devopsy.kinsta.cloud

Category: Enterprise DevOps

  • Reimagining CI/CD: AI-Engineered Continuous Integration

    Reimagining CI/CD: AI-Engineered Continuous Integration

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that the continuous integration (CI) Pillar is about developers frequently merging code changes into a central repository. After that, automated builds and tests are run, successful builds are containerized and release candidate artifacts are signed. The main objectives of CI are to detect problems early, reduce integration issues and provide high-quality, secure release candidates. In this article, I explain how AI can enhance each step in the CI phase of DevOps CI/CD pipelines.

    Code Branching: In DevOps, managing multiple branches can be challenging, especially with large teams. This can lead to merge conflicts, confusion about where code should be committed and difficulty tracking changes.

    • AI Solution: AI can help by automatically managing branches and offering recommendations on merging. AI-based systems can analyze code patterns and project management styles to suggest optimal branching strategies, minimizing conflicts and maintaining organization.
    • AI Tool Example: Microsoft’s IntelliCode offers AI assistance for software development which could potentially help manage branches by suggesting optimal strategies.

    Code Commits: Commits need to be made regularly to maintain the codebase, but they can introduce errors. Miscommunication and the lack of a unified commit policy can lead to problems.
    • AI Solution: AI can analyze commit histories to identify patterns and recommend best practices. Additionally, AI tools can provide real-time feedback on code changes, suggesting potential improvements before the code is committed.
    • AI Tool Example: Kite is a coding assistant that uses AI to help with code changes and improvements before the commit stage.

    Merges: The process of merging code changes can lead to merge conflicts, particularly in large, complex codebases.
    • AI Solution: AI tools can help predict potential merge conflicts and offer solutions before they occur. They can analyze code structures and change patterns to predict and prevent these conflicts.
    • AI Tool Examples: Tools like DeepCode or Sider use AI to review and analyze your code to help prevent merge conflicts.

    Static Scanning: This process can be time-consuming and complex with a high potential for false positives.
    • AI Solution: AI can improve static analysis tools by learning from past scans to improve accuracy, reduce false positives, and even suggest potential fixes for issues identified.
    • AI Tool Example: DeepCode is an AI tool that analyzes your code, learns from past scans and suggests fixes for issues identified.

    Builds: Build failures can occur due to a number of issues, including poor code quality, incompatible changes, and environment configuration issues.
    • AI Solution: AI can predict build failures by analyzing historical data and identifying patterns that lead to such failures. AI can also automate the build process and manage environment configurations to reduce human error.
    • AI Tool Example: CircleCI Insights uses machine learning to analyze and predict the success of builds, helping to mitigate build failures.

    Scanning for Quality Errors and Security Vulnerabilities: This process can be slow and yield false positives, and the sheer number of potential issues can be overwhelming to manage.
    • AI Solution: Machine learning can be trained on previous scans to recognize patterns, improving the speed and accuracy of scans. AI can also prioritize issues based on potential impact, helping teams focus their efforts.
    • AI Tool Example: ShiftLeft scans for vulnerabilities in the code and uses AI to prioritize the issues found.

    Unit Testing: Writing and maintaining unit tests can be time-consuming and it’s often difficult to achieve good coverage.
    • AI Solution: AI can assist in generating unit tests based on code analysis and historical data, ensuring good coverage and saving development time.
    • AI Tool Example: Diffblue Cover uses AI to automatically write unit tests, aiming to improve coverage and save developer time.

    Containerization: Misconfiguration of containers can lead to issues such as application failures, security vulnerabilities or inefficient resource usage.
    • AI Solution: AI can help solve this challenge by automating and optimizing the configuration process.
    • AI Tool Example: Magalix can analyze historical configuration data and current application requirements to suggest optimal configuration settings for a container. It can flag potential misconfigurations or inefficiencies and suggest improvements based on best practices learned from past data.

    Functional Integration Testing: These tests often require significant resources and time to write and maintain.
    • AI Solution: AI can generate functional integration tests based on system behavior analysis, reducing the time and effort required to maintain these tests.
    • AI Tool Example: The test.ai tool uses AI to generate and execute functional tests, reducing the need for manual test case creation.

    Determining Whether a Build is Suitable as a Release Candidate Artifact: Manual analysis of build quality can be slow and subjective.
    • AI Solution: AI can analyze build artifacts, test results and other data to predict the suitability of a build as a release candidate, reducing the time and subjectivity involved in this decision.
    • AI Tool Example: Google’s Cloud Build can be leveraged with machine learning to predict the success of builds.

    Digitally Signing Artifacts in an Artifact Repository: This process can be cumbersome and prone to human error.
    • AI Solution: AI can manage the process of digitally signing artifacts, ensuring that only validated, authorized code is signed and reducing the potential for human error.
    • AI Tool Example: While no specific AI tool exists for this task, automated DevOps tools such as JFrog Artifactory or Sonatype Nexus could be combined with AI technology to automate the signing process, ensuring that only validated, authorized code is signed.

