devopsy.kinsta.cloud

Category: DevOps Toolbox

  • Hybrid Low-Code: The Next Step in App Development

    Hybrid Low-Code: The Next Step in App Development

    The promise of low-code development has long been the ability to develop business-critical applications by humans with little programming experience. In fact, over the past year or two, the lines between low-code and no-code have become increasingly blurred. Low-code platforms have incorporated more and more functional no-code features to increase the efficiency of the developer even further. Some of these platforms have become so intuitive to use, the idea that anyone can create an app has evolved into the idea of citizen developers. But is low-code really the be-all and end-all when it comes to app development? Seems the answer to that is, “It depends.”

    It has become glaringly obvious that exclusively no-code platforms can’t create complex applications. But then again, these platforms were never really designed with that kind of functionality in mind. No-code can be a highly valuable, rapid prototyping tool as well as a decent tool for very small, very specific apps. These apps would be best suited for intradepartmental use or to extend the functionality of very specific SaaS tools. No-code is not going to power your business-critical applications, and a not-quite-a-developer is not going to lighten your IT load.

    But what about low-code? Can low-code be the bridge between citizen developers and the ever-growing list of backlogged apps? Maybe. Using citizen developers comes with a whole heap of issues that need to be addressed. While this topic can be the subject of an entire blog in its own right, I can quickly highlight the major issues to consider. How much of a citizen developer’s time should be dedicated to app development? Is using citizen developers going to create backlog issues in their primary departments? Who is going to train and support citizen developers? How is IT ensuring that citizen developer-created apps are secure, scalable and extendable? As great as citizen developers sound, they still are not a definitive solution.

    A realization has dawned in the low-code industry. Low-code can’t be and do everything, but it can be a useful development tool to speed up application development. However, most low-code platforms are in their own development silos, separated from other development tools with their own IDEs. Instead, one idea is to create a quick and easy-to-use user interface, drag and drop some app functionality, and then finish complex apps in a language the low-code platform can integrate with, such as Java, or via a Visual Studio plug-in. Even the biggest and best low-code vendors admit that just using low-code isn’t going to power your business.

    Low-code can’t be everything, but it can be a major part of everything. It just needs to look different from how most low-code platforms are designed. Using a hybrid low-code approach will allow organizations to truly use low-code from start to finish in the app development process. Rather than looking at low-code as a separate tool in the development process, a hybrid low-code approach brings low-code inside an IDE where traditional coding methods are still used.

    Is hybrid low-code the future of app development? I would say hybrid low-code is a next step in the evolution of app development. Low-code development tools shouldn’t be isolated in their own IDEs. It can be frustrating to leave a low-code IDE to finish the app in another IDE, and then have to connect the different elements into one cohesive app. As you can see, efficiency is reduced every time a developer leaves one IDE for another. Hybrid low-code views low-code as a tool inside a bigger development toolbox. It is there when convenient, but a developer isn’t forced to use just low-code. They can import already created assets from other languages, hand-code complex solutions, drag-and-drop when it makes sense, and create all the necessary components of a progressive web app with a click of a button.

    While there might be a profound realization that “traditional” low-code can’t do everything it originally promised, hybrid low-code could, instead, fulfill that promise.

  • AppDynamics Partners With Cisco to Secure Application Runtimes

    AppDynamics Partners With Cisco to Secure Application Runtimes

    AppDynamics today announced its agent software, which it provides as part of its observability platform, now has the ability to enforce application security policies.

    Developed in collaboration with the security business unit of parent company Cisco, the Cisco Secure Application offering, available from AppDynamics, can detect attacks, identify deviations in application behavior and block attacks automatically.

    Gregg Ostrowski, a regional CTO for AppDynamics, said the goal is to make it simpler for IT teams that employ AppDynamics for monitoring and observing their IT environments to also embrace DevSecOps best practices. In effect, IT teams can now piggyback security for application runtimes on their existing investment in AppDynamics, Ostrowski said.

    The AppDynamics approach provides the added benefit of easy integration with the Cisco security tools to improve collaboration between DevOps and cybersecurity teams, Ostrowski said. Security details correlated with the application topology make it easier to share context in a way that identifies the actual business relevance of any security event, he added.

