devopsy.kinsta.cloud

Category: News

  • SolarWinds Adds Ability to Profile Live Code to APM Platform

    SolarWinds Adds Ability to Profile Live Code to APM Platform

    SolarWinds is advancing its campaign to become a leading provider of DevOps tools by adding the ability to profile live code to SolarWinds AppOptics application performance monitoring (APM) platform.

    Keith Kuchler, vice president of engineering for SolarWinds, said live code profiling provides a breakdown of the most frequently called functions and methods in a transaction, including class, method, filename and line number. That capability makes it possible for DevOps teams to identify what line of code might be causing a performance issue without requiring any changes to the code itself, he said.

    According to Kuchler, the ability to profile live code extends a distributed tracing capability that SolarWinds previously incorporated into SolarWinds AppOptics. Collectively, the two offerings show how committed SolarWinds is to providing DevOps teams with access to advanced capabilities at a fraction of the cost of rival APM platforms delivered as a software-as-a-service (SaaS) application, said Kuchler. Pricing for SolarWinds AppOptics starts at $7.50 per month. SolarWinds AppOptics is part of what SolarWinds describes as a DevOps Toolkit that also includes Pingdom, a website performance monitoring tool, Papertrail, a log management service, and Loggly, a log analytics service.

    The ability to profile live code supports applications written in Java and PHP, with support for additional programming languages forthcoming, said Kuchler. The goal is to reduce the amount of time DevOps teams need to spend guessing where the source of any issue might be after an application is deployed or updated, he added.

    As the rate at which applications continue to be deployed and updated, DevOps teams need to be able to pinpoint issues at the code level to enable developers to address that issue as soon as possible. Sharing a bunch of generic alerts typically doesn’t provide a developer with enough actionable intelligence to solve the problem. Not surprisingly, a recent survey of over 300 developers conducted by SolarWinds finds that most of them spend a lot more time troubleshooting existing applications versus writing new code. All that time spent troubleshooting code winds up having an adverse impact on the ability to make the transition to DevOps.

    In general, SolarWinds is trying to expand the total APM market by making its tools available as a service that organizations of any size can invoke. Historically, reliance on APM tools has been limited to mission-critical applications mainly due to cost. But over time, the number of applications deemed to be mission-critical has increased. In addition, because of the all interdependencies between applications, the potential impact a single line of code can have across the enterprise IT environment can be substantial. As a result, the need for an affordable approach to APM has become more acute.

    Naturally, it will be interesting to see how much pressure there is on APM pricing over the course of the coming year. Competition between providers of APM platforms is already fierce. The challenge will be finding a provider of an APM platform that not only provides all the capabilities required, but also has deep enough pockets to be around for the long haul.

    — Mike Vizard

  • VMware Advances Hybrid Cloud Ambitions

    VMware Advances Hybrid Cloud Ambitions

    VMware today advanced its hybrid cloud strategy by making a series of updates to existing offerings, including the CloudHealth by VMware software-as-a-service (SaaS) application for managing and optimizing cloud applications, which VMware acquired last summer.

    In addition, VMware Cloud on AWS is now available in data centers operated by Amazon Web Services in Canada, Paris and Singapore, the company noted. VMware also announced that the latest version of VMware Cloud Foundation—which provides and automatically updates all the VMware compute, storage and networking software required to build a cloud—has been optimized to deploy VMware Horizon virtual desktop infrastructure (VDI) software, and will available on Dell EMC VxRail hyperconverged infrastructure in April.

    New capabilities being added to CloudHealth by VMware include enhanced multi-cloud reporting, multidimensional reporting and workspaces reporting.

    The CloudHealth platform also is now integrated with the Wavefront by VMware cloud analytics and monitoring platform, enabling users of CloudHealth to employ Wavefront metrics to rightsize and optimize applications running on multiple cloud applications as part of their DevOps practices.

    A future update to the CloudHealth platform will add enhanced amortization as well as support for convertible Reserved Instance (RI) exchanger automation, container cluster visibility and cross-family rightsizing for Amazon EC2, according to the company.

