devopsy.kinsta.cloud

Category: Blogs

Self-Hosting is Dead. Hybrid is the Way to Go

If I scroll back through my photo library, it’s astonishing how few photos I have from before 2004. And in 2006 (and probably for a few years after that), I still kept every photo I had on the hard drive of my laptop computer. If I lost that laptop, those photos would be gone forever. At some point, I went through the process to back them up to an external hard drive.

And then along came the cloud. At some point, I could give my pictures to Apple or Google and not worry about backups. There was always the possibility they could have a critical disaster and lose every wedding photo I had or all the early pictures of my kids (it could still happen). But as a father who takes way too many pictures of my kids, I no longer maintain an external drive of backups because the several terabytes of photos I have are sufficiently stored and backed up in the big cloud provider I pay to handle it. The SaaS solution in a cloud backup was more than sufficient for me.

Camera Rolls and Data Centers

Likewise, it wasn’t that long ago that any meaningful internet presence required a company to have a large server room and host their own infrastructure. That meant racks and racks of computers and an enterprise internet connection to make sure customers could access those racks of computers. Most services you relied upon had to be close by physically to deal with latency and ensure the experience worked for your customers.

Logging and metrics were kept locally, as were backups. I’m sure I’m not the only one who remembers swapping out big tape drives for daily backups and storing them in large plastic bins somewhere we really hoped wouldn’t flood.

If you were using a significant piece of software, you would need to self-host that software for many reasons—but the biggest reason was that shared infrastructure wasn’t a reality yet. There was no way to share hardware and no meaningful way to share software in a multi-tenant environment.

IaaS, the Cloud, Automated Backups and SaaS

Today, the infrastructure-as-a-service (IaaS, or “Cloud”) providers are offering everything from email hosting to Kubernetes-as-a-service (KaaS), from serverless to logging. They even make sure the software that enables your edge computing is obscured from you and managed by them (backups are automatic! And included in the price! And happen without a single person touching a tape drive!). This frees us up significantly to spend time shipping code and bits instead of fiddling with wires, CPUs and drives. It’s like shipping your photos to a SaaS photo storage provider—it takes the headache and the worry away. Yet when companies move to the cloud, many maintain the “old way” of doing things because they haven’t adjusted to the new reality yet.

There is now no need to self-host your own email service. The cloud provides it, or you can use a third-party service that runs in the same cloud. Data proximity is no longer a concern, and latency won’t suffer. Similarly, there is no need to self-host your backups or even your logging service—because the cloud will provide it, and similarly, a third-party service is no longer a latency concern—that third party is probably hosted by the same cloud in the same region.

This move to the cloud and shared infrastructure has been a game changer. SaaS is the name of the winning solution. Still, there will always be some companies with compliance or security needs that want to maintain data residency, just like there will always be people with such sensitive data or important family photos that no matter how safe and reliable the cloud is, they’ll insist on self-storage for photos and backups.

The Hybrid Solution

That’s why a hybrid cloud is the future of cloud-native solutions for complex enterprise applications and data. You host the data, but the SaaS provider hosts the application. The data stays under your control, but the SaaS firm updates the application regularly. Today, a large enterprise may have five engineers just to handle a self-hosted version of a logging app. At $180,000/year per engineer (a reasonable tech salary today), that’s almost a million dollars per year to maintain a software product that the vendor will gladly maintain for you.

This is a simple shift, but it has only become a reality recently due to advances in technology, the things the cloud has enabled and the increased headache—now seemingly unnecessarily dated—of self-hosting (and then upgrading and patching) software built by a third party.

With a hybrid cloud offering, you’re always using the latest version of the software because you’re using the software hosted and updated by the SaaS provider. There is no need to self-update, scale up or down or security patch a self-hosted install. The SaaS provider handles the compute and scaling required to make the service run smoothly. And you get the best of both worlds — zero software maintenance while still keeping your data in your own hands.

To hear more about cloud-native topics, join the Cloud Native Computing Foundation, Techstrong Group and the entire cloud-native community in Paris, France at KubeCon+CloudNativeCon EU 2024 – March 19-22, 2024.

February 29, 2024
10 Ways to Optimize Your Cloud

Cloud optimization is the process of correctly selecting and assigning the right resources to a workload or application, ensuring that the resources are used efficiently and the performance is optimized. It’s about making sure you’re getting the most out of your cloud infrastructure. This includes ensuring that you’re not overprovisioning–or, indeed, underprovisioning–your resources and that you’re using the right services for the right tasks.

Cloud optimization is crucial for several reasons. First, it can lead to significant cost savings. By optimizing your cloud resources, you can ensure that you’re only paying for what you need. Second, it can improve performance. By ensuring that your workloads are matched with the appropriate resources, you can ensure they run as efficiently as possible. Cloud optimization can even help improve security by reducing the attack surface and ensuring that resources are appropriately protected.

