devopsy.kinsta.cloud

Category: DevOps Practice

Techstrong Research: Combatting CI/CD Security Anti-Patterns

Recently, Techstrong Research released our PulseMeter report, “Tackling CI/CD Security Anti-Patterns.” Our research shed light on the evolving landscape of continuous integration/continuous deployment (CI/CD) pipeline security, drawing from the collective wisdom and experiences of professionals across DevOps, DevSecOps, software development and security disciplines.

Our aim is not merely to explore the challenges but to provide guidance toward actionable steps and best practices that can fortify the backbone of modern software delivery processes. The findings of our research underscore a pressing reality: The security of the software supply chain and CI/CD pipelines is now as critical as the integrity of physical supply chains in traditional sectors.

This comparison is not made lightly; as digital infrastructure becomes the backbone of global commerce and communication, the repercussions of security lapses in software delivery can have widespread and consequential impacts. Our study reveals that the risks to software supply chains demand rigorous attention and strategic action, echoing the necessity for a shift in how organizations approach DevOps and CI/CD security.

A significant portion of our research was dedicated to identifying CI/CD security anti-patterns—practices that, albeit unintentionally, may provide a false sense of comprehensive security and even introduce vulnerabilities into development pipelines. These anti-patterns, such as the incorporation of external code from unverified sources or the adherence to rudimentary security measures without advancing to more robust strategies, significantly broaden the attack surface accessible to cyber adversaries. The research emphasizes the criticality of recognizing and rectifying anti-patterns to help safeguard the software supply chain from potential breaches and attacks.

Insightful Survey Findings: A Wake-Up Call

The survey provides a stark illustration of the current state of CI/CD pipeline security. With 84% of respondents acknowledging the importance of CI/CD pipeline security—motivated by the sobering statistic that over 20% of organizations reported a security incident within their pipelines in the previous year—the message is clear: Pipeline security must be improved beyond current measures.

These incidents showed tangible impacts, including but not limited to delayed deployments and significant data breaches. Moreover, the survey identified source/image repositories and code as particularly vulnerable points within the software development life cycle (SDLC), with a significant emphasis on the risks posed by open source vulnerabilities, secrets exposures and insecure code. This feedback from the field underscores the necessity for a proactive stance on security measures, one that anticipates potential vulnerabilities and implements robust defenses against them.

Drawing from the insights garnered through our research, Techstrong Research advocates for a holistic, strategic approach to enhancing CI/CD pipeline security. This includes the deployment of defensive measures designed to prevent unauthorized tampering with software production processes and the rigorous vetting of CI/CD pipeline artifacts to ensure their integrity through comprehensive role definitions and strict authorization protocols. Our endorsement of the NIST SP 800-204D draft underscores our belief in the necessity of a foundational framework that organizations can adopt to bolster their CI/CD pipeline security. Furthermore, our research shines a spotlight on the pivotal role of software composition analysis (SCA) in fortifying CI/CD pipelines against security threats. SCA facilitates the meticulous tracking of software elements and their dependencies, enabling organizations to identify and mitigate vulnerabilities swiftly. This tool is invaluable not only for preventive security measures but also as a critical component of incident response strategies.

Beyond traditional security measures, the research highlights the use of cloud-native continuous integration approaches, including containerization, to enhance security. These methodologies provide a framework for executing builds and tests within isolated environments, thereby minimizing the risk of conflicts and vulnerabilities. The adoption of containerization offers a myriad of benefits, including standardized packaging, enhanced transportability and improved traceability of software from development through to production.

The PulseMeter report on CI/CD security anti-patterns serves as a clarion call to the industry. The imperative to secure the software supply chain and CI/CD pipelines is undeniable and urgent. In this era of unprecedented digital reliance, our collective commitment to advancing CI/CD pipeline security is not just beneficial—it’s essential. The journey ahead is challenging, but with informed strategies and collaborative efforts, we can significantly reduce the vulnerability of the software we deliver as part of our digital infrastructures.

February 21, 2024
DevOps: What’s the End Goal?

In high tech, we have a penchant for not actually having an end goal. We have interim goals but no grand “this is what we need to do.” And yet, every space inevitably has a “this is the reason” attached. So what should the overarching goal of DevOps be?

We started out with streamlining processes as the goal, and quickly morphed into efficiency and being more responsive–all worthy goals, but it is the nature of both technologists and business people (for very different reasons) to not stop when the goal is reached. We went through several more iterations that all basically pulled more under the DevOps umbrella, and then settled on automation. AI will continue this automation trend, but to what end?

Where, exactly, do we want to go? Theoretically, we could make AI write the code, build the code, test the code and deploy the code with only a small contingent of actual people involved in the process. Seriously, if the idea is to let business people crank things out a la the promises of 4GLs, then we are closer than we have ever been to achieving that goal.

But, much like calculators, someone will still have to create these systems, and we are faced with a different conundrum: If no one is writing new code, learning-based AI will struggle to solve new problems. That challenge can, in theory, be overcome by teaching AI to disassemble and abstract existing solutions, but that will take time.