    Finally, VMware announced it is making available version 9.7 of VMware vCloud Director to cloud service providers. This offering provides a single pane of glass through which multiple VMware environments can be managed regardless of whether they are deployed on-premises or in the cloud. The latest version of VMware vCloud Director adds support for version 3.0 of VMware Cloud Availability, which unifies onboarding, migration and disaster recovery services between multi-tenant clouds. VMware vCloud Director is only available to cloud service providers, but Ajay Patel, senior vice president and general manager for the cloud provider software business unit for VMware, said VMware and its cloud service provider partners plan to make available a software-defined data center (SDDC)-as-a-service offering through which they will manage deployments of VMware from the edge to the cloud on behalf of IT organizations.

    VMware also revealed there are now more than 60 partners building or delivering managed service offerings for VMware Cloud on AWS, and more than 280 partners have achieved the VMware Cloud on AWS Solution Competency. VMware also now has 35 VMware Cloud Provider Program partners that have achieved Cloud Verified status, which is required to be eligible to deliver the forthcoming SDDC-as-a-service offering. Patel also revealed the number of organizations running instances of VMware on public clouds now exceeds 1,000, in the wake of the launch of VMware Cloud on AWS last year.

    Patel said the shift to hybrid clouds is more about transforming IT operational models than it is about deploying workloads at new physical locations. The challenge many IT organizations will need to come to terms with going forward is deciding what portions of that IT operational model they want to run themselves versus opting to rely on VMware and its partners.

    — Mike Vizard

  • Atlassian Adds Business Planning App by Acquiring AgileCraft

    Atlassian Adds Business Planning App by Acquiring AgileCraft

    Atlassian announced it is acquiring AgileCraft to give business leaders visibility into strategic projects in a way that is closely mapped to IT projects being driven by DevOps processes.

    The value of the deal, expected to close next month, is estimated to be $166 million.

    Many DevOps teams already make extensive use of the Jira project management software developed by Atlassian. AgileCraft emerged in 2013 as a provider of a collaboration application aimed at business users to keep track of the various strategic IT initiatives that are largely dependent on DevOps processes.

    Atlassian and AgileCraft previously established a technology alliance to facilitate that goal. Atlassian president Jay Simons said the acquisition represents an opportunity for Atlassian to extend its reach into the realm of business users who increasingly are trying to keep track of complex digital business transformation initiatives that are dependent on multiple IT projects. Many of those digital business initiatives tend to quickly fall behind schedule because the dependencies between various IT initiatives are not clear to all the key business stakeholders, he said.

    In addition, Simons said many businesses now are trying to apply the agile methodologies pioneered by DevOps teams more broadly within the IT organization. To achieve that goal, business users need a project management application that has been optimized to enable them to keep track of multiple inter-related DevOps projects, he noted.

    Most organizations are not yet anywhere near the point where the IT organization is completing IT projects faster than the business can absorb. But as agile methodologies and best DevOps practices become more widely employed, there may come a day when IT organizations will complete IT initiatives faster than most business will be able to adapt. In fact, it’s not uncommon for organizations that have embraced DevOps to deliver multiple updates to applications a week. AgileCraft planning software will make it easier for business users to appreciate all the business implications associated with each of those updates. The irony is, the constant debate over the inability to align IT with the business usually comes down to the inability of IT organizations to keep pace with the demands of the business. It soon may turn out the business is no longer capable of absorbing the rate at which new applications are being rolled out.

    In the meantime, applications such as AgileCraft should make it easier for IT leaders to have better-informed conversations with business leaders concerning where limited resources need to be applied and when. Business leaders will be able to see for themselves now what impact any given set of missed deadlines is likely to have on any strategic initiative. In fact, there may come a day when business leaders proactively make more resources available to achieve a specific goal without requiring IT leaders to attend a meeting to explain in excruciating detail how every delay adversely impacts the grand scheme of the business. Instead, business leaders will be able to see for themselves exactly where additional resources are needed to achieve a specific business goal.

    — Mike Vizard

  • Chef Achieves Multiple Compliance Mandates

    Chef Achieves Multiple Compliance Mandates

    Chef today announced it will make it easier for organizations that adopt its IT automation framework to stay compliant with mandates such as the Federal Information Processing Standards (FIPS), Secure Technical Implementation Guidelines (STIG) and the Center for Internet Security (CIS) certification.