    As organizations accelerate digital business transformation initiatives, Ostrowski said the need to embrace DevSecOps best practices is becoming more urgent. The level of risk attached to these types of projects is significantly higher than with previous generations of applications, Ostrowski said.

    While most organizations appreciate the need for greater application security, there’s a debate about how best to achieve that goal. There’s general agreement that developers need to be more involved. However, shifting responsibility for application security to the proverbial left often comes at the expense of developer productivity. AppDynamics is making a case for enabling IT teams, that may already rely on its application performance management (APM) platform, to enforce policies defined by the cybersecurity team.

    Of course, there’s still a need to provide developers with the tools required to write more secure code in the first place. The debate is over how involved in the cybersecurity management process developers need to be after applications are deployed in a production environment.

    Arguably, the goal should be to enable both teams to accomplish their respective tasks in a way that doesn’t require a constant stream of meetings and updates. In the event a vulnerability is discovered, it’s critical for security teams to determine the threat level that vulnerability represents. Otherwise, remediation of that vulnerability will be just one more item in a long list of patches that developers are already working on.

    Regardless of approach, there are now myriad ways to improve overall application security. In effect, the same defense-in-depth approach that IT organizations have relied on to secure network perimeters can now be applied to application security as applications are both constructed and deployed. The most significant challenge is not so much finding the tools required to improve application security, as defining the processes through which best practices can be consistently applied.

  • HashiCorp Expands Managed Services Offerings

    HashiCorp Expands Managed Services Offerings

    HashiCorp today announced the general availability of its Consul service mesh as a managed service on the HashiCorp Cloud Platform (HCP) along with a beta release of a managed instance of HCP Vault, a secrets management platform, on HCP.

    HCP is currently hosted on the Amazon Web Services (AWS) platform, on which the company is making available its complete portfolio as a managed service. In the longer term, HashiCorp plans to make its managed services available on all the major cloud platforms.

    Chris Kent, director of product marketing for HashiCorp, said despite the growing number of open source service mesh alternatives, many organizations would prefer to employ a service mesh provided by a single vendor that they didn’t have to provision and maintain. HashiCorp’s Consul service mesh provides a lightweight alternative that enables service-to-service networking and security via connection authorization and encryption and spans both Kubernetes clusters and virtual machine platforms using the mutual Transport Layer Security (mTLS) protocol.

    Applications can then employ sidecar proxies in a service mesh configuration to establish TLS connections for inbound and outbound connections without ever having to directly interface with Consul itself.

    HashiCorp is making the case for Consul at a time when internecine warfare is raging between proponents of open source service mesh platforms such as Istio, Linkerd and Kuma. The Consul service mesh provides an alternative that is simpler for developers to incorporate across both microservices-based applications running on a Kubernetes cluster and legacy monolithic applications running on virtual machines, Kent said. In contrast, Istio and Linkerd are designed solely for use in Kubernetes environments.

    It’s still the early days of service mesh adoption. In addition to simplifying application traffic routing between services, one of the other benefits of service mesh is that it provides a layer of abstraction above lower-level network application programming interfaces (APIs) and protocols that is more accessible to developers. As developers become more familiar with service meshes, the ability to programmatically include network and security operations within a DevOps workflow will grow. HashiCorp is collectively positioning Consul and Vault as foundational components for creating a zero-trust architecture.

    In the meantime, each IT organization will need to determine which type of service mesh makes the most sense for their environment. In many cases, organizations may find themselves employing multiple service meshes to address different use cases. Regardless of which they choose, service meshes will soon become a permanent fixture in the proverbial solar system around which IT services revolve.

    HashiCorp claims that more than 2,000 organizations signed up to participate in the HCP Consul and HCP Vault beta programs. That level of interest suggests interest is growing in consuming IT as a service rather than as a platform that requires deployment by an internal IT team. It remains to be seen the degree to which organizations will prefer to consume those services directly from a vendor, versus a cloud service provider or third-party IT services provider.

  • Atlassian’s Shift to the Cloud Gets Underway

    Atlassian’s Shift to the Cloud Gets Underway

    Atlassian today announced the general availability of Cloud Enterprise, a cloud-based service through which organizations can mix and match the company’s various offerings under a single subscription.

