devopsy.kinsta.cloud

Category: DevOps in the Cloud

  • GitKraken App Correlates Activity Across Jira Cloud and Git Repositories

    GitKraken App Correlates Activity Across Jira Cloud and Git Repositories

    GitKraken today made available a preview of a free application that aggregates activity across Atlassian’s Jira Cloud and any Git repository to provide a unified view across all the activities of a software development team.

    Adam Wride, general manager for planning solutions of GitKraken, said Team Insights for Jira (TIJ) will make it easier for DevOps teams, project managers and application stakeholders to collaborate.

    TIJ accomplishes that goal by providing an overlay using a familiar Gannt chart view of epics and issues found in project management applications to correlate, for example, user activity such as status changes and comments made in Jira Cloud with updates to commits and pull requests made in a Git repository, he noted.

    Team members can then filter those views by project, sprint, contributors, issue type and other criteria to drill down on the exact list of issues that need to be addressed, added Wride.

    Most application development efforts rarely follow the original DevOps workflow plan, so TIJ provides a means for organizations to track real-time activity data to visualize how their efforts are progressing against the plan. That makes it possible to make data-driven decisions about how to reallocate resources as needed, said Wride.

    At the core of TIJ is a Git Integration tool that GitKraken previously made available. TIJ is the second offering from the company based on that tool following the launch of an application that integrates Jira with continuous integration/continuous delivery (CI/CD) platforms. GitKraken claimed there are already more than 10,000 organizations employing its Git integration tool.

    As more organizations become dependent on software to drive a wide range of processes, the need for increased visibility into DevOps workflows has become more crucial. Revenue is now directly tied to the pace at which software is being deployed and updated. Any change to the pace at which an application is being developed needs to be communicated across all the stakeholders that might be impacted. The challenge is that given all the dependencies that exist within modern applications, it’s not always easy to discern how a delay in the development of one module or component might impact multiple application development projects.

    Of course, project managers have been using project management applications to bring some order to the chaos of software development for decades. The challenge has always been that manual updates to projects have not always been provided in a timely manner. Developers don’t always remember to update project managers, who must manually enter updates in a project management application. GitKraken is making a case for an approach that automatically updates Jira Cloud by collecting data from DevOps tools and platforms rather than waiting for software engineers to remember to share that information with a project manager.

    Arguably, there’s now no excuse for everyone in an organization—if they care to, they can find out the status of any application development initiative. The challenge is making sure the data that DevOps teams—and their tools and platforms—already generate seamlessly updates the project management software that everyone else relies on to keep track of those projects.

  • Pulumi Brings Advanced Analytics and AI to IaC Platform

    Pulumi Brings Advanced Analytics and AI to IaC Platform

    Pulumi today launched a platform that leverages analytics and artificial intelligence (AI) to generate infrastructure-as-code (IaC) from natural language prompts in addition to automating infrastructure management.

    Pulumi CEO Joe Duffy said Pulumi Insights will substantially improve the productivity of DevOps teams in addition to ultimately reducing the total cost of cloud computing.

    At the core of Pulumi Insights is an analytics engine automation application programming interface (API) that enables DevOps teams to launch queries using a search interface or natural language prompts across more than 100 cloud computing platforms. Results can then be organized to highlight the most-used clouds and resources broken down by project and environment using built-in dashboards. There’s also a REST API that makes it possible to export that data to a data warehouse such as Snowflake, Amazon Redshift, Google BigQuery and Azure Synapse.

    In addition, Pulumi has created a companion website and command line tool to make it possible to create code for provisioning infrastructure. That uses large language models like those at the core of generative AI platforms such as GitHub CoPilot or ChatGPT that promise to eliminate much of the toil associated with writing code.

    Pulumi has been making a case for an alternative approach to IaC tools, such as Terraform, that gives enterprise IT organizations more control over how IT environments are provisioned. Too many developers with limited cybersecurity expertise are provisioning infrastructure themselves, resulting in misconfigurations that cybercriminals can then easily exploit.

    The Pulumi approach also makes it simpler for IT teams to create platform engineering teams that can centrally apply guardrails that prevent those issues from arising without slowing down the rate at which applications are being built and deployed, noted Duffy.

