devopsy.kinsta.cloud

Tag: application development

GitLab Shifts 18 Features Into Core Open Source Platform

GitLab this week announced it has moved 18 features that previously organizations had to pay for into the core open source version of its namesake continuous integration/continuous delivery (CI/CD) platform.

Scott Williamson, executive vice president of product management for GitLab, said as a general rule the company makes available DevOps tools for teams across the four tiers of services that organizations can employ. Features now being migrated to the Core offering include:

Plan: Synchronize collaboration with “related issues,” “export issues,” “issues board focus mode” and “Service Desk”

Create: Build better code and branch with the “web terminal for WebIDE,” “file syncing to web terminal” and “design management”

Verify: Improve code quality with reports on merge requests

Package: Build and share more efficiently with a set of package managers in one place

Release: Continuous delivery simplified with “canary deployments,” “incremental rollout,” “feature flags” and “deploy boards”

Configure: Support for multiple Kubernetes clusters to ease deployment of different environments

Defend: Bolster application security with network policies for container network security

As the global economy falters in the wake of the COVID-19 pandemic, it’s likely reliance on open source software will increase. Most organizations would rather throw IT labor at the ongoing management of an IT environment to manage open source software versus having to lay off IT employees that would be extremely difficult to find once the economy recovers. It remains to be seen to what degree that strategy will play out in DevOps environments, but Williamson said historically most of GitLab’s customers are organizations that first adopt the open source version of its platform.

Less clear is the degree to which the downturn might also induce many of the organizations to employ a DevOps platform delivered as a set of software-as-a-service (SaaS) applications. GitLab has been for the past several years for an integrated approach to DevOps based on a single code base that is ultimately easier to deploy and manage. Many IT organizations may decide that rather than manage DevOps infrastructure, they now prefer to allocate what limited resources they have on hand to writing code.

The number of application development projects being launched could also decline while others are suspended. At the same time, however, there are some vertical industry segments, such as digital entertainment and education services, that might see a spike in demand for additional services now that many people are staying home to help limit the scope of the COVID-19 pandemic.

Of course, many DevOps teams are among the legions of workers that now need to remotely access platforms. Williamson said supporting remote DevOps teams has long been a strength of the GitLab platform. GitLab also makes available a playbook that provides DevOps teams with guidance on how best to work remotely.

Clearly, it will be a few months before the full impact of the COVID-19 pandemic is fully appreciated. Regardless, many IT organizations are clearly preparing for the worst of times while continuing to hope for the best outcome possible.

— Mike Vizard

April 2, 2020
CircleCI Surfaces More DevOps Insights

CircleCI today announced it is making it easier for DevOps teams to determine the amount of resources being consumed by its continuous integration/continuous delivery (CI/CD) platform to help make application development teams more efficient.

Kunal Jain, senior product manager for CircleCI, said via the application programming interface (API) that CircleCI exposes DevOps teams can now determine, for example, which workflows are taking the longest to run or what tests might be creating bottlenecks into the CI/CD pipeline.

Armed with that insight DevOps teams can also optimize how credits to employ the CircleCI platform are allocated across their DevOps teams, added Jain. That capability should make it easier for DevOps teams to predict how much they are spending per month to run their CI/CD platform, said Jain. Many more IT organizations may opt to access CI/CD platforms using a software-as-a-service (SaaS) approach that limits the need for them to invest in their own IT infrastructure or in some cases even manage the platform.

DevOps teams have always been sensitive to efficiency but given the current economic climate, minimizing costs is becoming a higher priority for many organizations. As such, DevOps teams need more insights into, for example, how to best break up workflows to keep CI/CD platform costs to a minimum, said Jain. In fact, Jain says the total cost of operating a CI/CD platform is likely to now play a bigger role in selecting a platform as IT leaders demand more visibility into DevOps processes.

Of course, some DevOps teams may find themselves competing for credits based on how efficient they are. Teams who are more efficient than others could also allow IT leaders to reallocate credits as they best see fit based on the progress being made. In a previous era where compute resources were largely considered to be a nominal cost, many DevOps teams may find access to IT infrastructure might no longer be taken for granted.

