devopsy.kinsta.cloud

Category: News

  • VMware Previews Spring AI to Accelerate Java Development

    VMware Previews Spring AI to Accelerate Java Development

    At a SpringOne at VMware Explore event this week, VMware demonstrated a tool that uses abstractions to make it simpler to build Java applications that invoke multiple artificial intelligence (AI) components with minimal changes to code.

    The goal for the open source Spring AI project is to, for example, make it simpler to swap out AI models using an AiClient interface for invoking OpenAI and Azure OpenAI services. It also adds capabilities that promise to make it simpler for developers to query documentation using generative AI enabled by large language models (LLMs). An additional goal is to extend those capabilities to other Spring projects, including Spring Integration, Spring Batch and Spring Data.

    In addition, the Spring command line interface (CLI) has been extended to support Spring AI and the Spring Boot framework has been extended to help set up dependencies and classes more easily.

    The AI capabilities are part of several additions made to the widely used framework for building Java applications that address everything from automatically turning off instances of Spring running in a container, also known as scaling to zero, to using virtual threads to call external services in a way that reduces memory consumption.

    Those additional capabilities promise to make it more efficient to run Java applications in, for example, a cloud computing environment.

    Betty Junod, vice president of product marketing for modern applications and the Management Business Group at VMware, said generative AI capabilities should serve to make Spring more accessible by not having to click around as much to gain answers to questions.

    In general, VMware is betting that a larger percentage of the Java applications built using Spring will be deployed on the Tanzu platform the company has built on top of Kubernetes. That platform streamlines the application development process in a way that reduces the cognitive load on developers by eliminating the need to know how to work with YAML files or use Docker Compose to create containers.

    Despite the proliferation of alternatives to Java, it remains the primary programming language used by developers to build applications. The challenges involved with learning additional programming languages are high, so most developers would prefer to continue to use Java to build both monolithic and emerging cloud-native applications.

    In the meantime, AI is already widely employed to help developers write code faster. AI isn’t going to replace the need for developers, but it will increase the pace at which applications are being developed. As such, DevOps teams will soon see a significant increase in the amount of code moving through DevOps pipelines. The hope is that AI will be applied in a way that enables those DevOps teams to manage increasingly larger codebases.

    In fact, the way applications are built and deployed will drastically change now that the AI genie is out of the proverbial bottle. But it remains to be seen how quickly those advances will change the way DevOps is managed at a level of unprecedented scale.

  • New Relic Extends AI to Identify Alert Coverage Gaps

    New Relic Extends AI to Identify Alert Coverage Gaps

    New Relic this week added additional artificial intelligence (AI) capabilities to its observability platform that make it possible to detect and resolve alert coverage gaps.

    Camden Swita, a senior product manager for New Relic, said it’s not uncommon for DevOps teams to discover an issue that the existing alerts they put in place were not designed to address. New Relic is adding machine learning algorithms at no additional cost that are designed to identify anomalies indicative of those potential issues. The platform then surfaces recommended alerts that DevOps teams can apply or further customize as they see fit, he added.

    Those machine learning algorithms ensure DevOps teams are tracking the right thresholds to ensure there are no blind spots that could adversely affect application performance, noted Swita.

    New Relic is employing both predictive and generative AI to enable DevOps team to detect and resolve issues faster. The company has been using machine learning algorithms for predictive AI for several years and, more recently, started providing early access to a generative AI tool dubbed Grok.

    The overall goal is to make the capabilities of an observability platform more accessible, Swita said. This is accomplished by surfacing issues without requiring a software engineer to craft intricate queries to interrogate metrics, logs and traces, he noted.

    The AI capabilities also serve to reduce the amount of alert noise; it’s now possible to more easily understand the root cause of an issue and reduce the total number of alerts that might otherwise be sent, he added.