    There’s also a much greater focus on improving the productivity of DevOps teams during uncertain economic times as organizations look to either limit or reduce the number of full-time employees they hire or retain.

    For one reason or another, DevOps teams are going to be required to find ways to become more productive as the number of applications being built and deployed continues to increase. AI clearly has a major role to play in enabling organizations to achieve that goal. However, before organizations can reliably benefit from those advancements, they will need to ensure the accuracy of the data those AI models use to surface recommendations and generate code. Otherwise, no matter how advanced these platforms are, the results will be suboptimal.

    In the meantime, IT organizations will need to revisit how IaC tools are being employed in an era where the focus on securing software supply chains has dramatically increased after some high-profile breaches. The challenge is that, in addition to all the applications currently being developed, there are thousands more that were deployed by developers without the same emphasis on cybersecurity.

  • 5 Best Practices for Using VMs on Azure Cloud

    5 Best Practices for Using VMs on Azure Cloud

    When beginning a cloud improvement/optimization project, an easy place to start is to focus on the initial low-hanging fruit of your virtual machine (VM) environments. This article takes a closer look at these steps, using a Microsoft Azure VM environment as an example.

    Here are five best practices that can be easily achieved when using VMs on Azure cloud.

    1. Properly Size Your Virtual Machines: To maximize performance and minimize costs, it’s important to size your VMs appropriately. You can use the Azure portal to determine the right size for your workloads and then select the right VM size based on the CPU, memory and storage requirements of your application. For example, you can use the Azure VM sizing calculator tool to get an estimate of the virtual machine size based on your workload requirements.

    Let’s say you want to host a web application that requires 2 vCPUs, 8 GB of memory and 50 GB of storage. You can use the Azure VM sizing calculator tool to determine the appropriate VM size based on these requirements. The tool may suggest using a “Standard B2s” VM which has 2 vCPUs, 4 GB of memory and a maximum disk size of 32 GB.

    In this case, you would need to increase the disk size to 50 GB. You can do this by adding a data disk to the VM or using a larger VM size with enough disk space. For example, you could use a “Standard B4ms” VM with 4 vCPUs, 16 GB of memory, and a maximum disk size of 64 GB.

    It’s important to note that the actual VM size may vary based on your workload requirements and the specifics of your application. The Azure VM sizing calculator tool provides a helpful starting point, but you should also perform your own testing and validation to ensure that the VM size meets your needs.

    2. Use Managed Disks: Managed disks provide increased reliability, scalability and security compared to traditional storage accounts. For example, you can use managed disks to automatically scale the disk size and performance as the data grows and to replicate data for disaster recovery.

    For example, to create a 100 GB managed disk, follow these steps:

    • In the Azure portal, go to the “Disks” section and click on “Add.”
    • Select “Blank disk” as the source and specify the disk size as 100 GB.
    • Choose the appropriate storage account type (Premium or Standard), replication options and disk type (HDD or SSD).
    • Give the disk a name and create it in the same resource group as your VM.
    • Once the disk is created, you can attach it to your VM by going to the virtual machine’s “Disks” section, clicking on “Attach,” and selecting the newly created disk. By using managed disks, you benefit from automatic disk management and replication as well as improved reliability and security compared to traditional storage accounts. Additionally, managed disks simplify the process of attaching and detaching disks to and from VMs, making it easier to manage your storage resources.

    3. Enable Monitoring and Diagnostics: To monitor the health and performance of your VMs, you can use Azure Monitor which provides real-time insights into resource utilization, application performance and other key metrics. You can also configure alerts to notify you of potential issues and diagnose problems using Azure Log Analytics. For example, you can set up an alert to notify you if the CPU usage of a VM exceeds a certain threshold.

    You can also use Azure Monitor to gain real-time insights into the virtual machine’s resource utilization, application performance and other key metrics by following these steps:

    • In the Azure portal, go to the virtual machine’s “Monitoring” section.
    • Click on “Diagnostic settings” and then click on “Add diagnostic setting.”
    • Give the diagnostic setting a name, select the VM you want to monitor and choose the metrics and logs you want to collect.
    • Choose the storage account you want to use to store the monitoring data and specify the retention policy for the data.
    • Click “Save” to apply the changes.