    The company has signaled its intention to shift toward cloud services for months; now, the initial Cloud Enterprise subscription will cover the company’s Jira Software, Confluence and Jira Service Management offerings.

    Bala Venkatrao, head of product for Enterprise Cloud at Atlassian, said the goal is to make it more cost efficient for organizations to consume the company’s software versus merely acquiring a license to deploy software in an on-premises IT environment.

    The company is also making controls available that enable governance of user and change management via a centralized admin hub. Administrators can assign users to instances, configure security policies and monitor usage trends through the hub. There are also built-in integrations with third-party identity-as-a-service providers, to enable administrators to automate provisioning and de-provisioning.

    Administrators can also set up and customize multiple application instances; they can keep data pinned to different regions to customize those instances with specific marketplace applications or configurations for compliance purposes.

    Finally, a marketplace will allow IT organizations to expand the number of applications they consume from Atlassian and its partners. A smart links and app switcher capability for Jira and Confluence Cloud enable easy collaboration across different instances of Atlassian applications.

    Atlassian currently has more than 194,000 customers, so it may take some time to transition the existing installed base to this model. In the meantime, Atlassian is pushing as many new customers as possible toward a cloud platform that makes it easier for Atlassian to keep customers current on the latest release of its software. Atlassian plans to support up to 20,000 users per application instance by later this year.

    Venkatrao said while the Atlassian portfolio is frequently consumed by individual end users, the Cloud Enterprise offering is designed to appeal to CIOs, and other senior level executives, that want to centralize billing for application services now accessed via the cloud. That approach will make it easier for large organizations to take advantage of discounts they may qualify for as overall usage increases, Venkatrao said.

    While Atlassian may be a little late to the software-as-a-service (SaaS) application game, Venkatrao noted that the Cloud Enterprise platform will make it simpler for Atlassian to apply AI to the metadata it will collect. Atlassian has already leveraged AI to improve document search within Confluence and Jira, in addition to employing predictive analytics to surface recommendations for including personnel on a project.

    It may be a slow transition to the cloud for Atlassian, but that transition is clearly underway.

  • vFunction Automates Conversion of Java Apps to Microservices

    vFunction Automates Conversion of Java Apps to Microservices

    vFunction has developed an eponymous platform capable of automatically converting a monolithic application written in Java into a set of microservices. The startup is emerging from stealth mode today.

    Fresh from raising $12.2 million in seed funding, vFunction CEO Moti Rafalin said the company’s platform employs dynamic analysis, static analysis, data science and automation to enable IT teams to reengineer, in a repeatable fashion, the source code used to create monolithic Java applications.

    As part of that process, vFunction also detects and eliminates code that is no longer executed to reduce the footprint of an application, minimize security risks and overall maintenance tasks.

    The vFunction platform is deployed as a server that communicates with agent software injected into the legacy monolithic application. The server then creates a microservice that is scanned by additional tools to determine how best to optimize it to run on, for example, a Kubernetes cluster based on the Red Hat OpenShift platform, said Rafalin.

    IT teams can also employ vFunction to determine which monolithic applications are better suited to being converted into a set of microservices that can be automatically extracted into separate compilable projects. Each project comes with an estimated timetable for completion that can be accessed via a Modernization Factory Dashboard and Application Complexity Assessment tool provided by the platform.

    Rafalin said most monolithic applications are made up of large amounts of ‘spaghetti code’ that was added over multiple generations by different development teams. Manually analyzing that code as part of an effort to refactor a legacy application would require weeks of effort, Rafalin said. As such, the rate at which most organizations are re-engineering applications is extremely slow, he said.

    In fact, it’s not unheard of for IT organizations to to start, but quickly abandon such because the time and effort required proved too costly. vFunction claims its automated, domain-driven processes accelerate manual refactoring by a factor of ten, resulting in a savings of anywhere from $300,000 to $500,000 per application.

    Pricing for vFunction is based on a per-application model. The company has also established alliances with system integrators such as HCL Technologies, Tata Consulting Services and Wipro that are regularly contracted by IT organizations to refactor their applications.