The other thing that business people and technologists share in the modern world is a lack of actual philosophers. I am a technologist, but much of my immediate family enjoys philosophy. So, I dug into philosophy with regard to science many years ago, and philosophers, being esoteric, ruined their ability to influence scientific thought. Focusing on questions like, “What if tomorrow, we found aluminum that wasn’t really aluminum?” was dumb and undermined the core idea of “Science will tell us what we can do, philosophy will tell us what we should do.”

So we’re on our own in that regard, and given a worldwide development community, we can assume that just because you can, someone will. Our question then is, “What does a given enterprise want and need from their DevOps processes?” The rate of change is about to accelerate again, so knowing what is important to your organization will matter in the next five years. A company that uses technology in support roles has wildly different needs than one that uses technology to develop products, and they have very different needs than a company for whom technology is the product.

Is the goal to eliminate the bulk of IT? Or is it to streamline IT even further and make it even more responsive to business needs? Perhaps the goal is to develop entirely new products or markets with the time that AI has freed up. The difference is huge in terms of planning. And these are the types of questions coming. The idea that any given technology can make things (or make them happen) faster and more efficiently without changing staffing is naïve and ignores the history of the auto industry.

Get together, IT and business leaders. Develop a plan. Do you want to do more with less, or do you want to reduce overhead? Do you want to have IT specialize while AI does the mass of generic work? Level one help desk can be taken over by chatbots today. Is that the type of direction the organization wants to go? Tell IT management that change is coming; the question is, how the organization wants to leverage it and conscious decision is far better than accidental results.

devopsy.kinsta.cloud · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 21, 2024
Skillsoft Taps ChatGPT to Improve Developer Training

Skillsoft today revealed it plans to add generative artificial intelligence (AI) capabilities to its Codecademy online training platform to provide developers with hands-on experience using ChatGPT to write code.

Kunal Ahuja, general manager for Codecademy consumer business at Skillsoft, said the goal is to give developers a more curated path toward teaching them how to define prompts that will result in better code being generated. These enhancements will be made available to Codecademy Plus and Pro users as well as enterprise customers in the coming months, he noted.

There’s no doubt that developers are relying more on generative AI to write code, but not all the output generated by platforms that are based on a general-purpose large language model (LLM) is going to be consistent. Codecademy provides a more immersive experience that enables developers to refine their prompt engineering expertise, said Ahuja.

AI-enabled capabilities include code explanations and project hints to improve debugging skills, along with other real-time feedback surfaced via a virtual coding assistant. There are also courses such as “Prompt Engineering for Software Engineers” available.

Finally, Skillsoft is also providing access to a mock interview simulator that developers can access to help determine if they are ready for a job interview.

As it becomes more apparent that prompt engineering is a skill application development teams will need to master to build and deploy software, there’s a clear need to teach nearly everyone in IT how to craft prompts efficiently. Ultimately, the number of prompts used to generate code will have an impact on the total cost of building software.

In the longer term, Skillsoft plans to build its own LLM using data it collects via its platform to provide training using an LLM that has been trained using code that has been curated, said Ahuja. One of the issues with a general-purpose LLM is that it is trained using examples of code pulled from across the web that varies widely in quality. That can result in outputs of code that have known vulnerabilities or that simply run inefficiently. Of course, it may be just as likely that a developer augmented by generative AI is, depending on their level of expertise, actually delivering higher-quality code.

Despite those concerns, however, it’s still important to provide developers with the training they need today to remain competitive, said Ahuja.

It’s not clear how much code these days is being generated by machines versus humans, but as the volume increases, the number and size of the software builds that need to be managed is only going to increase. Hopefully, as much AI will be applied to the DevOps workflows used to manage those software builds as there is being applied to writing code, but in the short term, at least, DevOps teams might soon find themselves overwhelmed.

The one thing that is certain is DevOps teams have a vested interest in making sure the code being written by developers is of the highest quality possible. After all, whenever there is an issue with that code, it usually falls to the DevOps team to fix it.

Image source: https://vecteezy.com/programming-background-with-person-working-with-codes-computer-e1679047506780.jpg

February 20, 2024
Harnessing Generative AI for Feature Management Testing
When it comes to DevOps, the emerging integration of generative AI into feature management testing marks a significant evolution. We’re going to take a no-nonsense look at how this technology is revolutionizing the way we create testing environments.

Using artificial intelligence to generate tests allows us to mimic a vast array of user scenarios and environments, which means we can develop and deploy features that aren’t just good but great—robust, efficient and ready for whatever the real world throws at them.

Embracing Generative AI in DevOps Testing

Artificial intelligence is dramatically transforming the world around us, impacting a wide variety of industries at breakneck speeds. A stunning 83% of companies assert that AI is a critical component of their business strategies, particularly when it comes to software development.

Generative AI has quickly become a transformative tool when it comes to DevOps, particularly when it comes to feature management testing, by leveraging machine learning algorithms to generate data and test scenarios that closely mimic real-world conditions.

Traditionally, DevOps teams have relied mostly on manual and a couple of automated testing methods to validate their features. However, these methods often fail to accurately simulate the wide variety of complex and unpredictable user interactions and environmental variables.

By creating nuanced and diverse test cases, generative AI can fill this gap, enabling a more thorough evaluation of features under various conditions. Even now, on a smaller scale, WordPress site owners are using predictive analysis and even simple comparisons to properly orchestrate the rollout of new features–with over 60,000 plugins to choose from, generative AI has the potential to prevent lag, which can often be the result of a single shoddy plugin.

