integrating their code, businesses can spot problems early and fix them, decreasing the possibility of significant issues later in the development cycle. Additionally, increased developer collaboration encourages better coordination, communication, and information sharing, which results in a more effective and unified development process.

Organizations can profit from continuous integration by utilizing automated build processes, extensive test suites and a collaborative development environment. Early problem identification and enhanced teamwork not only lead to better software quality but also enable development teams to build applications more quickly and consistently. Organizations can achieve improved efficiency, productivity and success in the dynamic world of software development by adopting continuous integration as a core practice.

The Role of Innovation in Breaking Barriers: Future Outlook and Trends

Machine Learning and Artificial Intelligence in Release Management

Release management is not an exception to the way that machine learning (ML) and artificial intelligence (AI) are transforming numerous sectors. Technologies based on machine learning and artificial intelligence (ML and AI) provide useful capabilities that can significantly improve release management procedures, increase effectiveness, and promote improved software quality. The function of ML and AI in release management is described in more detail below:

Automated Testing and Quality Assurance:
In release management, ML and AI may automate and enhance testing and quality assurance procedures. Intelligent algorithms can examine enormous amounts of data to find trends, anomalies and potential issues in brand-new software releases. To cut down on testing time and effort while maintaining high standards, ML models can be trained to anticipate and prioritize test cases. AI-driven testing solutions can also suggest the right test coverage and offer insights into the effects of code modifications.

Predictive Analytics for Release Planning
ML and AI approaches can be used to create prediction models for release planning using past release data, such as metrics, logs and performance statistics. These models are able to predict potential dangers, predict release dates, and allocate resources more efficiently. Release managers may prioritize important tasks, make data-driven decisions and improve the planning process for software releases by employing AI-driven insights.

Anomaly Detection and Continuous Monitoring
ML and AI algorithms can continuously monitor the production environment, analyzing real-time data to spot anomalies and potential problems. Release management teams can proactively identify and respond to performance bottlenecks, security breaches, and other key occurrences by putting in place sophisticated monitoring solutions. A faster and more reliable reaction to production issues can be achieved with the use of ML-powered anomaly detection, which can decrease the mean time to detect (MTTD) and mean time to resolve (MTTR).

Impact Analysis and Risk Assessment for Releases
ML and AI approaches can be used to evaluate the hazards that may be involved in a release. ML models can estimate the effect of a release on several areas like performance, stability and user experience by assessing historical data, code modifications, dependencies, and environmental factors. Release managers can prepare mitigation methods, make educated decisions, and reduce the likelihood of unforeseen problems throughout the release process thanks to these risk assessment skills.

Intelligent Release Deployment and Rollback
ML and AI technology can help with intelligently choosing when to deploy and roll back a release. In order to recommend deployment tactics, machine learning (ML) models can learn from previous deployment experiences, including success rates, user input and mistake patterns. In order to ensure a more dependable and error-resistant deployment process, AI algorithms can track the deployment process, evaluate the system’s health and initiate automated rollbacks if anomalies or severe concerns are discovered.

In general, ML and AI provide valuable capabilities to release management, boosting testing and quality assurance, streamlining release planning, enabling continuous monitoring, analyzing release risks and simplifying wise deployment decisions. Utilizing these technologies enables businesses to improve software quality, streamline release management procedures, and deliver high-performing applications more effectively and reliably.

Microservices Architecture and Cloud-Native Technologies
With the advent of cloud-native technologies and the adoption of microservices architecture, release management has been transformed, enabling organizations to leverage the benefits of scalability, agility, and flexibility. Let’s explore how cloud-native technologies and microservices architecture enhance release management:

Containerization and Orchestration
Release management has a solid foundation thanks to cloud-native technologies like containerization (like Docker) and orchestration frameworks (like Kubernetes). Application components are encapsulated in containers, which makes them very portable and independent of the underlying infrastructure. Release management can use containerization to streamline application packaging and distribution while ensuring consistent application deployment across a variety of environments. Frameworks for orchestration allow for automated container deployment, scaling and administration, speeding up release management procedures.

Scalability and Elasticity
Applications can use cloud-native technologies’ inherent scalability and elasticity to dynamically modify resources in response to demand. The modular and independent services of the microservices architecture make granular scalability possible. Release management can use these features to scale individual services or components on their own, ensuring optimal resource usage and effective handling of increasing user loads. This adaptability reduces downtime and enhances the application’s general performance during releases.