    While there’s no doubt AI will help democratize DevOps by making it possible to write scripts and better manage workflows, it might be a while before DevOps teams trust the recommendations made. AI models typically require some time before they understand how an IT environment functions, and not every initial recommendation may be valid. In time, however, DevOps teams will find themselves increasingly supervising processes that AI models are executing.

    In addition, there are competing approaches to building large language models (LLMs) that drive generative AI. For example, it’s not clear whether chaining LLMs together will be more efficient than creating a single large ‘parent’ LLM that has ‘child’ relationships with smaller LLMs, noted Swita.

    In the meantime, DevOps teams would be well-advised to list tasks that are likely to be automated by AI models. Many of them will tend to be manual tasks that most software engineers don’t especially relish, so in that regard, there’s naturally a lot of interest in AI. It remains to be seen, however, whether various forms of AI might one day automate an entire DevOps workflow. In fact, most DevOps engineers are going to set a high bar for AI models that, at the very least, will be expected to perform a task as well as humans before it’s trusted completely.

  • IBM to Provide Hybrid Cloud Service Based on VMware Cloud

    IBM to Provide Hybrid Cloud Service Based on VMware Cloud

    At the VMware Explore 2023 conference this week, IBM announced that it will soon provide a fully managed service based on a streamlined edition of VMware Cloud.

    Brendan Kinkade, vice president for independent software vendors, technology and hybrid cloud partnerships for IBM Global Sales, said VMware is now making available editions of VMware Cloud that are both easier to deploy and manage and, just as importantly, migrate between cloud platforms and on-premises environments as IT teams see fit.

    IBM is committed to using that platform to deliver a managed VMware Cloud service that will span hybrid cloud computing environments aligned to an NIST-validated framework, he added. That approach is critical because it will enable IT teams to apply VMware license credits to any instance of VMware Cloud no matter where it is deployed, noted Kinkade.

    In addition, the streamlined edition of VMware Cloud doesn’t use proprietary application programming interfaces (APIs) to make it simpler to port IT environments to another cloud service or back to an on-premises IT environment whenever necessary, he added.

    At the foundation of the hybrid cloud service will be an instance of a multi-tenant vCloud Director console residing on the IBM Cloud. Through the console, IT teams will be able to work with IBM to co-manage application environments.

    In addition, IBM is providing a managed IBM Cloud Cyber Recovery (ICCR) Service to better secure cloud computing environments.

    It’s not clear how much of IT is now being consumed as a managed service, but the COVID-19 pandemic has certainly increased that number. Many IT organizations are also finding it simpler to rely on a managed services provider (MSP) to manage infrastructure so they can focus more of their time and effort on application development, noted Kinkade.

    MSPs are also in a better position to aggregate all the telemetry data needed to train artificial intelligence (AI) models that will be used to automate workflows, he added.

    Exactly how DevOps workflows will evolve as organizations rely more on external service providers to manage IT infrastructure is, naturally, a work in progress within many organizations. The main challenge is aligning a unique set of continuous delivery (CD) practices for deploying and updating applications with a provider that has already defined its own workflows.

    Nevertheless, given the complexity of those environments, many organizations are not able to hire and retain the IT expertise required to manage it, so the only option may be to rely on an MSP.

    Each IT organization will need to decide whether to rely on an MSP, given the total cost of a service. Many organizations often wind up having a mix of workloads managed by internal IT teams and external service providers. The one thing that is certain is that as the pace at which workloads are being deployed in the cloud increases, many internal IT teams are overwhelmed by a level of complexity that will only increase.

  • IBM LLM AI: COBOL to Java ASAP ¦ ARM IPO is GO!

    IBM LLM AI: COBOL to Java ASAP ¦ ARM IPO is GO!

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Translating legacy COBOL code to a slightly more modern language, and Arm will go public (again) next month. (more…)

  • VMware Preps Generative AI Assistants to Automate IT Workflows

    VMware Preps Generative AI Assistants to Automate IT Workflows

    At its VMware Explore 2023 conference today, VMware previewed what will become a suite of intelligent assistants that use generative artificial intelligence (AI) to automate the management of a wide range of IT tasks.