    Challenges of CI Transformation to AI

    The transition from traditional continuous integration (CI) to AI-engineered CI presents several challenges:

    Integration with Existing Systems: When incorporating AI into an existing CI toolchain, ensuring seamless integration can be a challenge. Organizations need to verify that AI tools can work effectively with current systems and don’t disrupt existing workflows.

    Skillset and Understanding: Adopting AI requires a certain level of understanding of how AI works, including its strengths and weaknesses. Teams need to be trained on how to use AI tools effectively and interpret their outputs.

    Data Privacy and Security: AI tools often rely on analyzing large amounts of data, which can include sensitive or proprietary information. Organizations need to ensure that using these tools doesn’t compromise their data security and privacy.

    Cost: Implementing AI tools can be costly, both in terms of purchasing and deploying the tools and in the potential need for additional hardware resources. Organizations need to consider the return on investment (ROI) and determine if the benefits of using AI outweigh the costs.

    Tool Maturity: Many AI tools in the DevOps space are relatively new and still evolving. Organizations need to consider the maturity and stability of the tools they’re planning to use.

    Over-Reliance on AI: While AI can greatly enhance CI processes, over-reliance on AI without proper understanding can lead to misinterpretations and errors. It’s important to balance AI usage with human oversight and expertise.

    Benefits

    Transitioning to AI-engineered CI toolchains can have several significant benefits for organizations:

    Improved Efficiency: AI can automate various aspects of the CI process, such as code review, testing and environment configuration. This can greatly reduce the time taken for these tasks, speeding up the overall CI process and allowing teams to deliver software more quickly.
    Increased Quality: AI tools can perform in-depth code analysis and identify potential issues with a level of detail that might be missed by humans. This can lead to improved code quality, fewer bugs, and more stable software.
    Predictive Analytics: AI can analyze historical data to predict outcomes, such as the likelihood of a build failure. This can help teams proactively address issues, reducing the risk of failures and improving the reliability of the CI process.
    Improved Decision Making: AI can provide valuable insights based on data analysis, helping teams make more informed decisions. This can relate to things like identifying the most suitable release candidate or deciding when and how to scale resources.
    Consistency and Standardization: AI-driven CI can ensure consistent application of rules and standards, as there’s less reliance on individual developers’ judgment. This can lead to a more standardized, reliable development process.

    Summary

    Overall, AI has the potential to greatly improve the efficiency, accuracy and effectiveness of DevOps continuous integration practices. However, it’s also important to note that these solutions require careful management and oversight to ensure they’re working as intended and improving rather than hindering processes. Organizations should start with small, manageable projects to gain an understanding and experience with AI before scaling up. They should also invest in training and support to help their teams adapt to these new tools.

  • Identify Needs First

    Identify Needs First

    In several projects of late, I have noted a trend in otherwise rockstar IT departments: They identify an area that they wish to implement or approve and then set out to address it. So, “We need a new CI tool,” spawns a project to choose and implement a new CI tool, for example.

    But there are so many details that these projects are missing from the start that should have been put right into the charter/project kickoff documents.

    Let’s start with, “What CI tools do we currently have in place?” This is the 2020s. How is it possible we are still starting these projects as if there was no solution in the virtual building already doing the job? We need to start from, “Here are the tools that can do this job that are currently running in our environment.” Only then should we move on to, “Here are other options to consider.” But I will humbly suggest that if there is a single tool that can solve your issues, it should be used–and if, of all of the tools running in the organization, none of them can solve all of your issues, then a new product should be chosen that can.

    The same is true for things like alerting. When I am analyzing a given vendor’s solutions, I ask about how many places they can raise issues–it is important that a vendor asking you to purchase their product can report and alert to whereever the organization needs it to. So that could mean Jira or ServiceNow, Slack or email, centralized logging—all of the above and sometimes more (SIEM for security events, for example) need to be supported. But when a given organization is implementing? Choose a reporting method.

    The most common is, “We do Slack, but we also do email. And, of course, we coordinate though issue management like Jira …” Stop. Seriously. This is not about, “Oh, they made it easy, so we just implemented every option.” This is about, “We need to keep track of conversations and resolutions.” If two people are discussing an issue over Slack while a separate team is discussing over email, you’re failing to communicate. Even if there is linkage to ServiceNow or Jira and that is where conversations should happen, we all know that final resolution—but not troubleshooting steps—is what ends up there. So offer one robust and widely available alerting mechanism and let people run with it.

    That type of redundancy is all over IT. Organizations that would not implement per-team email solutions (not servers, solutions) will happily allow for per-team DevOps toolchains. Why? What, exactly, is different? The purpose of a mail server is to deliver mail. Choosing which mail vendor/service to run with is based upon how a given product does so and what additional services come with it. How is that different than, “The purpose of the DevOps toolchain is to deliver applications, and selection is based upon what vendor/product best serves the way our organization does so?” There isn’t a difference; we imagine one. We latch on to one feature that we must have to keep our current favorite, and the compromise is that the next team over can keep their tools, too, because they must have some other feature.

