devopsy.kinsta.cloud

Category: Blogs

Cutting Costs, Boosting Efficiency: The Economic Benefits of Framework-Defined Infrastructure

In a world that’s constantly modernizing, developers are at the forefront of progress, embracing cutting-edge tools that match the pace. Industry-standard practices like infrastructure-as-code (IaC) are getting an update: Framework-defined infrastructure (FdI) is an approach to deploying applications that is quickly gaining popularity among developers, where the deployment environment automatically provisions infrastructure derived from the framework and the applications written in it. For developers, this serverless architecture means more reliability, increased productivity, top-of-the-line security and reduced costs.

To modernize development practices, understanding the role of framework-defined infrastructure in defining and automating infrastructure—and its impact on the development experience in open source frameworks—is crucial.

The Evolution From IaC to FdI

Infrastructure-as-code (IaC) is the industry-standard practice for provisioning infrastructure in a repeatable and reliable way. Framework-defined infrastructure (FdI) is an evolution of IaC, where the deployment environment automatically provisions infrastructure derived from the framework and the applications written in it.

In the early days of servers and the internet, we SSH-ed (or worse) into individual machines, running install scripts or even configuring production software using graphical user interfaces to provision infrastructure. As the web scaled, it became clear that this approach wouldn’t scale with it, and together with the DevOps movement, IaC became the best practice for provisioning infrastructure. The code in IaC represents a version-controlled description of the desired state of the infrastructure—which, when executed, will create the described system state. However, as the web continues to scale, developers must apply new processes and architectures to increase the efficiency of their workflows.

Enter framework-defined infrastructure.

Framework-defined infrastructure abstracts over cloud primitives such as servers, message queues and serverless functions, making them mere implementation details of the frameworks’ concepts. Frameworks use well-established patterns to provide structure and abstraction to applications, making them easier to write and understand by managing the high-level application flow while the developer writes code within the hooks provided by it.

Framework-defined infrastructure takes advantage of both this inversion of control and the predictable structure of framework-based applications like Next.js to automatically map framework concepts onto the appropriate infrastructure without the need for explicit declaration or configuration of the infrastructure.

Optimization for Serverless Environments

Since framework-defined infrastructure lets the framework itself define the production behavior, local development can just use the framework’s own tooling, while production infrastructure is automatically configured to be a scaled and optimized representation of the same underlying behavior.

IaC uses machine-readable files, which developers can version much like software, to provision infrastructure such as physical servers, virtual machines and higher-level services like databases or applications. Serverless architecture—which, despite its name, still uses servers—eliminates the need for developers to manage specific physical or virtual servers.

Serverless products still require developers to define and deploy their respective serverless primitives, much like more traditional infrastructure. For example, in the archetype of serverless products, AWS Lambda, developers need to create a lambda function and deploy code to it.

While serverless architecture greatly simplifies managing production infrastructure, the systems that run serverless code are often complex and proprietary, which can cause problems with local development. In a worst-case scenario, local development isn’t possible, and developers must test local changes by making comparatively slow deploys to the production infrastructure. In a best-case scenario, developers must create a local simulation of the complex serverless stack, which must stay up-to-date with the production environment. Framework-defined infrastructure completely eliminates this problem, as it is capable of automating the process for users.

Framework-Defined Infrastructure and Immutable Deployments

These days, application code is developed almost exclusively within version control systems such as Git. IaC maintains infrastructure definition in either the same or a sibling version control system. However, production infrastructure itself can only represent limited points in time of the infrastructure’s version history. This is fundamentally incompatible with framework-defined infrastructure, which expects that production infrastructure directly maps to the framework code at the same commit hash.

Immutable deployments solve this impedance mismatch between an application’s and the infrastructure’s version history. Instead of deploying onto a limited number of infrastructures, immutable deploys create a completely new infrastructure for every single deployment that is ever made. For developers, this means lower IT complexity and failures, improved security, and easier troubleshooting, given there are fewer chances for unpredictable behaviors or unintended consequences of code changes.

Naturally, immutable deployments are impossible in a world where infrastructure is mapped to finite physical resources. However, in a serverless world, where unused infrastructure can scale to zero, immutable deployments become possible to perform, as unused deployments do not take up physical compute resources beyond the baseline storage needed for their contents.

Conclusion

It goes without saying that framework-defined infrastructures rely on IaC as the ultimate infrastructure interface and, hence, could not work without the amazing work of its community. In order to modernize, it’s imperative for developers to leave behind infrastructure constraints and embrace a world where scaling applications becomes effortless, enabling them to optimize efficiency without sacrificing performance. For developers growing frustrated with scaling issues or the burdensome process of their development process, widespread adoption of framework-defined infrastructure is key to improving the developer experience.

November 15, 2023
It’s Funny How We Forgot About Container Sprawl

…Because it sure as heck did not forget about us.