Fault Isolation and Resilience
Failures in one service do not affect the entire system, thanks to the fault isolation and resilience that the microservices architecture fosters. Release management can use this resilience to lessen the impact of any potential issues during releases. It is possible to roll back or replace a specific service if it develops issues without affecting other services. Release management may efficiently manage errors, improve fault tolerance and maintain service availability during the release process by implementing cloud-native technologies and microservices.

Observability and Monitoring
The enhanced observability and monitoring capabilities made possible by cloud-native technology allow for release management. Platforms for container orchestration include integrated monitoring and logging capabilities that give information on the efficiency of an application’s use of resources and the state of the system overall. With the use of this information, release management teams can proactively monitor releases, spot abnormalities and quickly resolve problems. Observability and real-time monitoring support the release process by ensuring the dependability and stability of programs.

Release management greatly benefits from cloud-native technologies and microservice architecture. Organizations can improve their dependability, achieve faster and more frequent releases, achieve scalability, fault isolation, and observability, and produce high-quality software applications by leveraging containerization, orchestration, CI/CD methods and many other technologies. Organizations are better equipped to manage complex release cycles and adjust to the changing needs of the software industry when they adopt these cutting-edge methods.

Conclusion

In this article, we have explored new technology’s role in raising the bar for release management quality standards. Organizations may increase communication, optimize processes, and more quickly produce high-quality software by adopting automation, continuous integration and DevOps approaches. The advantages and revolutionary potential of new technology in release management are apparent, notwithstanding the risks and difficulties that may arise. Organizations may promote continuous improvement, adjust to market demands and succeed in today’s changing business environment by tearing down barriers and embracing innovation.

August 4, 2023
2024—Year of the Linux Desktop? ChromeOS Reflects its Inner Penguin ¦ GNOME Rethink

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Can the Linux desktop installed base ever break the mythical 10% barrier? Google has been refactoring ChromeOS, and GNOME is working on new window manager ideas. (more…)

August 3, 2023
The DevOps Pendulum: Agility Vs. Control

Managing changes to cloud assets is a universal pain felt by many engineering leaders today, despite all of the advancements in tooling and practices like GitOps. This is because, in reality, it is simply impossible to always have everything completely locked down—we don’t live in a utopia with zero incidents. If your engineering organization prevents any changes from being made through the cloud console or to your infrastructure-as-code (IaC) without complying with strict GitOps practices or change management processes via CI/CD, then it’s likely you have very frustrated developers—developers who can’t troubleshoot or debug in real-time and who have little control in a real-world incident.

Engineering, like everything else in life, is all about balance.

The Pendulum Swings

The pandemic created a whole new mindset and practice for managing distributed and high velocity engineering and operations. Overnight, companies that were not built for remote ways of working had to continue their operations in a global, distributed and asynchronous way that they weren’t completely familiar with. This required a new way to think about software delivery—and it accelerated the DevOps practices that support that delivery. Self-service infrastructure removed barriers for developers to ensure continued performance and velocity.

At the same time, your cloud cannot be the wild west with everyone creating bespoke infrastructure. It becomes impossible to manage, and misconfigurations can be risky. Guardrails and policy automation have become a hot topic. Today, with tech markets depressed and cloud costs escalating, there seems to be a growing trend toward locking things down again, even at the risk of frustrating developers.

This begs the question: How can you achieve unencumbered infrastructure for your developers while simultaneously following policies and best practices for compliance, risk and cost? There is a way to find balance.

Like many aspects of security, we’ve learned that when constraints and barriers are too high, users ultimately find ways to bypass them. This is true for operations, as well. While sometimes it might seem easier to lock everything down than design a better and more balanced way to enable developers to move fast, eventually this approach backfires. This is the exact same evolution the application and cloud-native security industry are undergoing right now. All the guardrails and controls applied have created too much friction in development processes and developers ultimately bypass them.

Real-Time Insight is Key

CloudOps can learn a lot from the disruption the security industry is going through today. In the same way that point-in-time security has been rendered completely useless, non-real-time alerting or eventual alerting to infrastructure drift just won’t cut it when managing an ephemeral cloud. What is really needed is the same kind of real-time and continuous scanning of cloud assets and IaC, similar to what we apply to our systems through monitoring and observability. These solutions became an essential backbone of our business to ensure continuous operations and availability of cloud services.

As we embrace IaC and the benefits it brings, everything-as-code unlocks greater agility and visibility, enabling you to automatically remediate without locking everything down. As DevOps says, “fail forward and fail fast.” Rather than focusing on never making a mistake, focus on how to fix it immediately.

