devopsy.kinsta.cloud

Category: DevOps Toolbox

  • Hasura Unfurls Data Delivery Network Based on GraphQL

    Hasura Unfurls Data Delivery Network Based on GraphQL

    At its HasuraCon 2023 conference today, Hasura launched a Data Delivery Network (DDN) based on a set of GraphQL application programming interfaces (APIs) that makes it simpler to integrate distributed sources of data.

    In addition, Hasura is adding Hasura Schema Registry to streamline API governance using graph technology, a MongoDB connector, a Native Data Collector (NDC) for REST APIs and support for the Open Domain Data Specification (OpenDDS), an open framework for modeling APIs originally developed for the travel industry.

    Finally, Hasura is adding support for Native Queries and Logical Models capabilities that convert SQL requests into API calls.

    The Hasura DDN leverages the GraphQL API to enable sub-second integrations across a network that, in concept, is similar to how a content delivery network (CDN) is constructed.

    Hasura CEO Tanmai Gopal said the goal is to enable sub-second integration of data at a global scale across a network with more than 100 regions. Developers can integrate their APIs in less than a second regardless of the number of data models connected. Metadata changes can also be used to create builds that can be independently tested and applied to projects to enable API version control and collaboration among development teams.

    The Hasura DDN is accessed via Hasura Cloud, an instance of a data integration platform that can be deployed on multiple clouds, including Microsoft Azure, and will soon be made available for private clouds managed by internal IT teams.

    GraphQL is gaining traction as an alternative to REST APIs for integrating data, but it’s more complex to implement and manage. The Hasura DDN extends the reach of a Hasura Cloud platform that provides a simpler method for adding GraphQL capabilities to an IT environment in a way the also conserves network bandwidth, noted Gopal.

    GraphQL is a query language for APIs and a runtime for fulfilling queries that provides a complete and digestible description of the data in an API. It can also be used to pull data from multiple sources because it uses a schema that defines the different types of data available. REST APIs, in contrast, can only fetch data from a single source. As such, many organizations that are trying to drive adoption of reusable digital services are relying on GraphQL.

    It’s not always clear who within an organization is assuming responsibility for managing the APIs that developers create, but as the number of APIs increases, DevOps teams, in many cases, are moving to centralize API management. In fact, the more data an organization creates, the greater the corresponding use of APIs to programmatically access that data becomes.

    Hasura is betting that as organizations reach a critical mass of API integration requirements, it will make more economic sense to rely on a purpose-built data integration platform accessed as a cloud service versus relying on a set of tools and platforms they need to configure and manage. Regardless of approach, the one thing that is certain is the number and types of APIs that need to be managed are rapidly exceeding the ability of IT teams to keep pace.

  • System Initiative Employs Modeling to Reinvent DevOps

    System Initiative Employs Modeling to Reinvent DevOps

    System Initiative (SI) today made available in private beta a platform that creates simulations of IT environments. The platform leverages a built-in framework to generate the code needed to update an application environment.

    Fresh from raising $18 million in funding, SI CEO Adam Jacob said the ultimate goal is to provide a level of abstraction for DevOps environment that eliminates much of the complexity that creates bottlenecks in DevOps workflows.

    For all intents and purposes, DevOps is fundamentally broken; there are too many manual processes that need to be performed, he added. The SI platform represents an ambitious effort to reimagine how DevOps processes are constructed and maintained, said Jacob.

    At the core of that effort are models of IT environments created by the SI platform that are accessed via visual interface. The automation framework built into the platform then uses the relationships between models to infer configuration dynamically and then automatically generate TypeScript code that a DevOps team can apply to automate a task.

    Feedback loops are also provided in real time to provide insight into the viability of a configuration and eliminate the need for no state files to track and no ‘plan’ versus ‘apply’ stages.

    As more organizations realize how dependent they are on software to drive digital processes, many of them are looking to improve the productivity of developers and the DevOps teams that support them. After a wave of initial progress, many DevOps teams find themselves supporting DevOps workflows using custom code that varies widely in quality. SI is making a case for a digital twin platform that generates a set of code that can be applied more consistently, rather than relying on a DevOps engineer to write code.

    Ultimately, the goal is to launch a new DevOps era to eliminate most of the silos that slow down application development and deployment, noted Jacob. In fact, one of the reasons few organizations today fully automated DevOps across the application development and deployment process is that it’s simply too difficult to achieve using legacy tools and DevOps platforms, he added.