We are (thankfully) past the days when everything was a container. At least, most of us are. Just like anything else, some orgs will continue that approach for reasons both great and terrible. And all of us still use far more containers than we need, I would say. “One container, one function,” works if you are talking about one whole application, and maybe sometimes for busy parts of an application, but it certainly isn’t needed to host a couple of low-use APIs, for example. My favorite example is separate instances of the same exact application for different teams (not business units – that is a good method to separate business units).

Thankfully, technology is once again saving us from ourselves and our misdeeds. Processing power is no longer an issue, meaning we can spin up a million containers and keep them running until our public cloud bill arrives. So, it’s not about processing power. I cannot remember the last time that an org was bandwidth-limited, so it’s not about the network. The biggest issue is still security. More containers means a bigger footprint, which inevitably creates more vulnerabilities. Right behind that is container inventory management. What is running where, what images are available and what state are they in, which running containers have drifted from their definition, etc.

I’m a developer that has sometimes done support for the apps I develop. That means that I laugh at your “Our images do not drift because we’re agile and build-driven.” Of course they do, because troubleshooting is real. The real question is, can you get them back into alignment when the ticket closes? The DevOps toolchain is pretty darned good at that if you let it. Changing a running image and telling no one is a terrible idea that still happens nearly every day across our industry. But technology has brought us drift monitoring. We can be notified of changes as they happen. For those in highly sensitive spaces like FinTech, changes can be blocked in production, but for most of us, we want to know when it is happening and who made the change. And we can get that today.

Technology has also brought us some wonderful scanning tools from SBOM to SCA to Registry. These tools can give us a list of things for security to worry about in our images. In order to reliably generate these lists, we still have to know what images we are keeping and where—but choose a reliable registry or two, fit them into your DevOps processes and scan on commit. Simple and thorough—as long as everyone uses them.

Thanks to policy and regulation, container management tools can offer you a detailed list of not just what instances they’re hosting, but metadata like what image they came from. That helps manage inventory, and by now we are all building hierarchies of images from base to application specific.

So, we can tell what is running, what images are available to run, how far running images have drifted, what known vulnerabilities exist in both our images and our instances and how compliant we are WRT containers. Dunno about you, but it seems technology has our back yet again.

You are cranking it out, keeping the lights on, and dreaming of more you could be doing. Use the tools we already have to make it easier and the resulting systems more secure and reliable. You won’t regret it. And once again for those of you whose users never say it: Thank you.

November 15, 2023
Canonical Automates Provisioning of Cloud Environments Anywhere

Canonical today made generally available an open source framework, dubbed MicroCloud, that leverages Linux containers and the Snap software packaging and deployment tools the company developed to automatically orchestrate the provisioning of cloud computing environments using a single command.

MicroCloud automatically creates a functional cloud computing environment in minutes that can be deployed anywhere, including edge computing environments, using policies defined by an internal IT team to ensure the appropriate guardrails are in place. All components can also be updated over the air in a way that preserves data, and if any errors occur, rollbacks are automated.

Miona Aleksic, product manager of MicroCloud, said the platform enables organizations to democratize DevOps workflows in a way that becomes accessible to the average IT administrator.

In effect, Canonical is making cloud computing more accessible in a way that is reminiscent of its creation of the Ubuntu distribution of Linux that is easier to deploy and install, she added.

As IT environments become more distributed, programmatically spinning up infrastructure resources has become more challenging. MicroCloud enables IT teams to provision resources more easily at the point where data is being created, analyzed and consumed, noted Aleksic.

It should also improve cybersecurity because many of the cybersecurity issues that organizations encounter today can be traced back to infrastructure misconfigurations, she added.

It’s not clear how automated the provisioning of IT environments is about to become, but the demand for applications today far exceeds the ability of many DevOps teams to keep pace. Much of the toil that leads to burnout among DevOps teams stems from the manual tasks that persist within workflows. In theory, the more low-level tasks—that don’t add much in the way of differentiated value to the business—can be automated, the more time there should be to address more complex issues.

That’s critical at a time when many organizations still struggle to find and retain DevOps engineers. In addition, the simpler it becomes to automate the provisioning of infrastructure, the more accessible DevOps best practices become for small-to-medium sized businesses (SMBs) that historically couldn’t afford to hire software engineers.

One way or another, DevOps workflows will need to become more automated. There is naturally a lot of focus on artificial intelligence (AI), but while that approach holds a lot of promise, there are clearly advances to be made using a range of existing automation frameworks. The challenge organizations have encountered is that writing the playbooks required to automate processes requires a level of expertise they generally lack.

Platforms such as MicroCloud present IT teams with an alternative approach that should reduce the cognitive load developers encounter whenever they want to provision IT infrastructure. Arguably, the one reason developers provision infrastructure themselves is that previously it simply took too long for IT teams to do it on their behalf.

It may be too early to determine whether or not tools such as Terraform are required to provision infrastructure, but it’s clear that most developers would rather spend their time writing code instead of managing infrastructure.

