devopsy.kinsta.cloud

Category: DevOps Practice

  • mabl Adds Load Testing Tool to Test Automation Suite

    mabl Adds Load Testing Tool to Test Automation Suite

    mabl today added a load testing capability to its portfolio of application testing tools that it makes available via a software-as-a-service (SaaS) platform.

    That capability promises to make it simpler to streamline testing within a DevOps workflow by making available load testing tools that measure application peformance alongside existing mabl tools accessible via a test automation platform.

    Dan Belcher, mabl CEO, said the goal is to make it simpler for developers to run functional and non-functional tests as early as possible within the software development life cycle.

    It’s not clear how much responsibility for testing is shifting left toward developers, but as it becomes simpler to run these tests it is more likely they will be run, noted Belcher. One of the core issues that plagues application development today is the inadequate level of testing. That issue is largely because it takes too much time to create and run relevant tests, he added.

    mabl streamlines that process using a test automation platform based on a low-code tool that makes it simpler to create and manage the testing process. Those tests can be configured to run independently or be integrated with a DevOps pipeline, noted Belcher.

    Shifting testing further left toward developers doesn’t eliminate the need for a dedicated team of testers, but it should reduce the number of routine errors being made. That reduction should free those development teams to focus more of their time and effort on more complex quality assurance (QA) issues, said Belcher.

    Of course, more testing processes will become automated as artificial intelligence (AI) continues to evolve, so most organizations will soon find themselves revamping those processes. In theory, SaaS platforms that aggregate testing data should be in a better position to apply AI models to testing. That’s critical because the pace at which even more complex applications are being built and deployed shows no sign of slowing down.

    In the meantime, DevOps teams should assume they will soon be held more accountable for security issues that arise after an application is deployed. It may be a while, but the number of legislative initiatives focused specifically on application security has increased; it’s only a matter of time before laws that hold organizations liable for security are going to be passed. At the same time, the level of tolerance application software consumers have for issues that arise because some trivial mistake led to, for example, a SQL injection attack, is dropping. The expectation is that application testing is soon going to be a lot more thorough than it has historically been.

    The issue, of course, is that too many development teams tend to view security requirements as obstacles to be overcome rather than as intrinsic elements of the QA process that is supposed to ensure expectations are consistently met and exceeded.

    At this juncture it’s clear that application testing is going to improve. The only thing left to determine now is how much friction will be experienced on the way to achieving that goal.

  • Honeycomb Taps ChatGPT to Simplify Observability

    Honeycomb Taps ChatGPT to Simplify Observability

    Honeycomb today added a Query Assistant to its observability platform that uses OpenAI’s ChatGPT generative artificial intelligence (AI) platform to launch queries via a natural language interface rather than having to master a query language.

    That capability complements an existing tool based on machine learning algorithms, dubbed BubbleUP, that DevOps teams already use to debug code.

    Honeycomb CTO Charity Majors said both tools make the Honeycomb observability platform more accessible to IT teams that are tasked with managing complex application environments. Those teams are not going to be able to accomplish that goal without relying more heavily on AI to determine the root causes of an issue.

    Generative AI augments DevOps teams by making it possible to build a relevant, modifiable query that they can continuously iterate as IT staff investigate an issue. This approach means teams don’t necessarily need a deep understanding of code behavior and the underlying infrastructure it depends on, noted Majors.

    That’s critical, because not every IT professional immediately knows what query to launch. One of the challenges with adopting any observability platform is they require a a DevOps team member to frame a query to generate a result. If multiple queries are required, coding them in a query language becomes a cumbersome task.

    As AI continues to improve, algorithms should be able to automatically surface more issues. But given all the dependencies that exist in modern application environments, there will still be a need for a DevOps specialist to ensure application availability and optimize performance, at least for the foreseeable future.

    In general, generative AI represents a significant leap forward compared to AI for IT operations (AIOps) platforms that, in comparison, are not nearly as useful, noted Majors.

