devopsy.kinsta.cloud

Category: Blogs

  • Tabnine Unveils Beta of Generative AI Automated Testing Tool

    Tabnine Unveils Beta of Generative AI Automated Testing Tool

    Tabnine this week made available in beta a tool that enables developers to use natural language to interact with the artificial intelligence (AI) models embedded within its test automation platform.

    Brandon Jung, vice president of ecosystems for Tabnine, said Tabnine Chat extends generative AI capabilities the company developed to make it simpler for developers to invoke its test automation platform from within their integrated development environment (IDE).

    In addition to making it possible to search a codebase more efficiently, that capability can also be used to explain how a piece of code functions, said Jung.

    Developers can also generate new code via a natural language interface using Tabnine Chat in the same way other generative AI tools do, he added.

    In addition to developing its own LLMs, Tabnine previously announced it will be integrating LLMs provided by Google as part of a strategy to mix and match LLMs regardless of where they are hosted.

    Unlike general-purpose LLMs, the ones used by Tabnine were trained using a narrower base of testing code that the company curated using tests made freely available on the internet. No customer data was used to create any of those tests, so developers do not need to worry their code may inadvertently be accessed by anyone else, noted Jung.

    In general, as AI makes test creation simpler, tests will be run more frequently, said Jung. Over time, those AI capabilities and more frequent tests should significantly improve the overall quality of applications running in production environments, he added.

    It’s now only a matter of time before generative AI is applied across the entire software development life cycle (SDLC). Testing, however, may be one area where it will have the earliest impact.

    In the meantime, the debate over the impact generative AI will have on DevOps continues. Some proponents contend most of the software engineering process is about to become automated, while others suggest there will always be a need for a human to be in the loop of any process automated using AI models. Much of the current level of toil associated with DevOps today will be reduced, but the need for software engineers to manage the overall process will remain, they contend.

    The one thing that is certain is that the pace at which applications are built and deployed is about to be greatly accelerated. Prior to rise of generative AI, testing processes were barely keeping pace, so as more code is created with the help of AI, the need for similar advances in testing will become acute.

    There is as much irrational exuberance about AI as there is fear and loathing, but DevOps teams that committed early on to ruthless automation will naturally be at the forefront of adoption. The immediate challenge is assessing what functions will be automated and the impact those changes will have on the way DevOps teams are currently structured. Ultimately, the goal is to eliminate as many of the bottlenecks that conspire to slow application development and deployment while simultaneously improving the quality of the application experience.

  • Why Your Data Lake Strategy is Broken for Observability

    Why Your Data Lake Strategy is Broken for Observability

    Someone once said, “Life is better at the lake.” That may be true in the physical world, but when it comes to using data lakes for observability, that’s not typically the case.

    Just about every organization in every industry has a digital presence, whether it’s a website, an app or another digital service. This makes observability a universal need; it helps teams monitor software performance, optimize performance, detect potential security issues and quickly monitor for bugs if and when they occur. These responsibilities typically fall on engineering teams and require as close to real-time response as possible.

    Some organizations also have business intelligence (BI) needs, aimed at generating insights from multiple data sources for business decision-making. These responsibilities typically fall on business decision-makers; they are not real-time decisions, but rather made by looking back over long time periods.

    All-In on a Data Lake Strategy

    Companies that go all-in on a data lake strategy may ignore the needs of the engineering teams working on the real-time mission-critical aspects of the business and force all of the company’s data, queries, dashboards, etc. into a data lake solution. That doesn’t actually meet the needs of the engineering teams. The result? Engineering teams use unsanctioned solutions, fracturing the company’s data strategy from the ground up.

    By using a standards-based observability solution built on open source InfluxDB 3.0, companies can give their engineers the observability tools they need while preserving their data lake strategy.

    Here are three main challenges that teams come across when using data lakes for time-series, and how to solve the problem with InfluxDB 3.0.

    Problem One: Inefficient and Slow Ingest
    Data sources generate time-series data at an incredibly high rate, easily producing hundreds or thousands of data points every second; some sources even do so as quickly as every nanosecond. Data lakes can store massive volumes of data, but they aren’t optimized to quickly ingest and make it readable on a millisecond time scale.