    A recent survey conducted by the Continuous Delivery Foundation (CDF), for example, found only 22% of respondents are using CI and CD approaches to automate all building, testing and deployment of code in a production environment. Instead, many organizations are using a combination of DevOps and waterfall processes to manage application development and deployment.

    It’s not clear how many organizations are willing to fundamentally change the way they have implemented DevOps. But at a time when more organizations are moving to centralize the management of DevOps, many of them are evaluating their options, at the very least. The issue, of course, is that multiple DevOps teams within the same organization have committed to disparate platforms. Enticing them to centralize on a common platform will require not just a compelling technical advantage but also a significant amount of political capital.

  • Quali Adds Governance and Cloud Cost Control Tools to Automation Platform

    Quali Adds Governance and Cloud Cost Control Tools to Automation Platform

    Quali today revealed it added governance and cloud cost management tools to its Torque platform for automating IT infrastructure management.

    David Williams, senior vice president for market strategy at Quali, said the added governance tools will make it possible to enforce security, compliance and consumption policies as IT environments are launched using the automation blueprints that Torque enables IT teams to create.

    At the same time, IT teams can now also define consumption policies based on cloud runtime or regions employed within a cloud computing environment. In addition to taking advantage of dashboards to visualize consumption of cloud resources, IT teams can also use Torque to identify cloud waste including detached, inactive and overprovisioned instances. They can pause, right-size or tear down environments to reduce costs and eliminate the possibility of a billing surprise at the end of the month, noted Williams.

    Torque also enables IT teams to detect drift and then update live cloud environments to remediate any that fall out of scope, he added.

    Quali has been making a case for an environment-as-a-service approach to managing IT. That approach is based on a set of triggers for controlling infrastructure via a software-as-a-service (SaaS) platform that can be invoked either via an application programming interface (API) or a graphical user interface (GUI).

    In addition to providing a set of infrastructure provisioning guardrails that prevent mistakes from being made, Torque makes it possible to automatically deploy complete application environments on top of infrastructure provisioned as code using blueprints rather than relying on low-level Terraform scripts. The goal is to increase developer productivity by enabling IT teams to create self-service portals that developers can use to spin up environments.

    That approach is becoming more appealing as many organizations begin to adopt platform engineering as a method to centralize the management of DevOps workflows, noted Williams. In fact, as part of that effort, many organizations are starting to unify the management of cloud and on-premises IT environments, he added.

    While many developers routinely provision IT infrastructure using tools such as Terraform, many of them lack the cybersecurity expertise required to ensure cloud computing environments are configured properly. Developers also tend not to remember to de-provision cloud resources when no longer needed; over time, those factors contribute to unnecessarily increased cloud costs.

    Ultimately, the goal is to find ways to centrally manage IT environments to reduce costs and improve cybersecurity without inhibiting the pace at which developers are building innovative applications, said Williams.

    At the same time, as application environments become more complex, it is becoming even more challenging to provision and manage IT environments at a time when many organizations are reluctant to hire additional IT staff, he noted.

    One way or another, IT environments will become more automated. The issue is determining how best to organize the IT teams managing those environments as tasks that once required a lot of manual effort are increasingly automated.

  • Revolutionizing DevOps Culture Transformations With AI-Engineered Tools

    Revolutionizing DevOps Culture Transformations With AI-Engineered Tools

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that DevOps thrives in a culture of openness, transparency and shared responsibility. It’s about breaking down the silos that can exist between different teams (like development, operations, security and QA) and promoting effective communication and collaboration. AI-powered tools can improve collaboration through smart recommendations, fostering more effective communication and knowledge sharing.

    Collaboration and Communication: AI-powered chatbots can facilitate quick and easy communication across teams, enabling faster decision-making and problem-solving. AI-powered project management tools can improve visibility into tasks and dependencies, promoting better coordination among team members.

    Continuous Learning and Improvement: AI-based monitoring tools can help teams learn about system performance in real-time, identifying trends and patterns that can inform better decision-making. AI can also help in creating personalized learning experiences, identifying skills gaps and suggesting relevant training resources, promoting a culture of continuous learning.

    Shared Responsibility and Ownership: AI can improve visibility into the system’s state, helping all team members understand how their work contributes to overall system performance. This can promote a sense of shared ownership and responsibility. AI can also assist in automating the allocation of tasks based on an individual’s skills and availability, promoting a more equitable distribution of responsibilities.