    It’s still early days as far as measuring the impact AI will have on DevOps workflows. But the AI genie is already out of the proverbial bottle. Many of the low-level tasks that tend to make DevOps jobs tedious will soon be automated. As a result, job roles within DevOps teams will need to evolve.

    Less clear is what impact the rise of generative AI might have on the adoption of observability platforms. While there is no shortage of observability platforms, adoption has been limited by the number of DevOps professionals that could master a specific query language created for that observability platform. The ability to rely on a natural language interface instead reduces the need to use a proprietary query tool.

    In the longer term, the simpler it becomes to use DevOps best practices, the more widely they will be adopted. AI platforms should enable more organizations to embrace DevOps in a way that reduces the level of cognitive load currently required.

    In the meantime, there’s no doubt that current DevOps professionals are cautiously watching the rise of generative AI, much like everyone else. The difference is that most DevOps professionals are not going to want to work for organizations that don’t provide access to AI-infused tools and platforms that make their jobs easier.

  • How DevSecOps Addresses Supply Chain Security

    How DevSecOps Addresses Supply Chain Security

    “The absence of security in the initial stages of system engineering is the single most significant cybersecurity gap and risk in modern system development.” This quote from tech entrepreneur Linda Rawson is a good reminder for the current cybersecurity threat situation. With software supply chain attacks increasing in aggressiveness and sophistication, organizations need to understand that cybersecurity should no longer be an additional process, let alone an afterthought.

    Integrating security in the software development process provides a few other benefits, including better efficiency and customer satisfaction. However, its most notable benefit is addressing cybersecurity threats more effectively compared to the conventional ways of enabling software security.

    The Rise of DevSecOps

    DevSecOps is a fast-rising star in today’s search for effective cybersecurity solutions. The DevSecOps market is expected to be worth $23.63 billion in 2030, growing at a CAGR of 23.84% in the forecast period 2023-2030. Its value in 2022 was estimated at around $4.27 billion.

    This double-digit growth is actually a bit conservative. Other forecasts showed higher CAGRs in the 30% range. This growth hints at the strong demand for DevSecOps solutions. Many organizations have started to acknowledge the benefits of implementing security validation methods early in the software development life cycle (SDLC) instead of doing them in bulk as a separate phase at the end of the development process.

    Many organizations are now convinced that they can benefit from shifting left or bringing security into the SDLC earlier. Tools and solutions like static code analysis (SCA), automated dynamic analysis, interactive application security testing (IAST) and source composition analysis address security weaknesses before an application is released to the market. This allows organizations to release apps faster and, because of the elimination of most bugs and vulnerabilities, provide considerably better user experiences.

    Vulnerabilities will never be completely eliminated, but they can be significantly reduced and more properly resolved while software is being developed if security validation is integrated in the development process. Some software defects and weaknesses tend to be more difficult to address through a separate security testing process, since it would entail a broader code tracing or review as opposed to quickly spotting the affected code when security validation is done alongside the development process.

    Addressing Software Supply Chain Attacks

    So, how does DevSecOps help prevent supply chain attacks? The key is in the visibility and control DevSecOps affords.

    DevSecOps requires vigilance of security issues throughout the software development process. Security is not relegated to a different team that doesn’t understand the specifics of a development project. As such, the team has broad visibility over security concerns. Because the DevSecOps team also has mastery of the code being developed, it is easy to trace the origin of vulnerabilities and implement the necessary corrections.

    DevSecOps is aided by automated tools that scan code for security issues and detect threats even before they manifest themselves as problems. These tools are used across all phases of the development process, from the time code bears basic features and functions to deployment and post-production.

    Static testing: Even before an application’s code is ready to run, it can be subjected to static testing to find vulnerabilities. Tools such as static application security testing (SAST) can analyze code and detect possible security problems.

    How does this address software supply chain attacks? Static testing can be overlaid on automated CI/CD pipelines to stop code that has security weaknesses from getting committed to the codebase.