    Evaluate what the organization as a whole needs, identify tricky bits like must-have features and determine if that really is a requirement. If it is, ask why it isn’t a requirement for every project not using that tool.

    And keep moving those apps along! You are building and deploying more apps more securely than ever before. Continue to sanitize the build and delivery process, and continue to crank out apps that make the business hum. But don’t make it part of your job to support fifteen tools that all do the same job. Streamline and improve. And keep rocking it.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    LinkedIn

    DuckDuckGo
    Remote
    Senior DevOps Engineer
    $170,000

    CareerBuilder.com

    Credit Acceptance Corp.
    Remote
    Staff DevOps Engineer
    $145,000 to $150,000

    Indeed.com

    NASDAQ
    New York, New York
    DevOps Engineer
    $104,400 to $174,000

    SimplyHired

    U.S. Bitcoin
    Remote
    Software DevOps Engineer
    $100,000 to $130,000

    Dice.com

    ITBMS
    Remote
    DevOps OpenShift Engineer
    $80,000 to $100,000

  • How AI Addresses DevOps Monitoring and Observability Challenges

    How AI Addresses DevOps Monitoring and Observability Challenges

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that the continuous monitoring pillar involves monitoring observable systems and application performance in real-time so that teams can detect and react to problems quickly, often before they impact users. It’s crucial for maintaining application health and informing future improvement efforts.

    In this article, I explain how AI can analyze logs and metrics to predict potential system failures or performance degradation, allowing for proactive maintenance and issue resolution.

    Continuous Monitoring and Observability Use Cases

    CI Anomaly Detection: AI can analyze historical data to detect anomalies during the continuous integration phase. Any unusual change can be flagged for review before it proceeds to the next phase. Tools like IBM Watson Anomaly Detection can help identify these anomalies by using AI to detect patterns and irregularities.

    Code Quality Assurance: AI can be used to analyze the code in the development stage to ensure its quality, which can help reduce bugs and vulnerabilities. Tools like DeepCode and Codota use AI to identify potential problems and suggest improvements based on a learned database of code and solutions.

    Test Case Optimization: AI can help optimize the selection of test cases in continuous integration (CI). Using historical test data, AI can identify which test cases are most likely to find new defects. Tools like Testim.io can help with this by using AI to prioritize testing based on risk and change impact.

    Predictive Analytics in CD: AI can analyze historical deployment data and predict potential issues during continuous delivery (CD). This can help preemptively solve problems, reducing downtime. Tools like Splunk use AI and machine learning to provide predictive analytics for operations data.

    Automated Rollbacks: In the case of continuous deployment, AI can be used to automatically roll back deployments that are causing issues. Tools like Harness use machine learning to understand typical application behavior, automatically reverting to the last stable state if anomalies are detected.

    Infrastructure Optimization: AI can help optimize the usage of resources in cloud environments. Tools like CAST.AI and Turbonomic use AI to continuously optimize your infrastructure, ensuring better performance while reducing cost.

    Incident Management: AI can help automate the incident management process, from detection to resolution. Tools like BigPanda and Moogsoft AIOps use AI to aggregate, correlate and analyze alerts from various sources, reducing noise and speeding up incident resolution.

    Log Analysis: AI can analyze logs and identify patterns that would be difficult for humans to spot. Tools like Logz.io use AI to provide cognitive insights into log data, providing a deeper understanding of the data.

    Security Threat Detection: AI can analyze patterns and detect security threats more effectively. Tools like Darktrace use machine learning to detect unusual behavior in real-time, thereby detecting potential threats before they cause damage.

    Network Monitoring: AI can predict network outages by analyzing traffic patterns. Tools like Kentik use AI to proactively identify potential network issues before they affect users.

    Challenges When Transforming Continuous Monitoring to use AI

    Here are some challenges organizations might face when transitioning existing CI/CD pipelines to incorporate AI into continuous monitoring and observability, along with possible solutions:

    Data Quality and Availability: The effectiveness of AI-engineered tools largely depends on the quality and quantity of the data they’re given. Insufficient or poor-quality data can result in inaccurate insights or predictions. Implement effective data governance and management practices to ensure data quality and accessibility. Data should be thoroughly cleaned and properly labeled to facilitate the training of AI models.

    Skills Gap: Adopting AI-engineered tools requires new skills that the existing IT team may not possess. There might be a lack of understanding of how to use these tools effectively. Provide comprehensive training to your DevOps team to bridge the skills gap. Also, consider hiring AI specialists or working with an experienced vendor to help implement and manage the AI tools.

    Resistance to Change: As with any significant transformation, resistance to change can be a substantial barrier. Employees may be concerned about job security or the perceived difficulty of adapting to new tools. Communicate clearly and transparently about the benefits of the AI transition, both at an organizational and individual level. Ensure staff that AI is there to assist them, not replace them. Organize workshops and training sessions to ease the transition.