    Data lake ingest jobs can be measured in minutes or even hours, which is far too late for any meaningful interventions that can prevent catastrophes such as downtime. Customers will notice the outage before the data is even ingested into the data lake, much less acted upon.

    Problem Two: Time-Series Life Cycle
    Full-fidelity data is necessary for real-time analytics and observability, but the value of the full-fidelity data fades over time. Storing the full-fidelity data in a data lake may be convenient, but it is costly and not necessary for typical BI purposes.

    InfluxDB is designed for the time-series data life cycle. This life cycle entails:

    1. The leading edge of data. That is, data written in the last two hours or so. This is the data that is most likely to be queried, so the full fidelity data is kept in memory ready to query instantly.
    2. Compacted data. That is, data older than the leading edge that is still likely to be queried and requires full fidelity is compacted off to disk in object store, which still permits fast querying but does not incur the costs of storing data in memory.
    3. Retention policies. That is, data that has lost its value in its full fidelity form. For example, for observability data, data older than a few weeks can be aggregated into a much smaller data footprint. Then, this aggregated data is ingested into the company’s data lake while the full fidelity data is automatically dropped from InfluxDB 3.0.

    Without such a system, it is necessary to store the full fidelity data in the data lake and incur those massive costs without a reasonable way to manage the life cycle of the data. With such a system, the correct amount of observability data can be ingested into your data lake to support your BI needs.

    Problem Three: Slower Query Performance
    Engineers can experience a high degree of frustration when they are troubleshooting an issue in real-time, but their dashboards won’t load or their queries won’t return in a reasonable amount of time. Data lakes simply are not designed to produce fast results for observability, and so query performance is a primary complaint of engineers trying to use a data lake for observability. Waiting minutes for a query to return when you are running a BI report may be annoying, but it could spell extended downtime for an engineering team.

    Fortunately, InfluxDB is built on the Apache Arrow standards, which means that it can be directly queried by your engineering team. Via protocols such as Delta Sharing and Iceberg, anyone can query into InfluxDB 3.0 from their data lake and join the real-time observability data stored in InfluxDB 3.0 with the data lake data. This is akin to having your cake and eating it too.

    The Bottom Line

    If you are trying to use a data lake strategy to fulfill your engineering team’s observability needs, you are going to frustrate those teams because the data lake is not designed for data ingestion, the data life cycle, or the query needs of those teams. This will cause those teams to create rogue solutions that are inconsistent with your company’s data lake strategy.

    By providing those teams with open source InfluxDB 3.0, engineering teams will have a first-class observability platform that is designed to interoperate sensibly with your company’s data lake. This enables the critical mission of your observability platform while maintaining your overall data lake strategy for your BI needs.

  • How AI Addresses DevOps Monitoring and Observability Challenges

    How AI Addresses DevOps Monitoring and Observability Challenges

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that the continuous monitoring pillar involves monitoring observable systems and application performance in real-time so that teams can detect and react to problems quickly, often before they impact users. It’s crucial for maintaining application health and informing future improvement efforts.

    In this article, I explain how AI can analyze logs and metrics to predict potential system failures or performance degradation, allowing for proactive maintenance and issue resolution.

    Continuous Monitoring and Observability Use Cases

    CI Anomaly Detection: AI can analyze historical data to detect anomalies during the continuous integration phase. Any unusual change can be flagged for review before it proceeds to the next phase. Tools like IBM Watson Anomaly Detection can help identify these anomalies by using AI to detect patterns and irregularities.

    Code Quality Assurance: AI can be used to analyze the code in the development stage to ensure its quality, which can help reduce bugs and vulnerabilities. Tools like DeepCode and Codota use AI to identify potential problems and suggest improvements based on a learned database of code and solutions.

    Test Case Optimization: AI can help optimize the selection of test cases in continuous integration (CI). Using historical test data, AI can identify which test cases are most likely to find new defects. Tools like Testim.io can help with this by using AI to prioritize testing based on risk and change impact.

    Predictive Analytics in CD: AI can analyze historical deployment data and predict potential issues during continuous delivery (CD). This can help preemptively solve problems, reducing downtime. Tools like Splunk use AI and machine learning to provide predictive analytics for operations data.