Now that we’ve covered the basics, let’s dive into some practical steps you can take to optimize your cloud environment.

Practical Ways to Optimize Your Cloud

1. Right-Size Your Services

One of the first steps in optimizing your cloud is to right-size your services. This means ensuring that you’re using the right services for the right tasks and that you’re not overprovisioning your resources, which can lead to wasted resources and unnecessary costs.

By the same token, underprovisioning can lead to poor performance and service interruptions. To right-size your services, you need to understand your workloads and their requirements. This might involve conducting a thorough audit of your existing services or using cloud management tools to monitor usage and performance.

2. Leverage Auto-Scaling Features

Auto-scaling is a powerful feature offered by many cloud providers. It allows you to automatically scale your resources up or down based on demand. This can help to ensure that you’re only using (and paying for) the resources that you need, and it can also help to improve performance by ensuring that your workloads have the resources they need to run efficiently.

To leverage auto-scaling, you’ll need to set up scaling policies. These policies dictate how and when your resources should be scaled. For example, you might set a policy to scale up your resources during peak usage times and scale them down during off-peak times. Auto-scaling can be complex, but it’s well worth the effort.

3. Implement Cloud-Native Architectures

Cloud-native architectures are designed to take full advantage of the capabilities of the cloud. They are built on microservices, which are small, independent services that work together to deliver a larger application. This approach has several advantages when it comes to cloud optimization.

First, because each microservice is independent, it can be scaled independently. This allows you to precisely match resources to demand. Second, because microservices are small and focused, they can be more efficient than larger, monolithic applications. Finally, cloud-native architectures are designed to be resilient and fault-tolerant, which can help to improve performance and reliability.

4. Optimize Data Storage

Data storage is a significant cost for many organizations, and it’s an area where optimization can yield substantial savings. There are several strategies you can use to optimize your data storage.

First, consider using tiered storage. This involves storing your data on different types of storage media based on how frequently it’s accessed. Frequently accessed data is stored on high-performance, expensive storage, while rarely accessed data is stored on cheaper, slower storage.

Second, consider using data compression and deduplication. These techniques can reduce the amount of storage space your data requires, leading to cost savings.

5. Manage and Monitor Cloud Costs

One of the most important aspects of cloud optimization is cost management and monitoring. This involves keeping a close eye on your cloud spending and taking steps to control it.

There are several ways to do this. First, you can use cost management tools provided by your cloud provider. These tools can give you insights into your spending and help you to identify areas where you could make savings. Second, consider setting up budget alerts. These alerts notify you when your spending exceeds a certain threshold, helping you to keep costs under control.

6. Adopt a Multi-Cloud Strategy

A multi-cloud strategy involves using multiple cloud services from different providers. The primary advantage of this approach is that it allows you to leverage the best features of each service, enabling you to tailor your cloud environment to your specific needs.

In addition, a multi-cloud strategy can help improve your disaster recovery capabilities. By distributing your workloads across multiple cloud providers, you can ensure that your applications remain available even if one of your cloud provider(s) experience(s) an outage.

However, managing multiple cloud services can be complex. It requires a deep understanding of each provider’s offerings and pricing models. Therefore, it’s crucial to have a dedicated team that can oversee your multi-cloud strategy and ensure that you’re getting the most out of your investment.

7. Implement Caching Strategies

Caching involves storing data in a temporary storage area, known as a cache, to improve data retrieval times. By retrieving data from a cache instead of the source, you can significantly reduce latency and improve your application’s performance.

One caching strategy you can implement is edge caching. This involves storing data in edge locations, which are geographical locations near your users. When a user requests data, it’s retrieved from the nearest edge location, resulting in faster data delivery.

Another caching strategy is in-memory caching. This involves storing data in the memory of your cloud servers. Since memory is faster than disk storage, retrieving data from memory can significantly speed up your applications.

8. Use Managed Services

Managed services are another way to optimize your cloud environment. These are services provided by cloud providers that handle the day-to-day management of your cloud infrastructure. By using managed services, you can offload the burden of managing your infrastructure to your cloud provider, freeing up your team to focus on more strategic tasks.

Managed services also come with the expertise of your cloud provider. They have deep knowledge of their infrastructure and can help you navigate the complexities of the cloud. This can result in better performance and reliability for your applications.

9. Adopt Infrastructure-as-Code (IaC)

Infrastructure-as-code (IaC) is a strategy where you manage and provision your cloud infrastructure through code rather than manual processes. This approach allows you to automate your infrastructure management, reducing the chances of human error and improving the consistency of your infrastructure.

