devopsy.kinsta.cloud

Category: Features

  • Lineaje Allies With Persistent Systems on Open Source Software Remediation Service

    Lineaje Allies With Persistent Systems on Open Source Software Remediation Service

    Lineaje this week revealed it has partnered with Persistent Systems to provide a managed service for remediating open source vulnerabilities that leverages artificial intelligence (AI) technologies.

    Persistent is extending an existing open source software maintenance service by incorporating a Lineaje platform that makes use of machine learning algorithms to analyze software bill of materials (SBOMs) to provide recommendations for fixing code and surface remediations such as updates that should be applied.

    Lineage CEO Javed Hasan said Persistent Systems is augmenting that capability with a dedicated team of specialists that IT organizations can contract to maintain open source code along with previous investments the managed service provider has made in large language models (LLMs) that add generative AI capabilities.

    Options for the services range from simply identifying issues that an internal IT team should address to a white glove offering through which Persistent Systems ensures all open source components are continuously updated.

    In the wake of an executive order issued by the Biden administration that requires federal agencies to better secure their software supply chains, more attention is being focused on the inherent cybersecurity risks associated with employing open source software to build applications. Many open source projects are led by a handful of maintainers that often lack the time and skills required to ensure the components they employ have not, for example, been compromised by malware that might find its way into downstream applications.

    Those maintainers are not being paid, so cybersecurity patches to open source software might not be readily made available, and even when they are, many organizations lack the skills and resources required to apply them in a timely manner. The majority of known vulnerabilities within application environments are still unpatched. Many IT teams are also reluctant to upgrade components for fear of breaking applications that have dependencies that are often difficult to track.

    It’s not known how much of the open source software that many developers routinely incorporate into their applications might contain vulnerabilities that could be exploited, but the level of technical debt that has accrued over the last several decades is considerable. While only a small percentage of those vulnerabilities have been exploited, cybercriminals are becoming more adept at discovering them.

    Hopefully, more contributions to open source projects will improve the overall state of application security, but in the meantime, it’s clear organizations will need to rely more on AI to drive DevSecOps workflows as ever-increasing amount of open source software continues to be relied on to build applications, said Hasan.

    The challenge, of course, is identifying which vulnerabilities, if exploited, will have the biggest impact on the organization. After all, at this point, it’s not possible to defend every application so the focus needs to be on prioritizing remediation efforts based on their actual severity rather than a general rating.

    In the meantime, DevSecOps teams would be well-advised to have incident response plans in place for remediating breaches involving both known and zero-day vulnerabilities that, in addition to being all but inevitable, can now be exploited within minutes of being discovered.

  • Microsoft Previews Additional Copilot Tools for Azure

    Microsoft Previews Additional Copilot Tools for Azure

    At its Ignite 2023 conference, Microsoft this week previewed Copilot tools to simplify the management of the Azure cloud service along with a tool that streamlines the building and deploying of artificial intelligence (AI) applications on the Azure platform.

    In addition, Microsoft launched Microsoft Copilot Studio, a low-code tool that automates the process of creating data integration plugins and adding custom copilots within the Microsoft Copilot for Microsoft 365 tool that Microsoft previously launched.

    Microsoft Copilot for Azure leverages large language models (LLMs) to enable IT teams to use natural language to create, configure, discover and troubleshoot Azure services. It also enables IT teams to create complex commands, ask questions and optimize costs.

    Erin Chapple, corporate vice president for Azure Core at Microsoft, told Ignite attendees that Microsoft, along with a handful of customers, is already using Microsoft Copilot Azure to manage Azure infrastructure.

    In the long term, it’s clear that Microsoft is moving toward streamlining the building and deployment of AI applications using Azure AI Studio, a framework for invoking the AI models that Microsoft makes available on the Azure platform. The goal is to make it possible for organizations to create their own copilots based on AI models they have trained.

    It’s still early days in terms of organizations leveraging AI models to build applications, but it’s already apparent that DevOps and machine learning operations (MLOps), along with data engineering and cybersecurity best practices, will need to converge. Microsoft is making a case for Azure AI Studio as the framework that will enable IT organizations to achieve that goal.

    Of course, Microsoft is not the only provider of IT infrastructure resources with similar ambitions, but thanks to its investments in OpenAI and the acquisition of GitHub, it is furthest along in terms of defining a framework for building AI applications at scale. Last week, GitHub previewed an extension of the Copilot tools it already provides to help developers write code that leverages generative AI to automatically propose an editable plan for building an application based on natural language descriptions typed into the GitHub Issues project management software. Copilot Workspace will generate editable documents via a single click that can be used to create code that developers can then visually inspect. Any errors discovered by application developers or the Copilot Workspace platform can also be automatically fixed.

    At the same time, GitHub has extended the scope and reach of Copilot Chat to make it simpler for developers to use natural language to discover issues in their code base.