    Integration with Existing Systems: AI tools need to integrate seamlessly with existing DevOps tools and workflows to ensure that they add value without disrupting operations. Choose AI tools that are compatible with your existing infrastructure or consider implementing integration middleware. Conduct a proof-of-concept (PoC) to ensure the new AI tools integrate smoothly.

    Cost of Implementation: Deploying AI tools can require a significant upfront investment, both for the tools themselves and for necessary infrastructure upgrades. Conduct a thorough cost-benefit analysis to understand the return on investment (ROI) that the AI tools can deliver. Consider starting with lower-cost or open source tools or use cloud-based AI services to reduce initial investment in infrastructure.

    Summary

    As the world of DevOps evolves, the integration of AI in monitoring and observability becomes increasingly important. Whether it’s during the phases of continuous integration, continuous delivery or continuous deployment, or for applications, infrastructure and pipelines, AI can provide exceptional benefits. From anomaly detection in CI, code quality assurance and test case optimization to predictive analytics in CD, AI can transform your operations, delivering rapid and more reliable results.

    However, transitioning to an AI-optimized DevOps environment is not without its challenges. Issues such as data quality, the skills gap, resistance to change, system integration and cost implications must be considered and addressed. But fear not, solutions are at hand. With effective data governance, comprehensive training, transparent communication, smart tool selection and thorough cost-benefit analysis, you can navigate these challenges and reap the rewards of AI integration in your DevOps journey. So, are you ready to embrace the future of AI-driven DevOps? There’s no time like the present to start exploring the possibilities.

  • Harnessing AI in Continuous Delivery and Deployment

    Harnessing AI in Continuous Delivery and Deployment

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that the continuous delivery pillar is an approach where code changes are automatically built, tested and prepared for release to production; this may be followed by continuous deployment where an approved release is automatically deployed to the production environment. The practices of the CD pillar aim to make releases and deployments less disruptive and more frequent, increasing speed and efficiency.

    In this article I explain how AI can help continuous delivery and deployment processes.

    Continuous Delivery Use Cases

    Orchestration of Test Environments: Teams need a reliable way to prepare and manage various test environments. This includes setting up and tearing down environments, managing versioning and configuration and handling data and resources. AI tools that can help include Harness, and IBM’s UrbanCode, which can automatically spin up and down environments for testing purposes and handle configuration as code.

    Execution of Various Tests: This includes system acceptance tests, regression tests, performance tests, user acceptance tests and security tests. The AI tool that could help here is Parasoft’s SOAtest. Its AI can generate test scenarios, ensure full coverage and automatically adapt to changes in the code base.

    Performance Monitoring of Release-Candidate-Artifact: Tools need to assess the performance of release candidates, identify bottlenecks and compare performance against previous versions. Dynatrace is an AI-powered tool that provides automatic and dynamic baselining of application performance, helping teams to recognize when performance is lagging.

    Automation of Policies for Artifact Acceptance: Rules and policies need to be defined and enforced regarding when an artifact is ready for release. Tools like Harness use machine learning to analyze past deployments and test results to predict the success of future deployments and automate the approval process.

    Continuous Deployment Use Cases

    Orchestration of Deployment Environments: Teams need to manage deployment environments, including setup, versioning, configuration and data management. Spinnaker is an open source tool that uses AI to manage multi-cloud deployment strategies.

    Execution of Deployment Strategies: This includes executing strategies such as Blue-Green, Canary and Feature Flag gradual rollouts. A tool like LaunchDarkly can utilize AI to manage feature flags, analyze usage data and roll out features gradually.

    Testing in Production: Testing the new release in the live production environment is crucial. A tool like Sentry can use AI to monitor application use in real-time and identify and alert teams to issues faster.

    Restoring Production to a Prior Version: When a problem is detected with a new release, teams may need to revert to a previous stable version quickly. StackStorm is an event-driven automation platform that uses AI to define workflows, allowing you to quickly roll back to a previous version in case of failure.

    Updating Documentation and Configuration Management Databases: It’s crucial to keep records up-to-date. A tool like Guru uses AI to automatically update and keep track of documentation, ensuring that it’s always accurate and up-to-date.

    Challenges When Transforming CD to use AI

    Here are some challenges organizations might face when transitioning their existing CI/CD pipelines to incorporate continuous delivery, continuous deployment and AI tools, along with possible solutions:

    Lack of understanding of AI capabilities and uses: One of the first challenges that organizations might face is the lack of understanding of what AI can and cannot do. Some team members may have unrealistic expectations or fear that AI will replace their jobs. Regular training and workshops can help teams understand how AI can enhance their roles rather than replace them. Clear communication about the goals and benefits of incorporating AI can also help allay fears.

    Data privacy and security concerns: Using AI tools often involves handling a large amount of data, some of which may be sensitive or private. There are also concerns about the security of AI tools themselves. Establish a robust data governance policy that includes procedures for handling sensitive data. Also, when selecting AI tools, prioritize those that are known for their robust security measures.