    Dynamic testing: An automated dynamic analysis can be used for code that is already executable. This is done through dynamic application security testing (DAST) tools, which are capable of detecting vulnerabilities usually invisible to SAST but which are detectable once the code is running.

    How does this address software supply chain attacks? Organizations can implement automated black-box testing for apps in the CI/CD pipeline(s) to detect security flaws for apps that are already executable. This addresses the vulnerabilities that have not been detected by static testing while reducing the costs associated with the corresponding remediation.

    Interactive app testing: This is a combination of static and dynamic testing. It employs IAST tools which run static testing on available code and come up with bespoke dynamic tests for a specific app to identify issues more thoroughly.

    How does this address software supply chain attacks? Pure static and dynamic testing usually apply to earlier stages of the development process, whereas interactive testing addresses vulnerabilities that emerge in the later parts. By bringing IAST to the CI/CD pipeline, organizations achieve better security issue detection outcomes, which means the prevention of malicious code deployment.

    Supply chain analysis: This entails the use of tools that specifically examine the security of third-party libraries and dependencies. To be clear, this is not the only method for addressing software supply chain vulnerabilities. In this case, supply chain merely refers to the external libraries, dependencies and other components that do not originate from the development team.

    How does this address software supply chain attacks? Integrating software chain analysis tools in the CI/CD pipeline significantly reduces the adverse effects of vulnerabilities in dependencies and other components on a project’s codebase as well as on the development process itself.

    Security-as-Code

    One of the best practices developed in line with the integration of security in the software development process is the idea of implementing security-as-code. This means that security policies and measures such as testing and validation are turned into code whenever possible. In other words, the code itself already bears security mechanisms. Security testing runs automatically whenever code is committed. This ensures robust, consistent, highly scalable security that does not rely on external rules and mechanisms to prevent the introduction of anomalous code or malicious inputs.

    Security-as-code also means that the DevSecOps team can see how modifications to code and the underlying infrastructure are created. The team can map out the impact of code changes and identify the areas where security tests and regulations can be implemented to optimize processes and avoid unnecessary delays.

    Security-as-code is essentially the automation of security practices. It is not applicable in all instances, though, so it is still important to be knowledgeable about security testing methods that can be used in different stages of the development process.

    Securing the Software Supply Chain

    The SUNBURST incident and other similar high-profile attacks should serve as a warning for all organizations to ascertain the security of their software supply chain. DevSecOps is one of the best solutions right now. It does not guarantee the complete elimination of all threats, but it ensures that if threat actors succeed in getting around security controls, a breach won’t go unnoticed.

     

  • GitLab Allies With Google to Bring AI to DevOps

    GitLab Allies With Google to Bring AI to DevOps

    GitLab extended its alliance with Google as part of an effort to bring more generative artificial intelligence (AI) capabilities to DevOps workflows.

    The GitLab suite of software-as-a-service (SaaS) applications already reside on the Google cloud platform to provide GitLab with the foundation of data required to train those AI models. Over the course of the last two months, GitLab has already added numerous capabilities that rely on multiple types of AI technologies.

    For example, there is now an experimental Explain This Vulnerability capability that provides a natural language summary of an issue in a way developers and cybersecurity teams can easily comprehend.

    Taylor McCaslin, a product group manager for data science and AI/machine learning for GitLab, said going forward, most of the AI focus is going to be on leveraging generative AI capabilities. Those capability will be enabled by Google using a large language model (LLM) that GitLab developed for DevOps workflows. That approach enables GitLab to surface more accurate recommendations based on validated data compared to the general purpose LLM that was used to create the ChatGPT service.

    In addition, GitLab can continuously update the AI models it is running on the Google Vertex AI cloud service using the data from its SaaS application environment which is continuously monitored and updated, McCaslin noted.