The Solution

By providing a continuous comparison of actual cloud assets with their desired state through IaC and GitOps, it’s possible to surface configuration drift and policy violations immediately, much like any other kind of breach or major system failure. Failures and incidents are inevitable. It’s unrealistic, and even dangerous, to build systems with an inherent underlying design that prevents you from changing something at the cloud console at 2:00 A.M. during an outage.

With a locked-down approach, a developer would need to wait for the change management approval during a high-pressure production incident, oftentimes at 3:00 A.M. (because the incident gods of always make them happen in the middle of the night) or on a weekend. We don’t need to look much further than the catastrophic 40-minute and $440 million Knight Capital incident to understand that sometimes time is not on our side and that a delay can have severe consequences.

Cloud drift has become equally troubling as uptime or any other mission-critical aspect of continuous business operations, and that’s why we need to apply the same principles for monitoring drift in real-time as we do to our CPU and load. This will make it possible to be alerted when your cloud and your IaC are no longer aligned and even flag issues that can be prevented in real-time. You can automate ticket creation and escalation and also triage whether this is something that needs to be fixed in real-time with remediation suggestions provided or open a ticket to fix it later. The choice should be yours, not made by an administrator who has a lot less context about the systems and the ultimate business impact.

It is Not ‘One and Done’

Some vendors preach codifying your cloud into IaC and then locking it down so that you’ll never have to do it again. This feels like deja vu; we’ve definitely heard this before. It sounds a lot like the ‘write once, deploy anywhere’ JVM promise that never quite panned out.

By going down this path, you’re resigning yourself to never adding new cloud assets or changing your cloud configurations. If there’s one thing we’ve learned about the cloud, it’s that it’s a constantly moving target. (Read what cloud asset management can learn from the world of finance—another industry in constant flux). If this didn’t work decades ago with the JVM, it certainly won’t work in a dynamic and constantly changing environment like the cloud. That’s a fool’s journey.

Continuous Cloud Up to Code

There are major downsides of locking down agility and velocity. This is hard-earned advice, witnessed firsthand from tools like legacy CMDB and startups who have forgotten that cloud is ephemeral—and possibly the reason why we all use it in the first place! So if our cloud is constantly changing and is a continuously moving target, then shouldn’t our tools be built in just the same way to keep up? Solutions built for the rapidly evolving cloud-native era must continuously look for new, unmanaged and changed assets and ensure their cloud infrastructure always follows policies and regulatory standards.

Once we are able to find the balance between agility and control, we’ll be able to tap into the benefits of speed and safety (as DORA research shows time and again) that are the benchmark of high-performing teams. Automating cloud asset management can provide governance, policies and control while still enabling the velocity and agility engineering organizations today require.

Agility Versus Control

There’s a minority of people who claim they don’t worry about cloud asset configuration drift because they have everything completely locked down. Zero changes can be done at the cloud console or to IaC without going through GitOps for strict change management processes via CI/CD. I bet they have happy developers—not!

Life is All About Balance

Throughout the pandemic, organizations had to make developers happy for fear they would leave. So DevOps went full tilt aiming for self-serve infrastructure for developers to remove barriers to speed and velocity. Now, with tech markets depressed, maybe it’s easier to lock things down even if that risks losing engineers.

As we embrace IaC and its benefits, you need not live in the stone age of locking everything down. How can you achieve unencumbered infrastructure for your developers while following policies and best practices for compliance, risk and cost? There is a way.

The solution? Real-time continuous scanning of your cloud assets and your IaC with continuous comparison can surface configuration drift and policy violations immediately. Emergencies are inevitable. It’s bold/stupid/foolish to think you’ll never need to change something at the cloud console during an emergency or that a developer will wait for change management when production is down at 3:00 A.M. on a weekend. It happens, and you must deal with it.

August 2, 2023
Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery
We live in a fast-paced world of rapid changes and uncertainty where every aspect of our daily lives changes often, including the way we work and communicate. Organizations must deliver value to their customers at a much faster pace than ever before to thrive in such an environment. However, the decentralized nature of cloud infrastructure expands the threat landscape and poses several security risks that enterprises should address in light of recent data breaches.

Organizations must combat security threats and address challenges arising from cloud misconfigurations. Several recent tools, strategies, practices and technologies have emerged that can help you handle such security threats. This article discusses how the fusion of DevSecOps and trusted application delivery can extend the GitOps pipeline and add business value.

What is GitOps?