    Krish Prasad, senior vice president and general manager for cloud infrastructure at VMware, said VMware will eventually build out assistants for managing individual platforms such as VMware vSphere and the integrated VMware Cloud Foundation (VCF) platform through which the company aggregates those offerings into a single platform.

    VMware is creating those assistants, also known as co-pilots, using multiple large language models (LLMs) that the company uses to train AI models using code written by site reliability engineers (SREs), said Prasad. That approach ensures that the recommendations being made along with the code generated are of the highest quality, he added.

    That approach will enable IT teams to identify configuration drift that might be adversely impacting performance or that could create a cybersecurity risk, for example, noted Prasad. The first of those assistants is being made available in beta for VMware Tanzu, a platform based on Kubernetes. VMware is also building an assistant for its NSX virtual networking software that analyzes security events to generate policies and rules that can be applied to firewalls in real-time as threats are identified.

    It will then be up to each IT team to decide whether to implement those recommendations. Over time, it’s clear that the management of IT infrastructure is going to become increasingly automated as confidence in those recommendations increases, he added. In fact, the ultimate goal is to fulfill the promise of ‘lights-out’ IT management, said Prasad.

    In effect, advances such as these will lead to the democratization of DevOps workflows as it becomes simpler to manage IT infrastructure at scale. IT organizations will be able to invest more resources in building and deploying applications rather than hiring specialists to manage IT infrastructure, noted Prasad.

    In fact, the pace at which applications are built and deployed should dramatically increase in the months ahead, Prasad predicted.

    The rise of generative AI creates a unique opportunity for IT teams to become more relevant than ever to their organizations. It will soon be possible to build and deploy a wide range of distributed applications capable of processing and analyzing data at the point where it is created and consumed.

    While generative artificial intelligence (AI) has captured the popular imagination, it’s becoming apparent that multiple forms of AI will soon be used together to automate DevOps workflows at levels of unprecedented scale.

    Machine learning algorithms, of course, are already used by many organizations to automate everything from analyzing log data to identifying security issues to surfacing patterns in tests made using multiple regression, function and unit testing tools. With the rise of generative AI, it is now possible to automatically generate code and create summaries of reports that multiple stakeholders can more easily understand. Generative AI doesn’t replace the need for previous use cases involving machine learning algorithms. Instead, generative AI makes use of a form of deep learning algorithms to create different types of AI models.

    As a result, DevOps workflows will soon be invoking multiple classes of AI models to automate workflows in ways that should enable IT teams to automate processes at unprecedented levels of scale.

  • VMware Looks to GitOps to Drive Edge Computing

    VMware Looks to GitOps to Drive Edge Computing

    At its VMware Explore 2023 event, VMware today unveiled an orchestration tool, dubbed VMware Edge, that promises to simplify the management of edge computing services at scale.

    At the same time, VMware has launched a Project Keswick initiative through which it will work with customers to define additional use cases for VMware Edge based on zero-trust principles and GitOps workflows for deploying applications. The company also unveiled a VMware Retail Edge platform based on VMware Edge and is planning to add additional offerings aimed at specific vertical industry segments.

    Finally, VMware is making available a managed connectivity service through which it will provide private 4G/5G wireless services.

    VMware Edge Cloud Orchestrator is based on a tool that VMware created to orchestrate the management of its secure access service edge (SASE) platform. That has now been extended to support a wider range of software running on edge computing platforms.

    Sanjay Uppal, senior vice president and general manager of service provider and edge for VMware, said the goal is to streamline the management of software-defined edge computing platforms via a single console. Achieving that goal requires the ability to identify and programmatically manage workloads distributed across a mix of networks, he added.

