devopsy.kinsta.cloud

Category: Enterprise DevOps

  • Linux Foundation Lists Top Open Source Libraries

    Linux Foundation Lists Top Open Source Libraries

    The Linux Foundation today published a report that provides access to eight lists of the top 500 open source libraries being used by organizations as part of an ongoing effort to help better secure software supply chains.

    The Census II of Free and Open Source Software—Application Libraries report is based on usage data from providers of software composition analysis (SCA) tools such as Snyk, the Synopsys Cybersecurity Research Center (CyRC) and FOSSA. The report itself was compiled by the Harvard Lab for Innovation Science.

    The eight lists are made up of four that include version numbers and four that are version agnostic. The lists are separated into npm and non-npm packages because npm packages would dominate any ranking created. The top non-npm packages being employed include maven, nugget, Go and cargo.

    Frank Nagle, assistant professor at Harvard Business School, said the report is intended to provide organizations with some guidance in terms of knowing what open source packages are used in the wake of recent vulnerabilities discovered in the widely employed Log4j software used to manage logs within Java applications.

    Many of the organizations impacted by that vulnerability were unaware of just how widely deployed Log4j was within their enterprise IT organizations. IT organizations should evaluate the sustainability of those projects in terms of the number of contributors and maintainers that are working to ensure the security of those libraries.

    One of the biggest challenges is to find a way to standardize naming schema for software components and the overall management of versions of different libraries, noted Nagle.

    Ultimately, the goal is to convince more enterprise IT organizations—and the vendors that support them—to make more resources available to secure those libraries, noted Nagle. Much of the most widely used open source software is developed and maintained by only a handful of contributors. Many of those contributors argue that, while they made that software available for free, it is the responsibility of the organizations employing it to secure it.

    The Linux Foundation is moving to become a conduit through which it will make available additional resources to help better secure open source software. The Open Source Security Foundation (OpenSSF), a consortium hosted at the Linux Foundation, earlier this week announced that 19 additional organizations have joined OpenSSF to help identify and fix security vulnerabilities in open source software and improve tooling, training, research, best practices and vulnerability disclosure practices.

    Brian Behlendorf, executive director at OpenSSF, said in addition to making resources available, it’s clear there is a need for some form of a third-party audit of open source software as organizations are more broadly employing that software across their software supply chains.

    New premier member commitments to OpenSSF are now coming from 1Password, Citi, Coinbase, Huawei Technologies, JFrog and Wipro. New general member commitments are being made by Accuknox, Alibaba Cloud, Block, Inc., Blockchain Technology Partners, Catena Cyber, Chainguard, DeployHub, Gravitational Inc., MongoDB, NCC Group, ReversingLabs, Spotify and Wingtecher Technology. New associate members include Institute of Software, the Chinese Academy of Science (ISCAS), MITRE and OpenUK.

    Other efforts led by the OpenSSF include an Alpha-Omega Project to better secure open source security posture, scorecards that identify risks of the dependencies within more than one million projects, multi-factor authentication tokens and a Project Sigstore initiative to sign, verify and protect open source code.

    It may be a while before open source software achieves the level of security the IT industry strives for. On the plus side, however, there have never been more resources allocated to achieving that goal.

  • Best Practices for Modernizing App Modernization

    Best Practices for Modernizing App Modernization

    Modernizing legacy systems to embrace a loosely-coupled microservices architecture is the biggest predictor of success for continuous delivery, according to Google Cloud’s 2021 Accelerate State of DevOps report. Studies continue to show that the most elite DevOps performers enjoy more frequent code deployments, faster lead times to deploy, low change failure rates and faster time-to-recovery. 

    Leading enterprises like Netflix, Tesla and Starbucks proved that a microservices architecture minimizes fine-grained dependencies between services, which can then be independently tested, deployed and scaled. Combined with DevOps best practices, this reduces technical debt and allows for modernization based on a factory model approach that incorporates automated analysis and deep observability. 

    That said, application modernization to date has been a manual process requiring multi-year projects that suffer a high failure rate. How can we apply modern tools, known DevOps best practices and desired business benefits to improve and accelerate a company’s modernization efforts? In other words, how do we make modernization more modern? 

    By using automation, AI and data science, building repeatable pipelines and shifting architecture left, architects can get in front of technical debt before it becomes unmanageable. In this article, we’ll explore these practices in more detail.

    Intelligently Automate Everything Possible

    DevOps methodologies have taken manual steps and applied automation to create repeatable processes that scale. Modernization teams today are in dire need of these methodologies, as they are stuck with manual approaches that don’t scale across an entire application estate. Thus, applying intelligent automation, AI and data science to modernization—and creating a repeatable pipeline for refactoring—is a natural extension of DevOps successes over the last decade.

    Continuous Integration, Continuous Deployment, and Continuous Modernization

    CI/CD methodologies are a core best practice for DevOps teams and are already familiar patterns that development organizations are using for their application life cycles. But, there is no continuous delivery without continuous modernization. Elite teams continuously monitor technical debt accumulation and address it at every application release cycle, thereby implementing continuous modernization in their application life cycles.