CircleCI claims it runs more than 30 million independent jobs run every month. The company last year committed to exposing more API endpoints to help DevOps team better understand the languages, architectural patterns, code testing patterns, delivery success rates and team practices being employed. Like most providers of CI/CD platforms, CircleCI has made a commitment to making available a much broader range of actionable insights to DevOps teams via its API.

At this point, it’s unclear what the impact the economic downturn brought on by the COVID-19 pandemic might have on DevOps adoption. Undoubtedly, many organizations will put a hold on some application development projects as they reassess their priorities. On the other hand, with more people working from home, digital business transformation initiatives that require new applications are likely to become a higher priority as organizations seek to reinvent how they engage their end customers. Those projects may even be accelerated as part of a larger business continuity strategy. Regardless of the number of application development projects being launched, the scrutiny of how IT resources are being allocated and consumed is about to increase substantially.

— Mike Vizard

April 2, 2020
Oracle Adds APIs to Java SDK To Advance DevOps

Oracle announced it is making available the Java 14 software development kit (SDK), which provides access to several additional capabilities designed to help advance DevOps adoptions within IT organizations that still rely heavily on Java to build enterprise applications.

Those capabilities include a set of application programming interfaces (APIs) to enable continuous monitoring of JDK Flight Recorder data and a set of APIs that make it easier to access foreign memory.

In addition, via an incubator module Oracle is now providing access to a Packaging Tool that will enable developers to package Java applications and runtimes for distribution in platform-specific formats. That capability is being exposed as an incubator module because the associated APIs have not been finalized, which means they are subject to change in future releases.

The Java 14 SDK adds Java language support for switch expressions to be used as either an expression or statement and extends the availability of the low-latency Z Garbage Collector to macOS and Windows.

Finally, Oracle has added support for a Pattern Matching capability that eliminates the need for boilerplate code and a preview of a tool that makes it simpler to declare data immutable.

Aurelio Garcia-Ribeyro, director of product management for Java SE, said a lot of the capabilities being added to Java SDK were developed as part of the ongoing Panama and Amber research projects that in some cases have been in development and testing for years.

Despite the rise of rival programming languages, Garcia-Ribeyro said enterprise IT organizations continue to rely on Java to build most of their applications, especially mission-critical backend systems.

The challenge is modernizing the processes via which Java applications are built and deployed. Many organizations, for example, are embracing containers and microservices to build next-generation applications. As that transition occurs the need to embrace best DevOps practices becomes more apparent because applications themselves are becoming more complex. The upside, of course, is that microservices also make it possible to build more robust applications faster, which has become a critical requirement as organizations embrace digital business transformation.

Of course, no two organizations are likely to be at the same point on the DevOps maturity curve. In fact, in many cases, DevOps adoption is being driven from the bottom up as developers embrace new capabilities being added to familiar tools such as the Java Development Kit from Oracle. In some cases, the SDK will be used to build new applications while other members of the development team employ it to modernize legacy applications. Before long, however, IT operations teams start to realize how monitoring APIs and packaging tools are transforming how IT operations are managed.

Naturally, Oracle is hoping all these new capabilities will help keep organizations focused on Java as the primary means for building enterprise applications at a time when developers have more options than ever. The one thing that Oracle has most in its favor is that most organizations don’t want to retrain developers to learn how to master a new programming language unless it can’t be avoided.

— Mike Vizard

March 17, 2020
Tasktop Delivers Viz Value Stream Management App

Tasktop this week announced the general availability of an application to manage projects based on a flow framework that captures events as they occur across the software development toolchain.

Company CEO Mik Kersten said Tasktop Viz is the first substantiation of the flow framework in software that provides a value stream management application to enable organizations to more effectively manage software development projects. Tasktop Viz doesn’t necessarily replace project management software as a system of record for billing purposes, for example, said Kersten; however, it does provide a way to visually model the software development environment in a way that makes it easier to identify bottlenecks and potential opportunities to reallocate resources.