    Automated Rollbacks: In the case of continuous deployment, AI can be used to automatically roll back deployments that are causing issues. Tools like Harness use machine learning to understand typical application behavior, automatically reverting to the last stable state if anomalies are detected.

    Infrastructure Optimization: AI can help optimize the usage of resources in cloud environments. Tools like CAST.AI and Turbonomic use AI to continuously optimize your infrastructure, ensuring better performance while reducing cost.

    Incident Management: AI can help automate the incident management process, from detection to resolution. Tools like BigPanda and Moogsoft AIOps use AI to aggregate, correlate and analyze alerts from various sources, reducing noise and speeding up incident resolution.

    Log Analysis: AI can analyze logs and identify patterns that would be difficult for humans to spot. Tools like Logz.io use AI to provide cognitive insights into log data, providing a deeper understanding of the data.

    Security Threat Detection: AI can analyze patterns and detect security threats more effectively. Tools like Darktrace use machine learning to detect unusual behavior in real-time, thereby detecting potential threats before they cause damage.

    Network Monitoring: AI can predict network outages by analyzing traffic patterns. Tools like Kentik use AI to proactively identify potential network issues before they affect users.

    Challenges When Transforming Continuous Monitoring to use AI

    Here are some challenges organizations might face when transitioning existing CI/CD pipelines to incorporate AI into continuous monitoring and observability, along with possible solutions:

    Data Quality and Availability: The effectiveness of AI-engineered tools largely depends on the quality and quantity of the data they’re given. Insufficient or poor-quality data can result in inaccurate insights or predictions. Implement effective data governance and management practices to ensure data quality and accessibility. Data should be thoroughly cleaned and properly labeled to facilitate the training of AI models.

    Skills Gap: Adopting AI-engineered tools requires new skills that the existing IT team may not possess. There might be a lack of understanding of how to use these tools effectively. Provide comprehensive training to your DevOps team to bridge the skills gap. Also, consider hiring AI specialists or working with an experienced vendor to help implement and manage the AI tools.

    Resistance to Change: As with any significant transformation, resistance to change can be a substantial barrier. Employees may be concerned about job security or the perceived difficulty of adapting to new tools. Communicate clearly and transparently about the benefits of the AI transition, both at an organizational and individual level. Ensure staff that AI is there to assist them, not replace them. Organize workshops and training sessions to ease the transition.

    Integration with Existing Systems: AI tools need to integrate seamlessly with existing DevOps tools and workflows to ensure that they add value without disrupting operations. Choose AI tools that are compatible with your existing infrastructure or consider implementing integration middleware. Conduct a proof-of-concept (PoC) to ensure the new AI tools integrate smoothly.

    Cost of Implementation: Deploying AI tools can require a significant upfront investment, both for the tools themselves and for necessary infrastructure upgrades. Conduct a thorough cost-benefit analysis to understand the return on investment (ROI) that the AI tools can deliver. Consider starting with lower-cost or open source tools or use cloud-based AI services to reduce initial investment in infrastructure.

    Summary

    As the world of DevOps evolves, the integration of AI in monitoring and observability becomes increasingly important. Whether it’s during the phases of continuous integration, continuous delivery or continuous deployment, or for applications, infrastructure and pipelines, AI can provide exceptional benefits. From anomaly detection in CI, code quality assurance and test case optimization to predictive analytics in CD, AI can transform your operations, delivering rapid and more reliable results.

    However, transitioning to an AI-optimized DevOps environment is not without its challenges. Issues such as data quality, the skills gap, resistance to change, system integration and cost implications must be considered and addressed. But fear not, solutions are at hand. With effective data governance, comprehensive training, transparent communication, smart tool selection and thorough cost-benefit analysis, you can navigate these challenges and reap the rewards of AI integration in your DevOps journey. So, are you ready to embrace the future of AI-driven DevOps? There’s no time like the present to start exploring the possibilities.

  • Applitools Acquires Preflight to Further Apply AI to App Testing

    Applitools Acquires Preflight to Further Apply AI to App Testing

    Applitools this week revealed it has acquired Preflight, which provides a low-code automation platform infused with machine learning algorithms that makes it possible for developers to write their own tests.