    Of course, not every monolithic application needs to be converted into a set of microservices. However, most monolithic applications have components that would be easier to maintain and support as a distinct microservice. Organizations, in general, are embracing microservices to build applications that are more resilient. In the event a microservice becomes unavailable, requests for services are rerouted to another microservice to make sure the application degrades gracefully, rather than crashes altogether. The challenge is that, over time, the dependencies that can exist between hundreds of microservices can be more challenging to manage than those of the monolithic application being replaced.

  • ARMO Aims to Simplify Microservices Security

    ARMO Aims to Simplify Microservices Security

    ARMO this week emerged from stealth to launch a platform to secure cloud-native workloads and improve visibility. The ARMO Workload Fabric technology attaches code within the memory invoked by a microservice to enable cybersecurity policies to be applied via a cloud service.

    Company CEO Shauli Rozen said the ARMO Workload Fabric is designed to enable IT organizations to implement a zero-trust architecture more easily within the context of a DevSecOps workflow.

    Fresh from raising $4.5 million in seed funding, Rozen said ARMO’s approach eliminates the need to deploy and manage agent software, container sidecars or runtime application self-protection (RASP) software to enforce security policies across what inevitably will become thousands of microservices distributed across an enterprise IT environment.

    That leaner approach then allows for a centralized management platform that can be deployed on a cloud or on-premises IT environment to apply policies that restrict which microservices can communicate with one another, Rozen said. The approach would ensure that only microservices developed using a continuous integration/continuous delivery (CI/CD) platform are allowed to communicate with other microservices, Rozen said.

    Integration with multiple CI/CD platforms is already provided, added Rozen.

    That approach allows policies to be applied to microservices regardless of how they are constructed, Rozen said. That capability is critical, because developers are building microservices using everything from Python and Java to containers, he said. Many of those microservices are also frequently replaced, Rozen said, which can make updating any associated agent software a significant DevOps challenge. Given all the existing dependencies between microservices, overall application environment security is only as strong as the proverbial weakest link. The ARMO Workload Fabric enables developers to add a small amount of code to implement security policies each time a microservice is rolled out into a production environment.

    As part of an effort to make it simpler for IT organizations to apply those policies, ARMO provides a pre-built set of policies that organizations can immediately apply, in addition to creating their own polices over time, Rozen said. In many cases, IT teams simply don’t have the time or expertise required to build those policies, Rozen added.

    Microservices are being built and deployed at such a breakneck pace that it’s nearly impossible for cybersecurity teams to keep up. The ARMO Workload Fabric provides cybersecurity teams a means to centrally manage security policies that would otherwise be implemented as code by developers. It provides a level of observability for how those cybersecurity policies are being implemented across microservices that typically have a lot of dependencies on one another, Rozen said.

    Most organizations today recognize there is a clear need to shift responsibility for application security further left toward developers. The challenge is finding a practical way to achieve that goal, and in a way that doesn’t adversely impact the rate at which applications are being developed. The key to achieving that goal is finding a way to apply microservice security polices that causes the least amount of friction possible to existing DevOps workflows.

  • AIOps in Service Management: Removing the Noise

    AIOps in Service Management: Removing the Noise

    AIOps (artificial intelligence for IT ops) refers to the automation of IT operations through AI and machine learning. With every organization working rapidly toward the ultimate goal of digital transformation, there is a natural place for AIOps within service management as a means to automate processes and automatically spot and react to issues in real-time. But what exactly is AIOps, and how does it remove the noise from service management?

    AIOps: Taming the Growing Complexity of IT

    Digital transformation has resulted in IT infrastructure complexity growing at an astronomical rate. The resultant increases in infrastructure data and alarms at the service desk far exceed the capacity of any human to meaningfully read, analyze and respond to them. The infrastructure itself is also constantly morphing and changing, yet service desks are still expected to resolve requests, incidents, and performance issues in seconds – an impossible task, given the volume of data.

    AIOps provides the necessary firepower to address this exponential rise in data, using artificial intelligence to continually monitor and analyze changes in the IT infrastructure in real-time. By combining these insights with service desk automation, organizations can benefit from a closed loop of discovery, analysis, detection, prediction and automation which, combined, bring us closer to the enviable goal of self-healing IT.