    Automation and Efficiency: AI is pivotal in automating routine tasks, such as testing, deployment and monitoring. This can significantly improve efficiency and allow teams to focus on strategic, high-value tasks. AI can also help automate the detection and resolution of common issues, reducing downtime and improving system reliability.

    Feedback and Adaptability: AI-powered analytics tools can provide real-time feedback on system performance, enabling teams to quickly adapt their approach as needed. AI can also help in analyzing customer feedback and identifying key themes and sentiments that can inform product development.

    Risk-Taking and Innovation: AI can help simulate the potential impacts of different decisions, allowing teams to take calculated risks. AI can also drive innovation by helping teams identify new opportunities, predict trends and develop more creative solutions.

    Roadmap to AI-Assisted DevOps Culture

    A practical roadmap for transforming an organization’s DevOps culture using AI-engineered tools may look something like this:

    1. Define Goals and Evaluate the Current State: Identify what you want to achieve by integrating AI into your DevOps practices. This could be improving deployment times, reducing errors, increasing productivity and more. Evaluate your current DevOps practices and tools to understand where AI could bring the most value.

    2. Identify AI Opportunities and Select Tools: Look for areas where AI can enhance collaboration and communication. This could involve AI-powered chatbots for team communication or project management tools with AI capabilities. Identify opportunities for AI to support continuous learning and improvement. AI-powered analytics and monitoring tools can provide valuable insights for this. Determine where AI can help promote shared responsibility and ownership. AI-enabled visibility tools can assist here, too.

    Choose areas for AI-powered automation. This could include tasks like testing, deployment and issue resolution. Find avenues where AI can support feedback and adaptability. Tools that analyze system performance or customer feedback could be helpful here. Pinpoint where AI can assist in risk-taking and innovation. AI-powered simulation or predictive analytics tools could be useful.

    3. Implement AI Tools Gradually: Start by integrating AI tools into one or two areas of your DevOps process. Monitor the impact to ensure you’re driving the desired improvements. Gradually expand the use of AI tools to other areas of your DevOps practices.

    4. Train Teams on AI Tools: Provide adequate training to your teams so they can use these new AI tools effectively. Encourage a culture of learning and experimentation to help teams become comfortable with AI.

    5. Monitor and Adapt: Regularly monitor the impact of these AI tools on your DevOps practices. Are they improving speed, reducing errors, enhancing collaboration, etc.? Be prepared to adapt your approach based on the feedback and results you’re seeing. The integration of AI is a journey, not a one-time event.

    6. Continuously Improve: Continually look for new ways that AI can enhance your DevOps practices. AI is a rapidly evolving field, and new opportunities are emerging all the time. Remember that this roadmap is iterative and adaptive. AI integration should be seen as a part of the broader DevOps goal of continuous improvement.

    Benefits for Organizations, Teams and Individuals

    With the integration of AI-engineered tools into DevOps processes, organizations can expect significant improvements in efficiency, speed and quality. AI automation can drastically reduce manual, repetitive tasks, thereby lowering the chance of errors and freeing up resources for more strategic endeavors. This can lead to cost savings and a better allocation of resources. Additionally, AI can enable faster decision-making and problem-solving, accelerating the software development life cycle and making the organization more competitive. AI can also enhance product quality by providing valuable insights and analytics, enabling continual improvement.

    For Teams: AI can facilitate improved collaboration and communication, making workflows more seamless and efficient. AI-powered project management tools can provide better visibility into tasks, dependencies and progress, enabling smoother coordination. AI can also automate routine tasks, freeing up team members to focus on more challenging, high-value work. Additionally, AI can provide real-time feedback and insights, enabling teams to continuously learn and improve their processes. These improvements can lead to higher job satisfaction and productivity.

    For Individuals: Individuals stand to gain from AI integration in several ways. AI-powered tools can support skill development by helping individuals learn new technologies and best practices. Real-time feedback and insights can also foster personal improvement. Automation of routine tasks allows individuals to focus more on creative and strategic aspects of their work, leading to a more engaging and satisfying job experience. Furthermore, being part of an AI-driven DevOps environment can open opportunities for individuals to work on cutting-edge technologies and innovative projects, enhancing their career prospects.