    John Snow, senior software development engineer and federal content lead for solutions engineering at Chef, said it’s incumbent on the provider of an IT platform or application to make sure their offerings comply with widely required mandates. FIPS compliance, for example, not only applies to federal agencies, but also any organizations that interacts with those agencies.

    Specifically, Chef said it has achieved FIPS compliance along with providing an implementation of STIG profiles for RHEL 7 and Windows Server 2016 in Chef InSpec and achieving a (CIS) certification for Amazon Web Services (AWS) Foundations Benchmarks Level 1 and 2 in Chef Automate. Chef claimed it is the first vendor to achieve CIS certification across AWS, Microsoft Azure and Google Cloud Platform.

    Snow said Chef was able to achieve that goal in part because of the time and effort it put into developing a parser that enabled the company to approach compliance as a programmable extension of its development process. That translation process is required because most compliance mandates are written for auditors by auditors, not by IT operations teams. Chef will also leverage that capability to ensure its platforms remain current with any future updates to the compliance mandates its supports, said Snow.

    Chef has been making a case for treating compliance as code for several years now. Any given compliance mandate typically consists of a set of controls that need to first be put in place and then tested and validated. Rather than trying to achieve that goal relying on manual processes that don’t scale, Chef contends achieving compliance should become a natural extension of best-in-class DevOps processes.

    It’s not clear yet to what degree compliance may become integrated within DevOps. But recent advances in DevSecOps suggest it’s only a matter of time before responsibility for implementing compliance controls “shifts left” along with security control. Compliance teams may define what controls will need to be put in place. But responsibility for implementing those controls as part of any quality assurance process is moving toward DevOps teams. Developers, however, will take on that responsibility only when a means to programmatically implement those controls is readily available.

    The long-term economic implications of that shift may prove to be profound. Organizations of all sizes incur massive costs both implementing compliance controls and having them audited by a third party. As the compliance process becomes more automated, not only does it become easier to implement controls at scale, but the documentation required to pass an audit is generated automatically. Given that most auditors charge per hour for their services, the savings derived from limiting the time and effort associated with preparing for and then passing an audit could be substantial. The challenge and opportunity is educating the DevOps team on not just how much money might be saved for the company, but also how much of that money might be reinvested in advancing DevOps adoption.

    — Mike Vizard

  • F5 Networks Acquires NGINX to Meld NetOps with DevOps

    F5 Networks Acquires NGINX to Meld NetOps with DevOps

    As part of an effort to better align DevOps and network operations (NetOps), F5 Networks plans to acquire NGINX, a provider of widely employed open source loading balancing software.

    The two companies revealed in a call with financial analysts that the primary goal of the $760 million deal is to meld the two companies’ combined expertise to develop application delivery controllers (ADCs) that are optimized for modern applications based on microservices.

    F5 Networks CEO François Locoh-Donou said F5 Network plans to continue operating NGINX as an independent brand in addition to maintaining support for the NGINX open source community. NGINX CEO Gus Robertson will become general manager of the NGINX business unit. NGINX founders Igor Sysoev and Maxim Konovalov also plan to stay on.

    Locoh-Donou also disclosed that while NGINX software is employed today at more than 375 million sites, the company only generated $26 million in revenue in 2018, mostly by providing commercial support to enterprise customers. F5 Networks will move to combine investments both companies have been making in containers to deliver a next-generation ADC optimized for microservices-based applications spanning multi-cloud computing environments, he said.

    As part of that strategy, however, both companies will need to come to terms with Envoy, an open source load balancing project led by the Cloud Native Computing Foundation (CNCF). Envoy is already providing the foundation for multiple service mesh projects that make load balancing a feature of a higher-level mechanism for managing services running on a Kubernetes cluster. Obviously, F5 Networks hopes to fulfill an opportunity to manage multiple instances of service meshes running on multiple Kubernetes clusters that.

    In fact, Locoh-Donou cited industry research that forecasts by 2022 there will be more than 198 million workloads running on some form of a microservices-based architecture. In contrast, 44 million workloads are expected to be running on legacy platforms.