    Two Phases of AIOps Implementation

    The implementation of AIOps falls into two phases: discovery and analysis.

    Discovery

    The discovery phase involves uncovering all of the compute, network and storage entities across your ever-changing IT environment and ensuring your configuration management database (CMDB) is always kept up to date. But just knowing what is on your network is only the first step – you then need to determine how each asset relates to, or depends on, each other. This dependency mapping stage requires tracking of dynamic, multilayered relationships between applications and hybrid infrastructure, and creating rich, visual topology maps so that you can immediately see where dependencies lie within the network, and, therefore, where potential bottlenecks or risks reside.

    Analysis

    With your CMDB now kept up to date with automated discovery and dependency mapping, you now need to make sense of this data. After all, data is useless if you can’t use it to make informed decisions. By applying machine learning algorithms to analyze this data, AIOps can identify patterns, spot anomalies and predict future outages.

    Why AIOps in Service Management?

    AIOps has many benefits within the larger service management context. AIOps can:

    1. Support, not hinder, rapid digital transformation – with automatic discovery and dependency mapping, AIOps allow the business to continue to invest in new IT services without upsetting those in operations that need to keep the lights on.
    2. Reduce downtime – with automatic reporting of anomalies, operations can address potential issues before they result in a service outage.
    3. Automatically update the CMDB – An accurate CMDB is the foundation of successful IT operations. If your CMDB is out of date, then you are left trying to solve problems blindfolded. Just make sure your AIOps supports hybrid environments, so it can discover all IT assets from physical to virtual infrastructure, on-premises to public cloud, etc.
    4. Remove noise from the service desk – AIOps helps the service desk to overcome alarm noise and determine which events need their attention by eliminating false positives, performing advanced event correlation, reviewing time-series event playbacks and determining probable root cause.
    5. Actualize self-healing IT – no longer a myth or an IT operator’s dream, self-healing IT can be realized through AIOps. By automatically triggering actions based on the findings of the machine learning engine, AIOps can quickly fix issues or prevent them from happening, whether it’s a network link that’s gone down, an over-utilized disk or a service that simply requires a restart.

    Operations is not known for being a calm and relaxing environment in which to work. When your role is primarily a reactive one, there is rarely time to be proactive. You are bombarded with alarm bells and error reports all day long. How can you tell the difference between a false alarm, an isolated incident or the early indicators of a bigger problem? AIOps, leveraging machine learning, has finally provided IT operations with the tools needed to make sense of this growing barrage of data.

  • The Best IAM Practices for DevOps

    The Best IAM Practices for DevOps

    Through identity and access management (IAM), it is possible to assign policies that determine whether a user and the role can access particular services or not. An IAM system is also supposed to maintain the principle of least privilege (POLP), which grants the roles and users the permission to access certain resources. As a business focuses on ensuring the IAM is secure, some of the issues that come about include experimenting using new forms of technology, building fast and reducing friction across teams.

    As the scope and number of IAM objects grow, it may be hard to answer questions such as:

    • Are there inline policies?
    • Which policies are assigned to groups?
    • Can another person assume the role of other principles or users?

    As a developer, there are different approaches you can use to ensure the IAM configuration is auditable, tidy and right-sized. Automation plays a key role in this case.

    Below are the best IAM practices for DevOps:

    Use Strong Passwords

    The majority of the users will opt for an easy password. In such an instance, a hacker can easily gain access with minimal effort. Users should create passwords that are highly secure by adhering to the following measures:

    • The password should have 14 characters or more.
    • Include one uppercase alphabet, one special character and non-alphabet characters.
    • Avoid reusing the same password.
    • Don’t use dictionary words.
    • Utilize password-generation tolls.

    Use Third-party Tools to Enhance Security

    For better results, it is advisable to look beyond the service. For example, tools are available that can automate the creation of the IAM policies, making it possible to save a considerable amount of administration time. However, such tools help to eliminate risks while accelerating different management tasks. The administrators should monitor them since they lack flexibility. Update such tools regularly to ensure they are always useful.

    IAM Permissions Review Using Access Levels

    The IAM policies should be reviewed and monitored to ensure efficient security. Such policies grant access to permissions needed to execute certain actions as per particular requirements. Policy summary can help to review policies that issue details regarding access level for specific services. The access levels include read, list, permission management, tagging and write.