    VMware is betting that as more workloads are distributed to edge computing platforms, there will be a greater need to centralize the management of workloads running on platforms that are not always easy to physically access. Less clear, however, is to what degree those edge computing platforms will be managed by IT teams versus operational technology (OT) teams that are usually embedded within a department that manages a specific business process.

    However, regardless of who manages those platforms, they will be relying more on GitOps workflows to programmatically provision infrastructure and deploy applications that will need to be regularly updated. In fact, because these platforms are often dispersed across hundreds of physical locations, the need for a pull-based orchestration tool that works asynchronously is critical, said Uppal.

    In the longer term, IT teams should also expect artificial intelligence (AI) capabilities to be applied in a way that makes edge computing self-healing, he added.

    No one can say exactly how many organizations have adopted GitOps to manage the provisioning of both infrastructure and the delivery of applications, but it’s conceivable that edge computing will force the issue. The tricky part will be finding a way to manage those GitOps workflows at the necessary level of scale. Most DevOps teams already struggle with implementing DevOps workflows at scale, so if more workloads are to be distributed across hundreds of edge computing platforms, there will be a much more acute need for automation to consistently deploy, secure and update applications.

    Regardless of approach, however, there may come a day when the number of workloads deployed at the edge far outnumbers the number of workloads deployed in the cloud or in a data center. The challenge and the opportunity now is to get ahead of edge computing issues before they inevitably create a set of management issues that will be more difficult to address after applications have already been deployed.

  • VMware Looks to Streamline Multi-Cloud Computing Management

    VMware Looks to Streamline Multi-Cloud Computing Management

    VMware today integrated its console for managing cloud instances with its VMware Cloud Foundation to streamline the deployment of its software in on-premises IT environments.

    Announced at the VMware Explore 2023 conference, the latest edition of VMware Cloud will make it simpler to manage multi-cloud computing environments by combining VMware Cloud Foundation Software and VMware Cloud Services into a single platform.

    VMware also announced early access to an ESXi life cycle management cloud service for VMware vSphere+ that enables IT teams to centrally manage upgrades across a distributed vCenter environment. Additional updates to vSphere in the upcoming release include doubling GPU capacity per virtual machine.

    Krish Prasad, senior vice president and general manager for cloud infrastructure at VMware, said the goal is to improve the overall pace of innovation;  in addition to deploying workloads in on-premises IT environments, organizations are also deploying workloads on multiple cloud computing services.

    VMware Cloud is being made available in five editions that can either be managed by an internal IT team, an external services provider or by VMware. In addition, a VMware Ransomware Recovery service based on VMware Cloud is also generally available. Following a breach of an on-premises IT environment, VMware Ransomware Recovery will enable organizations to run production workloads in the cloud until forensics are completed. The company also unveiled a technology preview of cybersecure storage that will integrate recovery workflows with native vSAN snapshots and add support for Google Cloud VMware Engine.

    In addition, VMware is adding a managed NSX service delivered via the cloud, dubbed NSX+, that manages instances of the virtual networking software that runs on top of its virtual machine software. There is also now an NSX+ virtual private clouds (VPCs) option that isolates instances of the virtual networking platform.

    Finally, VMware is adding a VMware Cloud with VMware vSAN Max, which will make 8.6 petabytes of disaggregated capacity and 3.6 million IOPS per cluster available on demand later this year.

    VMware appears to be streamlining the number of platforms IT teams need to acquire to support and manage IT infrastructure at a time when more organizations are trying to navigate increasing economic headwinds.

    One way or another, IT teams will need to reduce the cost of IT at a time when IT environments are becoming more complex. VMware is betting that, given its dominance in on-premises IT environments, there will be a natural inclination to deploy more of its software in the cloud to create a more homogenous IT environment that is less complex.

    However, it’s not clear whether organizations are willing to pay extra for the privilege. Many organizations are now supporting multiple classes of virtual machines and associated software despite the fact that each additional platform raises the total cost of IT.