    Measuring Success

    Choosing the right metrics is crucial for measuring the progress of your DevOps culture transformation with AI-engineered tools. Here are some important metrics to consider:

    Deployment frequency: This is a measure of how often new features, bug fixes or updates are deployed. An increase in deployment frequency can be a sign that AI tools are improving efficiency.
    Lead time for changes: This metric refers to the amount of time it takes from code being committed to it being deployed. AI tools can help to reduce this time by automating testing and deployment processes.
    Change failure rate: This is the percentage of changes that result in a failure or that require a rollback or hotfix. AI can help reduce this rate by improving testing accuracy and identifying potential issues earlier in the development process.
    Mean-time-to-recovery (MTTR): This is the average time it takes to recover from a failure. AI tools can help to reduce MTTR by quickly identifying the cause of failures and automating the recovery process.
    Customer satisfaction: AI can help improve the quality and reliability of the product, leading to increased customer satisfaction. Customer satisfaction can be measured using surveys or net promoter score (NPS).
    Efficiency metrics: Look at how much manual, repetitive work has been reduced by automation. This could be measured in terms of man-hours saved.
    Learning and development: Monitor the upskilling of your teams to using AI tools and technologies. This could be tracked through training completion rates, skill assessments, etc.
    Innovation rate: AI can free up teams to focus on innovation. Measure the number of new ideas or features being developed over time.

    Summary

    To transform DevOps culture with AI tools, organizations must set clear goals, identify AI opportunities, gradually implement those tools and monitor their impact. Training teams to use AI tools effectively and fostering a culture of continuous learning and improvement will enable this transformation and help DevOps teams thrive. This integration can significantly enhance efficiency, decision-making speed and product quality at an organizational level.

    On a team level, AI can streamline collaboration, automate routine tasks and provide real-time insights for continuous process improvement. For individuals, this transformation provides opportunities for skill development, personal growth and more satisfying job experiences. Monitoring progress with metrics like deployment frequency, lead time for changes, change failure rate, mean-time-to-recovery (MTTR), customer satisfaction, efficiency, learning and development and innovation rate ensures the transformation is delivering the expected benefits and contributing to continuous improvement.

  • Unleashing the Power of AI-Engineered DevSecOps

    Unleashing the Power of AI-Engineered DevSecOps

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that AI-engineered tools can help implement the portion of continuous security practices known as DevSecOps.

    DevSecOps involves integrating security practices into the DevOps workflow. AI can be used in anomaly detection to identify potential security threats and to automate security policy enforcement. AI-engineered tools have the potential to significantly enhance security across all phases of the software value stream in DevSecOps.

    Planning: The planning stage involves dealing with complexities related to risk analysis and threat modeling. AI can help automate risk analysis and threat modeling based on data from past projects and known security issues. This can help identify potential security threats early in the planning phase and develop appropriate mitigation strategies.

    Design and Development (prior to integration): Developers often face difficulties in writing secure code, identifying potential security vulnerabilities, and adhering to best security practices while coding. AI-powered static application security testing (SAST) tools can automatically scan the source code for known vulnerabilities and coding errors, providing immediate feedback to developers. In addition, AI could be used to generate recommendations for secure coding practices and strategies for mitigating identified vulnerabilities.

    Continuous Integration (CI): Continuously integrating new code can introduce new security vulnerabilities and regression bugs that are hard to catch and fix in a timely manner. AI can be utilized in dynamic and interactive application security testing tools (DAST and IAST) during the integration stage. They can intelligently automate tests and identify complex security issues by analyzing data flows and the behavior of code in an integrated environment.

    Continuous Delivery (CD): Ensuring that the code is not only functional but also secure before it is delivered is a major challenge. AI-powered tools can help manage security configurations, monitor changes and alert to any deviations from security policies during the delivery stage. AI can also be used to automate security testing in pre-production environments to ensure that security standards are met before delivery.

    Continuous Deployment (to production): Monitoring, detecting and responding to security threats in real-time in production environments is a critical and challenging aspect. AI can enhance security information and event management (SIEM) tools by providing intelligent real-time analysis of security alerts generated by applications and network hardware. AI-based runtime application self-protection (RASP) tools can also detect and block attacks in real-time, providing robust protection for applications in production.

    Roadmap to AI-Engineered DevSecOps

    It’s crucial to implement AI-engineered DevSecOps solutions in a structured and well-planned manner. Here is a logical roadmap for implementing such a solution:

    1. Assessment and Planning: Begin by assessing your organization’s current DevSecOps maturity. Evaluate the existing tools and practices for their efficiency and effectiveness. Identify areas that lack automation or present security concerns. Align the AI-engineered DevSecOps initiative with your business objectives. This includes defining key performance indicators (KPIs) to measure the success of the initiative. Outline the required resources and budget for the implementation. This includes potential AI-engineered tools, the team’s skills upgrading needs and additional infrastructural changes.