    It’s not clear what impact AI may have DevOps workflows, but GitLab is forecasting a 10x improvement. That will be accomplished by, for example, surfacing code that can be used to remediate a vulnerability. Today, many vulnerabilities are not addressed simply because developers don’t have enough time to write a patch.

    A recent GitLab survey, however, suggested developers are already embracing AI to improve productivity, with 62% of developers using AI and machine learning algorithms to check code. More than a third (36%) also rely on AI and machine learning algorithms to review code.

    At this juncture, the one thing that is certain is AI and other associated technologies are going to make developers more productive. It’s not nearly as apparent what impact increased amounts of code moving simultaneously through DevOps pipelines is going to have on the software engineers that manage those processes. The expectation is that similar types of AI advances will also enable more code to flow through those pipelines without, hopefully, further exacerbating any existing bottlenecks that might exist.

    In the meantime, it’s clear the AI genie is out of the bottle. There will soon be more LLMs for all kinds of tasks. DevOps teams should start planning today based on the assumption that many manual tasks that conspire to make software engineering tedious are going to fade away. As such, the roles with a DevOps team are going to change and evolve. The assumption those DevOps teams should make is that these changes will be for the better. After all, the reason organizations embraced DevOps in the first place was to ruthlessly automate IT processes—AI is simply the latest iteration of that commitment.

  • Survey: Most Open Source Software Maintainers Want to Get Paid

    Survey: Most Open Source Software Maintainers Want to Get Paid

    A survey of 339 maintainers of open source software projects found 60% of them classified themselves as unpaid hobbyists versus only 13% who said they earn most or all of their income from maintaining projects. Slightly less than a quarter (23%) described themselves as semi-professionals, earning some of their income from maintaining projects. Overall, more than three-quarters of unpaid maintainers (77%) would prefer to be paid for their efforts.

    The survey was conducted by Tidelift, a provider of a platform for managing open source software use, and found there is a clear correlation between getting paid and the amount of time spent actually maintaining a project. A full 81% of professional maintainers spend more than 20 hours per week maintaining their projects, compared to 27% of semi-professional maintainers and only 7% of unpaid hobbyist maintainers, the survey finds.

    In fact, paid maintainers are much more likely to have reproducible and verifiable build processes (77%), formal backward compatibility policy (71%), a security disclosure plan (69%), provide fixes and recommendations for vulnerabilities (69%) and have a defined dependency management process (57%).

    Unfortunately, the survey also made it clear that more than half of maintainers of open source software projects (52%) are not even aware of emerging frameworks to better secure software.

    On the plus side, however, the survey also found that among maintainers that are aware of those frameworks 43% have already begun work to align with them or plan to start within the next year. Alas, 39% said they have no plans to align to these industry standards, while another 19% are still on the fence. Well over one-third of maintainers (38%) who do not plan to align their projects with industry standards said they just don’t have the time, while 37% won’t do it because they are not being paid for the work.

    Nearly half of maintainers (47%) want to be paid for undertaking the work needed to align their projects with the security frameworks, with 54% of maintainers noting they would appreciate help that would enable them to better understand these frameworks and how they apply to their project.

    Tidelift CEO Donald Fischer said as more organizations are concerned about the security of the open source software used across software supply chains, the survey makes it clear that maintainers need some sort of financial compensation to make it worth their time and effort to address vulnerabilities in a timely manner. That’s especially critical, especially as legislation is pending that would hold software developers more liable for vulnerabilities in software. In the absence of being paid to more proactively address vulnerabilities, many open source software maintainers may abandon projects altogether because of liability concerns.

    It’s not clear to how enterprise IT organizations are evaluating which open source projects developers can use based on the level of support made available. What is clear is that not all open source software is created and supported equally well. Of course, many of the organizations benefitting from open source software could be doing a lot more—not just in terms of financial support, but also helping with everything from identifying vulnerabilities and testing patches to simply writing better documentation.