    Deep Application Observability

    Observability, defined as monitoring, logging and tracing, is a foundation for cloud-native architectures. Modernizing an existing monolith requires deep observability beyond simple static code analysis to include deeper domain-driven behavior analysis and dynamically tracking dependency interactions. This is also the secret to uncovering dead code that is no longer used.

    Ensure Architectural Parity

    You must understand your infrastructure architecture to inform your application architecture and your modernization options. Lift-and-shift causes headaches for many organizations because the traditional three-tier architectures of monolithic applications have a completely different topology than cloud-native applications, which are designed from scratch to leverage the efficiencies of the cloud. 

    Whether it’s a hybrid approach (part on-premises, part cloud), public or private cloud, it’s important to ensure that your modernization strategy ensures architectural parity between the target application and its ultimate destination in the cloud. Also, it’s important to understand your modernization options: Rehost, replatform, refactor, rewrite, etc. What can you lift-and-shift and what needs more attention? 

    To find the answer, incorporating data science-driven analysis, automated service extraction and, more importantly, people, to help you understand the possibilities is critical. 

    Get Executive Support for Your Modernization Project

    This isn’t about simply churning through your backlog; your executive sponsors for a project of this scope need to understand, in business terms, why this is crucial for the organization. There are plenty of metrics showing the financial and opportunity costs of maintaining mission-critical applications that are aging and problematic. 

    To get executive buy-in for your modernization initiatives, you need to formulate a business case that communicates the cost of maintaining the legacy apps, both in time and resources to maintain, but also the negative impact on innovation, customer acquisition and retention and speed to market.

    DevOps practices emerged to improve how IT organizations reliably and efficiently deliver software from development to operations and out to customers. Applying these emerging technologies of automation, pipelines and deep observability to application modernization initiatives will enable teams to accelerate how they deliver application transformation projects. By investing in training application teams in these methods and providing modern tooling to support that training, organizations more reliably and more efficiently move both people and projects forward into the next generation of cloud applications.

  • Where Has All the Testing Gone?

    Where Has All the Testing Gone?

    Testing has long been a problem child of IT in general, AppDev in particular, and now it is DevOps’ problem. There are things that DevOps can do to improve the chances of tests actually occurring for your application(s). Interestingly, there are some that think we no longer need testing; the argument is that because new releases can be cranked out so quickly if something needs to be fixed that it is irrelevant. Combining feature flags with the ability to roll out a new version and, well, there may be some truth to that—at least for a limited subset of testing.

    If an organization implemented feature flags for user acceptance and new feature testing and then standardized on test-driven development for DevOps development teams, that would leave systems and security testing. Systems testing could, theoretically, be replaced by the ability to roll out a new version. Although systemic issues can be complex and difficult to fix, this is a riskier proposition than extending test-driven development to the systems level. For the sprint, assign a person responsible for the overall integrated system and have the rest of the team support them through the process of making certain all works as expected.

    Testing—particularly systems testing—slows releases. I get that. The rate at which most of us can iterate once DevOps systems and processes are in place is fast enough that you can afford a bit of slowdown. This leaves security testing as the last standalone bit. But some security validation can happen during the development process if DevSecOps tools are being utilized. That still leaves some security issues to test for but does remove a large chunk.

    The key to these last bits is to get them integrated into the process/toolchain. DevOps runs straight through, over and over. Any bit worked into the “runs straight through” will be executed. If today’s iteration falls for the “We ran over, we’ll make the deadline with less testing” mentality; not an issue—it’s one iteration. Just don’t let that become the default answer to someone not completing an iteration’s work on time. Development can have unexpected speed bumps that delay delivery and acknowledging that and documenting what it was for future reference is important. Covering it up by reducing testing time risks a less stable product and does not help overcome the issue in the future.

    So start thinking in terms of DevOpsTest. Make sure the product you are delivering represents the massive time investments you’ve made producing and maintaining it. You’re rocking it—and something like integrated testing ensures that users see how great you are rocking it and not an error page.

  • Multi-Cloud Computing is a Major IT Headache

    Multi-Cloud Computing is a Major IT Headache

    A CloudBolt Software survey of 500 senior IT, DevOps, security and finance leaders found 79% are struggling under the weight of managing multiple cloud computing environments.

    The survey from CloudBolt Software, a provider of a cloud management platform, found specifically that more than three-quarters of respondents (78%) said they have too many cloud tools throughout their enterprise, and 80% struggled to achieve comprehensive visibility into cloud usage and spending. A total of 80% also noted that their current approach to cloud computing created new security vulnerabilities.

    A full 88% said they need a “manager of managers” that would enable them to unify the various silos that have multiplied across their IT environment.

    Nevertheless, 78% of respondents said that moving to the cloud enabled them to achieve cost savings compared to running applications in an on-premises IT environment.

    CloudBolt Software CEO Jeff Kukowski said the issue is not so much that IT organizations regret shifting workloads to the cloud; instead, the issue is finding a way to manage multiple clouds, each with their own set of tools and frameworks that need to be mastered.