Coined by Weaveworks in 2017, GitOps thrives on a source code management system built on Git and adheres to the belief that Git is the single and definitive source of truth. Since all changes are stored in Git, anyone can see the audit trail if necessary. This enables you to use Git-based version control to manage your application’s code, environment and processes.
```
Figure 1: CI/CD with Git-based Version Control
```
GitOps leverages Git repositories as the one and only source of truth and embraces DevOps and infrastructure-as-code (IaC) best practices. Using GitOps, your developers can spend more time developing applications than configuring or maintaining Kubernetes clusters.

GitOps strategies are gaining traction with enterprises for various reasons, including improved productivity, increased deployment frequency and improved security. While it’s true that GitOps continues to be a transformative trend, the increased speed and automation can also lead to misconfigurations that compromise application stability and security.
```
Figure 2: CI/CD using GitOps
```
Often, these security vulnerabilities delay development as developers spend significant time and effort investigating them. Since this poses a hindrance to progress, the question that arises is how enterprises can maintain the frequency and speed of deployment while remaining secure and reliable. This is where trusted delivery comes in.

An Extension of DevOps

DevOps is a software engineering practice and culture that blends development and operations to provide a shared and collaborative approach to developing and maintaining software. This can boost productivity, lower costs and increase customer value through increased collaboration.

GitOps extends DevOps to bring the deployment workflow closer to developers. GitOps integrates code and configuration management for cloud-native application deployment and administration, while DevOps fosters shared ownership, transparency, and rapid feedback.

GitOps uses DevOps-proven practices like version control, code review and CI/CD pipelines with any Git-based repository, including GitHub, GitLab or BitBucket. It builds on DevOps and applies DevOps best practices for infrastructure automation.

What is Policy-as-Code?

When deploying and managing cloud-native infrastructures, adhering to security best practices and regulatory standards is critical without hindering development. Policy-as-code is an approach to infrastructure security in which rules are codified and enforced, thereby reducing or eliminating human errors. You can use it to write applications using a high-level language to control, manage and automate policies. With policy-as-code in place, developers may create applications to manage security, compliance and other regulations seamlessly.

Here are the types of policies that you can codify:
- Security Policies: By adhering to these policies, you can protect your software from data breaches caused by misconfigurations.
- Resilience Policies: The use of these policies in your Kubernetes clusters will help you create highly available, fault-tolerant systems as well as maintain business continuity.
- Coding Standards Policies: These policies can enforce coding consistency, i.e., any code that violates these policies will be rejected automatically by the system.
What is Trusted Application Delivery?

Trusted delivery entails codifying security policies within your software delivery pipeline for security and compliance and introducing guardrails at every stage. By ensuring the security, integrity and reliability of your applications deployed in production environments, unauthorized access, tampering or malware introduction is minimized. It establishes and maintains trust in application source code, artifacts and deployment pipelines throughout the SDLC process.

The key objectives of trusted application delivery are:
- Security: It protects the application from security threats and vulnerabilities
- Integrity: It verifies the authenticity and integrity of the source code of your application, together with the dependencies, and any artifacts
- Reliability: It ensures that the applications deployed to the production are stable and are devoid of any security loopholes so that they can perform as desired
Trusted application delivery helps development teams release applications early and secures them with automated protections or guardrails. It extends the GitOps pipeline by integrating security, governance and verification with policy-as-code. These security measures are implemented with policy-as-code. The policy-as-code approach encompasses the entire SDLC, including the design, development, testing and deployment stages.

According to your organization’s security and compliance policies, compliance and security rules are codified and integrated into the system. Throughout the life cycle of your application, you can manage its security, compliance and other regulations using policy-as-code. These code-defined policies prohibit the provisioning of non-compliant resources. You should implement trusted application delivery practices to secure your organization’s application delivery process and reduce the likelihood of unauthorized access.

Here are the key benefits of trusted delivery:
- Faster and more frequent releases
- Enhanced security
- Protect against misconfigurations
- Avoid compliance violations
- Improved collaboration
What is DevSecOps?

DevSecOps is a software development methodology that blends development (Dev), security (Sec) and operations (Ops) at all phases of the SDLC by incorporating mandatory security checks. An organization of any size can benefit by creating a culture of shared responsibility and collaboration by bridging the gap between development, security and operations teams.

A DevSecOps pipeline adds practices such as scanning, policy enforcement, static code analysis, threat intelligence and compliance validation to the SDLC process. Contrary to traditional software development processes that treat security as an afterthought leading to security vulnerabilities and breaches, DevSecOps is a paradigm shift that fosters a culture of proactive and continuous security approach to help address security concerns and vulnerabilities.