    Complexity in integrating AI tools with existing systems: Not all AI tools will seamlessly integrate with existing systems and infrastructure. This could lead to technical debt and instability in the pipeline. Prioritize AI tools that have wide integration capabilities. Engage the tool’s support team or hire consultants if needed to ensure the integration is smooth and stable.

    Resistance to change: The transition to a new way of working can be met with resistance, especially if team members are comfortable with the existing systems and processes. Change management strategies can help ease the transition. This can involve regular communication about the benefits of the change, training and providing support during the transition.

    Cost of AI tools and training: AI tools can be expensive, and there’s also the cost of training team members to use these tools. Start with a cost-benefit analysis to understand if the transition is worth the investment. Look for AI tools that offer a good balance between cost and features. Consider phased implementation to spread the costs over time.

    Dependence on vendor support: Given the complexity of AI, there may be a high dependence on the AI tool vendor for support. This could become a problem if the vendor is unresponsive or ceases to support the tool. Choose vendors who have a good track record of providing strong customer support. Also, consider tools that have a strong community around them, which can provide additional sources of help and support.

    Summary

    Navigating the landscape of continuous integration, continuous delivery and continuous deployment (CI/CD) pipelines can be complex, but it’s a vital process that’s being revolutionized by the introduction of AI tools. From orchestrating test and deployment environments, managing testing and deployment strategies, to automating delivery tasks and quality checks, AI is playing an increasingly critical role in streamlining and enhancing these processes.

    However, as with any significant change, transitioning to AI-enhanced CI/CD pipelines is not without its challenges. This includes understanding AI’s capabilities, data privacy and security concerns, technical integration difficulties, resistance to change, cost considerations and vendor support dependencies. By identifying and addressing these challenges head-on, organizations can effectively leverage AI’s capabilities, bringing increased efficiency, reliability and value to their software delivery pipelines.

    With proper planning, continuous learning and strategic use of AI tools, organizations can not only overcome these challenges but also thrive, gaining competitive advantages in their software delivery processes. The future of CI/CD is undeniably entwined with AI, and embracing this evolution is an exciting journey that holds the promise of transformative benefits.

  • Survey Surfaces Raft of Enterprise IT Challenges

    Survey Surfaces Raft of Enterprise IT Challenges

    A survey of  enterprise IT leaders found less than a third (32%) are extremely confident that they have the right technology, processes and people in place to execute an effective approach to IT management.

    The survey, conducted by Rocket Software, polled 275 U.S. IT leaders in organizations with more than 1,000 employees. A full 93% of IT leaders are also committed to maximize the value of investments in existing platforms.

    As a result, the top priorities for IT leaders are hybrid cloud computing (65%), data and content management (68%) followed by DevOps and infrastructure and application modernization, tied at 58%, and automation (57%).

    A total of 62% noted they have a much greater focus on efficiency due to the economic landscape, with faster DevOps processes, automated processes and increasing overall output as the top three improvements that would be most impactful for increasing efficiency.

    The survey also suggested many organizations still have much work to do to achieve those goals, with 63% of respondents spending anywhere from six to 15 hours on manual data entry and analysis each week.

    Phil Buckellew, president of infrastructure modernization for Rocket Software, said most organizations are still trying to determine the right level of DevOps to adopt. Few organizations have implemented DevOps workflows on an end-to-end basis, with many employing a mix of DevOps and waterfall processes to build and deploy applications across a hybrid cloud computing environment, he noted.

    Overall, IT leaders are most worried about improving overall IT performance (60%), data security (50%), process risk and compliance (46%) and the need to improve agility (41%), the survey found. Respondents also noted that they measure success within their IT organization by increased efficiency (71%), optimized resources (67%) and reduced risk (63%).

    The survey makes it clear that, despite challenges, enterprise IT organizations are committed to hybrid cloud computing as they become more comfortable with using various platforms that are fit for purpose, said Buckellew.

    Mainframes, for example, continue to play a major role in running online transaction processing (OLTP) applications alongside analytics applications that are now being infused with artificial intelligence (AI) capabililities, noted Buckellew.

    A quarter of survey respondents also identified providing cloud applications with access to mainframe data as an area where they need additional tools, followed by automation (22%).

    The biggest automation obstacles are the complexity of implementing automation (18%), resistance to process change among workforce (18%) and lack of skillsets to implement automation (18%), the survey finds.

    As always, the biggest challenge in enterprise IT environments is often simple inertia. Organizations that have been building and deploying applications on mainframes, for example, have been relying on waterfall processes for decades. Many of them have now adopted DevOps processes to varying degrees, but few have completely replaced legacy approaches to building and deploying software, noted Buckellew.

    It’s not likely the management of complex hybrid cloud computing environments will be simplified any time soon, but progress continues to be made. Soon, AI may automate many existing manual tasks. In the meantime, however, the number of enterprise IT organizations standardizing on a single IT platform remains few and far between.

  • Must You Collect All That?

    Must You Collect All That?