    Locoh-Donou said F5 Networks also expects to leverage NGINX to expand its presence in application programming interface (API) management and associated web application services, which he noted collectively represent multibillion-dollar market opportunities.

    The decision to acquire NGINX reflects the inevitable melding of NetOps and DevOps, he added, noting that inconsistent approaches to managing application service across emerging microservices-based environments are a recipe for creating unstable IT environments.

    While it’s still a little too early to determine to what degree NetOps will be subsumed into DevOps processes, Locoh-Donou said F5 Networks plans to advance adoption of NGINX software by educating its core base of NetOps administrators on how microservices applications are deployed across extended networks and the rigors of the DevOps processes required to manage them.

    Both F5 Network and NGINX made a name for themselves by interconnecting IT environments made up largely of virtual machines. While virtual machines are not going away anytime soon, so-called cloud-native applications built using containers running on Kubernetes clusters require a different approach to delivering infrastructure services. The challenge facing the combined company is finding a way to deliver those services in a way DevOps teams want to consume.

    — Mike Vizard

  • The Linux Foundation Launches Continuous Delivery Foundation

    The Linux Foundation Launches Continuous Delivery Foundation

    The Linux Foundation announced it will provide the home base for a vendor-neutral Continuous Delivery Foundation (CDF) committed to making it easier to build and reuse DevOps pipelines across multiple continuous integration/continuous delivery (CI/CD) platforms.

    The first projects to be hosted under the auspices of CDF, which was launched at the Open Source Leadership Summit conference, includes Jenkins, the open source CI/CD system, and Jenkins X, an open source CI/CD solution on Kubernetes. Both were developed by CloudBees. Netflix and Google, meanwhile, are contributing Spinnaker, an open source multi-cloud CD solution, and Google is also adding Tekton, an open source project and specification for creating CI/CD components.

    Additional projects are expected to join CDF once a Technical Oversight Committee (TOC) is formally named.

    Founding members of the CDF include Alauda, Alibaba, Anchore, Armory, Autodesk, Capital One, CircleCI, CloudBees, DeployHub, GitLab, Google, Huawei, JFrog, Netflix, Puppet, Red Hat, SAP and Snyk.

    Chris Aniszczyk, vice president of developer relations for The Linux Foundation, said that while a lot of progress has been made over the years regarding adoption of CI, the challenges associated with mastering CD have proven more vexing. To address that issue, the CDF will evangelize CI/CD and DevOps methodologies, define and document best practices, provide guidelines and create training materials to better enable organizations to implement CI/CD best practices.

    Kim Lewandowski, a product manager for Google Cloud, said making it possible for organizations to reuse DevOps pipelines is a high priority. Building pipelines is a significant challenge for most DevOps teams; as such, they need to be able to reuse those pipelines across as many CI/CD platforms as possible.

    Kohsuke Kawaguchi, creator of Jenkins and CTO at CloudBees, noted the creation of interoperability standards between CI/CD platforms will go a long way toward achieving that goal.

    It’s not clear yet just how widely the CDF will be supported by the entire DevOps community. While CloudBees provides one of the most widely employed CI/CD platforms, other offerings have started gaining traction, especially among enterprise IT organizations that tend to not have a lot of internal DevOps expertise.

    On the plus side, the CDF should help spur adoption of DevOps best practices even further. Adoption of DevOps processes within most enterprise organizations tends to be uneven at best. One team may be employing DevOps extensively, while the rest of the organization continues to rely on less agile legacy processes.

    The CDF also should play a significant role in enabling organizations to embrace microservices-based applications built using containers. While Jenkins is the most widely relied-on CI/CD platform today, it is built on what is now considered in many quarters to be a legacy Java Virtual Machine (JVM) platform. In contrast, Jenkins X Background an open source CI/CD platform for building and deploying modern cloud-native applications on Kubernetes. The Linux Foundation also plays host the Cloud Native Computing Foundation (CNCF), which oversees the development of Kubernetes.

    It still may take years for IT organizations to fully make the transition to DevOps and cloud-native applications. But in the months ahead, it’s clear the CDF intends to function as a force multiplier in enabling organizations to achieve that goal.