    Applitools COO Moshe Milman said Preflight extends the company’s efforts to leverage artificial intelligence (AI) to shift more testing capabilities left toward application developers using its existing test automation platform. The Applitools platform is compatible with frameworks such as Selenium, Playwright and Cypress.

    One of the major challenges organizations encounter as they encourage developers to run more tests is that many of them don’t have the skills required to write them. Applitools’ AI capabilities reduce the cognitive load required to create and run tests, noted Milman.

    The goal isn’t so much to replace dedicated application testing teams but to enable developers to more easily test code as they build it, noted Milman. There will always be a need for dedicated testing teams to evaluate more complex use cases for applications, he added.

    The issue is, thanks to advances in DevOps automation, the pace of application development is outpacing the testing resources available, said Milman. IT teams need to invest in test automation to close what has become a quality gap because not enough code is being thoroughly tested, he noted.

    Test automation also serves to reduce the total cost of creating tests. That enables organizations to conduct more tests without slowing down application development, noted Milman.

    In the longer term, Applitools also plans to leverage large language models (LLMs) to provide generative AI capabilities alongside existing support for machine learning algorithms to further automate testing, noted Milman. Applitools is already making use of computer vision to automate app testing. Preflight adds a set of tools infused with AI to create tests.

    The reasons behind inadequate application testing aren’t entirely clear. Whether it’s because tests are too difficult to create or development teams simply run out of time because of scheduling delays, the impact is the same. Too often, developers convince themselves they will address any issues that might arise with the next update only to become distracted by other priorities. Regardless of the reason, however, there are more poorly-tested applications running in production environments than many DevOps teams would prefer. In fact, much of the technical debt IT organizations need to manage today can be traced back to inadequate testing.

    However, as testing tools become more automated, the overall quality of applications should improve and technical debt may become less of an issue. In the meantime, automated testing promises to improve overall developer productivity as it becomes simpler for developers to create code that has been, at the very least, vetted by algorithms before being added to a codebase. In effect, developers are running out of excuses for not testing applications before delivering them to unsuspecting end users.

  • IBM/Red Hat Sparks Anger at GPL ‘breach’ as RHEL Source Locked Up

    IBM/Red Hat Sparks Anger at GPL ‘breach’ as RHEL Source Locked Up

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Red Hat Enterprise Linux (RHEL) goes closed source. Well—no, not really; but IBM’s lawyers are accused of skating so close to the edge of legality that they risk violating the GNU Public License. (more…)

  • Harnessing AI in Continuous Delivery and Deployment

    Harnessing AI in Continuous Delivery and Deployment

    In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that the continuous delivery pillar is an approach where code changes are automatically built, tested and prepared for release to production; this may be followed by continuous deployment where an approved release is automatically deployed to the production environment. The practices of the CD pillar aim to make releases and deployments less disruptive and more frequent, increasing speed and efficiency.

    In this article I explain how AI can help continuous delivery and deployment processes.

    Continuous Delivery Use Cases

    Orchestration of Test Environments: Teams need a reliable way to prepare and manage various test environments. This includes setting up and tearing down environments, managing versioning and configuration and handling data and resources. AI tools that can help include Harness, and IBM’s UrbanCode, which can automatically spin up and down environments for testing purposes and handle configuration as code.

    Execution of Various Tests: This includes system acceptance tests, regression tests, performance tests, user acceptance tests and security tests. The AI tool that could help here is Parasoft’s SOAtest. Its AI can generate test scenarios, ensure full coverage and automatically adapt to changes in the code base.

    Performance Monitoring of Release-Candidate-Artifact: Tools need to assess the performance of release candidates, identify bottlenecks and compare performance against previous versions. Dynatrace is an AI-powered tool that provides automatic and dynamic baselining of application performance, helping teams to recognize when performance is lagging.

    Automation of Policies for Artifact Acceptance: Rules and policies need to be defined and enforced regarding when an artifact is ready for release. Tools like Harness use machine learning to analyze past deployments and test results to predict the success of future deployments and automate the approval process.

    Continuous Deployment Use Cases

    Orchestration of Deployment Environments: Teams need to manage deployment environments, including setup, versioning, configuration and data management. Spinnaker is an open source tool that uses AI to manage multi-cloud deployment strategies.