    It’s not clear whether organizations are deliberately employing multiple clouds or if, because of simple inertia, they have found themselves managing multiple cloud platforms because of decisions made by various development teams. Some IT organizations, for example, employ multiple clouds because they are concerned about either becoming locked into a specific cloud computing service or whether an outage might take all their applications offline at the same time. Others are simply trying to take advantage of services that are better provided by one vendor than another.

    Regardless of how IT organizations found themselves managing multiple clouds, the total cost of IT rises as each new platform is added to an IT environment. CloudBolt Software is making a case for an IT framework that provides a layer of abstraction through which the management of multiple clouds and on-premises IT environments can be unified. It is more a question of time and degree to which IT organizations will eventually consolidate the management of disparate IT environments under a single control plane that provides the foundation for true hybrid cloud computing, said Kukowski.

    There are, of course, a few organizations that have standardized on a single cloud computing platform. The degree to which those organizations can maintain that standard will naturally vary as, for example, new workloads that may be optimized for a specific cloud environment are built or as companies acquire other organizations that are running workloads on other cloud platforms. In many of those cases, organizations discover that the cloud services invoked expose a range of proprietary application programming interfaces (APIs) and disparate virtual machines that make migrating workloads a major challenge.

    Like it or not, most organizations will be managing multiple IT environments for the foreseeable future. The only thing that is uncertain is the volume of workloads that might be running on any one of those platforms at any given time.

  • Akamai: Buying Linode | Firefox: Not OK | Gone: Google Vaccine Mandate

    Akamai: Buying Linode | Firefox: Not OK | Gone: Google Vaccine Mandate

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Linode gets bought by Akamai, Firefox market share is “measly,” and Google brings staff back to the office.

    1. Akamai + Aker = ‘Synergy’

    First up this week: Why is Akamai buying Linode? Whatever the reason, it’s a big payday for its solitary shareholder: Not far off a billion dollars.

    Analysis: There goes the neighborhood?

    The 100 lb gorilla of edge computing and CDNs is promising not to mess with Linode’s winning open source cloud formula: No change, steady as she goes, etcetera. But how many times have we heard that before?

    Here’s local scribbler Paige Gross: Linode’s $900M acquisition by Akamai is a ‘game changer’

    A household name in the Philly tech scene … CEO Christopher Aker founded the company in 2003, and it’s been bootstrapped ever since, growing to about 250 employees. … Aker has owned 100% of Linode since he founded it.
    …
    Aker said the deal brings the company closer to solving evolving challenges “as cloud services become all-encompassing, including compute, storage, security and delivery from core to edge. … We’ve been talking about ‘alternative cloud’ — alternative to the big guy — and now we’ve sort of validated ourself in this market.”
    …
    The Old City company maintains “well over a million accounts” but has anywhere around 150,000 active users of its platform at any particular time. Linode’s HQ, the bank building at Third and Arch Streets, remains. … For clients and Linode employees, there won’t be too much noticeable change [Linode] says.


    Why does Akamai want Linode? Jonathan Greig asked the CEO:

    Akamai CEO Tom Leighton [explained] that Linode has great customer support and is already in 11 locations, which Akamai is going to “dramatically” expand. … Leighton also noted the September 2021 acquisition of Israel-based Guardicore, a cybersecurity company that offers a micro-segmentation solution to reduce the potential attack surface of corporate networks, secure applications, and meet compliance standards.
    …
    According to Leighton, the company is expecting the cloud compute category — which includes edge applications, its net storage business, and Linode — to reach “well over half a billion dollars in 2023. … We were pioneers in edge computing and now we’re taking a big step forward in cloud computing with Linode.”


    But here’s a worried-sounding zoid.com:

    Well good for them but I hope [Akamai] don’t screw it up. Linode is a great hosting company.

    2. Firefox isn’t OK

    Last week, a journalist innocently asked, “Is Firefox OK?” And people lost their minds.

    Analysis: No, not OK—it’s a big problem for DevOps and the web.

    We need Firefox and Gecko. A Chromium monoculture is bad for the web and bad for DevOps. (Before you ask: No, the existence of WebKit doesn’t change things, thanks to Apple’s ridiculous policies). Much as I tried to say something nice about Firefox last month, its market share is, frankly, pathetic.

    Matt Burgess: Is Firefox OK?

    In the two decades since Firefox launched from the shadows of Netscape … the browser has slid to less than 4 percent of the market—on mobile it’s a measly half a percent. … Its fate also has larger implications for the web as a whole.
    …
    Each year Google pays Mozilla hundreds of millions of dollars in royalties. … In its 2020 financial results … Mozilla listed its total revenue as $496 million. … The Google-Mozilla deal was last renewed in 2020 and is expected to expire in 2023. … Mozilla and Firefox acknowledge that for its long-term future it needs to diversify the ways it makes money.
    …
    Firefox still matters: … The browser market is dominated by Google’s Chromium codebase and its underlying browser engine, Blink. … Microsoft’s Edge Browser, Brave, Vivaldi, and Opera all use adapted versions of Chromium. Apple [has] its WebKit browser engine [but] other than that, Firefox’s Gecko browser engine is the only alternative.