    In the meantime, many IT organizations are also awaiting the outcome of Broadcom’s effort to acquire VMware before deciding how to centralize the management of multi-cloud computing environments.

  • Rebellion Against Changes to Open Source Terraform License Mounts

    Rebellion Against Changes to Open Source Terraform License Mounts

    A segment of the community that has embraced open source Terraform software, originally developed by HashiCorp to provision infrastructure as code (IaC), has published a manifesto calling on the company to reverse recent changes made to licenses that determine how the software can be used.

    If that demand is not met, the group plans to launch its own fork dubbed OpenTF under the terms of the previous license that governed the usage of Terraform.

    Pawel Hytry, CEO of Spacelift, a provider of a platform for orchestrating the management of multiple IaC tools, said the issue comes down to restrictions that Hashicorp has put in place restricting use within platforms that have embedded it, in addition to limitations on how Terraform can be used in production environments.

    HashiCorp is shifting from a Mozilla Public License v2.0 (MPL 2.0) to a Business Source License (BSL) v1.1 in all future releases of its software including Terraform, Vault, Consul, Boundary, Nomad, Waypoint, Packer and Vagrant, as part of an effort to maintain maximum control over its intellectual property.

    This shift will have a chilling effect on Terraform innovation because fewer individuals and organizations will want to contribute to advancing the tool, said Hytry.

    However, Hytry added, historically HashiCorp has not been perceived as not being overly receptive to contributions from external developers, so the bulk of the code used to create Terraform has come from developers working for HashiCorp.

    It’s not clear to what degree this firestorm impacts DevOps teams, but the fragmentation of open source projects stemming from issues that come down to revenue streams is increasing as it becomes more difficult for vendors that create open source software to continue to increase the number of subscription services for the support they provide. Red Hat, for example, recently decided to no longer make the source code for the Red Hat Enterprise Linux (RHEL) edition of its operating system available. The decision led to Oracle, SUSE and CIQ pooling their resources to create a fork of RHEL that they promise will be compatible with future updates to RHEL.

    It remains to be seen how many vendors might throw their weight behind OpenTF. HashiCorp, in addition to having partners that built the business on the open source edition of Terraform, also has plenty of rivals that offer IaC tools.

    It may be a while before this conflict is resolved, but for now, the situation remains fluid, said Hytry. DevOps teams that make extensive use of Terraform will need to monitor events to make sure any future usage of Terraform complies with BSL terms that supporters of the manifesto claim are at this point too vague.

    In the meantime, organizations that rely on open source software should brace themselves for any abrupt changes to licensing terms that may be forthcoming in more challenging economic times. In fact, one of the hidden costs of using open source software is the different terms and conditions under which it is licensed. Resources to monitor each additional instance of open source software for compliance, with terms and conditions that are not always as simple or clear cut, need to be dedicated to a task that doesn’t make any meaningful contribution to return on investment.

  • Sysdig Identifies Cyberattacks on GitLab Platforms Using Binaries

    Sysdig Identifies Cyberattacks on GitLab Platforms Using Binaries

    The Sysdig Threat Research Team (TRT) has uncovered this week that cyberattacks using binaries written in Go and .NET compromise instances of the on-premises editions of the GitLab continuous integration/continuous delivery (CI/CD) platform.

    Michael Clark, director of threat research for Sysdig, said most attacks against software supply chains employ scripts. Cybercriminals that appear to be based in Russia are using binaries to launch proxyjacking and cryptomining campaigns utilizing infrastructure resources used to host instances of GitLab.

    Cryptomining is the process used to validate cryptocurrency transactions. Proxyjacking involves reselling bandwidth to providers of proxyware services to allow someone to hide their physical location.

    The Sysdig research effort, dubbed LABRAT, also noted that the tactics and techniques used to launch attacks are reasonably sophisticated. In addition to using binaries, the cybercriminals also employ tools with undetected signatures, cross-platform malware designed to evade cybersecurity platforms, a command and control (C2) platform that bypasses firewalls and kernel-based rootkits to hide their presence. Furthermore, the attackers abused a legitimate service, TryCloudFlare, to obfuscate their C2 network.