Simply put, AI is actively improving how features are implemented and tested across various platforms by intelligently crafting diverse test scenarios.

Enhancing Test Coverage and Efficiency

The significant expansion in test coverage is one of the key benefits of integrating generative AI into DevOps testing. Traditional testing methods are typically limited by the scenarios that testers can foresee and manually script.

In contrast, AI-driven testing tools can generate a multitude of unique, unexpected test scenarios, capturing edge cases that might otherwise go unnoticed, which is crucial in identifying potential bugs and vulnerabilities early in the development cycle, saving time and resources in the long run.

Additionally, AI can automate both the creation and implementation of these tests. This simplifies the testing workflow, allowing human testers to dedicate their full attention to more intricate and challenging tasks.

Simulating Real-World Scenarios

Another key advantage of generative AI in DevOps is its ability to simulate real-world user behavior and environments.

AI models can create realistic and diverse user scenarios by analyzing historical data, user patterns, and environmental variables. This type of functionality is a huge asset in feature management, where understanding how new features will perform in the real world is paramount.

To use a couple of examples, an AI model can generate test cases that mimic peak usage times, varying network conditions, or different user demographics. Furthermore, companies like Netflix, Google and IBM are already actively using generative AI to simulate real-world scenarios for various applications, such as content delivery optimization, predictive maintenance, and software testing.

Accelerating Feature Development in DevOps

The integration of generative AI into feature testing also accelerates the feature development and deployment process.

A well-constructed prompt chain can set up an environment where DevOps teams can effectively compare different products/services, especially when it comes to more sensitive software, such as cloud management platforms and even find the best ways to escape vendor lock-in without actually wasting time manually comparing and testing everything.

Applying generative AI can also drastically cut down on the time it takes to validate a new feature by generating and running through thousands of test scenarios in quick succession. In DevOps environments, where rapid iteration and continuous deployment are key, this is essential.

AI-driven testing can also provide developers with immediate feedback, allowing for quick adjustments and improvements. This ensures that features are developed faster while meeting the highest quality standards before proper deployment.

Potential Challenges and Considerations

While the potential of generative AI in DevOps testing is immense, there are challenges and considerations that teams must navigate and work to overcome to successfully apply this powerful new tool.

One key issue is the quality and relevance of the data used to train AI models; since inaccurate or biased training data can lead to suboptimal or even harmful outputs, carefully selecting and curating data is a crucial step.

Incorporating generative AI into established DevOps processes can also present challenges in terms of complexity and resource demands. Organizations may face significant challenges in modifying their existing pipelines and processes to accommodate AI technologies, which often require substantial investments in hardware, software and skilled personnel.

Lastly, the need to continuously improve and update AI models cannot be overstated. As new technologies and security threats emerge, these models must be regularly refined and adapted to remain effective and relevant, which will require ongoing investment in AI systems and a commitment to staying abreast of evolving technologies and methodologies in what is a rapidly evolving and advancing field.

Future Directions of Generative AI

Looking forward, the role of generative AI in DevOps is poised to grow even more prominent, and as AI models become more sophisticated and data-rich, their ability to generate realistic and complex test scenarios will only improve.

But let’s look beyond just creating testing environments and isolated testing environments: A well-executed, AI-aided process can reduce costs during SAP staff augmentation and can also streamline processes in other high-level enterprise systems such as Oracle ERP and Salesforce CRM. Overall, ERP software is a perfect candidate for DevOps feature management, as it allows devs to use generative AI for everything from writing code to custom tests.

We can also expect to see further integration of AI in other aspects of DevOps, such as monitoring and performance optimization. The ultimate goal is to create a seamless, AI-enhanced pipeline that tests and deploys features efficiently and continuously learns and improves from real-world feedback.

To better illustrate this transformative impact, some key examples of how generative AI will further impact DevOps in the future include the following:
- AI-Augmented Development: Generative will assist developers with code suggestions, bug fixes, and even making architectural decisions, thereby streamlining the development workflow.
- Improved Infrastructure Management and Automation: The use of predictive analytics, driven by generative AI, will play a crucial role in anticipating infrastructure requirements, facilitating preemptive scaling, and efficient distribution of resources.
- Adaptive Problem Resolution and Incident Handling: Generative AI is set to revolutionize the way operational problems are identified, diagnosed, and resolved swiftly, greatly boosting the dependability and steadiness of DevOps practices. This is evident in platforms such as Google Cloud’s operations suite, where such AI capabilities are already making a significant impact.
- Generative AI in Proactive DevOps: This emerging trend focuses on leveraging generative AI to anticipate potential issues before they manifest, which enables preemptive maintenance strategies and is aimed at reducing system downtime.
- AI-Driven Testing and QA: AI-powered testing will become more sophisticated, with capabilities such as automated test case generation, test data creation, and advanced anomaly detection.
Harnessing Generative AI in DevOps

Integrating generative AI into DevOps is a groundbreaking development poised to revolutionize how we approach software development, testing, and infrastructure management.

This innovative technology offers immense potential to automate complex tasks, enhance efficiency and improve the quality and reliability of software products. However, as with any emerging technology, its adoption comes with its own set of challenges and considerations.