Kersten said from a management perspective, existing approaches to managing software development projects are broken. They depend too much on software developers to manually enter data to update a project management application, which they don’t do as often as they should because it takes time away from developing software, he said. Tasktop Viz takes advantage of application programming interfaces (APIs) to automatically capture metadata from across the software development toolchain, providing instant visibility into software development projects without requiring DevOps teams to engage in an additional coding, Kersten noted.

Kersten has been making a case for the adoption of an approach to managing software development projects based on the flow framework for several years. Tasktop Viz now provides IT teams with an application that is designed from the ground up using that model.

Of course, the concept of value stream management applications has been around for some time. The debate now is not so much over the value of these applications as much as it is which architectural approach to building these applications best reflects modern software development. As the number of dependencies between projects continues to expand, it’s becoming next to impossible for organizations to manage multiple software development projects relying solely on spreadsheets and existing project management applications.

That issue is further exacerbated by the fact that businesses are now more dependent on software than ever, so any delay to a project could have a dramatic impact on future revenues.

Kersten said that despite the obvious business benefits, the biggest obstacle to adoption is more psychological than technical. Many software development teams are reluctant to adopt tools that might illustrate how chaotic the software development process within their organization really is. It’s critical that organizations that adopt value stream management applications do so with an eye toward wanting organizations to improve rather than just deploying another tool to measure metrics that are used to increase the amount of code being written.

Of course, there’s no correlation between the amount of code being written and the quality of the applications being developed. The real challenge is to not just accelerate the rate at which applications are being developed, but also to ensure that once those applications are deployed in a production environment the number of fixes required are kept to the absolute minimum possible.

— Mike Vizard

March 13, 2020
What Developers Should Take Away from the Iowa Caucus App Debacle
In the wake of the recent Iowa caucus, vote-counting software has fallen under suspicion after a smartphone app built by Shadow, Inc., brought chaos and delays to the first 2020 Democratic caucuses. Stopgap measures, such as Nevada officials canceling the application’s use in its upcoming caucus, are not enough to ensure vote tallies the electorate can be comfortable with. What’s needed is to correctly identify and fix the underlying problem.

The flaw does not lie with a lack of end-user sophistication, dataset complexity or inappropriate app security. Remember, government officials around the world are transforming urban areas into connected, responsive smart cities. Students are live-streaming interstellar space flights to Mars and Saturn. Uber drivers navigate past traffic jams, while seniors use apps to make time-sensitive healthcare decisions and adjust their retirement portfolios. People of all ages and experience levels do this and more, on the fly, with handheld mobile devices.

The real problem lies in the way leadership teams drive software delivery. The Iowa app failed for a number of reasons: It was released with no product testing after a short, two-month development runway conducted under a cloud of secrecy. It was not built to scale. Worse, there was little to no input, transparency or communication among the application’s most important stakeholders—the Shadow management team, the software developers and the end-users, in this case, precinct captains running the Iowa caucuses and party.

The IT professionals in charge could have avoided these problems by following three simple principles of successful software development:
- Collaborate With All Stakeholders: Applications are no longer stand-alone widgets. They are digital experiences. With even the most sophisticated design, experiences that don’t serve their target audience are failures. A development process that prioritizes collaboration with end users can prevent such failures. Feedback from those with a vested interest in the outcome would have quickly raised red flags for developers. In Iowa, collaborating with intended users would have highlighted a need for accessibility training and connectivity issues, since the app was deployed in buildings with high-speed internet along with remote, off-grid locations.
- Build to Scale: Every developer knows to build for performance at an order of magnitude larger than you expect. This includes ensuring performance on the widest possible range of handheld devices and phones. From a developer’s perspective, the phone model will impact application performance due to different hardware specs. It’s imperative for designers to build apps that are native, so that all users, devices and performance profiles will function as intended. A useful software solution should reap success, not failure, when more people use an application than initially expected.
- Be Transparent: Valid concerns over security risks and election integrity unfortunately led Shadow’s team to prioritize secrecy over transparency. That didn’t work. Problems are not detected and solved when siloed or when small groups of people work on a solution in secret. Proper vetting and testing falls by the wayside. The risk that the app will not be suitable for its intended users increases. The app may have additional, exploitable security vulnerabilities that can only be found when teams ensure proper openness and transparency during the development process. Proper governance and guardrails that protect core data mitigates the security risk for election-based applications (and software in general). There’s little to be gained and much to risk by closing off input and vetting at any point during the full application development cycle.
Developers Move From Stressed to Empowered