    Execution of Deployment Strategies: This includes executing strategies such as Blue-Green, Canary and Feature Flag gradual rollouts. A tool like LaunchDarkly can utilize AI to manage feature flags, analyze usage data and roll out features gradually.

    Testing in Production: Testing the new release in the live production environment is crucial. A tool like Sentry can use AI to monitor application use in real-time and identify and alert teams to issues faster.

    Restoring Production to a Prior Version: When a problem is detected with a new release, teams may need to revert to a previous stable version quickly. StackStorm is an event-driven automation platform that uses AI to define workflows, allowing you to quickly roll back to a previous version in case of failure.

    Updating Documentation and Configuration Management Databases: It’s crucial to keep records up-to-date. A tool like Guru uses AI to automatically update and keep track of documentation, ensuring that it’s always accurate and up-to-date.

    Challenges When Transforming CD to use AI

    Here are some challenges organizations might face when transitioning their existing CI/CD pipelines to incorporate continuous delivery, continuous deployment and AI tools, along with possible solutions:

    Lack of understanding of AI capabilities and uses: One of the first challenges that organizations might face is the lack of understanding of what AI can and cannot do. Some team members may have unrealistic expectations or fear that AI will replace their jobs. Regular training and workshops can help teams understand how AI can enhance their roles rather than replace them. Clear communication about the goals and benefits of incorporating AI can also help allay fears.

    Data privacy and security concerns: Using AI tools often involves handling a large amount of data, some of which may be sensitive or private. There are also concerns about the security of AI tools themselves. Establish a robust data governance policy that includes procedures for handling sensitive data. Also, when selecting AI tools, prioritize those that are known for their robust security measures.

    Complexity in integrating AI tools with existing systems: Not all AI tools will seamlessly integrate with existing systems and infrastructure. This could lead to technical debt and instability in the pipeline. Prioritize AI tools that have wide integration capabilities. Engage the tool’s support team or hire consultants if needed to ensure the integration is smooth and stable.

    Resistance to change: The transition to a new way of working can be met with resistance, especially if team members are comfortable with the existing systems and processes. Change management strategies can help ease the transition. This can involve regular communication about the benefits of the change, training and providing support during the transition.

    Cost of AI tools and training: AI tools can be expensive, and there’s also the cost of training team members to use these tools. Start with a cost-benefit analysis to understand if the transition is worth the investment. Look for AI tools that offer a good balance between cost and features. Consider phased implementation to spread the costs over time.

    Dependence on vendor support: Given the complexity of AI, there may be a high dependence on the AI tool vendor for support. This could become a problem if the vendor is unresponsive or ceases to support the tool. Choose vendors who have a good track record of providing strong customer support. Also, consider tools that have a strong community around them, which can provide additional sources of help and support.

    Summary

    Navigating the landscape of continuous integration, continuous delivery and continuous deployment (CI/CD) pipelines can be complex, but it’s a vital process that’s being revolutionized by the introduction of AI tools. From orchestrating test and deployment environments, managing testing and deployment strategies, to automating delivery tasks and quality checks, AI is playing an increasingly critical role in streamlining and enhancing these processes.

    However, as with any significant change, transitioning to AI-enhanced CI/CD pipelines is not without its challenges. This includes understanding AI’s capabilities, data privacy and security concerns, technical integration difficulties, resistance to change, cost considerations and vendor support dependencies. By identifying and addressing these challenges head-on, organizations can effectively leverage AI’s capabilities, bringing increased efficiency, reliability and value to their software delivery pipelines.

    With proper planning, continuous learning and strategic use of AI tools, organizations can not only overcome these challenges but also thrive, gaining competitive advantages in their software delivery processes. The future of CI/CD is undeniably entwined with AI, and embracing this evolution is an exciting journey that holds the promise of transformative benefits.

  • How Platform Engineering Protects Profit, People and our Planet

    How Platform Engineering Protects Profit, People and our Planet

    Platform engineering is emerging as a way of evolving DevOps, with 94% of respondents to the recent State of DevOps report agreeing that the practice helps their organization to reap the benefits of DevOps. The business arguments for platform engineering are clear: In that same report, respondents stated that platform engineering improves efficiency (59%), speeds up delivery time (58%) and improves workflow and process standards (57%).