November 14, 2023
EP 40: DevOps Building Blocks Part 3 – Making the “Sec” in DevSecOps Happen

Many organizations still make the mistake of treating security as an afterthought instead of considering it a top priority from the start, which can lead to breaches and major losses for their business. By adopting a DevSecOps approach, security is integrated early in the SDLC to identify and address potential risks promptly.

In part 3 of this series, hosts Alan Shimel and Mitch Ashley are joined by Andi Mann (Sageable), Shannon Leitz (ThirdScore) and Tracy Bannon (Mitre) as we discuss how to adopt the “Sec” in the DevSecOps model and promote a security culture within an organization so that security becomes a shared responsibility. We talk about shifting left and the essential strategies and best practices to bridge the gap between development, security and operations.

November 14, 2023
Grafana Labs Acquires Asserts.ai to Bring AI to Observability

At its ObservabilityCON event, Grafana Labs today announced it has acquired Asserts.ai to automate configurations and customization of dashboards.

In addition, the company is previewing an ability to apply artificial intelligence (AI) to incident management to make it simpler to surface the root cause of an issue. Sift is a diagnostic assistant in Grafana Cloud that automatically analyzes metrics, logs and tracing data, while Grafana Incident is a generative AI tool that summarizes incident timelines with a single click, creates metadata for dashboards and simplifies the writing of PromQL queries.

Grafana Labs is also making generally available an Application Observability module for Grafana Cloud to provide a more holistic view of IT environments.

Finally, Grafana Beyla, an open source auto-instrumentation project that makes use of extended Berkeley Packet Filtering (eBPF), is now also generally available. That tool enables DevOps teams to collect telemetry data for an IT environment from a sandbox environment running in the microkernel of an operating system. That approach makes it simpler to automatically instrument an IT environment, but there are instances where DevOps teams will be managing complex applications that will still require them to collect telemetry data via the user space of an application.

Richi Hartmann, director of community for Grafana Labs, said collectively, these additional capabilities will make it simpler to apply observability across increasingly complex IT environments. For example, the AI technologies developed by Assert.ai will make it possible for DevOps teams to start sending data to Grafana Labs that will enable the cloud service to identify the applications and infrastructure being used. AI models will then be able to automatically generate a custom dashboard for that environment that DevOps teams can extend as they see fit, said Hartmann.

In general, machine learning algorithms and generative AI are starting to be more widely applied to observability. The ultimate goal is to automatically identify issues in ways that reduce the cognitive load required to manage complex IT environments while also making it easier to launch queries that identify bottlenecks that could adversely impact application performance and availability.

It’s not clear to what degree observability tools might eliminate the need for monitoring tools that track pre-defined metrics, but most DevOps teams will likely be using a mix of both for the foreseeable future.

In the meantime, IT environments are only becoming more complex as various types of cloud-native applications are deployed alongside existing monolithic applications that are continuously being updated. The challenge is the overall size of DevOps teams is not expanding, so there is a greater need for tools to streamline the management of DevOps workflows.

AI will naturally play a larger role in enabling organizations to achieve that goal, but it’s not likely to replace the need for DevOps engineers, said Hartmann.

Conversely, many DevOps teams will also naturally gravitate toward organizations that make the tools they need to succeed available. Today, far too many manual tasks are increasing turnover as DevOps teams burn out. Organizations that want to hire and retain the best DevOps engineers will need to invest in AI.

Of course, DevOps, at its core, has always been about ruthlessly automating as many manual tasks as possible. AI is only the latest in a series of advances that, over time, continue to make DevOps more accessible to IT professionals of all skill levels.

November 14, 2023
New Relic Adds Ability to Monitor AI Models to APM Platform

New Relic today added an ability to monitor artificial intelligence (AI) models to its application performance management (APM) platform.

Peter Pezaris, senior vice president for strategy and experience for New Relic, said as next-generation applications are built and deployed, it’s apparent most of them will incorporate multiple AI models. New Relic is extending its APM platform to make it simpler to monitor the behavior of those AI models within the context of an application, he added.

To achieve that goal, New Relic has added more than 50 integrations with frameworks and AI models to troubleshoot, compare and optimize different prompts and responses to address performance, cost, security and quality issues such as hallucinations, bias, toxicity and fairness.

For example, response tracing for large language models (LLMs) can be applied using New Relic agent software to collect telemetry data that can be used to compare how different AI models are performing and responding to queries. Those results will provide immediate full visibility into the models, applications and infrastructure being used to provide complete visibility across the entire AI stack, said Pezaris.

That capability is going to prove crucial as developer use a mix of proprietary, open source and custom large language models (LLMs) alongside a range of other types of AI models to build and deploy applications, he added.

Organizations are likely to find themselves managing hundreds of AI models that either they or a third party developed. The challenge, as always, is bringing order to a potentially chaotic process that, in addition to wasting resources, represents a significant risk to the business given the potential for regulatory fines to be levied, noted Pezaris.