Enterprises aiming to leverage generative AI within their DevOps practices must address challenges associated with data integrity, intricate integration processes, adherence to privacy laws and the necessity for ongoing enhancement of their AI models.

Despite these challenges, the benefits of adopting generative AI in DevOps are quite substantial, ranging from increased efficiency and cost savings to enhanced scalability and improved overall software quality.
February 20, 2024
Embracing the Future: Navigating the Waves of AI in DevOps

In the rapidly evolving digital landscape, the advent of generative AI and large language models (LLMs) has ushered in a new era of innovation and transformation. As IT organizations pivot toward DevOps, DevSecOps and SRE mastery, leaders find themselves at the crossroads of excitement and anxiety. This dual sentiment stems from the vast potential of AI to revolutionize operations and the inherent challenges that accompany generative AI’s integration. In this article, we’ll explore the reasons behind this excitement and anxiety, outline the top use cases for generative AI and provide strategic guidance to ensure a smooth DevOps and digital transformation journey.

The Catalysts of Excitement

1. Enhanced Efficiency and Innovation: Generative AI, with its ability to automate complex processes and generate new ideas, promises unprecedented efficiency. It enables IT organizations to streamline development pipelines, reduce manual errors and foster innovation, making the leap toward DevOps and DevSecOps not just a goal but a tangible reality.
2. Improved Decision-Making: Large language models offer sophisticated data analysis capabilities, turning vast datasets into actionable insights. This empowers leaders to make informed decisions rapidly, optimizing operations and enhancing service reliability in line with SRE principles.
3. Competitive Advantage: In the digital age, staying ahead means adopting the latest technologies. Generative AI provides a unique competitive edge, allowing organizations to deliver superior digital experiences, innovate products and services and respond to market changes proactively.

Top Three Generative AI Use Cases in DevOps

1. Automated Code and Test Generation and Review: AI-driven tools can generate code and test snippets, conduct code reviews and testing and suggest optimizations, accelerating development cycles and improving code quality.
2. Security Enhancement: By integrating AI into security protocols, organizations can predict and mitigate potential threats more effectively, enhancing their DevSecOps initiatives with proactive rather than reactive measures.
3. Incident Management and Resolution: AI can automate incident response workflows, predict outages before they occur and suggest remediations, aligning with SRE goals of maintaining high availability and reliability.

Sources of Anxiety

1. Ethical and Privacy Concerns: The potential for misuse of AI technologies, including privacy violations and biased decision-making, raises significant ethical questions, creating apprehension among leaders.
2. Skill Gaps and Workforce Impact: The shift toward AI-centric operations necessitates new skills and roles. Leaders worry about the existing workforce’s ability to adapt and the challenge of filling emerging skill gaps.
3. Integration and Compatibility Issues: Integrating AI into legacy systems and ensuring compatibility across the digital infrastructure poses technical challenges, complicating the transition to advanced DevOps and SRE practices.

Navigating the Digital Transformation Journey

To harness the benefits of AI while mitigating its risks, leaders should consider the following strategic actions:

1. Foster an AI-Ready Culture: Cultivate a culture of continuous learning and adaptability. Encourage your team to embrace AI tools and methodologies, emphasizing the importance of upskilling and reskilling.
2. Implement Ethical AI Guidelines: Develop and adhere to ethical guidelines for AI use, focusing on transparency, accountability and fairness. Ensure privacy and security measures are integral to your AI initiatives.
3. Invest in Talent and Training: Address skill gaps by investing in training programs and partnerships with educational institutions. Consider hiring AI specialists to bridge the gap between traditional IT roles and AI requirements.
4. Prioritize Seamless Integration: Adopt a phased approach to AI integration, ensuring compatibility with existing systems. Leverage APIs and microservices architectures to facilitate smoother transitions.
5. Establish Governance and Oversight: Create a governance framework to oversee AI initiatives, ensuring alignment with organizational goals and compliance with regulatory requirements. This should include monitoring AI performance and its impact on operations and workforce dynamics.

Summary: Seize the AI Opportunity

As we stand on the brink of a transformative era, the fusion of AI with DevOps, DevSecOps and SRE practices represents a significant leap forward. While the journey is fraught with challenges, the potential rewards are immense. By embracing AI with strategic foresight, ethical consideration and a commitment to continuous improvement, IT leaders can propel their organizations toward unparalleled efficiency, innovation and competitive advantage.

In conclusion, the integration of AI into DevOps to further accelerate digital transformation is not just an option but a necessity for staying relevant in the digital age. The journey requires careful navigation, but with the right approach, IT organizations can emerge stronger, more agile and better equipped to face the future. Let’s embrace this opportunity to redefine the digital landscape, ensuring our transformations are not just successful but sustainable and responsible.

Embrace the future; embrace AI.

February 20, 2024
6 Transformative Mainframe Predictions for 2024

The success of organizations in today’s digital economy demands speed — the ability to quickly respond to market trends with new applications and services, instant access to critical data, and resolution of issues even before they affect service. As we move into the new year, the adoption and adaptation of emerging technologies on the mainframe will enable enterprises to embrace changing market forces, turning them into a competitive advantage.

Below are six predictions of how mainframe organizations will leverage new technologies to advance the platform in 2024.