IaC also makes it easier to scale your infrastructure. Instead of manually provisioning new servers, you can simply update your infrastructure code and apply it to your cloud environment. This can significantly speed up your scaling process and ensure that your infrastructure can handle sudden increases in demand.

However, adopting IaC requires a shift in mindset. Instead of treating your infrastructure as a set of static servers, you need to treat it as a dynamic, programmable resource. This can be challenging, but the benefits are well worth the effort.

10. Optimize Cloud Workloads With AI and Machine Learning

The final strategy to optimize your cloud environment is leveraging AI and machine learning. These technologies can help you analyze your cloud usage patterns and identify opportunities for optimization.

For example, AI can help you predict your future cloud usage based on historical data. This can help you proactively scale your infrastructure to meet expected demand, preventing performance issues before they occur.

Machine learning can also help you optimize your resource allocation. It can analyze your workloads and determine the optimal configuration for each workload, ensuring that you’re using your resources as efficiently as possible.

Conclusion

In conclusion, optimizing your cloud environment involves a comprehensive approach that spans from right-sizing services and leveraging auto-scaling features to adopting cloud-native architectures and implementing advanced strategies like AI and machine learning for workload management.

Each of these ten strategies plays a crucial role in enhancing the efficiency, cost-effectiveness, and performance of your cloud infrastructure. By understanding your workloads, utilizing the right tools, and embracing the dynamic nature of cloud computing, you can achieve significant improvements in your cloud operations. This optimization not only reduces costs but also improves service delivery, ensuring that resources are allocated effectively and that your infrastructure is resilient and adaptable to changing demands.

February 29, 2024
JFrog Extends MLOps Integration Efforts via Qwak Alliance

JFrog today announced it has integrated its DevSecOps platform with a managed machine learning operations (MLOps) platform from Qwak to advance collaboration between teams building and deploying multiple classes of software artifacts.

This alliance comes on the heels of a similar Amazon Sagemaker alliance announced last month that also integrated a managed service for building artificial intelligence (AI) models provided by Amazon Web Services (AWS) with the JFrog Software Supply Chain Platform.

Both machine learning operations (MLOps) platforms provide data science teams with a complete stack of curated tools required for building AI models from the ground up versus, alternatively, customizing AI models that were previously built.

Gal Marder, executive vice president for strategy for JFrog, said integration with the Qwak platform makes it possible to manage the software artifacts created by MLOps teams alongside the rest of the software artifacts a DevSecOps team is already managing. That approach makes it possible to also detect and block the use of malicious ML models in addition to ensuring models comply with company policies and regulatory requirements, he noted.

As it becomes apparent that more AI models will be directly embedded within applications, the need to integrate DevOps workflows with machine learning operations (MLOps) platforms used to create AI models is becoming more pronounced, said Marder.

JFrog Software Supply Chain Platform can be used to provide both data scientists and developers with a single source of truth for securely managing software artifacts using a common repository to foster greater collaboration between teams that, in most cases, are still determining how best to collaborate, he added.

The challenge is data scient teams typically train and deploy AI models every few months, while DevSecOps teams are often updating applications multiple times a month. Data science and DevSecOps teams, as a result, generally have distinct cultures, but in the long term, DevOps and MLOps workflows will eventually merge, said Marder.

Most organizations are still trying to determine how best to operationalize AI using their own data. In the term, AI models are being invoked via application programming interfaces (APIs). Still, it’s also now only a matter of time before more AI models are embedded in applications to improve overall performance. The challenge is that AI models can’t be updated the same way other software artifacts are patched, so managing versions of AI models will require a different set of controls as one model replaces another. JFrog, for example, has developed versioning capabilities that can be applied to AI models in the context of a DevOps workflow.

There is, of course, already no shortage of MLOps platforms, so DevOps teams should expect to see a wave of alliances being formed between the providers of these platforms. Less clear is to what degree those alliances might lead to mergers and acquisitions among the providers of those platforms.

One way or another, however, AI models are coming to DevSecOps workflows. The only issue to be resolved is how best to manage their deployment alongside all the other types of software artifacts already moving through existing DevOps pipelines.

February 28, 2024
How Much Testing is Too Much?

We have reached an interesting point in the automation of IT in general and testing specifically. Our tooling now allows us to generate a list of all of the possible permutations of a given test set. This is interesting because we can generate all of the possible permutations of a given test. We can also automatically run all of the tests so generated. And we can automatically filter those results, only raising what needs greater attention to a human for evaluation.

And that’s not necessarily a good thing.