    It is interesting that we no longer consider teams that super-tool their apps as being slightly ‘off’ or, working in a field where systems were mission critical, even life-and-death. Now, we all are collecting and reporting data points in real-time across not just the SDLC, but across the entire environment. It is wild the amount of data available to the average DevOps team about what is going on with their applications. But it’s not all being used.

    No, seriously, it is unreal. Let me offer two anecdotes that explain why I know you’re not using it all.

    Most of my regular readers know that I worked at F5 for years, the first couple on the DevCentral team, doing the Dev part. Their flagship product, the BIG-IP, collected an incredible amount of super-granular data. I am not exaggerating when I say an incredible amount. They had data points from the wire up to the traffic routes through the load balancing algorithm to nodes. And it was (and likely still is) all available to users via APIs. Whatever data was needed about traffic passing through the BIG-IP or the nodes behind the BIG-IP and the connections in between users and those nodes, you could get.

    One of my projects was to offer a simplified interface to the APIs. They were complex and granular, and customers wanted fast and easy, so I was publishing code that worked as an intermediate layer.

    Note: F5’s APIs, like everyone else’s, are far more advanced today than they were then, and it is easier to do what you need to do because they took the “create a user layer” part seriously. It’s complex machinery so it still has complex APIs, but accessibility is way up from those early days.

    Anyway, BIG-IP collected so much data that I could not name all of the fields, let alone when each one was pertinent. I gave up trying after a while, because if a board-level engineer needed a data point, the idea at the time was “Why not expose it?” so ‘number of connections to a given node’ under this algorithm was hidden among things like ‘microseconds to connect to DNS on that connection’ (I’m making those up; it’s been years). Some were terribly useful to end users and others were not. All were accessed in the same way, and learning by experimenting was the only real way to tell the difference.

    Users did not need all of that data. Users did not need the complexity and obfuscation created by supporting all of that unnecessary data.

    My other example is a massive system of interconnected IoT devices that were centrally connected/controlled with a private, specialized network to manage them (actually, there were several different networks on several different mediums, and that matters where data points are concerned).

    When setting this system up, we estimated about half a million IoT devices with capabilities that ranged from passive monitoring to active controllers of physical devices. Four different communications mechanisms, a couple dozen different devices, every major (and a couple minor) databases and command-and-control software on every major OS, managing from a handful to hundreds of thousands. And all of these were super-tooled because the IoT network was mission-critical. Our databases and the infrastructure to support/protect them were a major part of our data center budget because of the amount of data.

    The amount of data was a flood. The management software was developed by different companies with different transports and endpoints in mind, meaning each had a different dataset. Once all of the networks were running satisfactorily, our next immediate project was to create a unified dataset for reporting and troubleshooting. I was in charge of IT, but the top-level person–because each of those half a million devices was a physical install–was a physical engineer. We fought non-stop about what was important. I was trying to map and convert datapoints between systems; he was trying to maximize data available for reporting up. He often said, “Well no, we don’t need that today, but we might.” This put us in a zone where “number of devices on this system” was on par with “attenuation of the communications line to the nodes on this physical subnet.” Totally unworkable, and our compromise was to put together a small IT team to put a layer over all that raw data and offer an intelligent interface side-by-side with data dumps.

    We are there again today. I hear many of my friends in the enterprise space saying, “Because of ML, we might need that data and storage is cheap.” I disagree. Storage is an overhead that is wasted if you are not actively using the data. We are past the “all data is good data” craze; it’s time to adapt. Useful data that expands insights is all you need tooling for. Report data that will help solve problems, and if the team finds tomorrow that it needs a data point that is not currently collected, it can be added in.

    There is room for debate here–the rate of change for ML systems (please stop calling them AI; they’re not, yet, and we’ll need that word when they are cognizant) means that there is a reasonable argument for “all of the data.” And I’m not proposing limiting data collection. Honestly, application security specifically and enterprise IT security overall has benefitted from datapoint sharing between formerly separate market spaces. If the SCA scan shows X framework is used, then the IAST can narrow down tests to those that look at X and not its competitors, for example. But honestly, don’t drown yourself in a data lake when all you need is a fish tank where you can see all the guppies.

    And keep rocking it. Even if you entered IT two years ago, you are now a seasoned vet and things have changed–beyond all of our expectations, I’d say. Yet you’re still plugging away, keeping the enterprise running. Don’t stop—just try to keep the data hoarding to a reasonable level and make sure the data you have is being used, whether as useful feeds to an ML tool or as consumable information for other people/systems.

  • Design for DevOps: Using AI in App Design and Enhanced CI/CD Pipelines

    Design for DevOps: Using AI in App Design and Enhanced CI/CD Pipelines

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that design-for-DevOps practices, a DevOps pillar, involves designing software in a way that supports the DevOps model and CI/CD pipelines. This can include aspects like microservices architecture, modular design and considering operability and deployability from the earliest stages of design.

    In this article, I explain how AI can be used in the software design phase to enhance the performance of DevOps and CI/CD pipelines.

    AI-Assisted Code Review and Quality Assurance: AI-engineered tools such as DeepCode and Kite can detect bugs and security vulnerabilities in the codebase and suggest improvements.