One simple, effective way to solve or avoid these issues is by adopting an enterprise-grade, low-code software development platform. The “low-code” label refers to visual, model-driven software development, which employs an unambiguous visual language throughout the application development lifecycle, enabling nontechnical stakeholders, end users and professional developers to work together.

Such a collaborative platform can surface issues with senior leadership before it’s too late. Feedback from citizen developers—that is, not citizens in the voting sense, but rather, non-traditional developers—can capture leadership’s careful attention, precisely because the feedback is from nontechnical users. The right low-code platform would have enabled the Iowa caucus volunteers and stakeholders to collaborate on every step of the process without slowing it down.

Another benefit of a robust low-code platform is having more people on deck to meet product goals with tight deadlines. Insights from citizen developers with unique backgrounds can also help when testing applications. With suitable governance controls, low-code functionality speeds up a developer’s ability to deliver software without taking away their ability to dive deeply and extend functionality with coding when needed.

Market analysts have evaluated the strengths and merits of different low-code platforms. In multi-experience use cases—such as Iowa’s, particularly because the eyes of the world are watching—it’s important to use a low-code platform that enables applications that are truly device native. This allows the software to take advantage of core device capabilities, typically delivering better performance and supporting the interactivity users are familiar with. Additionally, continuity online and offline would address connectivity issues in areas where signals are weak or nonexistent; the data can be properly synced when a signal is available. Lastly, a robust low-code platform provides tools to enable apps to scale automatically, avoiding the coding work required to allow an app originally built for 1,000 people to service 100,000 or a million.

An Urgent Role for Software Developers

When roughly half of all eligible voters sit out general elections, talented developers should not lose sight of the many ways technology can aid and expand civic participation. Eventually, we may live in a world where election-based apps for registered voters are accessible and secure, regardless of the user’s device, age, location, physical ability or educational background. Building in redundant systems of paper-based vote confirmation and other offline systems will add integrity, inspire greater confidence and drive adoption of these innovations.

What happened in Iowa is, unfortunately, not an isolated case. These complications are endemic to how most leadership teams drive software delivery. Development teams of all types will continue to run into similar issues until their leadership makes transparency, accessibility and scalability a priority by investing in the appropriate resources. Organizations can leverage the strength and impact of fully robust low-code software development platform to that end.

Since the introduction of low-code in 2004, platform capabilities have matured at an accelerated rate, moving to widespread adoption for enterprise use. During the same period, elections have increasingly relied on software-driven electronics, leading to consistent issues. Citizens casting ballots is one of the most sacred mechanisms of our republic. Any software used to tally votes must be bulletproof. Truly open and holistic low-code software development platforms can make this happen by proactively bringing people together to make sure software works for those who need it most.

— Jon Scolamiero
February 25, 2020
What Is DevSecOps and How to Enable It on Your SDLC?
For the past three to four years, all the companies around the IT world have adopted agile and different application development methodologies that leverage the work for different departments or areas and helps them to develop new products and release new features to improve their processes and infrastructure.

In this new Agile and DevOps world where everybody on a team is involved in the rapid-changing and evolution of their application, we are promoting accountability for everybody in terms of security—this is when DevSecOps joins the party.

What is DevSecOps?

DevSecOps is a new model that provides accountability for the security implementation in the application; from the planning, design, development, QA/testing, to release and when operating on a production environment.