    By enabling monitoring and diagnostics for your virtual machines, you can proactively monitor the health and performance of your VMs and quickly identify and resolve potential issues. Additionally, you can use the collected data to generate reports, visualize trends and perform analysis to gain deeper insights into the performance of your VMs.

    4. Implement Security Best Practices: To secure your virtual machines, you can use Azure Security Center to implement security best practices and monitor for potential threats. You can also use Azure Active Directory to control access to VMs and secure your identity management. For example, you can use Azure Security Center to assess the security of your VMs and implement security recommendations such as enabling network security group (NSG) rules to restrict inbound and outbound traffic.

    If you have a VM that you want to connect to other resources in your Azure environment, you can use a managed virtual network to provide a secure and scalable networking solution for your VM.

    Here is how to create a managed virtual network in Azure:

    • In the Azure portal, go to the “Virtual network” section and click on “Add.”
    • Give the virtual network a name, select the appropriate subscription and resource group and specify the address space.
    • Create one or more subnets within the virtual network, and specify the subnet address range and subnet name.
    • Associate the virtual network with a network security group (NSG) to control inbound and outbound traffic.
    • Create a network interface for your VM and associate it with the virtual network and subnet you created.

    By using a managed virtual network, you can create a secure and isolated network environment for your VM and connect it to other resources in your Azure environment. Additionally, you can use the virtual network to control and manage network traffic and implement advanced networking scenarios such as load balancing, VPN connectivity and more.

    5. Keep Virtual Machines Up-to-Date: Regularly updating your VMs with the latest security patches and software updates helps ensure that they are protected against potential threats and vulnerabilities. You can use Azure Update Management to automate the update process and keep your VMs updated. For example, you can schedule regular updates for your VMs to ensure they always have the latest security patches and software updates installed.

    When planning public cloud environments, two commonly used words are “progress” and “results.” Following the best practices above will help position your cloud journey for success.

  • Android Apps Must Let Users Delete Data ¦ RISC-V in the Data Center

    Android Apps Must Let Users Delete Data ¦ RISC-V in the Data Center

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Google forces apps to make deleting users’ data easier, and the RISC-V drumbeat grows louder. (more…)

  • Declarative Compliance With Policy-as-Code and GitOps

    Declarative Compliance With Policy-as-Code and GitOps

    In recent times, the quest for greater agility, faster releases, enhanced scalability, security and performance brought forth the advent of several automation tools, technologies and frameworks. Software development has evolved considerably over the years to mitigate these challenges.

    Monoliths have been split into microservices for improved scalability, maintenance and faster releases. Since DevOps is adept at bridging the gap between development and operations teams, now these two teams can work together to improve productivity and speed up release cycles.

    The Need for Compliance

    One of the critical strategies for business success is to stay compliant since processes are always improving and evolving. Compliance ensures that your DevOps processes and practices are consistent and meet regulations or regulatory standards.

    An organization with a compliance-driven DevOps culture can cut down on operational costs, improve efficiency and reduce risks considerably.

    What is Declarative Compliance?

    Declarative compliance is defined as the process of managing and enforcing compliance in which policies are defined using code, and the system’s desired state is declared rather than explicitly programmed. To enforce compliance policies, you don’t write scripts or programs; instead, you use a high-level language or configuration file.

    Declarative Compliance provides several benefits:

    • Increased efficiency
    • Better managed compliance
    • Minimized risk of human errors
    • Enhanced security
    • Faster deployment
    • Better collaboration

    With declarative compliance tools, the system’s state is defined as a set of policies, and the tool makes sure it matches the desired state. The tool will automatically fix anything out of compliance, bringing the system back into compliance if there’s a deviation.