Each organization will need to determine for itself how best to construct workflows spanning data scientists, application developers, software engineers, cybersecurity teams and compliance specialists. Before too long, organizations will find themselves managing hundreds of AI models that might be integrated into thousands of applications. New Relic is essentially making a case for extending an existing APM platform to address that challenge rather than requiring organizations to acquire, deploy and maintain additional platforms.

Eventually, in addition to updating AI models, IT teams will find they are being regularly replaced as advances continue to be made at a fast and furious rate. Data science teams are now making AI models based on significantly larger parameters that make previous generations of models obsolete before they can even be deployed in production environments.

As a result, operationalizing AI is going to present DevOps teams with major challenges as they look to both tune application performance and ensure the results being generated are accurate and consistent. That latter issue is especially critical in enterprise application environments where the results generated by an AI model can’t vary from one query to the next.
It’s still early days in terms of how AI will be applied to applications, but as AI models join the pantheon of artifacts DevOps teams need to manage, application development and deployment are about to become much more complex to manage.

November 14, 2023
Leveraging Crowdtesting in DevOps to Enhance Quality Assurance (QA)
There’s no doubt that quality assurance (QA) within the DevOps culture of continuous integration and deployment helps to ensure the ongoing quality of software releases. Especially as QA experts collaborate with development and operations teams to ensure that the software meets quality standards, is free of defects and aligns with customer expectations in an efficient and timely manner.

But, not surprisingly, there are still challenges for QA teams within DevOps. One of the most significant is the need to “shift left” and be involved in testing and quality activities earlier in the development cycle, which requires adapting to faster development cycles and collaborating closely with developers to integrate testing and quality practices from the start.

This places additional stress on QA experts who must react faster while being increasingly tasked with building and maintaining robust automated testing frameworks. When timelines matter, this can become a considerable issue.

Additionally, QA professionals must also work collaboratively with developers, operations teams and other stakeholders. If cultures are opposed, this can severely impact development cycles.

Lastly, with frequent code deployments and configuration changes, maintaining consistent and reliable test environments becomes crucial.

But amid these challenges, there are many opportunities.

QA experts can contribute to early and continuous testing, collaborate with cross-functional teams, leverage automation and tooling, engage in continuous learning and take ownership of end-to-end quality. QA experts play a crucial role in ensuring high-quality software delivery in the DevOps environment.

Crowdtesting Within DevOps

Crowdtesting can play a significant role in DevOps throughout the entire software development life cycle (SDLC). Here are just a few benefits:
1. Faster Feedback: Crowdtesting brings diverse testers with various devices and configurations, allowing for quick issue identification and resolution in agile development.
2. Scalability and Flexibility: Crowdtesting easily scales up or down based on project needs, accommodating frequent updates and releases and ensuring testing coverage even during peak periods.
3. Real-world Environments: Crowdtesting provides insights into software performance under diverse conditions, including network speeds, hardware configurations and geographic locations, improving quality and user experience.
4. CI/CD Integration: Crowdtesting seamlessly integrates into CI/CD pipelines, enabling continuous testing of each iteration, catching issues early and reducing regression risks.
5. User Feedback: Crowdtesting gathers feedback from real users, offering valuable insights on usability, functionality and customer experience, aiding decision-making and feature prioritization.
6. Localization and Internationalization: Crowdtesting helps test localized versions and internationalization support, incorporating language translations, cultural nuances, and regional requirements, ensuring a global user base and enhanced market reach.
Automation and DevOps

Crowdtesting can also complement automation.

Within DevOps, automation plays a crucial role in continuous integration, delivery, and also testing – especially for unit testing, integration testing, functional testing, and performance testing – but there are times when manual testing, including crowdtesting, remains relevant and beneficial.

Do you want a realistic way to assess the usability and user experience aspects of your software? Human crowdtesters can provide subjective feedback, identify user experience issues, and offer suggestions for improvement – all within real-world scenarios that automated tests may miss.

Crowdtesters also possess the creativity and intuition to perform exploratory testing, where they actively explore the software to uncover unforeseen bugs, usability issues, or edge cases.

The same goes for user acceptance testing, where a specific target audience evaluates the software against their specific needs and requirements. These types of testing require human intelligence and critical thinking skills that automation cannot easily replicate.

This is especially true when it comes to edge cases, unusual scenarios and non-standard user interactions, which often require creative thinking. Manual crowdtesting can uncover potential issues that automated tests overlook.

But ultimately, it is the ability to test in diverse real-world environments, configurations and geographical locations where crowdtesting makes the biggest impact.

By leveraging both approaches, you can achieve a robust testing process that ensures software quality, usability and a positive user experience.
November 14, 2023
Elevating Quality Engineers in an AI-Driven Landscape

Artificial intelligence (AI) is quickly transforming software testing and quality assurance (QA) by powering game-changing capabilities like autonomous testing, intelligent test case generation and real-time risk analysis. As a result, it is creating new opportunities for AI-savvy test engineers. But that doesn’t mean that you can set it and forget it.