  • Breaking Down Silos: Applying Open Source Practices in the Workplace

    Breaking Down Silos: Applying Open Source Practices in the Workplace

    DevOps plays a prominent role in mainstream technology and companies’ ability to deliver results. While the definition of DevOps encompasses the complete range of characteristics it covers, in practice, current tech culture tends to focus solely on the tooling aspect, neglecting the equally essential focus on the people and process critical in delivering value to end users. While cultures are difficult to change and redefine, a transformation is needed to fully capitalize on the potential DevOps has to accelerate software development.

    Conway’s law–the concept that organizations ship software based on their organizational structure–outlines the need for visibility. This law revolves around the idea that in order for a software product to successfully operate, its developers must have established open pathways of communication to ensure each component works as a whole rather than as individual pieces. Unfortunately, today, many organizations still run into problems with how their teams operate when individuals own limited pieces of development.

    Take a retail platform, for example. In the development of the platform, there will likely be several sub-teams that focus on individual components of the design. Perhaps there’s a team for the shopping cart service, another for the catalog service, a team for the underlying data platform and one for user account services. The list goes on. Typically, those teams do not have visibility into each other’s work and operate in their own silo. As soon as teams start thinking about ‘their’ component or ‘their’ microservice, a dangerous tunnel-vision takes hold. In some cases, there may be standup meetings across teams for coordination efforts, but this takes time, energy and steals focus from the important task: Delivering value to end users.

    Alternatively, think about your favorite open source project. The inner workings were likely  designed asynchronously, openly, remotely and at a global scale. Given the remote nature of open source innovation, developer teams don’t need to be co-located in the same workspace. While physically operating separately, open source developers have mastered alternative methods to operate with transparency in such a way that external contributions aren’t just welcome, but encouraged.

    This same idea applies to proprietary software development, or InnerSource, a modern engineering approach that applies open source practices inside your organization to proprietary code. While a technological shift in practice, InnerSourcing is also a cultural revolution toward collaboration.

    Companies of all types can benefit from implementing InnerSource practices. Some enterprise organizations that operate using InnerSource methodologies today include 3M, Ford, KPMG, Mercedes-Benz, Nubank, Spotify and more.    

    A critical component in making this change is prioritizing team visibility. If other teams in your organization are unable to see what you’re working on, you’re inherently (intentionally or not) creating silos and limiting efficient collaboration. In practice, there will be scenarios where company-wide visibility may not be feasible due to external regulations, highly secure environments or sensitive projects; however, these moments of limited project visibility should be the exception rather than the default.

    When approaching InnerSource through an open source mindset, you will find that many DevOps principles still hold true. Here are a few strategies for implementing a collaborative open source culture when developing proprietary code:

    1. Use existing resources: When problem solving, using the existing materials available within your organization is a great place to start—it is possible someone has already tackled the issue you are addressing. If you find the right fit, you can reuse prior work and, if it has not been started, this is an opportunity to add value to your organization by creating a project that could help others in the future. When building upon someone’s work or starting a project, prioritizing visibility by providing an explanation of any technical requirements of the change will allow future project maintainers to determine whether it’s in the project scope, already a proposed change, on the backlog, or not a prioritized piece of work. This use of existing resources will help develop a collaborative culture over time.
    2. Documentation of work: Documentation is critical. Keeping track of the expected standards of the project and which tools or dependencies are required to build the project for local testing will help others in your organization know what to contribute. When in the early stages of contributing code to a project, documenting proposed changes without directly impacting the production version will allow you to receive feedback early on from the project maintainer about the direction you should take as they will be able to see your steps clearly outlined. To contribute code to a project, you can propose changes as a pull request, which doesn’t impact the production version but means you can get valuable feedback on the direction the project should take. Handling contributions by a pull request also ensures that branch protection rules apply and continuous integration practices are required.