    Tools for Declarative Compliance

    Some of the popular declarative compliance tools are:

    • Open Policy Agent (OPA)
    • Terraform
    • Kubernetes Policy Controller
    • Chef Compliance
    • AWS Config

    Declarative Compliance for Infrastructure and Application Deployment

    Often, declarative compliance is used in infrastructure management and application deployment, where policies are written as code and enforced across multiple environments. In addition to managing compliance at scale, declarative compliance tools ensure that the system’s desired state stays consistent across multiple systems and applications over time.

    With declarative compliance, organizations can manage compliance more efficiently, effectively and securely since they can define policies as code and enforce them automatically. In addition to reducing errors, downtime and security breaches, this approach enables organizations to stay compliant and maintain their system consistently.

    Introduction to Policy-as-Code

    A policy-as-code approach allows you to write programs that govern security, compliance and rules throughout your application’s life cycle. It entails defining and applying code to manage and automate policies. It shares the same ideas as infrastructure-as-code (IaC) and other DevOps practices like continuous integration and continuous delivery (CI/CD).

    A policy enforces constraints and restrictions to prevent unauthorized access to resources such as databases, storage, services, etc. By codifying policies, you can enforce rules and constraints throughout the development life cycle to prevent non-conforming resources from being deployed by integrating these policies into the software development life cycle.

    compliance policy-as-code

    Figure 1: Policy-as-Code at work!

    Why Policy-as-Code?

    Typically, businesses have the required processes, tools and procedures to guarantee the deliverable’s quality. Performance, scalability, ease of use and accuracy are typical quantifiable quality metrics used to ascertain the quality.

    You can examine the quality of your application using these metrics, but a manual procedure will take time and is prone to mistakes. A better alternative is to leverage policy-as-code.

    The traditional policy enforcement processes have certain drawbacks. It is challenging to perceive that your policies would be entirely adhered to, i.e., they will not be broken. It is cumbersome to check against a list of policies manually.

    Moreover, the traditional policy enforcement method cannot scale in today’s agile world, where organizations have been growing continuously with more and more employees, services and teams.

    Here are the key benefits of policy-as-code at a glance:

    • Faster and more efficient deployments
    • Automated governance, approvals and policy enforcement
    • More reliable and secure applications
    • Centralized policy management
    • Leverages version control
    • Better visibility of policies
    • Enhanced collaboration

    How Does it Work?

    Policy-as-code involves three key elements:

    1. The policy itself, which contains the required code to model the decision-making process
    2. The data and information about the environment, service or application
    3. The query that is responsible for triggering the decision-making process

    Here’s how policy-as-code works:

    1. Policies are defined as code in a human-readable format
    2. These policies are then translated into machine-readable code using Rego or HCL
    3. The policies are integrated with the IaC pipeline
    4. A policy engine evaluates the infrastructure and the application resources against these policies
    5. The policy engine accepts the policies as input, processes them and then produces a query result
    6. The policy engine reports violations (if any) to the respective stakeholders, such as the development or security teams
    7. If violations are reported, the necessary remediation is performed automatically or manually

    Types of Policies

    • Security policies: Security is enforcing adequate technological controls to safeguard company assets.
    • Compliance policies: Compliance policies are designed to help organizations adhere to governance standards. Typical examples include PCI DSS, GDPR, HIPPA, etc.
    • Operational excellence: This encompasses policies pertaining to service degradation or interruption.

    What is GitOps? How can GitOps Help With Compliance?

    GitOps is a subset or extension of DevOps encompassing a collection of practices that can simplify deployments using Git. It is an operating model for cloud-native applications that leverages Git as a single source of truth for declarative applications and infrastructure. Using GitOps, you can implement a standardized policy-as-code approach across your CI/CD and GitOps pipelines.

    The key principles of GitOps are:

    • The state of the system is captured and stored in a Git repository
    • The entire system is configured declaratively
    • Automated deployment

    You can create policies in Git and store them in a particular repository, which is essential since Git offers sophisticated change management tools like version control. Only the compliance team would have admin access to the repository.

    It’s easy to enforce policies with Git, and you can apply them to any execution engine, like CI or CD. With GitOps, you can audit and document every action that affects data consumption.

    You can expose system changes, optimize deployment and use a version-controlled infrastructure. By managing compliance with GitOps, you can make sure that the changes are visible, verifiable and auditable.