AI helps us work smarter by eliminating repetitive tasks. Think of it like a supercharged intern who can rapidly analyze huge datasets, suggest myriad test ideas and point out risks — all at incredible speed and scale. But also, like most interns, AI needs some guidance. With the addition of thoughtful human oversight and control, AI tools can ultimately enhance the work of test engineers, and even alleviate stress by automating mundane work. In the end, however, human test engineers will remain the key decision-makers.

Buckle Up: The Landscape is About to Change

AI enables QA professionals to focus more time and energy on strategic, high-value testing activities by automatically handling rote script maintenance, data management and other repetitive tasks that consume excessive time and effort. It can eliminate the grunt work so test engineers can focus on more rewarding testing aspects of their jobs. AI also reduces over-reliance on specialized technical expertise by shifting the focus back to foundational testing skills like business domain knowledge, advanced risk analysis and cross-team collaboration. Ultimately, a test engineer’s true value is a combination of their experience and their domain knowledge, not just their tech skills. And AI can help bring these to the forefront.

As AI helps developers produce more code faster, it will create more work for quality assurance testers. Using AI to automate their test plans, test engineers will be able to manage greater volumes of throughput without feeling overwhelmed by it. To be sure, this will all be a boon to the software industry as a whole. So, buckle up and prepare for more — not less — work.

Broad adoption of AI will organically transform QA roles into more advisory-focused, strategic positions focused on optimizing end-to-end testing processes versus hands-on test execution. Test engineers will transition from being “tactical doers” to a role akin to a strategic coach who guides the technology for maximal impact.

AI-enabled autonomous testing tools that automatically generate test cases, execute scripts, manage test data and identify risks will become standard components of future QA stacks, allowing test engineers to achieve much higher test coverage rather than simply automating happy path testing. But this can only happen if those in control ask the right questions, establish sound guardrails and apply the unique skills only a human can provide.

The Importance of Human Judgment — Don’t Relinquish Control

The key to the successful integration of AI into your testing program is to remain skeptical. It is unwise to blindly trust in the opaque limitations of an AI tool. It also helps to know how the technology works under the hood. In fact, irresponsible use of AI can be dangerous, especially if we don’t understand its limitations.

Testers need consistent human judgment and involvement. Human skills like customer empathy, communication and creative problem-solving remain critical, and AI will never replicate these distinctly human capabilities. By emphasizing their focus on users, systems and applications, creative testers will thrive in the presence of AI automation.

It is not only software testers who need to embrace change but developers of testing tools, as well. It is important that whoever creates the platforms for testing provides transparency into how their tools work. AI tool developers should avoid “black box” development and provide visibility into their models. When a test engineer understands how an AI tool works under the hood — and how it is limited — they will be in a better position to trust and verify the tool’s output. This open collaboration between tool developers and test engineers can maximize benefits and minimize risks in our industry.

Preparing for an AI-Driven Future

To best prepare for the adoption of AI-powered QA tasks, enterprises must invest in proper change management, provide extensive AI training and promote open communication. For their part, test engineers can benefit from engaging with each other to share their AI experiences — whether positive or negative.

In the short term, the software test industry needs leaders to take a measured approach by piloting AI tools on targeted use cases, versus attempting to overhaul all of testing overnight. Start small with low-risk AI projects, then scale what works.

While AI promises to change the testing status quo forever, human insight will remain the indispensable ingredient for responsible, successful software releases. Creative testers who master AI will drive the greatest innovations. Those who embrace this exciting time in our industry are sure to come out ahead of the pack.

November 14, 2023
DevOps Dozen² 2023 Finalists Announced
We are excited to announce the finalists for the DevOps Dozen² Awards 2023, celebrating the greatest innovators and their achievements in the DevOps space. These individuals and companies have taken an active role in the DevOps community, demonstrating their leadership and commitment to the improvement of our industry in the past year.

Congratulations to every one of the finalists. All of your hard work and dedication are greatly appreciated.

Without further ado, here are the finalists for the DevOps Dozen² Awards 2023:

DevOps Dozen Community Awards

1. Best DevOps Industry Implementation
- Codacy Pioneers Program (Codacy’s Pioneers Programme)
- DevOps Implementation across the SJP enterprise systems (St James’s Place in Partnership with Intellect Design Arena)
2. Best DevOps Survey/Analysis/Research
- State of Digital Quality Report 2023 (Applause)
- The Shift to a Security Approach for the Full Application Stack Report (Cisco AppDynamics)
- Accelerate State of DevOps Report (DORA)
- Charting Observability Research Report (Edge Delta)
- 2023 State of IaC Report (Firefly)
- Observability Survey 2023 (Grafana Labs)
- 2023 Software Artifact State of the Union (JFrog)
- What’s in Your Open-Source Software (Lineaje)
- 2023 Software Engineering Benchmarks Report (LinearB)
- 2023 Observability Forecast Report (New Relic)
- State of the API Report (Postman)
- Global State of API Security Report (Traceable AI)
3. Best DevOps-Related Video Series (video)
- DevOps Exchange YouTube Channel (DevOps Exchange)
- DevOps Toolkit (DevOps Toolkit)
- KubeSimplify (Kubesimplify)
- Saiyam Pathak (Kubesimplify)
- Ned in the Cloud’s Terraform Tuesday Series (Ned Bellevance)
4. Best DevOps-Related Audio Podcast Series
- The Modern Mainframe (BMC Software)
- 0800-DEVOPS Podcast by Ivan Krnic (CROZ)
- DevOps Paradox (DevOps Paradox)
- Let’s Get To The News (Kubernetes community)
- Dev Interrupted (LinearB)
- DevOps in Agile Way Podcast (Pawel Piwosz, DevOps Institute Ambassador)
- The MLSecOps Podcast (Protect AI)
5. Best DevOps Book/eBook of the Year
- Crafting a Mainframe Modernization Roadmap (Broadcom)
- Strategizing Continuous Delivery in the Cloud (Garima Bajpai , Thomas Schuetz)
- Redbook: Accelerate Mainframe Application Modernization with Hybrid Cloud (IBM)
- Industrial DevOps: Build Better Systems Faster by Dr. Suzette Johnson and Robin Yeman (IT Revolution Press)
- Beyond Agile Auditing: Three Core Components to Revolutionize Your Internal Audit Practices (IT Revolution)
6. Top DevOps Evangelist
- Sam Dion (National Bank of Canada)
- Garima Bajpai (Canada DevOps Community of Practice)
- Pawel Piwosz (Company or Community: DevOps Institute Ambassador)
- Amanda Lewis (DORA Community)
- Fatima Sarah Khalid (GitLab)
- Ayelet Sachto (Google)
- Richi Hartmann (Grafana Labs)
- Stephen Chin (JFrog)
- Eran Kinsbruner (Lightrun)
- Mayank Solanki (TataCliq)
- Viktor Farcic
7. Best DevOps Transformation (non-vendor)
- Informatica (Grafana Labs)
- Pera People Science B.V
- CGI Life and Health Insurance Agile and DevOps Team
8. Best DevOps Event of the Year
- DevOps World 2023 (CloudBees)
- DevOps Exchange
- GrafanaCON 2023 (Grafana Labs)
- swampUP (JFrog)
- Galaxy ’23 (LaunchDarkly)
- PASS Data Community Summit (Redgate Software)
9. Most Innovative DevOps Open Source Project
- Coder OS (Coder)
- AIaC (AI generator for infrastructure as code by Firefly.ai)
- Beyla (Grafana Labs)
- Jenkins
- Frogbot (JFrog)
- Galasa (Open Mainframe Project)
- OpenRewrite (OpenRewrite / Moderne)
- CNAPPgoat (Tenable Open Source)
- Terrascan (Tenable Open Source)
10. DevOps Executive of the Year (non-vendor)
- Garima Bajpai (Canada DevOps Community of Practice)
- Dan Rogers (LaunchDarkly)
- Idit Levine (Solo.io)
- Kavitha Srinivasulu (TCS)
11. Best DevOps Presentation of the Year
- Time to Rip Off the Training Wheels and Enable End-to-End Automation, a SHARE Atlanta 2023 presentation by Tony Anter and Mark Schettenhelm (BMC Software)
- Beyond Agile Auditing: The Path to a Better Audit Experience by Clarissa Lucas
12. Best DevOps.com Article of the Year
- Six Mainframe DevOps Predictions for 2023 (BMC Software)
- VS Code for Mainframe: The Enterprise Developer Tipping Point (Broadcom)
- Muneesh Sharma (Neem Consulting Ltd.)
DevOps Dozen Tools and Services Awards