    The attacker, still active, is also continuously updating their tools, which requires organizations running GitLab to track the tactics, techniques and procedures (TTP) being employed by the cyberattacker to keep their indicators of compromise (IoCs) list updated.

    Relative to the illicit revenue that might be gained from cryptojacking and proxyjacking, this cyberattack is noteworthy in its sophistication. What is less clear is the degree to which this attack might also be used to inject vulnerabilities into the software supply chains based on the GitLab platform.

    The one certain thing is that cybercriminals have developed more advanced capabilities for compromising software supply chains that are likely to be used to compromise multiple DevOps platforms.

    Fortunately, there’s a lot more focus on securing software supply chains in the wake of a series of high-profile breaches. The challenge is most efforts are still relatively nascent. As such, there isn’t a high enough appreciation for the lengths cybercriminals might go to compromise a software supply chain. The ability to inject malware that might one day find its way into any number of downstream applications makes a software supply chain a tempting target.

    Multiple legislative initiatives have been launched that eventually will require organizations to better secure software supply chains. As such, most DevOps teams would be well-advised to begin those efforts now. Some aspects of the proposals being debated today eventually will become law. Rather than trying to comply with a requirement, a more methodical approach to ensuring the security of software supply chains would create less stress for all concerned later.

    In the meantime, thanks to the adoption of DevSecOps best practices application security continues to steadily improve. The issue stands that those advances are not being made as quickly as cybercriminals are evolving new tactics and techniques.

  • Zenhub Brings Generative AI to Software Project Management

    Zenhub this week made available an edition of its project management platform for software engineering teams that makes use of generative artificial intelligence (AI) to summarize reports and identify bottlenecks to help streamline DevOps workflows.

    Aaron Upright, the co-founder of Zenhub, said the company plans to work with each Zenhub AI customer to enable them to securely use their personal data to train an AI model using the ChatGPT platform to make DevOps teams more productive.

    For example, DevOps teams will be able to use historical sprint data to identify bottlenecks more easily. Natural language processing (NLP) will also enable teams to reduce the impact of project label sprawl by making it easier to associate related projects regardless of naming conventions.

    Overall, the quality of data being collected will also improve story point estimations, noted Upright.

    It’s still early days as far as the usage of generative AI within the context of project management applications is concerned, but the potential AI has to transform the role of project managers is already apparent as more data is collected and analyzed by AI models. Rather than reacting to changes to project schedules as they occur, it should become easier for project managers to proactively surface issues that might have previously delayed or derailed a software development effort.

    Project managers should also be able to better track the return on investment (ROI) metrics for any given project as changes occur, added Upright.

    In theory, project managers augmented by AI models should be able to simultaneously manage more complex development efforts at levels of scale that previously would have been unachievable. The challenge is making sure project managers have visibility into the suggestions being made by AI platforms. Often when presented with conflicting data they will make up an inaccurate response, also known as a hallucination.

    However, the narrower the range of data used to train an AI model the more accurate it tends to become. The critical issue many organizations will initially face is vetting the quality of the data being used to train the AI model. In addition, organizations will also need to make sure that no biases have been inadvertently injected into an AI model because the data used to train it was either flawed or inaccurate.

    Ultimately, the amount of toil that project managers regularly experience should decline considerably as AI continues to advance. The expectation should be that AI will soon be pervasively applied across multiple project management applications. The race is now on to deliver on that promise.

    In the meantime, project managers might want to start assessing which tasks they perform daily that are likely to be automated. This will enable them to add higher levels of value by having the time needed to focus more on strategic imperatives. After all, every minute spent checking to see whether data is accurate is one less minute spent understanding what needs to be done to affect a better project management outcome.