    Generative AI is already having a massive impact on the rate at which applications are developed, but that code still needs to be reviewed. Chat GPT is based on a general-purpose large language model (LLM) that is trained by pulling in code of varying quality from all across the web. As a result, code generated by the platform might contain vulnerabilities or be inefficient. In many cases, professional developers still prefer to write their own code.

    Of course, not every programming task requires the same level of coding expertise. In many instances, ChatGPT will generate, for example, a script that can be reused with confidence across a DevOps workflow. There is no shortage of mediocre developers who are now writing better code thanks to tools such as GitHub Copilot, and soon, domain-specific LLMs will make it possible to consistently write better code based on validated examples of code.

    The next challenge is going to be finding a way to manage increased volumes of code. There is no doubt that AI will be applied to the management of DevOps pipelines, but for the moment, at least, the pace at which AI is being applied to writing code is already exceeding the ability of DevOps teams to manage it.

  • Nobl9 Allies With Microsoft to Simplify SLO Creation

    Nobl9 Allies With Microsoft to Simplify SLO Creation

    Nobl9 this week revealed it has integrated its reliability center platform for managing service level objectives (SLOs) as code with the Microsoft Azure Monitor service to make it simpler to both create and track service levels.

    The Nobl9 Reliability Center provides access to dashboards for a single source of truth about the state of reliability in an application environment based on the metrics collected from the SLOs that have been defined.

    Nobl9 Chief Growth Officer Kit Merker said the integration with Microsoft Azure Monitor is the first in a series that will ultimately make it easier to define SLOs using historical data collected by third-party tools.

    The Nobl9 Reliability Center is already integrated with more than 50 DevOps, observability and incident management tools through which it collects metrics, events, logs, traces, alerts to track incidents, releases, rollbacks, runbooks and other documentation.

    Those integrations will ultimately make it simpler for IT teams to create SLOs using historical data that today are still challenging to define from scratch, noted Merker. In fact, the data tracked by Nobl9 can be used to automate remediations via those integrations, he noted.

    As more microservices-based applications are built and deployed, it’s becoming more challenging to maintain SLOs across applications that have many more dependencies than legacy monolithic applications. Each feature and application programming interface (API) added over time conspires to adversely impact performance. It‘s not so much that any given service will outright fail as much as it is determining where degradations are occurring that result in SLOs not being met.

    Ultimately, each IT team needs to provide some sort of objective benchmark that assesses their overall effectiveness at delivering application services by making it simpler to track whether SLOs are achieved and maintained. Not every service needs to necessarily meet a stringent requirement. Instead, IT teams need to have confidence in the fact that, on average, certain levels of performance are being consistently maintained.

    That’s crucial because as more organizations depend on software to deliver digital services, any disruption is likely to have a direct impact on profit and revenue. As such, the reliability of application environments has become a major concern in an era where IT teams are now trying to manage distinct services rather than individual applications.

    The challenge and the opportunity now is to find a way to proactively reduce that stress by programmatically managing SLOs as code rather than having to overprovision infrastructure resources to ensure maximum availability at the highest cost possible. At a time when more organizations are encountering economic headwinds, that’s no longer a luxury they can afford.

    Each organization will need to determine for themselves how aggressively they need to manage SLOs. Of course, SLOs as a concept have been around for decades, but with the rise of digital services that span multiple organizations, the level of reliability DevOps teams are expected to provide is now being written into business contracts. Not surprisingly, the overall level of associated stress DevOps teams are experiencing has correspondingly increased.

  • Redgate Automates Pulling of Test Data From Production Databases

    Redgate Automates Pulling of Test Data From Production Databases

    Redgate today added a Redgate Test Data Management (TDM) tool that automates the pulling of masked test data from databases running in production environments.

    David Gummer, chief product officer for Redgate, said this capability eliminates manual tasks that previously inhibited testing or resulted in personally identifiable information (PPI) being inadvertently used to test applications.

    Redgate TDM automatically classifies and masks data residing in SQL Server, PostgreSQL, MySQL or Oracle database before it is used to test an application. It then produces a copy or clone of that data that is a fraction the size of the original, said Gummer.

    That approach creates a repeatable process for DevOps teams that can withstand a regulatory audit of application development processes, he added. In fact, with the increased focus on software supply chain issues, more auditors are specifically reviewing how data is secured during the application development process.

    Designed to be invoked via a command line interface (CLI), within an integrated development environment or via a graphical interface, Redgate TDM reduces the friction that currently occurs when DevOps teams request test data from database administrators (DBAs), said Gummer. Many DBAs are either too busy to fulfill those requests or reluctant to provide access to sensitive data that would result in the organization running afoul of a compliance mandate.