    Firefox, how do we love thee? Let not_count_zero count the ways:

    I still use Firefox because:
    a) I remember Internet Explorer and the standards wars. …
    b) I don’t trust Google. …
    c) Most sites work well.
    …
    I do have questions though. … They’re currently getting around a half a billion‽ What are they doing with it? … This seems really off—really, really off.


    But heed a deeply worried Thom Holwerda:

    The decline and potential demise of Firefox is a massive problem that everybody seems to be kind of tiptoeing around—too afraid to acknowledge that if Firefox were indeed to disappear, we’d be royally screwed. We’d end up right back where we started 20 years ago, with Chrome being the new IE6.
    …
    The situation is especially dire for … Linux users, developers, and distribution makers. … Gnome Browser or KDE’s Falkon can barely be taken seriously, and … are based on Apple’s WebKit, which isn’t a great position to be in.

    3. Google’s Return to Work Plan Drops Vaccine Mandate

    Google is planning “celebrations” to welcome back employees after being fully remote. And in practice—unlike at IBM—this doesn’t mean a vaccine mandate.

    Analysis: Vocal minority wins—or do they?

    It was just three months ago that Google said it “firmly stands behind our vaccination policy.” What changed? It’s unlikely to have been due to a tiny minority of staff publishing a manifesto.

    Jennifer Elias: Google relaxes mandates

    The company will no longer require vaccination as a condition of employment … as it prepares to bring workers back to the office … at least three days a week for a “hybrid” work model. … The company [had previously] told employees that they must comply with vaccine policies or they’d face loss of pay and eventually loss of employment.
    …
    According to Google spokesperson Lora Lee Erickson … the company dropped the requirement … after removing the Jan. 18 deadline it had set for employees to either get vaccinated or get exemption approval. She declined to provide further details on the policy or the reasons for the reversal.
    …
    Google Real Estate and Workplace Services VP David Radcliffe [said Google] is preparing to begin its 30-day transition period to the hybrid work week if conditions continue to improve. He said his team is planning “celebrations” to welcome back employees. … Unvaccinated employees who are approved to enter offices will still need to follow additional protocols, including testing and wearing a mask.


    It’s too simplistic to say the anti-mandate brigade are also anti-vaxxers. For example, raxxorrax:

    I am vaccinated and HR knows this. … But if they officially demanded a certificate, I think I would have called it quits. Many people don’t have that option [but] there are consequences for such unreasonable demands.
    …
    I understand a mandate for vaccinations in certain occupations relating to health. It is something you have to personally accept if you want to work in the field.


    Although a few others are way over at the end of the bell curve. Greg Jinkerson:

    Don’t get excited, [Google is] still evil and stupid. … Now they’re backing down for some reason, [but] this is barely anything notable as far as a rollback of restrictions. [It] is not any kind of encouraging news.

    The Moral of the Story: Failure is the foundation of success—and the means by which it is achieved.


    You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

    Image: Aleksey Kuprikov (via Unsplash; leveled and cropped)

  • Natural Language Query (NLQ) is Key for Self-Service BI

    Natural Language Query (NLQ) is Key for Self-Service BI

    Modern business intelligence (BI) and analytics software solutions offer more ways to explore data and find insights than ever before. However, ensuring everyone in the enterprise can use analytics independently, when they need it, remains a challenge.

    For analytics to be adopted across the full enterprise, your tools need to be tailored for all users.

    While many BI solutions today provide streamlined experiences, some data literacy and knowledge is required to fully understand them. Dashboards, for instance, are considered self-service BI tools, but they are often still too technical for the average person to use effectively.

    Today, only two out of five (40%) organizations report their people can analyze data without getting help from IT, according to Ventana Research. To better enable business users to interrogate their data independently, certain BI vendors now provide a natural language query (NLQ) capability that sits alongside their dashboards and reporting. Rather than having to search for answers in a traditional dashboard or chart, NLQ allows analytics users to ask questions of their data directly.

    An Overview of NLQ

    Natural language query is a self-service BI tool that provides the ability for an analytics user to ask a question using non-technical language and get an automatically generated answer instantly. Using data modeling and machine learning technologies to parse questions for key terms, NLQ scans related databases and generates a tailored report or chart that provides relevant insight.

    The integration and implementation of natural language query capability, as well as the complexity of the questions and the types of data supported, varies between vendors. The most common and traditional approach is search-based NLQ, which places a free text search bar somewhere within the user interface (typically on a dashboard) that allows BI users to begin typing a question and get a list of reports and charts generated quickly as potential answers.

    A smaller number of vendors also include support for voice commands in their NLQ solution.

    As NLQ increasingly becomes a part of BI ecosystems, however, some vendors have evolved their natural language offering to account for additional barriers: A user still has to know what question to ask, and how they can use it to avoid inaccurate or irrelevant results to their question.

    The new approach is called guided natural language query, or guided NLQ, which takes the concept of NLQ further by programming the solution itself to guide the user as they type a question, helping them structure it using pre-defined sequences and suggested prompts.