    But in addition to the huge benefits organizations are now realizing in terms of business value, platform engineering is also pretty crucial for a business’s long-term viability. And by that, I mean that platform engineering can be inherently sustainable.

    How Can Platform Engineering Be Sustainable?

    First, it’s important to note that ‘sustainability’ here doesn’t just mean ‘green.’ Rather, sustainability means that an organization is able to meet the needs of the present without compromising the ability of future generations to meet their needs, too. These are needs that come in three different varieties: People, planet and profits.

    This means that to be truly sustainable, platform engineering needs to deliver lasting and stable returns on things like return on investment year-over-year, improved awareness of and reduction in an organization’s carbon footprint and better governance and optimization through monitoring and analytics.

    Any approach which supports business growth while simultaneously empowering employees and being kind to the planet is the dream for pretty much every organization. But how exactly can departments and wider organizations unlock all of these benefits? The answer is: There’s no magic bullet.

    Sustainable platform engineering is about treating your platform as an iterative cycle: It isn’t the actual creation of the tool that matters, as much as it is the maintenance, upkeep and usability of the platform as your business moves forward. This, naturally, will take time, effort and money—all of which, it’s safe to say in the current climate, are in short supply. But it is crucial that businesses act strategically, looking for areas for improvement and paths that will all add up to a more sustainable business in the long term.

    The Three Paths to Success

    These paths can be divided into three main areas of focus, and the first is GitOps or infrastructure-as-code (IaC).

    A tweak that every organization should start making is using Git as a single source of truth for deployments, enabling developers to work faster by empowering them to use their own code without hands-on involvement from ops teams. This could be combined with optimized infrastructure, moving toward IaC to enable faster and more efficient deployments.

    These principles form the foundation of sustainable platform engineering as they protect profits, allowing the business to keep moving forward and investing in the other areas crucial for a sustainable operation. Combining IaC with GitOps ensures speed and simplicity while maintaining a high-quality end product.

    Creating an optimized infrastructure is important, but just as important is empowering employees to feel good about the work that they are doing. That’s why implementing a self-service tool alongside an optimized UX is the second area of focus. This removes the pressure on those in the tech department to be infrastructure experts while erasing the need for endless tickets to be raised for issues.

    By freeing up DevOps engineers and platform experts to spend more time doing what organizations need them to do, businesses can keep innovating to maintain an edge over their competitors. Self-service capabilities combined with an accessible UX are a useful combination for a much-improved developer experience (DevX).

    Finally, it’s important to keep in mind that self-service isn’t just going to benefit end-users; it also has major upsides for improved governance, as well as keeping control of cloud spending and carbon footprint impact. Optimizing and iterating your platform engineering tool means that a business can keep up with the fast pace of the global tech market while also continuing to implement the latest tweaks and upgrades. It all adds up and builds on the organization’s platform engineering solution.

    Reaping the Rewards of Sustainability

    If an organization follows the above three paths, it is well on its way to a more sustainable business powered by platform engineering. By focusing on targeted, achievable projects to build a solid foundation, organizations can achieve big benefits for people, the planet and profit.

    From an economic perspective, sustainable platform engineering ensures legacy infrastructure is modernized, silos are broken down and production is accelerated, all ensuring the business doesn’t risk lagging behind competitors. A stable and secure return on investment is key to sustainability in the medium to long term, and sustainable platform engineering ensures a business is able to weather future challenges and keep a healthy profit margin.

    As we all know, underpinning any great business is the people who work there. Techs get stressed by having to interact with infrastructure they know nothing about, DevOps and specialists get stressed when those techs desperately raise tickets in an attempt to get help, and platform engineers get stressed when the weight of providing a solution to these problems rests squarely on their shoulders. Implementing a UX-strong self-service portal relieves the pressure, allowing employees to focus on delivering real value to the business through innovation. A better DevX ultimately leads to better business outcomes.

    And, of course, it’s ultimately no good having a successful business if the planet we all share continues to suffer from the effects of the climate emergency. Just like a business that hemorrhages money is unsustainable, so is a planet that wastes its finite resources. By getting control of cloud usage and controlling cloud climate impact, businesses will not only be empowering their people and improving their bottom line, but they will also be making a tangible difference to our shared environment, supporting our planet as it recovers from years of climate neglect.