Nothing is free. Nothing. In the case of pervasive testing that goes beyond the wildest dreams of the most stringent QA manager, it costs a lot. The CPU cycles and storage space to create, execute, evaluate and notify the volume of tests we are talking about is exorbitant and unlikely to be adopted by your average organization. Truth is, it is unlikely to be adopted by any organization, but there is always some corner case, so I’m being a little vague to keep the conversation focused on the technical issues.

Testing vendors are already working on filtering tools to test only what has changed in the product, but this implies that, at a minimum, this level of testing should not be applied when testing is most needed–during initial development. I might be bringing my baggage along, but I personally prefer focused and curated testing to a firehose that is always on. It doesn’t take much imagination to see a scenario where a full-on automated test filtering tool is off just a little bit, and we get flooded with alerts that are not necessarily false positives but that include information we don’t want to see and consume man-hours needlessly.

Like everything in our recent past, this process will be rolled out too early and then will get tweaked and fixed on the fly, with you and I paying for the privilege of being beta testers, in fact, if not in name. So, I strongly advise caution in adopting new testing automation. I’m super excited by the possibility that all application testing can get the attention it deserves. Still, I am not at all interested in being the experiment on the way to that panacea. So watch the space, listen to other tech folks, and pay attention to how it is working out for them. We have had a tiny percentage of test coverage for so long that waiting for the early adopters to work out the kinks is not going to cause too much additional risk.

As a couple of glaring scenarios have recently reiterated, high-tech vendors are more than happy to do to you in the age of recurring revenue rather than for you. Use caution; make sure that any test automation tool you use aligns with your corporate goals and that the ones you hold subscriptions to are not rolling out massive test automation behind your back. Know your product, and pay attention to any changes in release or license—now more than ever.

And keep rocking it. Soon, we will have effective 100% or near 100% coverage in testing; just don’t rush it. Let the work mature and keep your eyes focused on serving your customers the best product you can without adopting bleeding-edge ideas that might create liability via technology or implementation immaturity. Your customers should thank you, but far too many won’t, so I will for them. Be they internal or external, those who use your systems owe you big thanks for the quality and massive uptime they take for granted.

February 28, 2024
Securing the DevOps Pipeline: Tools and Best Practices

The DevOps pipeline refers to the set of practices and tools designed to automate and integrate the processes between software development (Dev) and IT operations (Ops) teams. This pipeline facilitates continuous integration (CI), continuous delivery (CD) and rapid deployment practices, aiming to shorten the development life cycle and provide continuous delivery with high software quality.

The DevOps pipeline typically includes planning, coding, building, testing, releasing, deploying, operating and monitoring, enabling teams to develop and deploy software more efficiently and with fewer errors.

By automating workflows and integrating various development and operational activities, the pipeline supports the rapid iteration of software releases. This not only accelerates the pace of software development but also ensures that quality and performance standards are met throughout the application’s life cycle.

Due to the critical nature of the DevOps pipeline, security is becoming a top priority. Some of the most devastating cyberattacks in recent years were related to breaches in DevOps pipelines, which led to global-scale supply chain attacks.

The Need for Security in DevOps

DevOps, by its very nature, encourages speed and efficiency. However, this drive for rapid software development and deployment can sometimes overlook the critical aspect of security. That’s why it’s essential to weave security into the fabric of the DevOps pipeline, an approach known as DevSecOps. By doing so, we can ensure that security isn’t an afterthought but an integral part of the development process.

Incorporating security into the DevOps pipeline offers multiple benefits. First, it helps identify and rectify security vulnerabilities early in the development process, reducing the risk of security breaches. It also fosters a culture of shared responsibility, where the development, operations and security teams work together toward the common goal of creating secure software.

Tools for Securing the DevOps Pipeline

Securing the DevOps pipeline requires a set of tools that align with the DevOps philosophy of automation and continuous improvement. Let’s explore some of these tools.

Static Application Security Testing (SAST)

SAST, also known as white-box testing, is a tool that helps locate security vulnerabilities in the codebase without executing the application. It makes it possible to identify issues early in the development process, even before the code is run.

SAST works by analyzing the source code, bytecode or binary code, looking for patterns that might indicate a security flaw. The strength of SAST lies in its ability to pinpoint the exact location of the security vulnerability in the codebase. This makes it easier to fix the issue, thus saving time and resources.

Dynamic Application Security Testing (DAST)

DAST, a type of black-box testing, involves testing the application in its running state. It’s designed to find security vulnerabilities that can’t be spotted during static analysis.

DAST works by simulating attacks on the application and observing its response. It can identify security issues like cross-site scripting (XSS), SQL injection and security misconfigurations. The beauty of DAST is that it views the application from an attacker’s perspective, thus providing a real-world assessment of its security. However, DAST can’t identify vulnerabilities in the source code and relies on the application being in its running state for testing.