When implementing DevSecOps on the Software Development Lifecycle (SDLC), an organization will experience the continuous integration and will notice that the costs for compliance are reduced, code is constantly being analyzed, tested, delivered and released properly.

DevSecOps enables the process of implementing security to everybody and makes them accountable.

Why Is It important?

As I stated previously on this blog, on this rapid-changing era, everything is evolving at a very accelerated pace. We continue to discover vulnerabilities and breaches across platforms and operating systems, patches are released constantly but we—as part of the operating team of a company—cannot afford the risk of having a vulnerability on any side of our IT system/application.

Main Benefits
- Reduces vulnerabilities present on your code.
- Reduces vulnerabilities present on your IaC technologies.
- Reduces the number of ways to exploit your application
- Reduces downtime.
- Improves your application stability, availability and security.
How Can I Enable DevSecOps on My Current DevOps Pipeline or SDLC?

DevSecOps is a must-have methodology that needs to be integrated into your DevOps process/pipeline to help you improve your security on your SDLC.

There are five important phases that need to be followed in order to enable DevSecOps on a current DevOps pipeline or in the SDLC. Here are the crucial phases to enable it:

Phase 1: Secure Local Development. Start by implementing secure working-environments. When you are developing an application, in most cases you will use open source technologies. Docker is a great helper at this phase since it automates the infrastructure and services deployments on local machines. So when you are using this ready-to-go docker environment, make sure that you are using the most recent/updated versions of the Docker Images and scan them for vulnerabilities. Even the images from official providers have vulnerabilities that need to be patched.

Phase 2: Version Control and Security Analysis. Enable Vulnerability while uploading your source code. Having multiple hands or people working at a piece of code can lead to vulnerabilities, especially when they are remote. Git systems have been a great improvement for collaboration between team members and code. When a team member uploads a piece of code, I strongly suggest that you enable automated testing for security on your code dependencies and core. Some good alternatives to do it are Snyk or Sonatype’s Nexus.

Phase 3: Continuous Integration and Build. When creating the development image/package, you’ll need to make sure that your build tool or system has the proper security in place. It uses https:// protocol, it’s properly hardened and secure, it’s available and protected for attack mitigation or even not accessible via the internet. The tools that you can use here are Jenkins, Circle CI, AWS CodeBuild, Google Cloud Functions, Azure DevOps.

Phase 4: Promotion and Deployment. When deploying to an environment, insert the environment variables through your CI/CD tool and try to manage them as secrets. Proper encryption and management of these are recommended in order to enhance your security protocols.

Phase 5: Infrastructure Security. When your app is deployed, make sure that you have an IDS (Intrusion Detection System). Tools such as OSSEC or Wazuh will help on this matter to protect all your hosts.

Once your code gets to the production, it doesn’t mean that it will be 100% secure. New vulnerabilities are disclosed every day but this cycle will help you and your team to test your code against all the repository of known vulnerabilities, at the time of monitor, configure, reconfigure, adapt and deploy solutions to the environment.

Tools and Processes

These are the tools you will need to enable in your DevSecOps process:
- CI/CD Tool.
- Secrets Manager.
- Version Control System.
- Docker Orchestration tools.
- Security Analysis tools.
And these are the processes:
- Automated regression testing.
- Dynamic testing.
- Automated Vulnerability Assessment.
- Automated Integration.
- Promotion.
- Automated Deployment.
What Is the Ideal Workflow for DevSecOps?
1. A developer creates a new code and integrates it into the VCS.
2. Members from the QA team retrieves the code to perform the static code analysis to identify security flaws or functional tasks.
3. A test environment is created automatically using IaC such as Terraform, CloudFormation, Chef or Puppet and the security configurations are added to the system.
4. The test automation suite is performed to the application with a tool usually Selenium or any other tool that performs backend, UI, integration, security and API tests.
5. After the test suite is performed and successful the new changes are sent to the production environment.
6. The new version of the code is now going to be monitored in the production environment using an APM or Cloud-native monitoring tool.
Following these points you are ensuring that your application is following TDD practices improving the code quality, compliance, increasing the number of releases of code to production and reducing the time to market which is essential for any organization.