    Developers then often resort to using anonymous data that doesn’t actually reflect the environment in which their application will ultimately be deployed.

    The amount of data that developers need to build applications is only going to increase. In the absence of any way to effectively automate the process of accessing that data, it ultimately takes longer to build and deploy stable applications. In many cases, applications are simply not tested as thoroughly as they should be before being deployed in a production environment, resulting in rollbacks that might otherwise be avoidable.

    Advances in artificial intelligence (AI) are making it easier to create test scripts, but much of the testing setup process is still based on manual processes that increase the overall level of toil.

    At a time when more organizations than ever are trying to increase developer productivity, automating relatively mundane tasks such as pulling test data can have a big impact. Developers want to spend as much time as possible focused on writing code. Everything else is a task that gets in the way of achieving that goal. While there is a general desire to empower developers, that doesn’t necessarily mean they want the cognitive load associated with building applications to increase. In fact, one of the reasons platform engineering has emerged as a methodology for managing DevOps workflows at scale is to reduce the current level of cognitive load developers experience today.

    Of course, DevOps teams are, by their nature, ruthlessly committed to automating as many processes as possible. The challenge is bottlenecks in those processes conspire to slow down the overall rate at which applications can be built and deployed despite the best intentions of all involved.

  • What the Future Holds for FinOps and DevOps

    What the Future Holds for FinOps and DevOps

    FinOps, or financial operations, is a cultural practice that brings financial accountability to the variable spend model of the cloud. It’s a strategic approach combining systems, best practices and culture to increase an organization’s ability to understand cloud costs and make informed decisions.

    In essence, FinOps is a framework for managing cloud operating expenses (OpEx). It’s about bringing together technology, business and finance professionals to ensure that companies can get the most out of their cloud investments. The goal is to provide businesses with a better understanding of their cloud usage and costs, enabling them to make strategic decisions about resource allocation and cost management.

    FinOps bridges the gap between finance and operations. It’s not just about monitoring costs; it’s about understanding why those costs occur, how they relate to business value and what can be done to optimize them. It’s a comprehensive, cross-functional and continuous approach to managing cloud expenses, ensuring that businesses can maximize their return on investment (ROI) in the cloud.

    What Does FinOps Mean for DevOps Teams?

    Traditionally, DevOps has been focused on improving the speed, efficiency and quality of software delivery. But with the advent of cloud computing, cost has become a crucial factor. The dynamic nature of the cloud, with its pay-as-you-go model, means that costs can quickly spiral out of control if not properly managed. This is where FinOps comes in.

    Budget Responsibility

    As a DevOps team member, you’re likely used to thinking in terms of speed, performance, and quality. With FinOps, you need to add cost to that equation. You’re not just responsible for delivering high-quality software quickly; you’re also accountable for the cost of that delivery. This requires a shift in mindset, moving from a project-based budgeting approach to a product-based one.

    In a project-based approach, you have a fixed budget for a specific project. Once the project is finished, so is the budget. In a product-based approach, on the other hand, you’re responsible for the ongoing costs of a product throughout its life cycle. This means you need to consider not just the cost of development, but also the cost of maintenance, support, and continuous improvement.

    Resource Optimization

    In the context of FinOps, resource optimization is all about making sure you’re getting the most bang for your buck. You want to ensure that you’re using your cloud resources as efficiently as possible, minimizing waste and maximizing value.

    Resource optimization can involve a variety of strategies, from rightsizing instances to eliminating idle resources. But it’s not just about cutting costs; it’s also about aligning costs with value. You need to understand the value that each resource brings to your organization and allocate costs accordingly. This requires a deep understanding of your cloud usage and a commitment to continuous monitoring and improvement.

    Collaboration With Finance

    One of the key aspects of FinOps is the collaboration between DevOps and finance. You’re no longer working in silos; you’re part of a cross-functional team working towards a common goal. This requires open communication, mutual understanding, and shared responsibility.

    As a DevOps team member, you need to understand the financial implications of your decisions. You need to be able to articulate the value of your work in financial terms, demonstrating how your efforts contribute to the organization’s bottom line. At the same time, you need to be open to feedback and guidance from your finance colleagues, learning from their expertise and incorporating their insights into your decision-making process.

    Performance Metrics

    Performance metrics are crucial in the world of FinOps. They provide the data you need to understand your cloud usage, monitor your costs and make informed decisions. But these aren’t just any metrics; they’re metrics that align with your business goals and reflect the value of your cloud investments.

    These metrics might include cost per workload, cost per user or cost per unit of output. The key is to choose metrics that make sense for your organization, providing meaningful insights that can guide your resource allocation and cost management efforts. And remember, these metrics need to be regularly reviewed and updated to reflect changes in your cloud usage and business needs.