    — Mike Vizard

  • DevSecOps: Fortanix Adds Open Source Rust SDK to Build Encrypted Apps

    DevSecOps: Fortanix Adds Open Source Rust SDK to Build Encrypted Apps

    There’s a lot of focus these days on DevSecOps as part of an effort to fix what’s generally acknowledged as a broken cybersecurity paradigm. But instead of trying to ensure every potential vulnerability is addressed before an application is deployed, another idea is gaining momentum among the DevOps community: Build applications that are secure in the first place, using modern programming languages.

    Fortanix, at RSA Conference 2019, launched an Enclave Development Platform (EDP) based on an open source software development kit (SDK) written in Rust. The SDK is optimized for Intel Software Guard Extensions (SGX), which are extensions to Intel instruction sets that define private regions of memory, dubbed enclaves, that prevent data to either be read or saved by any process outside the enclave. Intel SGX is required to be on by default in the latest generations of Intel processors.

    Company CEO Ambuj Kumar said Fortanix has been advocating the adoption of a runtime platform that makes it possible to process encrypted data in memory without ever having to expose it as plain text. By partnering with Intel to create a Rust-based SDK, the company wants to make it easier for developers to take advantage of an inherently secure programming language to invoke the Fortanix runtime.

    Fortanix, which also provides access to a self-service key management service for managing encryption, recently received an additional $23 million in funding led by Intel Capital.

    Kumar said Rust is gaining in popularity as a programming language because it is designed to include guardrails that prevent cybercriminals from injection attacks by corrupting code running in memory. In fact, Kumar noted that one of the reasons why cybersecurity professionals are now against deploying applications written in C or C# is because there are no such guardrails available.

    The combination of Rust and Intel SGX doesn’t eliminate the need for organizations to define a set of best DevSecOps processes. But it does take a significant amount of pressure off developers who choose to build applications using a modern programming language to create applications that are not as easily hacked.

    Naturally, it will take some time for developers to give up tools based on legacy programming languages that many of them have been using for years. But Kumar said Rust adoption is already spreading like wildfire because developers are looking for a way to eliminate cybersecurity issues that many are now being held accountable to resolve once they are discovered in a production environment.

    Of course, billions of lines of legacy application code are not going to disappear overnight simply because a new programming language has come into vogue. But enhancing cybersecurity may very well become a compelling reason to rewrite some of those most mission-critical legacy applications, especially if they wind up improving the performance. After all, those legacy applications are targeted because that’s where the organization’s most valuable data resides. Of course, Intel is betting it won’t make sense to deploy those rewritten applications on processors that don’t support SGX. But whatever the rationale, the amount of time developers have to devote to ongoing cybersecurity issues is clearly limited.

    — Mike Vizard

  • Survey Finds Mixed Progress on DevSecOps

    Survey Finds Mixed Progress on DevSecOps

    A survey of 5,558 IT professionals published today by Sonatype in collaboration with CloudBees, Carnegie Mellon’s Software Engineering Institute, Signal Sciences, 9th Bit and Twistlock finds 27 percent of organizations have mature DevOps practices in place, while another 48 percent are still working on improving them.

    Despite the DevOps works that remains to be accomplished, however, the survey also noted that 47 percent of respondents still manage to deploy code multiple times a week.

    The survey, announced at the RSA Conference, also finds that 25 percent of respondents now consider security to be a fundamental element of quality assurance process. But responses among the 23 percent of respondents who identified themselves as developers suggest implementing best DevSecOps practices remains a significant challenge. For the third year in a row, about half of developers reported they don’t have enough time to address cybersecurity issue.

    The survey, however, also noted that organizations that do implement best DevSecOps practices see substantial benefits:

    • Elite DevSecOps practices are 700 percent more likely to have fully integrated and automated security practices across the DevOps pipeline.
    • Almost two-thirds (62 percent) of respondents with elite programs have an open source governance policy in place that is improved via automation.
    • Organizations with elite DevSecOps practices are three times more likely to provide application security training to developers.
    • A full 81 percent of those with elite practices have a cybersecurity response plan in place.
    • More than half (51 percent) of respondents with elite practices leverage automated security products to identify vulnerabilities in containers.