DevSecOps and GitOps help organizations adapt quickly to changing emerging trends and requirements. DevSecOps is an offshoot of DevOps that focuses primarily on security throughout the development process. It helps detect and resolve security issues and vulnerabilities easily and quickly while fostering a culture of continuous improvement.

Here are the benefits of DevSecOps at a glance:
- At the outset, determine which points in the SDLC process are susceptible to security flaws and vulnerabilities in the SDLC process
- Streamlined compliance
- Secure supply chain
- Reduced risk of the attack surface
- Complete visibility of potential threats
Why DevSecOps?

DevSecOps is a proven way to secure your CI/CD pipelines, deliver secure, trusted, high-quality software and foster an environment where security is the responsibility of everyone in the organization. By shifting security left—i.e., introducing security into the CI/CD pipeline earlier—organizations can be much more productive and the teams can be more cooperative and collaborative.

Given the threats to the security of the software supply chain, DevOps practices have given way to DevSecOps practices, where safety is paramount and a fundamental and ongoing component of software development. At the outset of the SDLC, you should ensure that software components and dependencies are secure to avoid potential software supply chain hazards.

Additionally, it would help if you had built-in security gates in each step of the SDLC to ensure consistent, repeatable and automated processes from the software build phase to deployment. Remember, DevSecOps isn’t an option; instead, it is a necessity.

Trusted Delivery With GitOps

Automated software delivery pipelines are based on Git as the only source of truth. Policy-as-code is a great way to ensure that misconfigurations and errors are detected, alerted, and deployments halted automatically. Next, we’ll cover how a typical GitOps workflow determines where multiple checkpoints can be implemented for trusted delivery.

In a typical workflow based on GitOps, a developer commits the source code to a Git repository. The CI tool then builds the container images. These container images are then tested and then uploaded to an image repository. At the end of this process, these container images will be deployed to a Kubernetes cluster. GitOps agents compare the current cluster state with the desired state on a continuous basis.

Hence, you should implement security guardrails at the following points:
- Git repository
- CI stage
- Configuration repository
- Kubernetes cluster
Creating a Trusted Software Supply Chain With DevSecOps

You can build a trusted software supply chain by incorporating security practices throughout the SDLC to ensure the integrity and security of the software delivered by DevSecOps. Here is a step-by-step guide to building a trusted software supply chain by leveraging DevSecOps principles:
- Security by Design: You should integrate security right from the outset of the SDLC and identify the key threats to the security of the pipeline.
- Application Dependency Scanning: When building applications, we often use third-party dependencies to accelerate the development process. You should monitor security vulnerabilities and patches as they become available for these dependencies. You can leverage OWASP Dependency Check, Firewall from Sonatype, etc.
- Secure Coding Practices: You should adhere to and enforce these practices among your development teams. You can integrate static code analysis tools into your DevSecOps pipeline, conduct regular code reviews and identify and fix security issues.
- Container Security: You should scan container images regularly for security vulnerabilities, implement strategies to secure your containers and use container registries with access controls.
- Continuous Compliance: You should ensure the software supply chain adheres to the relevant standards and guidelines for compliance requirements. In this regard, you should conduct audits regularly to check if compliance requirements have been satisfied.
- Collaboration and Communication: You should be able to foster a culture in your organization that facilitates collaboration and communication across the development, operations and security teams.
DevOps, DevSecOps and GitOps: The Future

As organizations strive to optimize the efficiency of their software supply chain, DevOps, DevSecOps and GitOps are approaches that can improve collaboration, efficiency and security, to help software developers and IT operations succeed. These practices would become more critical and widely used in the future. GitOps provides teams with better tools for managing configurations so they can focus on more strategic activities.

While GitOps is an approach that advocates Git-based version control systems as the single source of truth, DevOps is concerned about a cross-functional team that can work together. DevSecOps goes a step further by blending security into all stages of the SDLC process.

The future of DevOps, DevSecOps and GitOps will see increased automation, tighter security integration and a sustained emphasis on efficiency and collaboration. Your organization should adopt these approaches to provide reliable software and services to its customers.

Conclusion

Trusted application delivery is essential for securing applications, protecting user data, meeting compliance requirements and preserving market credibility and trust. It helps enterprises and end consumers by ensuring that software is distributed securely and reliably. Organizations can ship high-quality applications with guaranteed security and performance by adopting trusted delivery practices.
July 28, 2023