    GitOps

    Figure 2: GitOps at work!

    Using GitOps as the Execution Engine in a GitOps Process

    There are several benefits to using GitOps as a process execution engine, including:

    • Increased automation: GitOps automates software delivery, reducing manual intervention and increasing deployment accuracy and speed.
    • Better transparency: GitOps records all changes to the system in a transparent and auditable way so that you can track compliance easily.
    • Maintaining consistency: GitOps keeps the system in the desired state defined in the Git repository, reducing non-compliance risk.
    • Fosters collaboration: All changes to the system are made through the Git repository, so GitOps encourages collaboration across teams.

    Using Policy-as-Code and GitOps: Policy-Based Compliance

    By using GitOps and policy-as-code, teams can manage compliance-as-code in an auditable, declarative way and enforce it via GitOps, ensuring that the desired state is always maintained. This can help your teams to codify compliance requirements as code, store them in version control and automatically enforce them through GitOps.

    Organizations can improve the consistency and reliability of their systems by defining and enforcing compliance requirements using policy-as-code and managing their deployment processes with GitOps. While this can minimize compliance violations, it can also maximize efficiency.

    By following policy-based compliance declaratively, businesses can define policies as code and enforce them automatically and repeatedly. By adopting such an approach to compliance management, you can better manage compliance in complex systems in a consistent, scalable, agile, transparent and collaborative manner.

    For example, you can leverage policy-as-code to define policies for infrastructure provisioning and configuration management to ensure that the infrastructure complies with organizational policies and industry standards. Typical examples are defining policies for network configuration, access control and resource allocation.

    Use Cases: Using Policy-as-Code and GitOps in a Production Environment

    Infrastructure Provisioning

    Open Policy Agent (OPA) can define policies for infrastructure resources like AWS Elastic Compute Cloud (EC2) servers. You can use GitOps to manage the deployment of infrastructure resources by storing IaC files in a Git directory. When the IaC files are changed, GitOps is adept at automatically deploying the changes while OPA checks for policy compliance.

    Deployment

    You can use policy-as-code tools such as OPA to create application deployment policies requiring specific security settings, while GitOps manages the application deployment by storing manifests.

    Manage Kubernetes Clusters

    You can leverage policy-as-code to better manage your Kubernetes clusters. So, you can write your code to define policies to manage Kubernetes resources, such as nodes, pods, clusters, etc., declaratively.

    Compliance Management

    You can use policy-as-code to establish and implement rules and regulations, such as those pertaining to security, to help businesses ensure that their systems comply with industry regulations and standards.

    OPA can be used to set compliance policies, like restricting access to sensitive data to authorized users only. You can use GitOps to manage the deployment of compliance policies seamlessly.

    Trusted Delivery: Policy-as-Code Integrated With GitOps Workflows

    Trusted application delivery is a software delivery approach emphasizing security and trust in the software supply chain. This ensures that any software delivered to the clients is devoid of security flaws, malicious code and other attacks.

    This approach prioritizes security and trust at the development, testing, packaging and deployment stages and integrates security and compliance checks into the GitOps pipelines. This quality check reassures clients about the product’s quality and ensures that any modifications adhere to predetermined rules and principles.

    Trusted application delivery allows for quick deployment while securing apps with automated guardrails. These guardrails are implemented using policy-as-code. By enforcing these guardrails, you encourage frequent deployments while ensuring that the reliability and security of the application are not compromised.

    Conclusion

    Declarative compliance with policy-as-code and GitOps is a best practice for achieving greater compliance, reliability and agility in software development and deployment processes. You can simplify defining and enforcing compliance policies using declarative configuration files and automation tools. Using Git as the single source of truth for all configuration changes, an organization can achieve greater efficiency, visibility and auditability in the compliance process.

  • Orgs Shift Toward Centralizing Automation Initiatives

    Orgs Shift Toward Centralizing Automation Initiatives

    A survey published today found that 75% of respondents recognized that automation silos hamper their ability to unify cloud operations across functions.