    This eliminates the burden of knowledge or any potential problems in accurately interpreting the semantics (language) of a user’s question, as the system itself assists them in building it, from start to finish. They don’t need prior technical knowledge or need to go to IT to get started finding answers from data.

    When employed correctly, guided NLQ can help make the use of analytics more pervasive and open up analytics for every type of business person in the enterprise—not just experts.

    Self-Service That Suits Every Enterprise User

    The aim of NLQ is to help workers not accustomed to traditional, structured BI tools find insights and information they need to inform and make business decisions, while also being a helpful tool for advanced users throughout the enterprise.

    For non-technical analytics users, NLQ is an easy way to get detailed answers from their data faster than exploring a dashboard or chart and use it as a springboard for their ad-hoc reporting.

    Similarly, advanced users can leverage NLQ, whether guided or traditional, to quickly generate a report or chart and further build upon it.

    Generated insights using NLQ can be added into existing analytic content, such as dashboards, reports and data stories, to enhance them with additional detail, relatively quickly and easily.

    Finally, NLQ can be embedded into the interfaces of your users’ workplace applications, to make analytics far more ubiquitous in their day-to-day workflows. They can ask a question, get an answer, and start exploring data much faster and more easily than via dashboards alone.

    Ultimately, having an awareness of your users’ varying self-service BI needs, and how the new wave of tools such as Guided NLQ can help to further open up analytics to more people, will help you ensure your analytics tools are adopted and usable by everyone throughout the enterprise.

  • Automation is Key for Success of 5G at Scale

    Automation is Key for Success of 5G at Scale

    5G is more than a progressive step; it is a catalyst for individuals, society and industries to meet their digital aspirations. 5G goes beyond connectivity by providing a platform to collaborate across industries, and 5G networks will be at the center of an ecosystem that pushes society’s continued digital transformation forward. By design, 5G networks will be flexible and modular, with technologies such as network slicing, software-defined networks (SDN), cloud-native and cloud radio access networks (cloud RAN). A flexible architecture makes it feasible to increase overall network capacity as needed, completing the standardization of application programming interfaces (APIs) towards underlying infrastructure, which will be key for automated connectivity to a heterogeneous network. APIs have sparked a revolution in banking, finance, health care and other fields, and now it is communications’ turn.

    Communications service providers (CSPs) can’t lose sight of the imminent innovation coming from cloud and cloud-native software. 5G is where telco meets IT. Virtualization, cloud edges and containerized 5G deployment alongside a legacy network bring tremendous challenges with numerous interfaces, processes and complexities. The basic automation model that exists today will not be able to support the next-generation networks that come with a plethora of connected devices and the volume of traffic that must pass through. End-to-end, closed loop automation is going to be the catalyst that accelerates the space from network-centric operations toward customer-centric operations.

    Why Automation is Crucial in 5G

    5G drives incident-driven operations toward data-driven operations. It also drives human-triggered automation toward outcomes, triggers processes and initiates massive machine-to-machine communications. At the same time, the internet of things (IoT) has vastly increased the number of endpoints that need to be managed and, as network slicing comes to fruition, network slices will include SLA delivery models, which will be beyond humans’ ability to manage.

    As a result, CSPs must rethink the way their networks operate now and enhance their existing value-adds by complementing their existing, strong cellular expertise with software capabilities. As organizations integrate their networks with cloud assets, databases and application assets, they must focus on incorporating automation at every step to efficiently manage their 5G networks and enable new 5G offerings.

    AI/ML and Automation

    5G is evolving alongside AI and ML. The high speed and low latency of 5G along with AI and IoT are going to significantly impact the way we live and work. 5G and intelligent connectivity enable automation to go through a complete transformation from digitization to artificialization. ML is pushing CSPs from playing the role of digital service provider to becoming cognitive service providers. AI will augment human decision-making in telecommunications to achieve newer use cases. The power of AI can be used to identify features and qualities in the current environment from a large set of big data, then analyze the use cases and predict future network failures which will help to mitigate the impact of any possible failure.

    Enabling digital innovation is a high priority for CSPs as they transition from a prescriptive model to a declarative, API-driven and DevOps model. Success will ultimately depend on efforts to build the necessary organizational readiness. By leveraging cloud technology, managing risk, embracing openness and establishing a human-augmented AI model, CSPs can break silos in their network and enable this transition to happen.

    Are CSPs Ready to Embrace the New Era of Automation?

    In the 5G era, mobile will become even more central to our daily routines. According to a GSMA report, the economic value created by 5G connectivity will reach $1.4 billion by 2025 and 5G will contribute $2.2 trillion to the global economy over next 15 years.

    5G networks will require automation that can support multi-domain and multi-vendor technologies, as services such as network slicing will traverse across multiple network segments like radio, access, core and edge, which may contain a mix of virtual and physical network functions.

    On their journeys from communications service provider to cognitive service provider, many network operators today have orchestrated network and IT domains, but few have the capability to orchestrate end-to-end services, given the fact that physical legacy networks will coexist with cloud-native network functions. While network slicing and tailored connectivity are still in their early days, full automation will not happen without end-to-end service orchestration.