    2. Selection of AI-Engineered Tools: Based on your assessment, select the AI-engineered tools that best fit your organization’s needs. This selection should cover the entire software development life cycle: Planning, design and development, continuous integration, continuous delivery and continuous deployment. The tools should ideally be scalable, easy to integrate with your existing systems and capable of providing real-time, actionable insights to your team.

    3. Training and Upskilling: Train your team on the selected AI-engineered DevSecOps tools. This may require technical training on how to use the tools effectively and how to interpret the insights generated by the AI. Upskill your team to enable them to work effectively within the new AI-engineered DevSecOps environment. This could involve training in AI and machine learning, security best practices and new DevSecOps methodologies.

    4. Gradual Implementation and Integration: Start with pilot projects to validate and tweak your approach. The lessons learned from these initial projects will be valuable for the broader roll-out. Gradually implement and integrate the selected AI-engineered tools into your existing DevSecOps pipeline. This should be a phased approach that allows your team to adapt to the new tools and practices.

    5. Review and Refinement: Regularly review the effectiveness of your AI-engineered DevSecOps implementation against the defined KPIs. Continuously refine your approach based on these reviews. This could involve adjusting your security policies, refining how you use your AI tools or providing further training to your team.

    6. Continuous Improvement: Keep yourself updated with the latest developments in AI and DevSecOps to ensure your approach remains effective and up-to-date. Continually improve and evolve your AI-engineered DevSecOps solution based on emerging technologies, shifting business objectives and feedback from your team.

    Avoiding Pitfalls While Implementing AI-Engineered DevSecOps

    Implementing an AI-engineered DevSecOps solution comes with several potential pitfalls that can derail the process if not appropriately managed. Here are a few of them, along with suggestions for how to avoid them:

    1. Inadequate Planning and Alignment with Business Goals: Ignoring the strategic alignment between implementing AI-engineered DevSecOps and overall business goals can lead to undesirable outcomes. Clearly define the business objectives and how AI-engineered DevSecOps supports them. Outline expected outcomes and key performance indicators (KPIs) that align with business goals to guide the initiative.

    2. Neglecting Training and Upskilling: AI tools can be complex, and without proper understanding and training, their deployment may not yield desired results. Invest in training your teams on AI-engineered DevSecOps tools and techniques. Ensure they understand the functionalities of these tools and how to effectively use them. Upskilling your team will be crucial for leveraging AI capabilities.

    3. Ignoring Change Management: Introducing AI into DevSecOps is a significant change that can disrupt workflows and resistance from the team members. Adopt a systematic approach to change management. Engage stakeholders from the beginning, communicate the benefits of the transformation clearly, and encourage feedback. Also, plan for a gradual rollout to help teams adapt.

    4. Overdependence on AI: Relying too heavily on AI can be a risk if the tools are seen as a complete replacement for human judgment. Recognize that AI is a tool designed to assist human decision-making, not replace it. It’s important to maintain human oversight of AI outputs, as AI models might not fully account for all contextual and situational factors.

    5. Neglecting Data Privacy and Ethical Considerations: Using AI requires handling a lot of data, which can lead to privacy breaches and ethical dilemmas if not handled correctly. Develop a clear policy for data management, ensuring compliance with all relevant data privacy laws and regulations. Make ethical considerations a priority when implementing AI, ensuring transparency and fairness in the AI systems.

    6. Lack of Continual Improvement and Adaptability: AI-engineered DevSecOps requires a culture of continuous learning and adaptation. Failure to embrace this can lead to stagnation and ineffectiveness over time. Establish a framework for continual improvement. Regularly evaluate the effectiveness of the AI tools and be ready to adapt your processes based on new technological advancements, feedback, and changes in business needs.