    Infrastructure-as-Code (IaC): IaC tools such as Terraform, Ansible or Chef enable automation and standardization of the IT infrastructure and enhance the efficiency of DevOps pipelines by supporting rapid, consistent and repeatable deployments and rollbacks.

    Serverless Architectures: Developers can build and run applications without thinking about servers. This means less time spent on managing infrastructure, updating servers and debugging system issues. AWS Lambda, Google Cloud Functions and Azure Functions are all examples of serverless computing platforms.

    Containerization and Orchestration: Tools like Docker provide an easy way to package and distribute applications across various environments using containers. Kubernetes, on the other hand, can help manage these containerized applications at scale. Containerization and orchestration help maintain consistency across environments, simplify scaling and speed up the CI/CD process.

    Microservices Architecture: Small, independently deployable services can significantly improve the speed of development and deployment cycles as well as the reliability of applications.

    A/B Testing and Feature Flagging: Aided by AI-engineered tools, A/B testing and feature flagging can help to test new features in production with a small subset of users, making the release process less risky and more controllable.

    AI-Powered Performance Optimization: Tools like Akamas use machine learning to autonomously optimize the configuration of software applications, dramatically improving the performance and efficiency of CI/CD pipelines.

    AI-Driven Test Automation: AI-engineered tools can help automate the testing process. They can predict which tests are likely to fail and need to be executed first, optimize test suites and automatically generate tests.

    Adopt Observability: Use AI-powered tools for monitoring, logging and tracing to gain a comprehensive overview of the system. This data-driven approach can provide insights that can lead to performance improvements.

    Predictive Analytics: Tools that use AI can predict possible failures in the development process or in the software itself, which saves resources and helps developers anticipate and mitigate problems before they occur.

    Challenges and Solutions

    Challenges faced when implementing each of these strategies, and recommended solutions for overcoming them are described below.

    AI-Assisted Code Review and Quality Assurance: Developers may resist due to fear of relying too heavily on automation and skepticism about the accuracy of the tools. Begin with smaller, non-mission-critical projects and gradually scale up. Continuous training and iterative feedback improve the accuracy of the tools.

    Infrastructure-as-Code (IaC): The learning curve can be steep and managing IaC can require new skills. Invest in training your team or consider hiring experts. Start with simpler projects and scale up.

    Serverless Architectures: Debugging can be difficult and there can be concerns about vendor lock-in. Use application performance monitoring tools specifically designed for serverless environments. To address vendor lock-in concerns, use abstraction and containerization methods.

    Containerization and Orchestration: Containers require a different mindset and skillset compared to traditional virtualization. The initial setup and learning curve of Kubernetes can be steep. Training or hiring specialists is key. Starting with smaller projects can help in getting familiar with this new way of managing applications.

    Microservices Architecture: Implementing microservices can add complexity, especially around inter-service communication, data consistency and managing multiple databases. Use tools and practices designed for microservices such as service meshes and API gateways. Also, ensure each service is as decoupled and cohesive as possible.

    A/B Testing and Feature Flagging: This requires a mature deployment pipeline, and managing feature flags can be complex. Tools that manage feature flags can simplify this process. It is also essential to ensure a strong culture of testing and to have good monitoring and rollback capabilities in place.

    AI-Powered Performance Optimization: The accuracy and effectiveness of these tools depend heavily on the quality and comprehensiveness of the data they receive. Ensuring good data hygiene practices and comprehensive observability measures is crucial.

    AI-Driven Test Automation: AI testing tools can be seen as a black box, and their effectiveness is heavily dependent on the quality of the data they are trained on. As above, good data practices and thorough understanding of how these tools work is necessary.

    Adopt Observability: Implementing observability can require significant changes to application design and development practices. Start small with key applications or services and gradually increase scope. Training or hiring for the necessary skills is also important.

    Predictive Analytics: Building effective predictive models requires high-quality, comprehensive data and skilled data scientists. Invest in data management and data science capabilities. Using pre-built models and tools can help to get started.

    Roadmap to AI-Assisted DevOps Culture

    Implementing these strategies can be complex and vary significantly depending on the specific context and needs of an organization. The following is a generalized roadmap that can serve as a starting point.

    Step One: Assessment and Planning

    Conduct a thorough assessment of your current state, including the technologies in use, the skills of your team and the specific needs and goals of your business. Prioritize the strategies that are most likely to deliver value for your organization, taking into consideration the investment required and the readiness of your team. Create a detailed plan for implementing each strategy, including milestones and metrics for success.

    Step Two: Build Skills and Infrastructure

    Based on your plan, invest in the necessary training for your team. This could involve in-house training, hiring new team members with specific skills or contracting with external consultants or service providers. At the same time, start building the necessary infrastructure. This could involve setting up new servers, purchasing software or services or configuring existing resources.

    Step Three: Pilot Implementation

    Begin by implementing the chosen strategies on a small scale, ideally in a non-critical project or environment. Monitor the progress closely, gathering data on the impact of the changes and any problems that arise.