1. Best End-to-End DevOps Tool/Service
- Bitrise
- Copado
- Harness Software Delivery Platform
- Morpheus v6.x
- The Netlify Platform
- PagerDuty Process Automation
- Sourcegraph’s Code AI Platform
- BMC AMI DevX
- Digital.ai AI-Powered DevSecOps Platform
- JFrog Software Supply Chain Platform
- Nethopper KAOPS
- Opsera Unified DevOps Platform
- Rootly
- Reliability Management
2. Best DevOps Repo/GitOps Tool/Service
- gitStream (LinearB)
3. Best CI/CD Tool
- Bitrise
- BMC AMI DevX Code Pipeline
- Buildkite Pipelines
- CircleCI
- CloudBees CI/CDRO
- Codefresh CI/CD Solution
- Copado
- Octopus Deploy
- OpsMx Secure CD
4. Best Value Stream Management Tool
- Allstacks Platform
- ValueOps by Broadcom
- Digital.ai’s Value Stream Management Tool
- LinearB
- Planview Value Stream Management
5. Best Observability Solution
- Apica
- BMC Helix Operations Management with AIOps
- Cribl Stream
- Grafana Cloud Free Tier
- Lightrun Observability Platform
- Memfault
- The New Relic All-In-One Observability Platform
- Observe
- StackState
- BMC AMI zAdviser Enterprise
- Cisco Observability Platform
- Edge Delta
- Honeycomb.io
- Logz.io Open 360™ Platform
- Mezmo Telemetry Pipeline
- Nobl9 Reliability Center
- SolarWinds Observability
- vFunction Architectural Observability Manager
6. Best DevSecOps Solution
- Broadcom SBOMz
- CodeSonar
- CodeSentry
- Dazz Remediation Cloud
- Digital.ai AI-Powered DevSecOps Platform
- GitLab
- Mend Application Security Platform by Mend.io
- Progress Chef
- DuploCloud DevOps Automation Platform
- Graylog
- JFrog Curation
- Lineaje AI with BOMbots
- Moderne
- ReversingLabs Software Supply Chain Security Platform
- Tanzu Application Platform
- Xygeni Software Supply Chain Security Solution
7. Best Testing Service/Tool
- Telepresence (Ambassador Labs)
- Applitools
- BMC AMI DevX Total Test
- Buildkite Test Analytics
- Copado
- Digital.ai Continuous Testing
- Sauce Labs / Sauce Orchestrate
- SonarQube
- Tricentis Mobile
8. Best Kubernetes Platform/Service
- BMC Helix Operations Management with AIOps
- Edge Delta
- Kalix
- Rafay Systems
9. Best Cloud-Native Security Solution/Service
- The Aqua Platform (Aqua Security)
- Axiomatics’ Orchestrated Authorization Solution
- Britive Identity Security Platform
- Cyera
- Dazz Remediation Cloud
- Fleet Endpoint Security Platform (Fleet Device Management, Inc.)
- JumpCloud Directory Platform
- The Orca Cloud Security Platform
- Sumo Logic SaaS Log Analytics Platform
- Sysdig Secure
- Tenable Cloud Security
- Tetrate Istio Subscription (TIS)
10. Best DevOps for Mainframe Solution
- BMC AMI DevX tool suite (BMC Software)
- Code4z (Broadcom)
- Wazi Deploy (IBM)
- PopUp Mainframe
- Rocket DevOps 10.2.2 (Rocket Software)
11. Best DevOps for DataOps/Database Solution
- BMC AMI DevOps for Db2® – BMC Software and BMC AMI SQL Performance for Db2® (BMC Software)
- Coalesce Data Transformation Platform
- Percona
- Flyway (Redgate Software)
- TDengine
12. Best New DevOps Tool/Service Provider
- Applause Crowdtesting Solution for DevOps Teams
- BMC AMI DevX Code Insights (BMC Software)
- BMC Helix ServiceOps, BMC Helix Operations Management with AIOps, BMC Helix ITSM
- Devtron
- Firefly Cloud Asset Management
- New Relic Grok
- PerfectScale Platform
- PopUp Mainframe
- Recommended Learning Paths (Security Journey)
- Sourcegraph’s AI coding assistant, Cody
- Tabnine Chat
- Vercel
Finalists were picked by the judges and based on which entry had the most nominations.

Voting for the winners in all 24 categories is now open to the public. To vote for the leaders, tools and companies you think are truly deserving of an award for their exceptional service to the DevOps community, please visit the DevOps Dozen² website.

Winners will be chosen from among the finalists, with general public voting weighted for 40% of the final score and our judges’ selections for 60% of the final score. The deadline for public voting is December 31 at 5:00 p.m. ET.

The winners will be announced at the Predict 2024 Virtual Summit on January 18, 2024, and will receive both digital badges and physical trophies celebrating their achievements.

Thanks to everyone who has supported the DevOps Dozen² Awards by nominating candidates and voting. Good luck to all the finalists!
November 13, 2023
Who Should Have Access to Production?

In a perfect world, no one would have access to production, as that’s the safest way to make sure there won’t be any issues. However, this remains unattainable for most companies.

On the one hand, providing developers access to production servers can be risky. If they make changes to the code or configuration, it could break things for everyone else. Also, having too many people with access to production servers can make it more difficult to track what changes have been made and when.

On the other hand, developers need access to production servers to be able to debug issues that may arise. They also need to be able to deploy code changes and monitor their performance in production. Without any type of access to production servers, many developers would not be able to do their job effectively.

While it’s advisable not to grant access to production environments, often, there is simply no way around it, and access has to be granted. Therefore, you need to ensure that the risks of exposure are as low as possible.

10 Risks of Accessing Production Data

Increasing the number of people who have production access increases the likelihood of the risks typically associated with higher-privileged access. The most common risks are operational impairments due to misconfiguration (e.g., a malformed production change causes the system to become unavailable to its customers), security breaches due to negligent actions, or confidential information leaks due to mishandling datasets.