    While implementing these practices may not result in immediate changes, over time they will result in a significant cultural shift. And while cultural transformations require continued conscious efforts, embracing modern software engineering practices–learned from the open source community–will enable teams to break barriers for organizational collaboration.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    LinkedIn

    SiriusXM
    Associate Director for Software Delivery
    Deerfield Beach, Florida
    $157,000 or $250,000

    SimplyHired

    Nagarro
    Remote
    Senior Staff Engineer – DevOps
    $155,000 to $196,000

    Dice.com

    Engage Partners
    Davie, Florida
    DevOps Architect
    $130,000 to $160,000

    Indeed.com

    ServiceNow
    Orlando, Florida
    Staff DevSecOps Engineer
    $114,000 to $144,000

    Monster.com

    Swift Group
    Fort Belvoir, Virginia
    DevOps Engineer
    $80,000 to $180,000

  • Mezmo Adds Free Community Plan for Managing Observability Data

    Mezmo Adds Free Community Plan for Managing Observability Data

    Mezmo this week added a free trial and a community plan for the Mezmo Telemetry Pipeline service to make it simpler for DevOps teams to store and manage the large amounts of telemetry data they are collecting.

    Mezmo CEO Tucker Callaway said as more DevOps teams embrace observability to minimize disruptions to application environments, they are struggling to manage the explosion of data being created. The Mezmo platform makes it possible to apply data engineering best practices to manage that data using a set of drag-and-drop visual tools, he added. A set of data transformation tools also makes it simpler to extract metrics embedded in the logs, summarize events and metrics and then forward those metrics to downstream platforms for analysis.

    The free edition of the platform makes it possible for organizations to begin to apply those capabilities without any upfront costs required, noted Callaway.

    It’s not clear to what degree DevOps teams may need to add data engineering to manage all the telemetry data being collected. It’s already apparent that the cost of storing and managing all that data is becoming a significant issue as more applications are instrumented. In fact, it’s nearly impossible to manage cloud-native applications without being able to observe interactions between the microservices used to construct them.

    Log management has always been a challenge, but with the addition of traces, the amount of telemetry data being collected to surface metrics has increased. The Mezmo platform makes it possible to set a daily or monthly hard limit on the volume of logs stored or, alternatively, set soft daily or monthly quotas that can apply throttling logic to ensure mission-critical log data will continue to flow.

    DevOps teams can also make use of soft limits to reallocate storage resources from one team to another based on how much log data might be generated for a specific amount of time.

    Reducing storage costs has naturally become a higher priority during challenging economic times, so there’s a lot more pressure for DevOps teams to be more efficient. Finance teams are reducing costs by, for example, applying quotas to the amount of storage resources being made available to individual DevOps teams. The days when cloud storage resources were made available indiscriminately are over.

    It’s not clear how quickly DevOps teams are embracing observability, but it is certain that relying on predefined metrics to monitor IT environments is no longer sufficient. DevOps teams need to be able to query telemetry data to, for example, identify bottlenecks that are often created by dependencies between microservices. The issue is striking a balance between the amount of data being collected and the cost of storing it all.

    Regardless of approach, observability is rapidly becoming a requirement for DevOps teams to succeed. In fact, there is already no shortage of observability platforms to choose from. The issue is that not every observability platform provider is equally concerned about the cost of storing all the data being collected.

  • Loosely Couple Your Schema and Keep Data Separate

    Loosely Couple Your Schema and Keep Data Separate

    In software development, one of the primary goals is to write clean, maintainable and extensible code. To achieve this, developers often strive to design systems that are loosely coupled and separate concerns into smaller, more manageable components. Loose coupling refers to the practice of designing components that are not tightly dependent on one another, allowing them to be modified or replaced without affecting the rest of the system. Separating data into distinct layers, such as a database layer, further contributes to this modularity by allowing developers to focus on writing business logic without worrying about data management. Together, loose coupling and data separation provide a solid foundation for building scalable and adaptable systems that enable developers to concentrate on writing high-quality business logic. This approach also lends itself to platform engineering best practices, a popular methodology that is being implemented or considered by developer teams today.