Software Composition Analysis (SCA)

Software composition analysis (SCA) is designed to provide visibility into the open source components used in the software. It helps identify any security vulnerabilities, licensing issues or outdated libraries in the open source components.

SCA works by creating a bill of materials (BOM) that lists all the open source components used in the software. It then compares this list against various databases that track open source vulnerabilities. If a match is found, SCA flags the component, allowing the developers to take necessary actions.

Endpoint Detection and Response (EDR)

Endpoint detection and response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. EDR tools continuously monitor endpoint and network events and record the information in a central database where further analysis, detection, investigation, reporting, and alerting take place.

EDR is like a surveillance system for your DevOps pipeline. It keeps an eye on endpoint activity, and if it detects a potential threat, it alerts developers and security staff. EDR is not just about detection; it also provides tools for responding to security incidents. It helps isolate affected systems, block malicious activities and even roll back systems to their pre-attack state.

Container Security Tools

In a DevOps environment that increasingly relies on containerization, container security cannot be overlooked. Container security tools provide a means to enforce security policies and protect containerized applications.

These tools offer functionalities like image scanning, runtime protection and network segmentation. Image scanning helps identify vulnerabilities in the container images. Runtime protection monitors the container’s activities in real-time, looking for any signs of compromise. Network segmentation allows for isolating containerized applications, thus limiting the blast radius in case of a security incident.

Best Practices for Securing the DevOps Pipeline

Integrate Security Early (Shift Left)

The concept of ‘shifting left’ in DevOps refers to integrating security measures early in the development process. Instead of treating security as an afterthought, it becomes a part of the software development life cycle from the get-go.

Implementing security early allows us to identify and address potential vulnerabilities before they become a significant issue. It saves us time and resources by preventing security breaches instead of responding to them. Besides, it fosters a proactive approach to security, emphasizing prevention over remediation.

SAST and DAST are useful in integrating security early. SAST tools analyze code in its static state to identify vulnerabilities, while DAST tools test applications in their running state to detect security flaws.

Automate Security Processes

Automated security scans can be incorporated into the continuous integration/continuous delivery (CI/CD) pipeline. Each time a code push occurs, these scans are triggered, allowing for immediate feedback on potential security issues. Automated scans can detect a broad range of vulnerabilities, from code defects to configuration errors.

Configuration management tools like Chef, Puppet, Ansible and Terraform can help manage configurations and enforce security policies. They ensure that all systems are configured correctly and consistently, reducing the risk associated with manual configuration.

Regular Security Audits and Compliance Checks

Regular security audits and compliance checks are essential in securing the DevOps pipeline. They provide an opportunity to review and update security measures, ensuring they are effective and up-to-date.

Security audits should be comprehensive, covering all aspects of the DevOps pipeline. They should evaluate security controls, identify potential vulnerabilities, and recommend remedial measures. Compliance checks ensure that security practices align with relevant regulations and standards.

In conclusion, securing the DevOps pipeline requires a holistic approach that integrates security into every aspect of the development process. It involves shifting security left, automating security processes, conducting regular audits and compliance checks and fostering a culture of collaboration.

February 27, 2024
Forget Shift Left: Why ‘No Shift’ is the Future of Software Innovation

The evolution of DevOps, continuous testing, DevSecOps and site reliability engineering (SRE) practices has always been aimed toward increasing efficiency, safety and speed in software development and deployment processes. The “shift left” strategy has been a cornerstone of this evolution, emphasizing the integration of testing and security practices early in the development life cycle to catch and fix issues sooner, thereby reducing costs and improving quality. However, with advancements in automation, AI, machine learning technologies and deployment strategies like feature flags, a “no shift” strategy is emerging as a compelling alternative. This strategy argues for the feasibility of developing and testing directly in production, thus potentially bypassing the traditional development-to-production delivery pipeline. Here, we’ll compare the “shift left” and “no shift” strategies, examining their strengths, weaknesses and how the latter could address its challenges.

Key Concepts

Shift Left: This strategy involves integrating testing, security and operations concerns early in the software development process. The goal is to detect and fix issues earlier, which is less costly and less time-consuming than doing so later in the life cycle. It emphasizes early and frequent collaboration among cross-functional teams.
No Shift: Contrary to “shift left,” the “no shift” strategy involves using advanced technologies and practices to safely develop and test within the production environment. This strategy leverages real-time data, feature flags for controlled rollouts, AI for predictions and anomaly detection and robust automation to ensure that changes can be made directly in production without compromising stability or security.