    Step Four: Review and Iterate

    After the pilot implementation, conduct a thorough review of the outcomes. Based on this review, iterate on your strategies and plan.

    Step Five: Scale Up

    Once you are confident in the effectiveness of your strategies, begin scaling up.

    Step Six: Continuous Improvement

    Regularly review your progress, keep an eye on new developments in the field and be prepared to adjust your strategies as needed.

    Benefits

    Implementing the roadmap as described will bring several benefits to the organization:

    • Improved Efficiency: Automation and streamlined processes, reduces manual effort and leads to increased productivity and more efficient use of resources.
    • Enhanced Quality: By using AI-assisted tools for code review, testing and performance optimization, the quality of the software can be significantly improved.
    • Increased Agility: Strategies like IaC, serverless architectures and microservices make it easier to adapt to changing requirements and market conditions.
    • Greater Reliability: By implementing robust testing, monitoring and rollback capabilities, the reliability of the software is enhanced.
    • Better Decision Making: By adopting data-driven strategies like observability and predictive analytics, the organization gains deeper insights into its processes and outcomes.
    • Risk Reduction: Through A/B testing, feature flagging and predictive analytics, potential issues can be identified and addressed before they cause problems.
    • Skills Development: Investing in an organization’s people has many lasting benefits.
    • Competitive Advantage: Adopting leading-edge practices and technologies will create competitive advantages.

    Summary

    This article provided guidance on crucial strategies for optimizing application design and development processes to enhance DevOps CI/CD pipelines. AI-enhanced strategies included AI-assisted code review, IaC, serverless architectures, containerization, microservices, A/B testing, AI-powered performance optimization, AI-driven test automation, observability and predictive analytics. Each of these strategies, while powerful, poses unique challenges such as resistance to adoption, complex learning curves and data dependency. Solutions to address these challenges focused on the importance of training, initiating less complex projects, maintaining good data hygiene practices and potentially hiring specialists.

    To practically implement these strategies, an example roadmap starts with an initial assessment and planning phase to understand the existing status and prioritize strategies. This is followed by skill development, a pilot implementation phase, a review and iteration phase, finally scaling up successful strategies. A successfully executed roadmap promises benefits such as improved efficiency, enhanced quality, increased agility, greater reliability, better decision-making, risk reduction, skills development and a competitive edge. The implementation of this roadmap necessitates careful planning, continuous learning and iterative improvement but holds the potential for a transformative impact on the organization, truly embodying the principle of ‘Design for DevOps.’

  • Google Calls Microsoft Azure Anti-Competitive ¦ Gen-Z Can’t Email

    Google Calls Microsoft Azure Anti-Competitive ¦ Gen-Z Can’t Email

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Google complains to the FTC about Microsoft market abuses, and new graduates don’t know how to office. (more…)

  • The Security Pipeline

    The Security Pipeline

    Over the last few years, the ability to secure our applications has grown, and deep integration into the DevOps toolchain has, too. There are more tools doing more security checks protecting more of the infrastructure and source than there have ever been. The key is putting them to use intelligently.

    We now have the ability to secure the image an app is based upon, the images that are derived from that original—complete with supporting software. We can get feeds to tell us which bits of our included open source components are insecure and how to protect them; we can scan the source, the assembled application, the APIs and the network. We can put runtime protections in place in front of web apps and in front of APIs. We can even track the long-tail attacks like slow data extraction that are becoming more common as security tools master more obvious attacks.

    That is a great set of security capabilities. And automation puts every bit of it within reach. Your job is to pick the bits you need to increase the security posture of your environment and get them worked into your specific toolchain. This is not all that difficult, but nothing is free, so you will need at least some implementation time and some staff time to work through results. After all, no matter how automated, current solutions do end with a list of changes that need to be made to increase security. Some tools will put a runtime fix in place immediately, but honestly, that is a patch—it only stays in place until you can fix the underlying issue.

    Integrating all of the great security tooling with each other is another aspect that will require some time. Some vendors cover a massive amount of the security testing needed across markets and technologies. These companies show us that even if an organization would rather use best-of-breed, there is a lot of benefit in increasing integrations. For an easy example, consider this: If the software bill of materials (SBOM) generated during the build steps shows that a given framework is included in an application, then active testing via dynamic or interactive application security testing can include extra tests specific to that library.

    Integrations will take effort, but once they’re in place they will enhance application security. There is no perfectly secure application, but the tooling is available to make a given environment less of a target because it is too much work to attack. And that is what you should be shooting for.

    I’ve said before that making security part and parcel of your DevOps practices is mandatory at this point, but that was in reference to the great DevSecOps toolsets currently out there. I’m suggesting now that we include it all–from design to GitOps runtime drift management. Because we can, and the result is reduced risk to the organization.

    And keep rocking it. Honestly, you’re maintaining something worth protecting–that alone means you are successful, even if you aren’t aware of every issue that crops up. Issues are why you’re there, and the systems keep running because you are.