    Loose coupling is an important concept in microservices architecture because it helps to achieve the goal of creating modular, scalable and easily maintainable software systems. In a microservices architecture, individual services are designed to be independent, self-contained and loosely coupled, meaning they can be changed, updated or replaced without affecting other services or the system as a whole.

    There are several benefits to loose coupling in microservices:

    • Scalability: Microservices architecture allows scaling of individual services independently based on their needs, and with loose coupling, the interdependencies between services are minimized, allowing for better scalability.

    • Maintainability: With loose coupling, it’s easier to make changes to individual services without disrupting the system as a whole, reducing the risk of introducing bugs and making maintenance tasks easier to perform.

    • Flexibility: With a loosely coupled architecture, services can be developed, tested and deployed independently, enabling teams to work in parallel and make changes to the system without impacting each other.

    Platform engineering plays a crucial role in ensuring that microservices are loosely coupled. A well-designed platform should provide a standardized set of APIs, protocols and interfaces for service communication, as well as tools and frameworks for building, testing, deploying and managing services. This enables service teams to focus on developing their services rather than worrying about the underlying infrastructure and communication protocols.

    Moreover, platform engineering can also ensure that there is a standardized and centralized approach to security, monitoring and logging, which are critical aspects of microservices architecture. By providing a consistent and standardized approach to these areas, platform engineering can help ensure that individual services remain loosely coupled and can evolve independently, without negatively affecting the system as a whole.

    It’s All About Keeping the Schema Separate

    In platform engineering, the concept of keeping the schema separate typically refers to separating the schema of a database or data store from the application code that interacts with it. This separation allows for greater flexibility and scalability in the platform, as changes to the schema can be made independently of the application logic. By decoupling the schema from the application code, developers can avoid introducing breaking changes to the platform, and can more easily evolve and scale the platform over time.

    Separating the schema also allows for different parts of the platform to interact with the same data store using their own specialized schemas, without interfering with each other. This is particularly important in large and complex systems, where different teams may be working on different parts of the platform concurrently. By keeping the schema separate, teams can work independently and avoid stepping on each other’s toes, while still interacting with the same underlying data store.

    In summary, it’s all about the schema – don’t share databases and tables. The separation of data is fundamentally driven by that desire for loose coupling. Microservices should be as independent as possible from each other from design to development to production. Why? Efficiency. Disparate teams can change data structures and will not affect others versus the more traditional approach where we do share and it’s more cumbersome and involves more coordination between teams.

    Keeping schema separate in platform engineering is important for several reasons:

    ● Scalability: Each microservice owns its private schema, which enables the platform as a whole to scale more effectively. As the platform grows and evolves, it may become necessary to change the data schema without necessarily changing the underlying code. Separating the schema makes it easier to make these changes without disrupting the rest of the platform.

    ● Maintenance: Separating schema from code makes maintenance easier. It allows developers to make changes to the schema without needing to change the code, which reduces the risk of introducing bugs or errors.

    ● Collaboration: Separating schema from code makes it easier for multiple developers to work on the platform at the same time. When developers work on the code and schema separately, they can work independently without interfering with each other’s work.

    ● Flexibility: Separating schema from code provides greater flexibility for integrating with other systems or applications. It enables the platform to adapt to changing requirements or to interface with different data sources more easily.

    Separating Schema From Code is an Essential Practice

    By hiding data from service components from other service components, It provides guardrails and “just works.” While it does provide a form of coupling, it’s through messaging (typically asynchronous). Platform engineering encourages good design patterns from the start versus having to be more aware of these things. It’s a lot easier for especially newer developers that are not familiar with some of these architectural patterns and can get themselves into trouble.

    Overall, separating schema from code is an essential practice in platform engineering that provides scalability, maintenance, collaboration and flexibility benefits. It allows developers to build more robust and flexible platforms that can adapt to changing business requirements and technical environments.