Prediction: AI/ML Adoption Grows

The roles of artificial intelligence (AI) and machine learning (ML) and their adoption across the mainframe, from application development to monitoring to data management, will continue to grow.

The generative AI revolution is real and here to stay. In the coming year, organizations will continue to explore best-use cases for its integration into mainframe management. Development teams will leverage key AI-recommended insights into automated workflows and code generation, improving developer productivity. Database administrators (DBAs) will look to automate data management processes to efficiently handle the demand for the diverse datasets required by generative AI tools, and mainframe operations teams will increase their reliance on AI-driven predictive analytics and root cause analysis.

As adoption increases and experience is gained, organizations will work past their AI trust issues and begin to harness the power of automation to become a fully autonomous digital enterprise. At the same time, there will be a growing need to govern AIOps and MLOps to ensure the validity and accuracy of ongoing model development.

Prediction: DevEx Comes to the Forefront of Companies’ Innovation Strategies

With the long-awaited shift of mainframe workforces from those with decades of experience to a new generation of stewards now in full effect, organizations will find a new imperative to attract and retain top talent by providing developers with familiar tools and development environments.

Professionals who have recently graduated from college or are moving from other platforms bring with them an expectation of integrated and automated DevOps practices. The move towards enterprise-wide DevOps and continuous integration and continuous deployment (CI/CD) pipelines will continue, with many companies also looking to employ cross-platform tooling. By giving developers the freedom to use their integrated development environment (IDE) of choice, organizations can decrease onboarding time and get new mainframe developers up to speed faster, enabling them to understand code and its function quickly and easily, and creating a seamless, frictionless way to make changes, debug, and deploy.

Prediction: Database DevOps Bridges the Gap Between DBAs and Developers

Changing customer demand and the need for agility will accelerate the drive for developers to seamlessly access and manage data sources. The demand for an agile development environment that extends from applications to databases will increase the inclusion of database DevOps in CI/CD pipelines, including version-controlled database schemas and data, automated database provisioning, and database testing as part of the pipeline.

By embracing agile practices, such as incremental database changes and rolling deployments, organizations will bridge the gap between DBAs and developers and ensure that mainframe databases evolve alongside application code. This cohesive approach will enhance collaboration, reduce conflicts, and expedite application development, positioning mainframes as agile and adaptable components within the rapidly changing IT landscape.

Prediction: Democratizing Mainframe Data

The move ― and the need ― to democratize mainframe data, making it available to AI/ML analytics engines, will gain momentum.

Organizations have matured their data lakes and gained valuable insights from data housed on distributed and cloud platforms, but the efforts needed to extract and transform mainframe data stored on tape and virtual tape libraries (VTL) has left volumes of business-critical data behind. By operationalizing mainframe integration with the cloud, organizations can make it easier and faster to access mainframe data and transform it into open formats, making it accessible to analytics engines and AI/ML applications.

The ability to realize the hidden potential of data they already store will make cloud-based storage of mainframe data a prerequisite for enterprises looking to digitally transform their businesses and gain competitive advantage.

Prediction: Object Storage Becomes Critical for Security

Mainframe-dependent organizations will seek to integrate hybrid cloud object storage to fortify mainframe data protection against escalating cyberthreats and ransomware attacks.

In 2024, cyberthreats will almost certainly increase in number and sophistication. The European Union’s Digital Operational Resilience Act (DORA) seeks to ensure that organizations remain vigilant and protect their systems and their customers’ data against increasing threats.

With DORA set to come into effect in January 2025, and further regulations and guidelines on the horizon, managing mainframe data across diverse locations while prioritizing immutable data copies will be imperative. Organizations will pivot towards proactive strategies, aligning their mainframe infrastructure with hybrid cloud solutions to meet evolving compliance standards and shield against the growing sophistication of cyberthreats.

Prediction: Innovation Takes the Lead

Organizations will adopt ruthless prioritization, shifting focus from maintaining services and applications to building new ones for the future.

Having seen firsthand the success of ongoing mainframe modernization efforts, organizations will place a new focus on building skills and specialties that align with future goals and product roadmaps, putting them in a position to capitalize on coming trends and giving them the ability to quickly respond to changing market forces with innovative new products and services.

As companies mature their approaches to AI on the mainframe, many will turn to building “applied AI” teams tasked with developing proactive solutions to better analyze data and forecast trends. In short, organizations will think logically about how to embrace AI rather than being embraced by it.

In 2024, mainframe organizations will accelerate the adoption of emerging technologies like AI and the cloud to increase the adaptability, resilience, and efficiency of the platform while situating it for even greater success in the future. The mainframe will continue to be a platform of innovation, integrating with new technologies and practices borrowed from other platforms to further the evolution of a hybrid IT environment that meets and exceeds the demands of the modern digital economy.

The role of AI, the impact of data governance regulations, the mainframe skills gap, affordability, and interoperability requirements are all brewing a perfect storm around the mainframe that will mark 2024 as a year of significant transformation that will define the leaders from the laggards.