Shift Left Strengths and Weaknesses

Early Issue Detection: Catches bugs and vulnerabilities early in the development cycle.
Cost Efficiency: Reduces the cost of fixing issues by catching them early.
Enhanced Collaboration: Encourages cross-functional team collaboration from the start.

Shift Left Weaknesses:
Initial Slowdown: Integrating testing and security early can slow initial development efforts.
Complexity: Requires significant effort to integrate and automate various tools and practices.

No Shift Strengths and Weaknesses:

Real-Time Feedback: Offers immediate feedback from real users and production data.
Speed: Potentially faster delivery by eliminating the traditional staging/testing phase.
Innovation: Leverages cutting-edge AI and ML technologies for predictive analytics and anomaly detection.

No Shift Weaknesses:
Risk in Production: Higher initial risk of impacting users with bugs or security issues.
Complexity and Overhead: Requires sophisticated feature flagging, monitoring and rollback mechanisms.

Overcoming No Shift Weaknesses

To mitigate the risks and challenges associated with the no shift strategy, organizations can adopt several practices:

• Robust Feature Flagging: Implement a comprehensive feature flagging system to control feature releases and perform gradual rollouts.
• Advanced Monitoring and Observability: Utilize AI-driven monitoring tools to detect anomalies and issues in real-time.
• Automated Rollbacks: Develop mechanisms for quick rollback of changes that cause issues in production.
• User Segmentation: Test new features on subsets of users to minimize potential negative impacts.

How Platform Engineering Can Facilitate ‘No Shift’

Platform engineering, combined with AI-assisted development tools, plays a pivotal role in enabling and facilitating a successful no shift strategy in software development. This combination creates a robust, flexible and intelligent infrastructure that supports the seamless development, testing and deployment of applications directly in production environments. Here’s how these components work together to make no shift a reality:

1. Automated Environment Provisioning

• Platform engineering creates standardized, self-service environments for developers, reducing the setup time and complexity traditionally involved in preparing production-like environments.
• AI tools can predict and automatically adjust resources based on the application’s needs, ensuring optimal performance without manual intervention.

2. Intelligent Continuous Integration/Continuous Deployment (CI/CD)

• AI-assisted development tools analyze code in real-time to predict potential integration and deployment issues, recommending fixes before the code is merged or deployed.
• Platform engineering ensures that CI/CD pipelines are scalable, secure and resilient, incorporating AI insights to streamline workflows and decision-making processes.

3. Advanced Monitoring and Observability

• Platform engineering provides a backbone of monitoring tools that collect vast amounts of operational data.
• AI tools leverage this data for predictive analytics, anomaly detection and automated root cause analysis, enabling teams to preemptively address issues before they impact users.

4. Enhanced Security Posture

• AI-assisted tools continuously scan for vulnerabilities and anomalous behavior within the codebase and the production environment, offering real-time alerts and automated patching or mitigation strategies.
• Platform engineering integrates these tools into the development life cycle, ensuring that security is a paramount concern handled efficiently and without disrupting the flow of development.

5. Feature Flag Management and A/B Testing

• Platform engineering facilitates the implementation of feature flags and A/B testing frameworks, allowing developers to roll out new features gradually and safely.
• AI tools analyze user interactions and feedback with new features in real-time, offering insights that help decide whether to roll back, continue or expand the rollout of a feature.

6. Scalability and Performance Optimization

• AI-assisted tools can predict load patterns and automatically scale resources up or down as needed, ensuring that applications remain responsive under varying loads.
• Platform engineering ensures that the infrastructure supports dynamic scaling and performance optimization, making it possible to maintain high performance and availability even as demands change.

Conclusion

The debate between “shift left” and “no shift” strategies highlights the dynamic nature of software development methodologies. While shift left has been effective in improving software quality and security, the no shift strategy, with its emphasis on real-time feedback and rapid deployment, presents an attractive alternative in an era dominated by automation, AI and ML technologies.

By leveraging the strengths of platform engineering and AI-assisted development tools, organizations can effectively implement a no shift strategy. This approach not only accelerates the development cycle but also significantly reduces the risks associated with deploying directly into production. It fosters a culture of innovation, allowing developers to rapidly iterate on and refine their applications in real-time, based on actual user feedback and data-driven insights. The synergy between platform engineering and AI creates a solid foundation for a resilient, efficient and adaptive software development life cycle.

Despite the initial risks and complexities, the no shift strategy’s potential for faster innovation cycles and its ability to leverage real-world data make it a compelling choice for organizations willing to invest in the necessary tools and practices to mitigate its weaknesses. As these technologies continue to evolve and mature, it’s likely that the no shift approach will become increasingly feasible and popular, potentially overtaking shift left as the preferred strategy for forward-thinking organizations seeking to maximize speed, efficiency and innovation in their software development processes.