    To enable automation on every aspect of the network, CSPs must embrace fully interoperable, data-centric solutions that offer the visibility and monitoring that is expected of cloud-based applications. By working closely with customers, each network function can be built in microservices with fully automated testing and regression testing and by leveraging DevOps for carriers.
    5G is the catalyst that is converging telecom network engineering and operations with IT. The vast amount of data to be analyzed for insight-driven business models is forcing a cultural shift from pure network management to services management. Evolved, smarter networks, new agile and insight-driven business models all require that 5G automation be taken to the next level. Simply put, automation is not an option but a necessity.

  • The Past, Present and Future of OpenStack

    The Past, Present and Future of OpenStack

    OpenStack, described as the world’s most widely deployed open source cloud software, will mark its 12-year anniversary milestone later in 2022. In September 2012, the OpenStack Foundation launched as an independent organization to manage and promote the technology—a watershed moment for a project announced just two years earlier.

    Today, with contributions from more than 34,000 people at 550 companies, OpenStack is one of the three most active open source projects, alongside the Linux kernel and the Chromium web browser, according to the group now known as the Open Infrastructure Foundation (OIF). More than 25 million OpenStack cores are running in production worldwide.

    It’s easy to forget that only a few years ago many predicted OpenStack’s demise. Initially, OpenStack was positioned as a general-purpose private cloud platform that offered an open source alternative to Amazon Web Services (AWS), but it never stood much of a chance in that matchup.

    Then, after OpenStack regained momentum and pivoted to become a platform for telco network function virtualization infrastructure (NFVI), it was rumored that it would be overtaken by the new ‘next big thing’—Kubernetes, the open source orchestration and coordination system for containerized applications. 

    The Kubernetes-as-OpenStack-killer talk was silly, in retrospect, because the technologies are complementary, not competitive. In fact, more than 70% of OpenStack users reported running Kubernetes on top of OpenStack for container coordination, according to the OIF.

    And OpenStack adoption should continue to flourish in 2022. Gartner forecasted that global spending on cloud services will exceed $480 billion this year, up from $313 billion in 2020, as more organizations invest in hybrid cloud: A mix of pay-as-you-go public clouds and private clouds that can offer lower, more predictable operating costs and greater customization. As the hybrid cloud market expands and open source continues to become more firmly entrenched in development and IT organizations, OpenStack is more relevant than ever.

    If you’re not familiar with OpenStack, here are 10 things you should know about its past, present and its future.

    1. OpenStack began in early 2010 as a collaboration between Rackspace and engineers at NASA’s Ames Research Center in Mountain View, California. Rackspace wanted to rewrite the infrastructure code running its cloud servers and the NASA team wanted to standardize the space agency’s websites. Their original mission was “to produce the ubiquitous Open Source Cloud Computing platform that will meet the needs of public and private clouds regardless of size, by being simple to implement and massively scalable.”

    2. The first OpenStack design summit was held in Austin, Texas in July 2010, and the project was officially launched at the O’Reilly Open Source Convention (OSCON) later that month.

    3. A whopping 80% of OpenStack clouds are used in production, while 13% are under development and 8% are in the proof-of-concept stage, according to the OIF. With that level of adoption, no wonder OpenStack is considered the most widely deployed open source cloud software.

    4. An OIF survey showed that nearly half of the organizations using OpenStack have deployed at least 1,000 cores. The breakdown: 29% of organizations have 1,000-9,999 cores, 13% have 10,000-99,999 cores, 6% have 100,000-999,999 cores and 1% have one million or more cores.

    5. An enormous corporate ecosystem supports OpenStack, including IBM, Red Hat, HP Enterprise, Intel, Huawei, NEC, Cisco, VMware, AT&T and Canonical, whose Ubuntu Linux distribution is the most popular operating system for OpenStack deployment (used by about 40% of OpenStack clouds globally).

    6. OpenStack has a great resource guide available on openstack.org with all kinds of helpful information for developers, including for those new to the platform.

    7. One of the main qualities people love about OpenStack is that it’s a modular architecture with interconnected components including, for example, services that expose API endpoints and handle basic cloud functions, a dashboard, SQL databases that store records created by OpenStack services and message queues for facilitating inter-process communication. 

    8. OpenStack jargon includes several special terms. A tenant, for example, is a user or group of users with isolated cloud resources. (OpenStack is multitenant.) An image is a template containing an OS for instance provisioning. A flavor is a template defining cloud resources for instance provisioning. An instance is a virtual machine (VM) provisioned from the image and flavor. And so on.

    9. The platform has expanded through the years to include a panoply of core services, such as the Keystone identity service that manages domains, projects, roles, groups and user accounts, the Glance service that manages the catalog of cloud images, Nova for instance provisioning, scheduling and termination, the Neutron network service and the Cinder block storage service.

    10. Beyond these core services, several newer services are seeing increased adoption. For example, according to the OIF, use of Ironic, a project that provisions bare metal, nearly tripled between 2016 and 2021. Others with growing traction include Octavia, which provides load balancing capabilities, Manila for file system sharing between instances and OpenStack Charms which provide rich life cycle management capabilities for services.