February 19, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

Indeed.com

Autodesk
Portland, Oregon
Principal DevOps Engineer
$141,400 to $228,800

LinkedIn

Zscaler
Remote
Staff DevOps Engineer
$129,000 to $185,000

CareerBuilder.com

Convey Health Solutions
Fort Lauderdale, Florida
Senior DevOps Engineer
$120,000 to $160,000

Dice.com

DISH
Dallas, Texas
Senior DevOps Engineer
$106,250 to $143,750

SimplyHired

Parsons
Summit, West Virginia
DevOps Engineer
$100,400 to $175,700

February 19, 2024
What the Evolution of Specialized Hardware for AI and ML Means for DevOps
The widespread adoption of artificial intelligence (AI) and machine learning (ML) technologies is accelerating the evolution of computational hardware, essential for automating complex processes and enhancing accuracy in decision-making. This acceleration is crucial in advancing computer science and data processing, especially within the various segments of AI/ML data pipelines.

This growing demand is prompting a diverse array of chip manufacturers, from established players to emerging contenders, to innovate and lead in the development of faster and more efficient processing solutions. The primary goal? To design chips that optimize data transfer, improve memory management and enhance power efficiency. These advancements are far from incremental; they are pivotal in meeting the escalating demands of sophisticated AI and ML applications.

This evolving hardware landscape for DevOps necessitates greater unification and automation of the various applications to the specialized AI infrastructure. With chip architectures diversifying, building the application stacks focusing on portability, performance and ease of access becomes even more crucial. The ability to seamlessly embrace multiple architectures will be key to striking the right balance for the varying technical abilities of the people who want to interact with technology.

This article explores the implications of these hardware advancements on DevOps processes within AI and ML. Additionally, we explore strategies DevOps teams may consider to ensure applications remain efficient and portable across various chip architectures.

The Rise of Specialized Hardware

Historically, general-purpose hardware, including GPUs and CPUs, was the staple for many workloads. However, a clear pivot to specialized hardware is underway in artificial intelligence and machine learning, where training and inferencing demands have grown exponentially. These applications often hit performance limitations inherent in traditional hardware, partly due to the modern constraints of Moore’s Law. As a result, there is an increasing need for hardware capable of handling specific AI tasks with increased efficiency and speed. For instance, in certain machine learning scenarios, using hardware that supports single-precision floating-point computations can speed up processes without the need for the accuracy provided by double-precision computations.

Although NVIDIA remains a dominant force in the AI chip market, the competition is heating up, with various companies offering innovative alternatives. And it’s not only from the usual suspects like Intel or AMD; Google has made strides with its Tensor Processing Units (TPUs). Amazon recently announced Trainium2, a new AI chip designed specifically for training AI systems. This chip, set to compete with Microsoft’s Maia and Google’s TPUs, underscores the growing custom AI chip development trend among major tech companies. Beyond these giants, startups such as Cerebras, SambaNova Systems, Graphcore and Tenstorrent bring fresh takes on AI hardware solutions.

Challenges for DevOps

As specialized hardware becomes more prevalent, the DevOps community will need to manage various new challenges, including performance portability. Performance portability refers to ensuring that applications run efficiently and perform well across varying computing architectures with minimal to no modifications.

Cognitive computing (the broader category of AI and ML) varies in complexity, depending on the algorithms, models and creators’ unique demands for hardware-specific features. While an architecture-tailored version will certainly maximize performance on respective platforms, it complicates the process of ensuring a consistent software experience across diverse hardware.

The challenge of system design lies in optimizing the environment for maximum efficiency, especially when the precise nature of the workload is unknown to those responsible for designing and supporting the systems.

Of course, there are also significant and related considerations with continuous integration and continuous deployment (CI/CD) pipelines. The intricacies of CI/CD pipelines are magnified when pursuing performance portability. The need to validate software performance across multiple hardware configurations introduces a more elaborate testing matrix and can extend deployment cycles, directly affecting time-to-market requirements. Suddenly, workloads are now crossing the traditional IT infrastructure and high performance/supercomputing boundaries once defined by microservice and batch processing technologies; they are now one in a CI/CD pipeline.

As organizations adopt specialized hardware, there’s the potential for a parallel rise in specialists focusing solely on one type of hardware or application use case. While such expertise can drive innovation and optimization for a particular platform, it also creates complexity and the potential for knowledge silos and unnecessary complexities for the operations teams and clients that use those systems.

Leveling up Performance Portability

Performance portability and closely related concepts, such as hardware-agnostic performance and cross-platform efficiency, are increasingly important for DevOps teams. As the technological landscape shifts, the pressing question becomes: How can the industry and DevOps teams navigate this evolution seamlessly?

Ongoing research and development will no doubt play a key role. For example, the U.S. Department of Energy (DoE) is exploring new methodologies to support its Exascale Computing Project. This includes refining existing software libraries, pioneering new programming models and developing new tools that could eventually influence wider DevOps practices. Other researchers are developing software abstraction layers, aiming to simplify the adaptation of generic code for specific hardware configurations.