What Are the Challenges When Enabling DevSecOps?
- Enabling too Many Tools: Enabling too many tools can become a problem on your SDLC, especially when your team is not used to work and relate with DevOps/security tasks. The main recommendation here is to start slow. Start by enabling only the necessary tools to get your team familiar with the process and add more when you feel your team is prepared for it.
- Getting Used to the Methodology: It will take some time for all the team to get used to the DevSecOps methodology/culture and also to keep following it in order to be compliant with the normative that your business demands. Try to always stay up-to-date and coaching your team for the newest technologies.
- Chasing Perfection on the Process: Keep in mind that all the DevSecOps process won’t be perfect, but it will get mature over time. Teams always try to chase perfection and this only leads to more problems with even more integrations or dependencies.
Conclusion

In the end, I think every organization must make the effort to shift to a DevSecOps methodology or process and come up with a multidisciplinary team with a focus on security. That’s how an organization will transition from doing DevOps to DevSecOps. Allowing all their collaborators to have accountability on the part they are actively developing.

— Guillermo Vélez
February 10, 2020
How Integration Can Keep Up with Digital Demands

Integration holds the key to accelerating innovation, but in many organizations, business systems and application integrations haven’t kept up with the demands of digital. Data still exists in a siloed blend of on-premises systems and unconnected cloud applications, and IoT has added another layer of complexity into the mix.

Understanding the three trends below, and how to leverage them, will help organizations continue to drive innovation for years to come.

The Rise of the Integration of Things

It’s no secret that the adoption of IoT is increasing, generating massive amounts of data from devices and sensors. As the number of devices increases in response to the explosive growth of IoT, the amount of data increases exponentially. This explosion of devices–and its associated data–is driving the need to leverage that data for the benefit of the business, such as improved customer experience, cost and downtime reductions or efficiency and productivity gains.

Integration is the key piece that will enable businesses to get control of this data and put it to work. Without the right integration tools, it’s only possible to leverage IoT at specific levels. Essentially, integration provides the ability to connect the data from IoT devices and enterprise applications, orchestrate workflow and enrich IoT data with contextual information from other systems for better decision-making.

Organizations can even use integration to link IoT platforms together for a comprehensive view of data, analytics and actions–making it easier and quicker to analyze, draw conclusions from and determine how to use the data. On top of this, they can also create complex and sophisticated responses when something goes wrong by leveraging automated integration workflows.

As we continue to connect our devices, the Integration of Things will be as important as the Internet of Things.

Blurred Lines Between Application Development and Integration

For cloud applications to survive and thrive, they require built-in integration with other apps and data sources. Otherwise, users are constantly switching contexts from one tool to another when trying to complete a task, and content is scattered across the organization in multiple applications and departments. Because of this, the lines between application development and integration will blur as apps are compelled to have integration embedded under the covers.

There will be many benefits to this. First, organizations will easily create and deploy integrations directly within their products, fully baked into the user experience. These in-app integrations to third-party sources will unlock additional capabilities for users, empowering them to do more.

Second, building integrations without the right tools and specialized integration know-how requires a lot of work. Embedded integration eases the pain of monitoring API changes and documentations so that maintenance is smoother and cheaper.

Finally, business services can involve complex interactions with cloud apps and data that require ordering, have dependencies or may even need to be reversible on demand. Organizations can handle these sophisticated jobs by leveraging advanced integration orchestration to manage app interaction–meaning that instead of using manual code for complex data mapping, they can create a visual drag-and-drop data flow.

AI Powers Smarter APIs

Businesses have already been leveraging intelligent automation to improve operations, drive innovation and personalize the customer experience. As we head into the new decade, API management will harness the power of AI with innovative ways of protecting and controlling APIs and the applications they serve.