    Summary

    Implementing an AI-engineered DevSecOps solution necessitates a thorough and strategic approach. This begins with an in-depth assessment of your organization’s current DevSecOps maturity and an understanding of how AI can enhance each phase of the software value stream. Essential steps in the roadmap include tool selection, team training, gradual implementation, regular review and continuous refinement and learning. While AI can significantly bolster security and efficiency, it’s important to avoid pitfalls like inadequate planning, neglecting training, resisting change, overdependence on AI, neglecting data privacy and ethical issues and lack of continuous improvement. By focusing on these areas, aligning the DevSecOps initiative with business objectives, investing in team upskilling, managing change effectively, maintaining human oversight, adhering to data privacy regulations and fostering a culture of continuous learning, organizations can successfully implement and maximize the benefits of AI-engineered DevSecOps.

    Remember, this transformation won’t happen overnight. It is a continuous journey that requires regular review and improvement. With the right strategy, the benefits of implementing an AI-engineered DevSecOps solution can far outweigh the challenges.

  • 92% of Devs Use AI, Survey Says ¦ Intel One Mono Font

    92% of Devs Use AI, Survey Says ¦ Intel One Mono Font

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: GitHub touts unbelievable AI stats, and Intel’s beautiful open source typeface. (more…)

  • BMC Adds Generative AI Capabilities to Helix Management Platform

    BMC Adds Generative AI Capabilities to Helix Management Platform

    BMC today revealed it is embedding generative artificial intelligence (AI) capabilities across its BMC Helix service and operations management platforms.

    BMC CTO Ram Chakravarti said the company is incorporating the open source GPT-J large language models (LLMS) to build generative AI models. Those models are optimized for specific domains using data collected by BMC and imported from other data sources, like the Jira project management software from Atlassian. That persistent layer of storage is designed to aggregate multiple types of data within what amounts to a Helix data lake.

    The generative AI capabilities added to BMC’s portfolio include natural language summaries of issues and events captured by BMC Helix Operations Management, along with an ability to create a historical analysis of a user’s specific environment to identify recurring issues more easily.

    BMC Service Management, meanwhile, can now correlate incidents and provide resolution summaries that can be stored. It’s also now possible to run clustering analysis on chat archives to find new or improved utterances that help virtual agents answer queries better and execute workflows.

    BMC initially opted to build its own LLMs because general-purpose LLMs—such as the one created by OpenAI—are subject to “hallucinations.” Hallucinations are created when incorrect data is included in a model. BMC is training its LLMs on a narrow range of trusted data to ensure the recommendations and subsequent automations it creates are valid.

    Over time, BMC will add additional LLMs; the company hasn’t yet decided if there are use cases where it makes sense to rely on an existing general-purpose LLM to add additional capabilities, noted Chakravarti.

    Organizations can also opt to use a containerized version of the BMC LLM if they prefer, but BMC will encourage most organizations to invoke generative AI via its Helix SaaS platform, he added.

    BMC Helix is an IT services management (ITSM) platform that integrates with a range of DevOps platforms. Helix is part of a larger existing BMC Connected Digital Ops initiative that seeks to unify ServiceOps and DevOps with AIOps, DataOps and AutonomousOps. Generative AI will automate a range of tasks from within Helix that can then be extended to DevOps platforms such as Jenkins.

    It’s still early days as far as applying generative AI to processes, so organizations should focus on use cases where it will add some immediate value, said Chakravarti. Once they develop a level of trust in the automation created and executed, they can then pragmatically expand the number of generative AI use cases where they make sense, he added.

    One way or another, generative AI is going to be applied to the management of IT. Many routine tasks that conspire to limit the productivity of IT teams today will be eliminated, but there will always be a need for a human to remain in the loop to ensure the right outcomes are achieved. However, it will also soon become possible for existing teams to manage IT at levels of scale that were previously unattainable.

    Image source: Photo_Credite_Indira-Tjokorda via Unsplash

  • HashiCorp Releases Slew of Updates to Improve DevSecOps

    HashiCorp Releases Slew of Updates to Improve DevSecOps

    At a HashiDays event this week, HashiCorp launched updates to its Terraform implementation and a software-as-a-service offering, dubbed HCP Vault Secrets, that promise to simplify infrastructure security and ensure that secrets are not leaked.

    In addition, HashiCorp has added a self-hosted edition of its remote access security tool, Boundary, that can now also record SSH sessions. The company is also announcing general availability of Vault Secrets Operator, which provides a high level of abstraction for managing secrets in a Kubernetes environment and which synchronizes with the secrets management interfaces defined by the Kubernetes Technical Oversight Committee.