    Automation of Cost Controls

    Automation is a key tool in the FinOps toolkit. It can help you streamline your cost management processes, reduce manual effort and increase accuracy. From automated alerts to automated remediation, there are many ways automation can improve your FinOps efforts.

    With automated alerts, you can be notified when your cloud costs exceed a certain threshold. This allows you to respond quickly, addressing issues before they become major problems. With automated remediation, you can take this a step further, automatically adjusting your cloud resources in response to changes in demand or performance.

    Future FinOps Trends

    The year 2024 promises to be an important one for FinOps, with several trends poised to redefine the landscape:

    1. AI Algorithms for Cost Analysis and Prediction

    The use of AI algorithms for real-time cost analysis and predictions is predicted to be a major trend in 2024. AI enables the automation of complex financial calculations and projections, allowing for more accurate and timely decision-making. AI is already not just analyzing and predicting costs but also providing actionable insights to optimize these costs.

    The power of AI in FinOps lies in its ability to process massive amounts of data quickly and accurately. It can analyze past and current financial data, identify patterns, and predict future trends. This means that instead of reacting to financial changes after they happen, you can be proactive and make strategic decisions based on accurate predictions.

    The use of AI in FinOps will also enhance risk management. By predicting potential financial risks, AI can help organizations take preventive measures and mitigate the impact of these risks. The integration of AI in FinOps is a trend you cannot afford to ignore if you aim for financial operations excellence.

    2. Empowering Teams to Manage Their Own Cloud Costs

    Traditionally, financial operations and cost management have been centralized functions. However, the advent of cloud computing and the shift toward decentralized work models have resulted in a new trend—empowering individual teams to manage their own cloud costs. In 2024, we can expect this trend to gain further momentum.

    In a cloud environment, costs are often directly linked to usage. This means that the teams using the cloud resources are in the best position to control these costs. By empowering these teams to manage their own cloud costs, organizations can promote accountability, encourage resource optimization, and ultimately achieve cost efficiency.

    This approach requires a shift in mindset and the development of new skills. Teams need to understand the financial implications of their actions and make cost-effective decisions. They also need tools and processes to monitor their cloud usage and manage their costs effectively.

    3. Managing Costs Across Multi-Cloud and Hybrid Cloud Deployments

    The use of multiple cloud providers and the coexistence of cloud and on-premises data centers have added a new layer of complexity to financial operations. Managing costs across these diverse environments is a major challenge, and it’s another trend that is expected to shape FinOps in 2024.

    With multiple cloud providers, each with its own pricing model and billing system, cost management can be a daunting task. Add to this the costs of maintaining on-premises data centers, and the complexity multiplies. In 2024, organizations will need to adopt strategies and tools that enable them to manage these costs effectively.

    One of these strategies is the use of cost management platforms that provide a unified view of costs across multiple environments. These platforms can track and analyze costs, allocate them to the appropriate departments or projects, and provide insights for cost optimization. They can also automate cost reporting and forecasting, easing the workload of financial teams.

    4. Emphasizing the Security Aspects of FinOps

    As financial operations become more complex, the risk of abnormal spending patterns or unauthorized activities increases. Identifying and addressing these issues promptly is critical to prevent financial losses and maintain financial integrity. In 2024, the identification of abnormal spending patterns or unauthorized activities will be a key focus area in FinOps.

    Tools and technologies that enable real-time monitoring and anomaly detection will play a crucial role in this regard. These tools can analyze financial data, detect deviations from normal patterns, and alert you to potential issues. They can also help you trace these anomalies back to their source, facilitating investigation and resolution.

    Moreover, organizations will need to strengthen their internal controls and governance mechanisms. They will need to define clear responsibilities and accountabilities, establish robust approval processes and enforce strict access controls. Regular audits and reviews will also be essential to ensure compliance and detect any irregularities.

    5. Measuring and Optimizing for Environmental Impact

    The environmental impact of financial operations is a concern that cannot be overlooked. As organizations strive to be more sustainable, measuring and optimizing for environmental impact is becoming a key aspect of FinOps. This trend is expected to gain prominence in 2024.

    The environmental impact of financial operations is largely tied to energy consumption. In a cloud environment, for instance, the energy consumed by data centers contributes to carbon emissions. Therefore, optimizing cloud usage not only reduces costs but also reduces environmental impact.

    To measure and optimize for environmental impact, organizations will need to track their energy consumption, calculate their carbon footprint, and implement strategies to reduce it. These strategies can include using energy-efficient technologies, optimizing resource usage and sourcing renewable energy.

    Conclusion

    In conclusion, FinOps is a dynamic and evolving field. The trends and predictions outlined above provide a roadmap for achieving financial operations excellence in 2024. By harnessing the power of AI, empowering teams to manage their own cloud costs, managing costs across diverse environments, emphasizing security in FinOps and optimizing for environmental impact, you can take your FinOps program to the next level.