    Use Multifactor Authentication

    IAM users should have access to multifactor authentication, which ensures response generation on the user’s device, part of the authentication process. To sign in, the user requires the response generated on the device and the right credentials. If the password is compromised, the account’s resources will be secure because of multifactor authentication.

    The response can be developed in the following manner:

    • A code is generated using U2F keys after tapping on the device.
    • For hardware devices, the response code is generated on the device. You’ll key in the code during the sign-in process.

    Get Rid of Unnecessary Credentials

    A good security practice should audit the user credentials regularly and get rid of the users who are not active. Credential reports help keep track of the access keys and the password’s life cycle. The report includes the date of creation, user details and when a password was last used or changed. If you’re using a password-rotation policy, you’ll receive a reminder that you should change your password. The auditor can download the credential report and perform additional tasks as per the requirements.

    Rotate Credentials Regularly

    Change access keys and passwords regularly for all IAM users and place a password policy in place. Also, IAM users should be enlightened about how frequently they should change the passwords.

    Never Share Your Account Credentials

    Avoid sharing your credentials. If anyone needs to access certain resources, you can create IAM users for them. In such an instance, you can assign permissions to different users.

    Monitor User Activities

    Organizations should monitor the activities of all the users to get a better view of cloud activities. By doing so, it will be possible to find any threats. A cloud access security broker (CASB) can provide cross-cloud visibility meant to monitor user activity and offer threat protection.

    Create a Strategic Plan for IAM

    After compiling identities and mapping the access points, you should decide the permissions to keep and change. Every organization should determine its priorities and liaise with the stakeholders while formulating a strategic plan regarding IAM. Put in place a common decision-making framework.

    Most firms usually start with privileged accounts. Since such accounts belong to the administrators, they are considered high-value targets for hackers.

    An account that has unnecessary access privileges is termed as a security liability. The risks are high if such an account can gain access to sensitive pieces of information. It is always good to determine who has access to the database or different applications.

    Come up with an Agile System

    Companies are dynamic since they do merge and acquire other firms. Departments are also reorganized in some instances, and people are also assigned new roles. The issue arises when you fail to notify the IT department.

    The change is constant; however, security lags since the access updates are limited to a specific time frame. Hackers can take advantage of such loopholes, making companies suffer from a massive data breach, which costs the firm a significant amount of money.

    Consider Unstructured Data

    Although managing access to applications such as emails is important, it is good to consider the information these applications contain. Ensure you assess the information beforehand to determine who can access it. Failure for an organization to keep track of unstructured data makes it hard to decide whether it’s being stored or transmitted securely.

    Some of these apps require social security and credit card numbers. Sending such information through an unencrypted email poses a data breach at some point. It’s, therefore, advisable to keep track of unstructured data.

    Conclusion: IAM Best Practices

    IAM comprises different pieces of the cloud security issue. By adhering to each of the practices above, it is possible to ensure tight security in the DevOps toolchain.

  • Developer Tooling for Emerging Technology

    Developer Tooling for Emerging Technology

    2020 has brought a seemingly endless amount of problems, but software developers have responded with solutions. Despite all of this year’s change, one thing remains true: Software is being used in a multitude of ways to tackle some of the world’s most pressing challenges. And developer creativity is helping to progress exciting new areas of technology innovation; specifically, internet of things (IoT) and edge computing, 5G and autonomous vehicles.

    The barriers to entry for development in these new areas has lowered in recent years. It’s now just as cost-effective to get started on an IoT hardware project as it is to build a web or mobile application and learning how to get started with the hardware is as easy as searching for “how to raspberry pi” on YouTube. The issue is, once you get started and begin shipping units, you’ll come to realize that developer tooling for emerging areas of technology is lagging behind the curve. The market for tools that monitor and test web and mobile applications is healthy and diverse, but tooling for IoT/edge, 5G and autonomous vehicles has yet to see the same surge. And as projects become more complex, how do you keep up with both automated and manual testing? How do you ensure that firmware updates don’t “brick” devices out in the field? Fixing a bug in a website can be deployed in a few minutes, and in some cases, customers won’t even notice. Shipping new versions of software to devices is a little more tricky.