    Platform engineering offers lots of tangible benefits for businesses, but sustainable platform engineering can be even better, not just for a business, but employees and our shared environment. It might just be time to upgrade DevOps and start thinking about building a sustainable organization that supports profit, people and the planet.

     

  • How Can DevOps Evolve? Platform Engineering

    How Can DevOps Evolve? Platform Engineering

    Kaylee Van De Voorde co-authored this article.

    Has your team adopted a DevOps mindset? Are your engineers using tools like Docker containers, Kubernetes and Terraform? Over the last decade, many engineering teams that adopted DevOps culture and pivoted to cloud-native applications that required rapid scaling may face a new set of problems. 

    DevOps

    DevOps practices have brought operations and software engineering teams together throughout the entire development life cycle, from initial concept through the engineering process to production support. This collaboration paved the way for iterative development: Improving velocity, providing rapid feedback and consequently improving application quality by uncovering bugs and environment requirements earlier without user impact. DevOps automation created a more “blameless” culture that improved trust, collaboration and innovation, which boosted team morale and increased engagement. 

    That said, DevOps teams have encountered many obstacles, including fears of job obsolescence and steep learning curves for every member. Teams that learned how to implement DevOps practices on their projects may have moved more slowly at first while learning how to work together in new ways and adopting new tools.

    What is Platform Engineering?

    So, what is platform engineering? Platform engineering bridges the existing gaps between software, hardware and infrastructure that come with adopting DevOps practices: Automated horizontal scaling, service discovery and cost optimization. Platform engineering makes it even easier and simpler for engineers produce high quality applications quickly by standardizing CI/CD deployments, ensuring that infrastructure is auditable and monitored, automating deployment methods and processes, providing accurate documentation and incorporating FinOps.

    Platform engineering teams can make these improvements available to their teams by creating tools such as an internal developer platform (IDP) that includes APIs that expose internal tools and features within the platform. 

    The Next Evolution

    Evolution does not mean starting from nothing.

    The core tenets of DevOps practices still hold their value; aligning software engineering and operations teams to better create applications that embody business and user functionality and run smoothly within an incorporated infrastructure, automation, security and dedicated site reliability engineering (SRE). Many DevOps teams may already be moving toward an overarching platform engineering culture and simply need to refine their standards. Distinct application teams may already be building similar features to provide platform functionality; a strong indication that a platform engineering team would be beneficial.

    Choosing to create a dedicated platform engineering team has tradeoffs: Building a platform engineering team pulls resources from building applications and new features that the business needs, but application teams could experience an increase in productivity if a separate platform engineering team is created. A dedicated platform engineering team can also provide clear, unified direction and nuanced goals for application teams; this is incredibly important when creating standards and internal tools.

    A platform engineering team is just one way that to advance and improve engineering culture. DevOps teams that may not require platform engineering can continue their growth by refining their existing practices and patterns in their everyday work. 

  • HashiCorp Acquires BluBracket to Extend Secrets Management Reach

    HashiCorp Acquires BluBracket to Extend Secrets Management Reach

    HashiCorp this week revealed it has acquired BluBracket to add a set of scanning tools for discovering static secrets to its portfolio.

    James Bayer, senior vice president of research and development for the Secure product line at HashiCorp, said the existing Vault platform for managing secrets is designed to enable developers to manage them as they build applications. BluBracket has developed a secrets management tool that makes it possible to discover secrets in applications that have already been deployed in production environments, he said.

    The amount of secrets management-related technical debt many organizations have can be enormous, especially if they’ve been deploying applications for decades. IT teams need a tool that discovers secrets in applications that, in many cases, were deployed by application developers that are no longer with the company, Bayer added.

    The BluBracket tools make it possible to discover those unmanaged secrets even before efforts are put in place to improve application security, he noted.

    HashiCorp will initially integrate BluBracket’s functionality into HashiCorp Vault to expand HashiCorp’s zero-trust capabilities, and add detection and remediation workflows via additional capabilities expected later this year. That’s critical, because for decades, developers have been storing secrets in applications and forgetting to remove them before an application is deployed.