Beyond new tools and methodologies that may come from current R&D efforts, there are many existing tools and processes that lend themselves to improving performance portability, including:
- Containerization: Containers encapsulate applications and their dependencies in a way that helps ensure they run consistently across various environments. Open source tools like SingularityCE with Open Container Initiative (OCI) compatibility can help standardize and simplify deployment across different hardware configurations, promoting performance portability for high-performance computing and traditional IT infrastructure management.
- Benchmarking and profiling: To achieve performance portability, it’s imperative to understand how software behaves across different architectures. Benchmarking tools provide quantitative performance measures, while profiling tools offer insights into software behavior, helping developers identify bottlenecks and areas that need optimization.
- Code Portability Libraries: In addition to libraries like OpenCL that enable software execution across diverse hardware, recent advancements in container technologies complement this capability. For example, enhancements in container device interfaces, such as those in SingularityCE, streamline the integration of hardware-specific resources. This development aids DevOps teams in optimizing software for various hardware without extensive codebase rewrites, exemplifying the tools supporting hardware diversity and software agility in all aspects of cognitive computing.
Of course, on top of all these tools and strategies, agile methodologies will remain essential since they prioritize iterative development, continuous feedback/improvement, and adaptability—all of which are important to fast-evolving hardware and software configurations.

Looking Ahead: Adaptability as the Key

As we embrace the new frontiers in AI and ML, the role of DevOps teams in navigating a constantly evolving hardware landscape becomes increasingly vital. At the heart of this journey lies the formidable challenge of application portability—a challenge that calls for technical expertise and a strategic shift toward adaptability. Enter containers emerging as indispensable tools that ensure a consistent application experience and performance across diverse platforms and handle the intricacies of portability.

Likewise, adopting agile methodologies transcends process adherence; it embodies a mindset of flexibility and responsiveness, essential in rapid technological shifts. These approaches, far from temporary fixes, are integral to a strategy that aims to unleash the potential of AI. As DevOps teams continue to navigate these challenges, their success will depend on their adaptability and willingness to explore and integrate established and emerging technologies—particularly those excelling in scalability and efficiency. This proactive exploration and integration will be the key to surviving and thriving in this dynamic technological landscape. And yet, while we have discussed this problem regarding scientific applications, the impact is also felt on the AIOps side of the house, using AI-specific hardware with AIOps practices. While our goal here was to discuss the complexities of creating and administering systems for artificial intelligence and machine learning, we have yet to approach the security conversation, particularly with confidential computing, which is a topic for another time. Happy computing.
February 16, 2024
Software Development in the Age of AI: How to Balance Quality and Speed

There’s no mistaking the reality of AI’s influence. Across industries, businesses are calling on tech workers to make the most of this transformative technology as demand skyrockets and companies race to overcome the competition. A flagging economy only pushes expectations for AI use—in software especially. To contend with arduous workloads, 92% of developers are already using AI code generators, according to GitHub. That’s an overwhelming majority, not to mention that this usage is poised to continue generating steam.

In light of this, we must ask ourselves a critical question: How can businesses ensure developers retain the quality of their AI-generated code? AI is a useful complement to human developers to maximize their time and allow them to focus on projects best suited to their skill sets. That said, companies have to put safeguards in place to harness the technology, not just for boosting developer productivity but also for quality outputs.

AI Can’t Replace Human Developers

AI code generators are a useful tool for a developer’s toolbox. Efficient, easy to use, and helpful (in a fairly rudimentary way in these early AI days), they give developers the ability to outsource some code-writing, which helps alleviate mounting demands as companies expect them to produce massive amounts of code — and fast. As most developers continue to buy into AI for productivity benefits, though, comes the responsibility to gut-check what these AI tools produce.

There are multiple limitations and risk considerations when it comes to AI-generating code. Lack of source knowledge and context is one of them. AI pulls from what it’s taught (i.e., past data, natural language processing, machine learning), meaning it combines too many sources to trace specific pieces of coding back to one place; it’s impossible to trace the code back to a single developer or project. Security, too, becomes an issue; you can’t guarantee that what is produced is safe or clean as is. And, finally, AI doesn’t check for quality, which increases the likelihood that the code will be difficult and costly to maintain. All this ladders up to the mounting technical debt companies are already contending with.

Developers can’t assume that any AI-generated code is of quality to be put directly into production. Human workers must review code thoroughly to ensure it meets clean code attributes–secure, reliable and maintainable. Ignoring these tenets puts businesses at risk of falling victim to the trillion-dollar cost of bad software. That said, there are still undeniable benefits to using AI in a coding environment that make it an invaluable tool for any company that wants to stay at the top of their software game.

Working Responsibly With AI in Software Development

Despite its potential shortcomings, when used safely and effectively alongside a clean code solution, AI brings a tremendous opportunity to the software space that has already made it a key tool for developers as their workloads and demands mount. For one, AI has the incredible ability to churn out code at a speed that far outpaces its human counterparts. This tech can complete tedious work that may take valuable time out of a developer’s day in a matter of seconds. AI can not only move a project forward at a faster rate, but its quick coding capabilities can also give developers a jump start on their projects and help them figure out where to begin.

While the source of AI’s knowledge base can present a challenge, the vastness of that knowledge is a benefit. As long as a developer can input their preferred language and their specific needs, AI can share the best approach to solving a problem. Its algorithmic assistance can help lead a developer through parts of their projects step by step. This also alleviates the burden of research from developers, who can spend less time checking for accuracy than they would trying to understand different programming concepts or code snippets outside their area of expertise. AI can also handle the slog of documentation, which can not only bring clarity to what didn’t work during the development process but reduce time to delivery overall.