    One of the biggest areas of change in this sector is innovation in CPUs. For the longest time, engineers could write software that worked on either Intel- or AMD-based CPUs—and the majority of software that exists today can run on either of those platforms. However, IoT devices make heavy use of the newest player in the CPU space: Arm. Most people don’t realize it, but anyone with either an Android or iPhone smartphone in their pocket already has a device running an Arm processor. Arm processors work especially well in low-power environments, such as those you find in IoT. The biggest problem that engineers face with this new CPU is that the majority of developer tooling isn’t suited for them. It’s all been built with either Intel or AMD CPUs in mind.

    We are only beginning to realize the possibilities of these emerging technologies—and developers will be the ones paving the way, building the solutions that will power our future. As they continue to evolve and create new unstructured data sources, companies will need to invest in the tools that enable developer teams to not only keep pace but also innovate.

    The tools I’m referring to will be the ones that let developers seamlessly deliver software across any environment—from IoT devices to private or public cloud to embedded systems to 5G. CI/CD platforms are one way to accomplish this. But there’s a misconception when it comes to selecting CI/CD providers: that developers must choose between the security of on-premises environments and the scale of public cloud. A hybrid cloud approach to CI/CD is an effective way to test and deploy software at scale without compromising the security of a company’s most valuable resource: its source code.

    For so many teams and companies, this was the year of throwing out the playbook and rewriting the road map. The window of opportunity for true software innovation has never been more open. Whether it be in IoT, 5G or autonomous vehicles, developers are moving fast to change the world. They need developer tooling that will help them deliver on those ambitions.

  • LinearB Looks to Automate DevOps Project Management

    LinearB Looks to Automate DevOps Project Management

    LinearB today unveiled a namesake tool that automatically constructs and visualizes detailed progress timelines without requiring DevOps teams to rekey data into a separate project management application.

    Company CEO Ori Keren said the issue DevOps teams find most frustrating when it comes to managing software development projects is collecting the data that’s required to track the progress of any given project when much of that data already resides in the DevOps tools being employed. LinearB automates the collection and display of that data that DevOps teams previously spent hours collecting, he said.

    That approach makes it easier to then identify which teams and projects need additional help in near real-time using metrics surfaced in dashboards provided by LinearB, Keren noted, adding metrics such as the tracking of cycle times also make it easier for DevOps leaders to justify those investments to business executives.

    Keren said DevOps leaders also gain better insights in how DevOps teams are actually functioning in a way that makes it easier to predict and eliminate project delays, remediate high-risk code before it is included in a production environment, eliminate bottlenecks and make certain the focus of the DevOps team remains on tasks of the highest priority.

    LinearB is making use of the application programming interfaces (APIs) that DevOps tools expose to gather the metadata that exists about the status of any given project. LinearB then employs machine learning algorithms to construct and correlate that data to give DevOps leaders more accurate insights into the status a project when compared to a project management application that requires data to be entered manually. Given the rate at which application development projects are now updated, much of the data in a project management application is outdated shortly after its entered.

    Project managers also often spend a significant amount of time trying to encourage various members of a DevOps teams to update the data that resides in those project management applications.

    At a time when many members of those DevOps teams are now working from home to combat the spread of the COVID-19 pandemic, Keren noted that manually collecting that data has never been more problematic.

    While many DevOps teams are embracing value stream management tools to optimize DevOps workflow, Keren added most of those tools do not collect data at a granular enough level to provide DevOps leaders with enough software deliver intelligence to meaningfully impact DevOps workflows in near real-time.

    In general, Keren said most DevOps teams are too focused on metrics such as the number of lines of code or the number of commits being made. Metrics such as cycle times are more indicative of the productivity of a DevOps team.

    It’s not clear how the ability to automatically pull metrics from DevOps tools might impact the role of project managers. In theory at least, they should be able to spend more time helping DevOps leaders identify issues proactively versus badgering DevOps teams to fill out reports.

    Regardless of how the role of the project manager evolves, the one thing that is for certain is most members of a DevOps team would happily prefer to see as much of that process become automated as possible.