    Brian Dawson, DevOps evangelist at CloudBees, said the survey results show that despite the gains being made by some organizations, there is much work to done in terms of overcoming technical hurdles and cultural tribalism. For example, 35 percent of all respondents said their No. 1 challenge in application security is that they find out about the problem too late in the process. Nearly half (46 percent) of organizations without a DevOps practice do not have application-level credentials encrypted. Half of respondents (50 percent) with a cloud infrastructure said they rely on their cloud service provider to secure their IT environment, and 28 percent of respondents admitted they do not protect secrets such as passwords, API keys and certificates.

    The core issue most organizations need to focus on first is to firmly establish a DevSecOps mindset, said Dawson. Much progress has been made in driving adoption of DevOps practices. Now those principles need to be extended to include automating the implementation of security controls as applications are being built and deployed. The survey noted that 63 percent of organizations that have elite DevOps practices are now informing developers of cybersecurity issues directly within the tools provided to the DevOps team. Armed with that information, it becomes much easier to incorporate security fixes within the overall application lifecycle management process.

    It may be a while before best DevSecOps process are widely implemented. But as cybersecurity issues continue to be incorporated within the quality assurance process, it’s now only a matter of time before applications become much more secure.

    — Mike Vizard

  • Akamai Extends Scope of DevOps Reach

    Akamai Extends Scope of DevOps Reach

    Akamai today moved to further extend the number of capabilities it exposes via its content delivery network (CDN) that are designed to appeal to DevOps teams.

    Those enhancements include HTTP/2 performance optimizations and the ability to automatically load font libraries, as well as providing access to “middle-mile” logs that will enable DevOps teams to more precisely investigate performance issues and test logic in a local development environment before moving those changes into production.

    Akamai has also re-engineered Control Center to provide more detailed reporting across security, acceleration and delivery functions, and made TLS 1.3 the standard mechanism for establishing connections.

    Finally, Akamai is also looking to advance DevSecOps processes. Its CDN now can optimize or block access to content within a fully integrated virtual private network and domain name system proxy detection service. Akamai’s Token Authentication capabilities have been extended to include coverage for browsers and devices that do not support cookies.

    Ari Weil, vice president of product marketing for Akamai, said these latest extensions are part of an ongoing effort to make the company’s CDN a natural extension of any DevOps process. Developers today often wind up wasting a lot of time and effort writing code to load fonts that now can be automated using via the Akamai CDN, for example. The enhancements should free them to write code that adds more value to the business, he said.

    Akamai is also promising DevOps teams they will see much faster activation times across Akamai CDN, as well as have deeper visibility into application performance issues beyond what most application performance management (APM) tools offer, added Weil. Akamai is especially focused on any application development project where service level agreements need to be both achieved and maintained, he said.

    Thus far, Weil said Akamai is finding a higher level of appreciation for the role CDNs can play in DevOps. CTOs and enterprise architects who are typically held responsible for achieving application delivery goals in particular are now taking notice of CDNs’ capabilities, as most individual developers aren’t usually focused enough on finding ways to automate the routine aspects of building a modern web application, he said.

    Akamai will continue to focus on making its CDN a natural extension of the continuous integration/continuous deployment (CI/CD) platforms on which DevOps processes are implemented, with an eye toward making its CDN a preferred deployment platform for web and mobile applications. It may take while longer before DevOps teams view CDNs as a deployment platform for their applications. Much of the decision regarding what CDN to employ historically has been been left to application owners. But Akamai is clearly betting that if more applications take advantage of CDN functionality as they are being built, there’s a much greater likelihood those applications will be distributed on the Akamai technology.

    — Mike Vizard

  • SoulCycle Flexes Its Muscles with DevOps and CI/CD

    SoulCycle Flexes Its Muscles with DevOps and CI/CD

    When SoulCycle wanted to improve application development and deployment, including improving services for customers across its 80-plus indoor cycling centers in the United States and Canada, the company turned to Mark Sost, a veteran developer and engineer who worked at several media companies, including Hearst.