    Conducted by CloudBolt Software, the survey polled 350 senior IT and DevOps leaders at organizations with more than 3,000 employees. On a positive note, the survey found 57% of respondents were starting to pursue a more centralized approach to automation, with a total of 88% acknowledging that having all previous and new automation centralized for the entire organization would ensure compliance, bolster security, enable business continuity, encourage reuse and reduce risk.

    Rather than taking a more holistic approach, well over half of respondents (57%) reported automation efforts are limited to specific silos. On average, organizations are employing 27 different automation tools their organizations have deployed, using one or a few as they see fit, with little to no consistency across teams. More than half (55%) of respondents said they have four or more separate automation teams, with 95% noting that each of those teams operates in their own silo.

    CloudBolt CTO Rick Kilcoyne said that lack of continuity clearly creates inefficiencies and redundancies that conspire to raise the total cost of IT. The challenge is that each team tends to favor one approach to automating a silo with little to no regard for a larger overall strategy to create an automation standard, he said.

    That approach also creates issues whenever a member of one of those teams leaves an organization, he noted. In fact, the survey found 77% of respondents reported that continuity is at risk any time a vital member of the team leaves.

    CloudBolt has been making a case for a federated automation platform that can be invoked either via application programming interfaces (APIs) or a graphical user interface (GUI) that provides access to low-code tools. The goal is to make the platform equally accessible to DevOps teams or IT administrators that tend to lack programming skills, and do so in a way that doesn’t require individual teams to replace their automation platform of choice. Instead, each of the automation platforms can be programmatically invoked via a central framework, said Kilcoyne. That approach eliminates any political debate over the potential need to replace one team’s favored automation platform with another, noted Kilcoyne.

    Regardless of who is accessing the platform, most organizations would be well-advised to develop a center of excellence for automation, he added.

    DevOps teams have always been committed to ruthlessly automating as many IT processes as possible, but in many cases, that has resulted in a plethora of automation tools being employed. In effect, automation may have become too much of a good thing. One approach to regaining control over those platforms is to create a platform engineering team that centralizes the management of DevOps workflows.

    Regardless of approach, Kilcoyne said the most important thing for any team to do before automating an IT workflow is to first understand how to manually set it up. Too many IT teams are trying to apply automation to processes they don’t really understand with mixed results, he added.

    The one thing that is certain, especially with the rise of artificial intelligence (AI), is the management of IT is going to become more automated.

  • npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

    npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The npm registry suffers spam infestation, and Microsoft makes Google sad. (more…)

  • 5 Key Performance Metrics to Track in 2023

    5 Key Performance Metrics to Track in 2023

    It’s never a bad time to adopt healthy new habits for the mind and body, and for developers, it’s always a good time to consider new best practices at work. As 2023 rolls on, I’ve been thinking about some key performance metrics that help to ensure critical applications and websites perform optimally throughout the year—especially during unpredictable spikes.

    To see why this is important, just look at the problems Ticketmaster had in November 2022 when Taylor Swift’s concert tickets went on sale. Fans of the pop idol (including me!) swamped the Ticketmaster site and brought the system to its knees, resulting in frustrated customers and a wave of bad publicity for the company.

    These usage spikes and the problems they can produce are not uncommon. The holiday sales period, starting with Black Friday and Cyber Monday, is notorious for technical issues that can cost retailers millions due to lost sales and other problems. And it’s not just retail. A few years ago, the Internal Revenue Service (IRS) had to extend its tax deadline after a rush of last-minute filers knocked its systems offline.

    Fortunately, developers can mitigate these problems with the right planning and practices in place. There are key performance metrics that developer teams should monitor, especially in times of peak traffic, to avoid application crashes, long wait times—and burnout for the teams who have to fix these problems when they arise.

    Here are the five performance metrics developers should be tracking in 2023—especially on their busiest days of the year.

    Web Vitals

    The largest contentful paint, or LCP, measures the load speed of a webpage. Having a fast LCP is a clear sign that a customer’s experience is optimal as they toggle between pages. In tandem, the cumulative layout shift, or CLS, scores how a user is experiencing unexpected layout shifts. This plays out on busy shopping days: Typically, these pages have ad and sales notifications that affect a brand’s main page layout, potentially causing shoppers to experience unexpected shifts. This can reduce their ability to shop and becomes a hindrance if a developer cannot quickly access and address the issue.