    As these 10 points show, far from being on its deathbed, OpenStack has survived, sometimes against the odds, and thrived as a unique force in open source and cloud computing. Given its journey over the last 10 years, it will be interesting to see what lies ahead in the next decade.

  • Snyk Acquires Fugue to Secure Cloud Infrastructure

    Snyk Acquires Fugue to Secure Cloud Infrastructure

    Snyk today announced it has acquired Fugue as part of an effort to embed security within an infrastructure-as-code (IaC) provisioning tool.

    The Fugue platform combines a unified policy engine with an implementation of the open source Open Policy Agent (OPA) software, dubbed Regula, to ensure security and compliance policies are consistently enforced. OPA provides IT teams with a tool for declaratively applying policies and is being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

    The Fugue IaC tool also provides pre-deployment security checks for Terraform, AWS CloudFormation, Kubernetes manifests and Dockerfiles. It enables IT teams to create and test custom policies using Rego, the programming language created for OPA. In addition, there are interactive visual maps of IaC templates and the ability to export IaC diagrams that IT teams can use for planning and approval processes.

    Josh Stella, the former CEO of Fugue who is now a chief architect for Snyk, said Regula is designed to make it possible to apply those policies to both cloud-native and legacy monolithic applications. Tighter integration with the cloud security posture management (CSPM) tools that Snyk provides will make it possible to provide developers with an instant feedback loop as they provision infrastructure, he added. Armed with that intelligence, it becomes less likely that mistakes will be made and that cybercriminals can take advantage of those, noted Stella.

    DevOps teams should also expect to see Fugue integrated with the artificial intelligence capabilities Snyk gained with the acquisition of DeepCode, a provider of an interpretable machine learning semantic code analysis tool that scans code anywhere from 10 to 50 times faster than existing approaches. In total, Snyk has acquired five companies in the last 18 months, including CloudSkiff, FossID, Manifold and DeepCode.

    Misconfigurations of IT infrastructure have emerged as a major issue in the cloud era. Developers often have little to no cybersecurity expertise, and using application programming interfaces (APIs) to provision IT infrastructure themselves increases the chance that mistakes will be made. The acquisition of Fugue creates an opportunity to address that issue at a time when the management of infrastructure and applications is converging, said Stella.

    The amount of focus on cloud security also is increasing as part of a larger discussion involving software supply chains that increasingly becoming targets of attack. Cybercriminals are becoming more adept at scanning for vulnerabilities created when developers, for example, inadvertently leave open a port on a cloud service through which data can be exfiltrated.

    It’s not clear just how far responsibility for cybersecurity will shift left toward developers in the months and years ahead. However, as more intelligence is incorporated into the tools that developers use, the easier it will become to automate DevSecOps best practices. In fact, the goal should be to make it easier to build more secure applications faster rather than forcing organizations to slow down to deal with security issues that should never happened in the first place.

  • IBM ‘is Ageist and Sexist’ | IBM Mainframe-aaS | IBM Vaccine Mandate

    IBM ‘is Ageist and Sexist’ | IBM Mainframe-aaS | IBM Vaccine Mandate

    Think! Welcome to Big Blue Week here at The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: IBM’s employment practices scrutinized, IBM z/OSaaS breaks cover, and IBM encourages staff back to the office.

    1. ‘Dinobabies’ and ‘Dated Maternal’ Workforce Woes

    First up this week: IBM’s defense in an employment age discrimination lawsuit looks to be shredded. Internal emails “appear to show high-level discussion about paring the ranks of older employees.”

    Analysis: Not a good look

    According to one of the plaintiff’s lawyers, unnamed “top IBM executives were explicitly plotting with one another to oust older workers … to make room for millennial employees.” On the face of it, they seemed to be doing the polar opposite of the Age Discrimination in Employment Act.

    Noam Scheiber: Making ‘Dinobabies’ Extinct: IBM’s Push for a Younger Work Force

    Top IBM executives were directly involved in discussions about the need to reduce the portion of older employees … sometimes disparaging them with terms of art like “dinobabies.” … Documents made public by a Federal District Court … show executives discussing plans to phase out older employees.
    …
    The newly unsealed documents, which quote from internal company emails … show top IBM executives specifically emphasizing the need to thin the ranks of older workers and hire more younger ones. [One] email refers to IBM’s “dated maternal workforce,” an apparent allusion to older women, and says: “This is what must change. They really don’t understand social or engagement.”
    …
    Adam Pratt, an IBM spokesman, [claimed,] “IBM never engaged in systemic age discrimination.” [He] said that some of the language in the emails “is not consistent with the respect IBM has for its employees” and “does not reflect company practices or policies.”


    Yikes, ageism and sexism? Experienced staff are valuable, says MrBanana:

    I did some time at IBM [and] remember being invited to a meeting with a new group, headed by a new “thinker,” who had something to present to myself and a colleague. We walked past the foosball table to the meeting room. Naturally the room had no chairs, and was covered in multi-coloured Post-it Notes. Once they had gone through their mood boards and the non-linear presentation of this new idea, I turned to the other old geezer in the room. “Didn’t we look at something like this 8 years ago?”