1. Accidental Outages. Developers may inadvertently make changes or updates that disrupt production services, leading to downtime or reduced system performance. This can occur due to coding errors, misconfigurations, or incorrect deployment procedures.
2. Data Loss or Corruption. Inexperienced or improperly trained developers may accidentally delete or modify critical data, leading to data loss or data corruption in the production environment.
3. Security Vulnerabilities. Developers accessing production systems may introduce security vulnerabilities, especially if they have excessive or unnecessary privileges. They may inadvertently expose sensitive data or create security holes during development or troubleshooting.
4. Unauthorized Access. Developers with access to production environments could misuse their privileges, intentionally or unintentionally. This misuse might involve unauthorized data access or changes, potentially leading to data breaches or other security incidents.
5. Limited Accountability. In shared or poorly controlled environments, it can be challenging to attribute specific actions to individual developers, making it difficult to identify the source of problems or security breaches.
6. Operational Disruptions. Frequent access by developers can disrupt the operational flow of the production environment. While developers are troubleshooting or testing, the system might be less stable or responsive.
7. Uncontrolled Changes. Developers might make changes in the production environment without adhering to proper change control procedures. This can lead to undocumented changes, making it difficult to track and manage the system effectively.
8. Exposure to Sensitive Data. Developers may encounter sensitive data in production environments, such as personal information or financial data. Mishandling or accidental exposure of this data can result in legal and compliance issues.
9. Resource Constraints. Developers accessing production systems for troubleshooting or experimentation can consume resources and potentially affect the performance of the environment for end users.
10. Lack of Separation of Duties. In some cases, developers may have both development and production access, which can lead to a lack of separation of duties and potential conflicts of interest.

10 Benefits of Accessing Production Data

Allowing developers access to production environments, when done responsibly and with proper controls in place, can bring several benefits to an organization. Here are some of the advantages of letting developers access production environments:

1. Faster Issue Resolution. Developers can troubleshoot and diagnose issues in the production environment more effectively when they have direct access. This can lead to quicker resolutions and reduced downtime.
2. Improved Software Quality. Access to production allows developers to gain firsthand insights into how their code behaves in a real-world environment. They can identify and address issues related to performance, scalability, and compatibility more effectively.
3. Enhanced Collaboration. Developers can collaborate more efficiently with operations and system administrators to optimize the production environment. This cross-functional collaboration can lead to improved system performance and stability.
4. Rapid Deployment and Updates. Developers can deploy new features and updates directly to the production environment, reducing the time between development and deployment. This agility is essential in fast-paced development cycles, such as those in DevOps environments.
5. Effective Monitoring. Developers can set up and configure monitoring tools and alerts in the production environment, enabling proactive issue detection and response. This contributes to higher system availability and reliability.
6. Knowledge Transfer. Developers who are familiar with the production environment can transfer their expertise to other team members, improving overall team capability and reducing reliance on a select few experts.
7. Continuous Improvement. Developers can gather feedback and real-world data from the production environment, enabling continuous improvement of applications and services. This iterative process can lead to better user experiences and business outcomes.
8. Cost Savings. By empowering developers to handle routine operational tasks and troubleshoot issues, organizations can reduce the need for dedicated operations teams or external support, resulting in cost savings.
9. Agile Development. Developers can perform A/B testing, feature toggling and other agile development practices more easily in the production environment, facilitating rapid experimentation and feature rollout.
10. Faster Feedback Loops. Developers can receive immediate feedback on their code changes and their impact on the production environment. This tight feedback loop helps identify issues early in the development process.

Giving devs a least-privileged role is how they are typically given access to the production environment. While this is a solid approach, many times, developers only need to briefly access a production database system and run a few ad-hoc queries to troubleshoot the current bug. For large organizations, administering access is a full-time job. In an agile world, people move teams and switch to different projects seemingly on an hourly basis. This can lead to a lot of churn in access management to your backend database systems.

A better approach for handling access to database systems would be to allow your application developers to provision their own access and have it revoked with no extra work on your end. With the right data access controls in place (read-only access), a dev could grant themselves temporary access to certain resources to debug issues that will be automatically deprovisioned for whenever you choose.

Reasons for not Granting Devs Access to Production

While there are benefits to allowing developers access to production environments, there are just as many benefits to restricting their access. Restricting developer access to production environments is a common practice in many organizations, and there are several valid reasons for doing so. While developers play a crucial role in building and maintaining software systems, there are inherent risks associated with allowing them unrestricted access to production environments. Here are some of the key reasons for restricting developer access to production environments:

● Mitigating security risks
● Reducing insider threats
● Compliance obligation
● Minimizing chances of human error
● Change control
● Stable production environment

Reasons for Granting Devs Access to Production

Developers may need access to production environments for several reasons, depending on the organization’s development practices, project requirements and workflow. Here are some common reasons why developers might need access to production environments:

● Troubleshooting and issue resolution
● Performance tuning
● Deployment and release management
● Monitoring and alerts
● Configuration management
● Scaling and load testing

November 13, 2023