    Error Count Vs. Error Rate

    Error counts typically increase alongside site traffic as more people flock to a website—that’s a natural occurrence. The error rate is more telling because it reveals if a greater proportion of users are experiencing issues with your application or website. Developers who see an increase in this metric should investigate and take action.

    Mobile Monitoring

    More and more consumers are using their mobile devices to shop and manage all aspects of their lives. For example, mobile accounted for 45% of sales during the holiday shopping period in 2022 from October to December. Mobile performance metrics are critical to understanding what is happening on your users’ devices during these busy times. Vitals like frozen and slow frames or cold and warm starts when an app opens provide visibility into how fast views are loading for your users. As became obvious with the Taylor Swift incident, a slow shopping experience can lead to an outcry and a lot of upset customers.

    Outside of vitals related to mobile performance, it’s important to monitor mobile changes through application release health. Developers can see this in the rate of crash-free sessions and crash-free users as traffic to an application increases—which helps to identify abnormalities in the overall health of the app.

    Slow Database and HTTP Ops

    During sustained traffic spikes, database queries and HTTP requests that take too long to execute harm the user experience. Hitting a slow checkout process, or seeing the dreaded spinning beach ball after adding a product to the cart, confuses shoppers. They don’t know if they should refresh the page, and often they will abandon a purchase completely.

    What’s more, if a developer is working on a backend framework, slow database and HTTP ops could also be a sign of an N+1 query problem. At that point, an application is making database queries in a loop and causing performance issues for the purchaser.

    User Misery

    This is a homegrown metric we use at Sentry; tracking user misery helps developers understand a customer’s experience with an application. It is a ratio of unique users who have experienced load times at 4x a configured threshold in a Sentry project and thus serves as a proxy for customer frustration. With this user misery score, our developers can see which transactions have the highest negative impact on users and prioritize fixing them.

    Providing a smooth end-user experience is table stakes for businesses throughout the year, but especially during high-pressure, culturally-driven spending moments. In any of these scenarios, developers behind the scenes often work long and odd hours to address performance issues and ensure the most seamless experience. You can’t prepare for everything that can possibly go wrong, but you can be equipped with the right tools and metrics to quickly identify and remediate any problems that occur.

  • Vega Cloud Commits to Reducing Cloud Costs

    Vega Cloud Commits to Reducing Cloud Costs

    Vega Cloud today made a commitment to save customers at least 10% on their cloud infrastructure spending or it won’t charge for its software. Vega Cloud’s software automates cloud infrastructure management.

    The Vega Cloud platform enables IT teams to connect, automate, manage and optimize new and existing networks, applications and other multi-cloud IT environments from a single console. As part of those capabilities, the company includes cost allocation and cost identification tools using a curated set of data to surface daily recommendations for cost improvements.

    Vega Cloud CEO Kris Bliesner said the goal is to provide a financial operations (FinOps) capability within the context of a platform capable of acting on those recommendations that, on average, reduces cloud costs by 15% to 25%.

    During uncertain economic times, IT leaders are under more pressure than ever to reduce costs. FinOps has emerged as a discipline for applying a set of best practices for specifically reducing cloud costs. In addition to reducing cloud costs, Vega Cloud is also making a case for reducing the total cost of IT by relying on a single automation framework to manage multiple clouds.

    In the cloud era, many organizations have found themselves employing multiple clouds, each of which requires a separate set of tools to manage. IT teams then need to hire additional staff to manage each of those tools. As a result, the total cost of IT increases with each additional platform added to the overall IT estate.

    Many organizations, of course, have allowed the number of platforms they manage to proliferate. This is because many application deployment decisions were driven by developers who can easily provision cloud infrastructure on their own. However, as concerns over the cost of cloud computing continue to rise, many organizations are revisiting how cloud infrastructure resources are used. Many of those reviews are being driven by finance teams that want cloud costs to become more predictable as cloud computing continues to account for a much larger percentage of the IT budget, noted Bliesner.