    “Yeah, we worked out that compute power just to run the UI for one session wouldn’t be available for a couple of decades.” The children were somewhat disappointed, and (fortunately) we were never asked back to their romper room.


    But experience can be both a blessing and a curse, learned aahortwwy:

    I experienced both sides of this in five years at a company in hypergrowth. … I learned so much at that job: … In year 1, I was determined to accomplish X and ignored the skeptical comments of some colleagues who’d been at the company longer than me. I failed and wasted some time. In years 4 and 5, new colleagues were determined to accomplish X and ignored my skeptical comments.

    2. IBM Wazi as-a-Service Confusion

    “Mainframe” is not a dirty word. It’s secure, vertically scalable, and it put the VM in VMware. Now, what IBM Wazi did for on-prem LPARs, Wazi aaS promises to extend to hosting z/OS instances.

    Analysis: Mainframe-as-a-service reinvented

    Mainframes and cloud-native DevOps need not be incompatible. To modernize legacy apps using hybrid cloud instances for dev/test—and even prod—can be a big productivity boost. But isn’t it weird that IBM spun out its mainframe-as-a-service zCloud offering only a few months ago?

    Mike Vizard: IBM Shifts Mainframe App Testing to the Cloud

    While many workloads over the years have been migrated off mainframes or simply retired, the applications that run on z/OS today are still among the most mission-critical that organizations run. … IBM this week revealed it has added the ability to set up testing environments on the IBM Cloud for z/OS mainframe applications.
    …
    IBM plans to make IBM Wazi as-a-Service (Wazi aaS) for z/OS generally available in the second half of this year, [which] will enable DevOps teams to self-provision an instance of a z/OS virtual server on a secure private space running on IBM Cloud. … At the same time, it will become easier to modernize mainframe applications by making them more accessible to other applications via a set of secure APIs … using a cloud-native set of DevOps tools that run in a Kubernetes environment.
    …
    Modernizing mainframe applications is a less complicated endeavor than migrating them. The challenge is that building, deploying, maintaining and securing all the APIs required to do so represents a significant amount of effort.


    OK, boomer, why are we talking about 1960s mainframes on devopsy.kinsta.cloud? Here’s ArchieBunker:

    Mainframes are different beasts altogether, almost alien when you compare them to PC hardware. You have binaries written for the S/360 system in the 1960s? Good news you can still run them natively without a recompile.

    You think virtualization and containers are a hot topic? IBM was running multiple OS instances inside a VM in the 1970s. … The engineering is incredible.


    But z/OSaaS? It’s déjà vu time for Beleagured Greybeard:

    “Cloud Managed Services for z” AKA “zCloud” has been around for over 10 years. … IBM offloaded it with the Kyndryl spin, so its odd that they now want to re-invent it.
    …
    If it’s a strategic platform, why didn’t they hold onto it instead of spinning it off to Kyndryl? Sounds like yet more daft leadership decisions.

    3. IBM’s Return to Work Plan has Vaccine Mandate

    IBM wants to “keep employees safe” as they return to office work after being fully remote. In practice, this means a vaccine mandate.

    Analysis: IBM Digital Health Pass is divisive to vocal minority

    Although there are exemptions on medical or religious grounds, IBM has promised to place dissenters on unpaid leave. As you might expect, the policy has a few employees up in arms.

    Cassie Werber: How Salesforce, IBM, and HSBC are approaching return to work

    When the pandemic hit, and IBM moved 95% of its workforce to fully remote, it was pleasantly surprised to discover no drop in productivity. … Still, they planned to return to offices.
    …
    The company saw this as a way to keep employees safe. … One example … is its development of the IBM Digital Health Pass as an alternative to vaccine cards or paper vaccine certificates, which they use to make sure all the staff that come into their offices are vaccinated.
    …
    Arvind Krishna, IBM’s CEO, meanwhile came up with what he called the IBM Work From Home Pledge. [It] included commitments to flexibility, kindness, sensitivity to family, setting boundaries, and acknowledged video fatigue. It concluded with a commitment to “be connected.”


    Tricky to “be connected” if you’re not allowed back in the building. Anne D’Innocenzio, Heather Hollingsworth, Tali Arbel, Mae Anderson, Ken Sweet, Matt O’Brien and Dee-Ann Durbin:

    IBM software engineer Justin Albano said his company recently notified employees that it would be revoking badge access to workers who aren’t vaccinated or haven’t proved that they are. “We’re not able to enter an IBM office at this time,” said Albano.
    …
    He said some workers have successfully sought religious exemptions but “my thought process was I shouldn’t have to explain to my company my faith” to get out of a policy that’s “immoral in its foundation.”


    What’s the alternative? With a perspective, it’s Chris Haney:

    Or, get the vaccine. Protect yourself and the people around you. You people really are detached from reality.

    The Moral of the Story: Those who know do not speak; those who speak do not know.


    You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

    Image: Marcin Wichary—cc:by; leveled and cropped (ask your parents)