DevOps.com · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 27, 2024
404: Role Not Found – Generative AI’s Impact on DevOps Jobs
Many DevOps professionals are wondering if generative AI will be a friend or foe, even as DevOps remains at the forefront when it comes to onboarding new technologies. Our DevOps communities have been enabling and fostering the collaborative cultural shift and evolving roles and responsibilities of software professionals. In this article, we explore the impact of generative AI in key DevOps roles and explain how to prepare ourselves for the shift.

Let us start by highlighting the basic roles and their broad areas of responsibility so we begin with a common vocabulary.

Overview of DevOps Roles

DevOps roles are evolving quickly, but PagerDuty outlined six main DevOps roles for modern organizations.
1. The DevOps Evangelist: Responsible for delivering changes, collaborating with dev and ops teams and working toward optimizing flow, enabling feedback and fostering experimentation.
2. The Code Release Manager: Responsible for creating cadence between delivery and deployment of code. This role often requires deep technical expertise to run and maintain the releases.
3. The Automation Architect: Responsible for designing and implementing automated pipelines and reducing manual toil.
4. The Experience Assurance Expert: Responsible for user experience, enabling feedback loops and ensuring superior experience, assessing feature performance and improving end-product usability.
5. The Software Developer & Tester: Developers and testers are responsible for the design and development of the software product. Primary responsibilities are writing code, testing and fixing bugs.
6. The Security and Compliance Engineer: Responsible for the overall security and compliance of the software product. Collaborating with all the above roles to ensure standards and regulations are implemented.
All roles above are expected to work across the value chain to maximize their impact. Note that there are many other roles, including leadership and executive roles, which we have not covered in this article. Next, let’s assess the impact of generative AI on some of these roles.

Adding Generative AI to Every Role

Before diving into the business value of adding generative AI to job roles, let’s build a common vocabulary, starting with defining generative AI. According to Gartner, generative AI can learn from existing artifacts to generate new, realistic artifacts (at scale) that reflect the characteristics of the training data but don’t repeat it. It can produce novel content such as images, video, music, speech, text, software code and product designs.

Automated code generation: AI-augmented code generation tools serve as companions for developers and testers. As an example, GitHub Copilot, developed by GitHub in collaboration with OpenAI, primarily offers predictive code generation and supports multiple languages. Tabnine offers deep learning capabilities and supports around 20 programming languages.

As these and other tools evolve, software developers’ time may be freed up to focus on higher-level, more creative, and innovative thinking and business value-driven development. Some pundits say these code generation tools may be a stopgap in the race to hire developers. It may also result in generative AI-based moderators, a new job role entirely. These moderators would help with exporting or reusing existing code rather than trying to reinvent it.

AI-based release management: Generative AI can also help with release management; from a simplified approach for generating release notes to boosting the productivity of the feature release to setting a precise release cadence, generative AI-based tools are coming to our rescue. For example, Digital.ai introduced predictive decision-making, threat insights and many more features to orchestrate releases. Another example is K8sGPT, a tool for scanning your Kubernetes clusters, diagnosing and triaging issues in simple English. More integration of generative AI is on the way for DevOps tools. Release managers’ roles are at a pivotal point and will evolve with time and new skills to manage real-time releases, integration with several channels of special edition software, classic upgrades and core software releases. They will need to address different customer segments with managed subscription-based, open source versions and take a human-centric approach to software releases.

Security and compliance engineers: DevSecOps firm Jfrog is integrating generative AI capabilities into its Xray and Artifactory solutions. It will automatically detect security flaws, license violations and more early and often. Snyk surveyed more than 400 IT professionals and found the use of artificial intelligence (AI) to write code is creating a security paradox. Generative AI also can be used to simulate malware attacks and identify vulnerabilities. However, this is a double-edged sword as it also can be used to enhance the portfolio of bad actors. That means that security and compliance engineers must increase their focus on regulatory, assessment, audits and validation of generative AI outcomes. Specialist knowledge, decision-making, and ethical evaluation are needed for a strategic approach toward next-generation cybersecurity capabilities.

The automation architect: An automation architect is responsible for decomposing complex tasks and automating them through reusable code. These tasks become more sustainable, with less rework and delays. As an automation architect, generative AI is another tool in the toolset that helps improve efficiency and productivity. Generative AI can help automation architects to scale and allow self-service options for DevOps teams and automate redundant tasks.