    Over the last two-plus years, Sost, who now holds the title of senior director of engineering at SoulCycle, has built-up the company’s engineering and DevOps teams, increasing the headcount from eight or nine developers to about 40 employees now.

    The first major project was revamping a legacy, LAMP-based stack used to support applications to focus more on a modern platform that could take advantage of DevOps methodologies, as well as continuous integration and continuous delivery practices (CI/CD).

    Sost and his team dubbed this new platform Podium. However, Podium is more than a development platform, Sost explained.

    “Podium became the ethos and the methodology, as well as the architecture and application stack for re-platforming Soul’s technology stack in total,” Sost said in a telephone interview. “We moved from that monolithic to more of a service-oriented architecture. As such, we started to break out functionality on multiple applications.”

    The re-engineering also meant investing in new infrastructure, as well as other cloud-based technologies. This includes a multi-cloud approach.

    While most of the legacy applications have now been moved to Amazon Web Services, SoulCycle also uses Google Cloud Platform for Podium and all new developments. Sost also takes advantage of Kubernetes and Docker for container orchestrations, as well as investments in other managed services.

    Other tools in the DevOps arsenal include Jenkins to run unit tests; DataDog and StackDriver for monitoring and analytics for workflows; combing Travis CI, Cloud Builder and GCR for CI; and technology from startup Harness, which provides CD-as-a-service. Sost called Harness the “last-mile” tool needed for application deployment.

    “For Harness, that’s CD for us,” Sost said. “That’s continuous delivery to our various Podium environments. We’re leveraging it for delivery to all our Podium environments. Everywhere from UAC (user account control) during the code review cycle to QA after merge, to production, load test and everywhere in-between.”

    This revamped approach to application development now means that the SoulCycle engineering team has created approximately 30 different apps over the last 24 months, this includes internal apps used within the company environment, and ultimately to customers using the facilities and equipment.

    Additionally, Podium helps create a more unified architecture to help ensure that the entire team—whether it’s DevOps, QA or the production team—can paint a 360-degree view of the problem that needs to be solved and what the implications are for the business once the solution is put into place.

    This is what Sost and his team call “Podium principles.”

    “When we say that we’re building things with Podium principles in mind, we’re talking about the fact that everything is version-controlled,” Sost said. “We have full test coverage. We have everything in terms of Kubernetes manifests to infrastructure automation written down and version control checks it as part of source code. That applications are conforming to more of that 12-factor methodology and that we’re really focused really heavily on developer empowerment.

    “I think for us, that really is a shift that Podium has introduced; a move from writing the code as an application developer and then throwing it over a wall to an operations person—a QA person—to test it and deliver it somewhere,” Sost added. “Instead, we provide a developer the tools and the patterns of principles to go about controlling more of their application development life cycle all the way through to delivery.”

    The results have helped improve the overall SoulCycle experience for customers, which includes:

    • Reducing deployment time by approximately 80 percent.
    • Instead of one hour, deployments now take one developer 10 to 15 minutes.
    • QA verification has been reduced by approximately 80 percent.
    • It now takes three QA engineers one hour to verify, compared to three to six hours previously.

    At the same time, Sost believes that the Podium approach gives developers more control over their projects and lets them focus on writing good code that creates apps people want to use.

    “It’s more, ‘Now, I know what’s involved with getting my application to people,’” Sost said. “Because at the end of the day, engineers are just concerned with writing things that people want to use. … This is how we’re going to give you more control of the code and applications that you’re writing, so that you can see meaningful results quicker, without having to wait for someone.”

    What’s next for Sost and his team at SoulCycle? The answer: Machine learning and a bit of automation to the DevOps process.

    Here, SoulCycle is using Harness tools to log more data and infrastructure monitoring into the platform, which allows the algorithm to learn more about the various development projects. This can make the code better and eliminate errors that come with constant development and deployment.

    “We’re letting it get smarter over time around how it can detect anomalies and understand whether our code was successful because there are going to be times where things slip through unit testing or slip through integration tests and there are even going to be times where they slip through load tests, where things like 99 percent are just not going to cut it,” Sost said.

    — Scott Ferguson