  • Majority of Organizations Report Benefits From Low-Code Platforms

    Majority of Organizations Report Benefits From Low-Code Platforms

    Some IT departments are feeling the strain amid recent economic downturns. 2023 has already seen a disproportionately high degree of layoffs in the tech sector. As a result, there aren’t always enough software developers available to meet the demand. This has led some organizations to turn to new ways to upkeep morale and reduce burnout, retain productivity and do more with less.

    Low-code development is one solution that could help tackle rising application backlogs. Low-code/no-code platforms use reusable components to help engineers (and citizen developers) construct functional applications and internal workflows. Many teams report they are using low-code to rapidly deliver new features. A recent study from Microsoft found that 89% of CIOs and IT pros said low-code is effective in increasing efficiency.

    Microsoft Power Platform recently sponsored a study that surveyed 2,000 IT CIOs and IT professionals on their use of low-code platforms. According to the report, users benefitted from these platforms by modernizing legacy IT, improving efficiency and reducing costs, among other areas. Below, I’ll review some key takeaways from the Microsoft study and compare them with other perspectives.

    The Benefits of Low-Code Development

    The report showcased a slew of benefits from the use of low-code platforms. One is modernizing legacy applications—87% of CIOs and IT pros said low-code is very useful in helping their organizations modernize legacy applications. Solving the technical debt issue is top-of-mind, since 69% of IT leaders identified technical debt as a threat to innovation. Another key benefit is efficiency. The study found that developer efficiency with these platforms significantly increases over time, averaging 62% over three years.

    Low-code platforms are also a prime area to insert artificial intelligence and more automation into the software development process. Microsoft, which recently announced it was integrating ChatGPT into its Power Platform, reported that 87% of CIOs and IT pros said increased AI and automation embedded into low-code platforms would help them better use the full set of capabilities.

    Finally, a significant benefit is cost reduction. A full 87% of those surveyed said low-code is effective in helping reduce costs. These solutions could accelerate the completion of the software backlog, increasing efficiency and lowering the resources required to deliver. This comes at a time when cost optimization is critical to avoid rising cloud fees.

    How Are Companies Working With Low-Code?

    So, how are development teams actually working with these platforms? One common use case is improving data processes by streamlining integrations and having a centralized repository. In fact, 86% of CIOs and IT pros said low-code helped their organizations generate more accurate insights from their data. These data-driven insights have been used to help better serve customers and internal stakeholders.

    For example, ÖBB, an Austrian rail operator, leveraged a low-code platform to synchronize data and automate customer service inquiries with virtual agents. Other case studies report using Microsoft Power Platform for migration from legacy systems and reduced document processing lead time.

    Looking outside of the Microsoft report, however, not everyone is fully on board the low-code bandwagon. For example, the CEO of StackOverflow has expressed reservations because low-code platforms ultimately have a ceiling. With low-code, there’s a limit on customization, making it a less-than-ideal fit for experienced developers or technology-specific companies. Organizations must also mitigate the potential security repercussions of allowing business users to create applications, requiring new governance and policies. Low-code platform users may also fall victim to vendor lock-in and uneasy data retrieval—underscoring the need for open platforms with programmatic access.

    The Advantages of Low-Code Platforms

    Low-code solutions are a viable option to help clear items from the IT backlog, automate tedious processes and free up engineers to focus on more pressing matters. Some low-code/no-code tools also help democratize application development to those with different skill sets, thus bringing in new users to the development arena. And interest in low-code continues to pick up—Markets and Markets forecast a compound annual growth rate (CAGR) in the low-code development industry platform market of 28.1% to reach $45.5 billion by 2025.

    Naturally, the findings and case studies in this particular report are a bit skewed toward the benefits of using the Microsoft Power Platform. Nonetheless, it serves as an indication of the various advantages of low-code platforms. For more insights, you can read the full report here on the Microsoft Power Platform blog.