Developers who don’t harness AI do so at the risk of falling behind the competition as this tech becomes such a vital piece of everyday work in software. But there’s no mistaking the fact that to best incorporate AI, developers still need to ensure its accuracy before any code generated by AI makes it to production.

GenAI Requires Automated Tools as Safeguards

As I previously said, developers can’t assume that any AI-generated code is clean and fit for production. That means human skills are still required to check the output. However, this kind of work can often fall to developers or DevOps, and having human workers check code on their own creates an incredible workload that can even negate the use of AI in the first place.

The best way for companies to mitigate this and mitigate technical debt is to implement automation in the part of the process that scans and monitors AI-generated code. But that can’t be done without developer buy-in. Those creating the software are the people who will best understand the development process as they work through it day in and day out, so their input is required to make the most out of automation.

There are developer tools that can handle this kind of work while still including developers in the process. For example, introducing code-scanning into the CI/CD process can not only help continuously monitor AI-generated code for bugs and issues, allowing developers to focus on other more challenging aspects of their projects, but it also gives them insight into errors and allows for speedier resolutions. These tools aren’t necessarily new to development, but their ability to identify bugs can help developers prioritize other aspects of the process, particularly as the amount of code reaches exponential levels compared to decades ago with the introduction of GenAI.

Static application security testing (SAST) also allows for the identification of security vulnerabilities that can potentially arise from AI-generated code. This is critical in the software development lifecycle (SDLC) so developers can spot vulnerabilities before the code goes into production. AI-generated code is only as strong or secure as that source, and since it’s not entirely possible to verify, developers need to take every precaution available to avoid security issues that rack up costs in the long term.

The vital part of using these tools is ensuring they’re integrated into the process in a way that makes sense for developers rather than creating additional work and headaches with a cumbersome process that doesn’t fit the way teams think and work. But, the need to check AI-generated code shouldn’t be underestimated. Developers can’t simply trust what they’re given. By including a level of automation within the development process—and doing so early and often—developers are in a position to produce better-quality, more secure software to push a business forward.

Effective Adoption of AI Will Encourage Business Growth

While it’s difficult to predict exactly where AI will take us in the years to come, it’s equally undeniable that it will play a critical part in the future of software development. Yes, AI is already helping to streamline processes and letting developers prioritize the tasks that best take advantage of their skills. But, as noted above, that doesn’t mean the code output is entirely safe, secure or accurate. Developers still need a level of automation to deliver code that best takes advantage of AI while keeping their workload manageable and their focus on other parts of the development process.

With the right guardrails in place, developers can guide AI to create the kind of clean, secure, and reliable code that aids businesses rather than create costly problems for them, both now and down the line. Human skills, with a boost from AI, plus code scanning safeguards, give organizations the winning combination to put themselves in the best possible place to succeed in a rapid, fierce competitive landscape of digital business.

February 16, 2024
ngrok Previews API Gateway Service to Streamline App Networking

Under an early access program, ngrok today made available an application programming interface (API) gateway that can be consumed as a service.

Rather than having to deploy, maintain, and secure API gateways themselves, application development teams, via a single command or function call, can now invoke a service through which they can route API traffic, authenticate and authorize access, and apply rate-limiting policies using an ngrok policy engine.

ngrok CEO Alan Shreve said this approach also makes it simpler for IT teams to unify ingress management at a time when application networking is becoming more challenging to manage. That approach also reduces friction because instead of being dependent on an IT operations team, it gives developers more direct control over APIs, he added. Today, most access to APIs is granted after developer first create a ticket request in an IT services management (ITSM) platform, noted Shreve.

In addition, the ngrok gateway also streamlines access to APIs spanning multiple clouds and on-premises IT environments in a way that enables organizations to implement a multi-cloud computing strategy, he added. Today, many organizations are locked into a single platform because they are dependent on the API gateway services provided by their cloud service provider, noted Shreve.

Finally, organizations will only need to pay for the API gateway service based on actual usage versus incurring the cost of acquiring a gateway upfront, said Shreve.

Previously, ngrok has been making available software development kits (SDKs) to provide programmable access to its API gateway. The as-a-service option being offered now is the next logical extension of that effort, noted Shreve.

In general, more infrastructure than ever is being consumed as a service, so making available an API gateway service is only the latest example of that larger trend, he added.

Each organization, based on total cost, will naturally need to decide when it makes the most economic sense to consume IT infrastructure as a service; however, as application networking continues to become more challenging to manage at a time when the number of IT professionals with that expertise remains limited. Relying on a service provides a viable alternative for managing what are often hundreds of APIs spanning a distributed computing environment.

It’s not clear yet precisely which teams within an IT organization are assuming responsibility for application networking, but as layer 4 through layer 7 of the networking stack become more programmable, more responsibility for networking can be assumed by DevOps and platform engineering teams. Existing networking teams, meanwhile, continue to manage the physical networking underlays used to route network traffic. Regardless of how application networking evolves, the rigidity that has characterized the delivery of network services is starting to fade away in a way that makes it possible to dynamically invoke networking services as needed.

IT teams must decide how best to approach application networking across legacy monolithic applications, microservices and event-driven applications. The goal, however, should be to eliminate as much friction as possible at a time when applications have become more dependent on networking services than ever.

February 15, 2024