    In general, HashiCorp is moving to transform its Vault platform into an orchestration engine for managing secrets regardless of where those secrets might be stored, said Bayer. That approach will enable developers to build applications and store their secrets on, for example, the Amazon Web Services (AWS) cloud in a way that can be centrally managed via the Vault platform, he added.

    Most organizations today are at varying stages of embracing DevSecOps best practices to improve software supply chain security. It’s not clear how readily secrets management is being embraced as part of those modernization efforts, but as cybercriminals routinely scan for application secrets stored in clear text, the need to encrypt secrets becomes a higher priority.

    The core DevSecOps issue most organizations are wrestling with is how involved cybersecurity teams should be in application development. There’s clearly a concerted effort to push more responsibility for application security further left toward developers. The challenge is, even when those tools are provided, it’s not clear that developers can distinguish between the severity of one vulnerability versus another.

    Conversely, most cybersecurity teams don’t really understand how modern applications are developed. That doesn’t necessary mean cybersecurity professionals need to dive deep into application development workflows, but it does mean they should, at the very least, understand how applications are constructed to make sure the appropriate security guardrails have been put in place.

    Regardless of approach, it’s clear there is a need for some type of centralized security function to better ensure application security. Unfortunately, the cultural divide between application developers and cybersecurity teams remains fairly wide. The DevSecOps journey ahead will be long, as each organization determines how best to bridge that gap when the supply of available cybersecurity expertise remains constrained.

  • Survey Surfaces Raft of Enterprise IT Challenges

    Survey Surfaces Raft of Enterprise IT Challenges

    A survey of  enterprise IT leaders found less than a third (32%) are extremely confident that they have the right technology, processes and people in place to execute an effective approach to IT management.

    The survey, conducted by Rocket Software, polled 275 U.S. IT leaders in organizations with more than 1,000 employees. A full 93% of IT leaders are also committed to maximize the value of investments in existing platforms.

    As a result, the top priorities for IT leaders are hybrid cloud computing (65%), data and content management (68%) followed by DevOps and infrastructure and application modernization, tied at 58%, and automation (57%).

    A total of 62% noted they have a much greater focus on efficiency due to the economic landscape, with faster DevOps processes, automated processes and increasing overall output as the top three improvements that would be most impactful for increasing efficiency.

    The survey also suggested many organizations still have much work to do to achieve those goals, with 63% of respondents spending anywhere from six to 15 hours on manual data entry and analysis each week.

    Phil Buckellew, president of infrastructure modernization for Rocket Software, said most organizations are still trying to determine the right level of DevOps to adopt. Few organizations have implemented DevOps workflows on an end-to-end basis, with many employing a mix of DevOps and waterfall processes to build and deploy applications across a hybrid cloud computing environment, he noted.

    Overall, IT leaders are most worried about improving overall IT performance (60%), data security (50%), process risk and compliance (46%) and the need to improve agility (41%), the survey found. Respondents also noted that they measure success within their IT organization by increased efficiency (71%), optimized resources (67%) and reduced risk (63%).

    The survey makes it clear that, despite challenges, enterprise IT organizations are committed to hybrid cloud computing as they become more comfortable with using various platforms that are fit for purpose, said Buckellew.

    Mainframes, for example, continue to play a major role in running online transaction processing (OLTP) applications alongside analytics applications that are now being infused with artificial intelligence (AI) capabililities, noted Buckellew.

    A quarter of survey respondents also identified providing cloud applications with access to mainframe data as an area where they need additional tools, followed by automation (22%).

    The biggest automation obstacles are the complexity of implementing automation (18%), resistance to process change among workforce (18%) and lack of skillsets to implement automation (18%), the survey finds.

    As always, the biggest challenge in enterprise IT environments is often simple inertia. Organizations that have been building and deploying applications on mainframes, for example, have been relying on waterfall processes for decades. Many of them have now adopted DevOps processes to varying degrees, but few have completely replaced legacy approaches to building and deploying software, noted Buckellew.

    It’s not likely the management of complex hybrid cloud computing environments will be simplified any time soon, but progress continues to be made. Soon, AI may automate many existing manual tasks. In the meantime, however, the number of enterprise IT organizations standardizing on a single IT platform remains few and far between.