    In fact, one of the challenges IT leaders have is finding a way to make sure developers and DevOps teams are more motivated to reduce costs rather than focusing entirely on how fast they can build and deploy applications, he added.

    The reality is the average developer doesn’t need application build infrastructure running 24/7, so application development and testing is a great place to focus on cutting cloud costs initially, noted Bliesner. There’s also plenty of opportunity to better schedule workloads to reduce costs by relying more on lower-cost instances of cloud infrastructure, he said.

    DevOps engineers, by nature, don’t want to be inefficient, so the issue comes down to providing them with the tools needed to identify resources that are being wasted, added Bliesner.

    Most cloud service providers, of course, provide tools that enable IT teams to optimize spending, but Bliesner said those tools don’t go deep enough in terms of exposing issues. As a provider of an independent management framework, Vega Cloud is more committed to providing cost optimization capabilities that can be applied to multiple clouds, he added.

    In general, interest in controlling cloud costs has risen sharply. Vega Cloud has been engaged with more customers researching this issue in the last four weeks than in the last three years, said Bliesner. The challenge—and the opportunity—is to not just cut cloud costs but also identify patterns that make it easier to predict them, noted Bliesner.

    At this juncture, cloud costs are coming down. The only issue left to be determined is whether that goal will be accomplished with precision versus a fiat that adversely impacts an organization’s ability to continue to build and deploy software.

  • env0 Extends Workflow Platform for Provisioning Infrastructure

    env0 Extends Workflow Platform for Provisioning Infrastructure

    env0 today announced it has added support for additional infrastructure-as-code (IaC) tools and the Microsoft Azure DevOps platform to its workflow automation and management platform.

    Fresh from raising an additional $35 million in funding, env0 CEO Ohad Maislish said while Terraform remains the most widely used IaC tool, there are now more organizations using alternatives such as CloudFormation from Amazon Web Services (AWS) along with Pulumi and Terragrunt.

    Other capabilities added to the env0 platform include automated drift detection, multi-tier workflows, auditing, external logging platform integration, support for plug-ins and expanded role-based access controls and OpenID Connect (OIDC) authentication.

    Finally, env0 is extending its existing Terraform support to include support for remote backend, module registry, remote plan, and the ability to plan and apply pull requests. The capabilities are especially critical for organizations that are now building microservices-based applications that require more sophisticated workflows to provision infrastructure resources, noted Maislish.

    Most IaC tools are designed to enable developers to address technical implementation and provisioning issues without regard for user experience, security and governance, or business goals. The env0 platform makes it possible to create infrastructure environments with guardrails in place that enable DevOps teams to centrally address governance issues, noted Maislish.

    In general, there’s now a lot more focus on continuous delivery (CD) as organizations look to continuously update applications, said Maislish. That requires a more structured approach to provisioning infrastructure across teams of developers that is managed by a platform engineering team, he added. The challenge is that CD is dangerous—in the sense that mistakes can easily be made, noted Maislish.

    It’s not clear whether organizations are embracing platform engineering to centralize the management of DevOps workflows, but the number of organizations that have mastered CD best practices remains low. Most organizations are adept at continuous integration (CI), but given the number of unique platforms on which applications are deployed, CD has proven more challenging to adopt. In theory, a platform engineering team should make it easier for DevOps teams to define a consistent approach to CD that could be adopted across an organization.

    Regardless of the DevOps approach, the overall goal is to improve developer productivity. The problem is that in the absence of any guardrails, developers have been provisioning cloud infrastructure as best they can. Not surprisingly, cloud computing environments are rife with misconfigurations that create vulnerabilities that cybercriminals have become more adept at exploiting. The fundamental issue is not such much the cloud infrastructure that is available as much as it is the processes employed to provision the resources. In their rush to build and deploy applications, developers will sometimes ignore best practices unless guardrails force the issue.

    One way or another, IT organizations are exercising more control over cloud computing environments as the security of software supply chains becomes a bigger issue. The only thing that remains to be resolved now is how to put much-needed guardrails in place in a way that adds the least amount of friction possible.