    Finally, HashiCorp is making available in beta a 1.16 update to the Consul service mesh for containers and virtual machines that adds a Sameness Groups capability to improve the resiliency of microservices by redirecting requests to an identical service. HashiCorp has also added a transparent proxy mode to enable failover between services along with a permissive mutual TLS (mTLS) that enables a service to be configured to accept both mTLS traffic from mesh-enabled services and non-Consul mTLS traffic from external downstream applications.

    Chris Van Wesep, senior director of product marketing for HashiCorp, said Version 1.5 of HashiCorp Terraform adds config-driven import workflow and check blocks capabilities that make it possible to declaratively use code to add existing resources into a Terraform state. Previously, the only way to update a Terraform state was to use an import command that could only be applied to one resource at a time. Terraform 1.5 also adds automatic code-generation capabilities for imported resources.

    In addition, version 1.5 of Terraform also includes a tool to validate that provisioned infrastructure is behaving as intended. That latter capability makes it possible to reduce the number of misconfigurations created by developers that might one day be exploited by cybercriminals to breach an IT environment.

    HCP Vault Secrets, meanwhile, provides a beta release of a SaaS edition of the existing Vault offering specifically designed to enable organizations to better manage application secrets that might inadvertently be exposed to cybercriminals in a production environment, said Van Wesep.

    HashiCorp is moving toward providing a portfolio of tools that enable DevOps teams to securely provision and manage hybrid cloud computing environments using a common workflow, he noted. A Forrester Consulting survey found nearly three-quarters (73%) of respondents are reporting this strategy is helping them reach their business goals, with another 19% adding they expected this strategy to help them achieve their business goals in the next year.

    It’s not clear whether organizations are fully embracing multi-cloud computing, but each additional cloud added to an enterprise IT environment increases the total cost of IT. The only way to mitigate those costs is to define a set of best practices for building and deploying applications that can be applied to any cloud computing environment.

    Unfortunately, many organizations will discover that, as they attempt to define those best practices, they have inadvertently become dependent on a set of proprietary application programming interfaces (APIs) that thwart those efforts.

  • Grafana Labs Slashes Time to Create Observability Dashboards

    Grafana Labs Slashes Time to Create Observability Dashboards

    At its GrafanaCON 2023 event today, Grafana Labs updated its core platform for visualizing data which makes it simpler to set up dashboards in minutes. The updates are part of a celebration of the 10th anniversary of a tool that is now widely used by DevOps teams.

    Ryan McKinley, a distinguished engineer for Grafana Labs, said Grafana 10 should help make DevOps more accessible to a wider range of practitioners with limited experience working with observability tools. The latest release also makes it simpler to share knowledge with external stakeholders via public dashboards, he added.

    In addition, Grafana 10 adds expanded role-based access control (RBAC) capabilities and streamlined implementation of the secure access markup language (SAML) to ensure authentication.

    Grafana Cloud has also been updated to provide a secure way to connect to data residing in an on-premises IT environment or in a cloud with the observability platform the company provides via a software-as-a-service (SaaS) platform.

    Finally, Grafana Labs is also making the engine it created to visualize data more accessible to third-party developers that are embedding visualizations based on Grafana within their applications, noted McKinley.

    Grafana Labs

    There are now more than 150 plugins for various data sources that have been made available to more than 20 million users of the Grafana visualization framework. Not all those users are working in DevOps environments, but Grafana is widely used to enable observability across increasingly complex IT environments. The Grafana Cloud seeks to capitalize on that popularity by adding a service that uses an instance of open source Grafana Mimir software to store data collected in a format originally defined for the open source Prometheus monitoring tool.

    It’s still early days as far as adoption of observability is concerned, but it’s apparent that as application environments become more complex, the plethora of monitoring tools that DevOps teams rely on will need to be streamlined. Observability platforms promise to unify logs, metrics and traces to simplify launching queries to identify the root cause of an issue.

    The rate at which DevOps teams will embrace observability will naturally vary, but the biggest obstacle might not be the platforms themselves. Instead, the issue is understanding what queries can help DevOps teams better understand the root cause of an IT issue before there is a major disruption. In the long term, it’s expected that machine learning algorithms will leverage the data collected by observability platforms to automatically identify issues that might lead to a disruption long before it actually occurs.

    Of course, the result of any query that gets launched needs to be visualized in a way that is easily understood. Grafana Labs is now making a case for a more integrated approach that, at its core, employs its visualization tools to make it simpler to discern what’s occurring in IT environments. After all, no matter how talented any DevOps team may be, it’s still not possible to manage what was never seen in the first place.