Generative AI’s Impact on Key Job Roles

As discussed in the previous section, there are many jobs that will be transformed by generative AI’s influence. Many companies will view generative AI-enhanced tools as a pot of gold where most of the work that requires building templates, infrastructure provisioning, log analysis, reuse or refactoring code can be done with the help of generative AI-enabled tools.
- Short-term skills gap: Software-related skills gaps are everywhere, and organizations need to go beyond reskilling to solve the problem. The role of leaders is key for successfully transitioning into the new era of workforce modeling. DevOps professionals should also look at strategies to improve our productivity by investing in capabilities and tools to fill the skills gap.
- Mid-term talent augmentation: Role disruption is most likely to happen due to generative AI; research and a more structured approach are needed to address the upcoming change. DevOps teams must focus on communication patterns, onboarding of human-machine collaborative models and ensuring performance of the new work models. Copyright, intellectual property (IP), licensing and the use of open source technology will be essential ingredients of mid-term talent augmentation with generative AI.
- Long-term, flexible workforce: Widespread and massive onboarding of generative AI in the long term will require a pragmatic approach to flexible workforce modeling. Task-based frameworks will emerge to guide the flexible orchestration of workforce, roles or even jobs or tasks. Task-based frameworks may mature into capability-driven roles that evolve into a flexible workforce where humans and machines together will deliver the desired business outcomes.
With rapid advancement in generative AI technology, companies will be forced to design new ways of working to keep pace with these changing dynamics. DevOps professionals should see this as an opportunity to get ahead of the curve, assess how generative AI technologies can boost productivity and enhance it with new tools and capabilities.
February 26, 2024
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

CareerBuilder.com

Northrop Grumman
Dulles, Virginia
Consulting Lead: DevOps Engineer
$203,300 to $304,900

LinkedIn

McKesson
Irving, Texas
Cloud Platform Engineer
$140,000 to $175,300

Indeed.com

Sumitomo Mitsui Banking Corp.
Jersey City, New Jersey
DevOps Engineer
$126,000 to $196,000

Dice.com

Qualcomm
San Diego, California
DevOps/Site Reliability Engineer (SRE)
$126,000 to $189,000

SimplyHired.com

Stanford University
Redwood City, California
Enterprise Cloud Infrastructure Engineer
$118,000 to $155,000

DevOps.com · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 26, 2024
Code and Composition

February 26, 2024
Dell Brings DevOps to Edge Computing Environments

Dell Technologies today updated its edge computing platform this week to make it simpler to programmatically provision infrastructure using DevOps best practices.

Phil Burt, senior director of project management for edge computing at Dell Technologies, said version 2.0 of Dell NativeEdge adds additional declarative blueprints based on YAML files and the Topology and Orchestration Specification for Cloud Applications (TOSCA) framework.

Blueprints for Telit, Litmus and PTC for manufacturing use cases, Deep North for retail, Dell Streaming Data Platform for analytics and Rancher Labs K3s for Kubernetes environments are provided.

Those blueprints make it simpler to either deploy applications on a lightweight operating system that Dell developed optimized for edge computing platforms or any other software stack an IT organization may prefer, he added.

Dell is also adding support for the virtual Trusted Platform Module (vTPM) and UEFI Secure Boot capabilities to apply zero-trust IT principles to edge computing platforms using hardware-based cryptography and secure storage for encryption keys, certificates and passwords.

Finally, Dell is also making available a three-year subscription plan for NativeEdge to lower the total cost of deploying edge computing platforms.

Dell relies on virtual machines it developed for edge computing platforms to deliver software. IT teams can then opt to deploy monolithic applications or container-based applications running on an instance of Kubernetes deployed as an extension of the virtual machine provided by Dell. Those platforms can then also automatically connect to a network to provide the connectivity required.

Regardless of approach, Dell is providing a method to programmatically orchestrate the management of highly distributed edge computing environments, noted Burt.

In the longer term, Dell is also researching how to apply generative artificial intelligence (AI) to the management of edge computing environments using the data its monitoring tools provide, he added.

While edge computing has been around in one form or another for decades, as more organizations start to process and analyze data at the point where it is created and consumed, the number of applications deployed at the network edge has increased substantially. As such, the number of applications that need to be built and deployed at the edge using DevOps best practices is growing exponentially. In fact, managing those workloads is only going to become that much more challenging as more AI models are deployed at the network edge.

Of course, not every workload at the edge is managed by an IT team. For years, many organizations have relied on operational technology (OT) teams that have historically deployed applications at the network using manual processes. Organizations that embrace DevOps practices to automate the deployment of workloads at the edge will naturally have to navigate some cultural issues alongside the technical challenges encountered when programmatically deploying software.

It’s not clear how much software will be running at the network edge in the years ahead, but as the capabilities of the IT infrastructure made available continue to increase, so will the complexity of the applications that will be deployed. The challenge, as always, is going to be finding the best way to manage all that distributed software at what will soon be an unprecedented level of scale.

February 23, 2024