Service mesh, an increasingly popular way of discovering and observing services in distributed networks, will evolve into app mesh, an application-aware model of monitoring, managing and securing your APIs. API policies will be able to reconfigure dynamically based on traffic, security threats and identified patterns. Additional layers of defense will come from bots deployed in an organization’s network to constantly monitor behavior and these bots will use machine learning to improve automated threat responses for APIs.

The integration landscape is changing, but understanding how to harness these trends will ensure organizations are well-equipped to take advantage of evolving technologies for innovation.

— Ann Marie Bond

February 7, 2020
Atlassian Extends Road Mapping in Jira

Atlassian has updated its Jira project management software for managing software development initiatives to add more capabilities to road mapping tools that teams use to share plans and update progress.

Matt Ryall, head of product for Jira Software at Atlassian, said the road mapping tools first provided in Jira a year ago are now being employed by 45% of customers, making it the most rapidly adopted feature in 18 years the project management application has been around. Thus far, Atlassian reports end users have created more than 2 million road map items within Jira.

Additional capabilities added to the road mapping tools provided in the latest edition of Jira include a drag-and-drop dependency mapping feature, support for filters to track projects more easily, a progress bar that indicates macro-level progress of each road map item, an ability to set up hierarchy levels on the road map, and the ability to set up road maps inline with a single click.

In addition, a live Jira road map can now be integrated with Confluence, a complementary tool from Atlassian for managing projects spanning multiple teams.

Atlassian currently offers several road-mapping solutions, including a team-level option in Jira, a program-level road map known as Portfolio for Jira and an enterprise organization-level version dubbed Jira Align. Atlassian has committed to making all three of these offerings work better together in 2020.

In addition, Atlassian is committing to bringing together the various road-mapping capabilities is provides across its portfolio. The company plans to enable organizations to aggregate multiple road maps into a single consumable artifact and is exploring ways to make road-mapping functionality accessible beyond Jira users. As more organizations in the age of digital business realize how much their future success depends on timely delivery of software, the number of end users who want to be able to monitor the pace of application development projects continues to expand.

In general, Ryall said Atlassian is focused on modernizing the end user experience for a project management application that is employed by more than 65,000 customers to manage software development projects. Much of that effort is focused on adding a visualization layer that will make it easier to navigate software development projects that continue to become more complex as organizations embrace, for example, microservices-based architectures.

Competition across the project management category is intensifying as startups look to drive alternative approaches that they claim are designed to support, for example, a mobile-first user experience that makes it easy to visualize data. It’s not clear to what degree any of those offerings are gaining traction, but a significant amount of venture capital is starting to pour into the sector.

In the meantime, visualization tools that promise to make it easier to appreciate what project events will have the most impact on the business are always going to be welcome. The real challenge, of course, remains getting developers to share accurate assessments of their progress with project team leaders. The good news is, it’s becoming much easier to automatically gather that data from the various repositories developers now rely on to check code in and out of various systems without having to ask anyone for an actual update.

— Mike Vizard

January 31, 2020
Latest Chef Habitat Release Embraces On-Premises IT

Chef today announced that the Chef Habitat automation framework for building and deploying applications can now be used in on-premises IT environments.

Mike Krasnow, a senior product manager for Chef, said version 1.5 of Habitat makes it possible to now store applications packages and their dependencies locally in addition to the cloud. In addition, pre-built application packages and dependencies from the Builder service can be deployed across multiple on-premises instances.

An Applications tab in Chef Automate now shows the service groups and instances that are deployed to make it easier to understand what’s deployed where and the health of each service. Both the Habitat Builder installer and the application dashboard are integrated with Chef Automate, which uses the same installer as Chef Habitat.

Finally, the Habitat Supervisor module is now more stable, easier to configure and manage, and provides improved support for Windows applications.

Krasnow said Chef has seen a 300% increase in the use of the software-as-a-service (SaaS) instance of Chef Habitat in the last year. Organizations that have embraced Chef Habitat include Alaska Airlines, Rakuten, and Walmart. That rate of adoption should increase now that an on-premises edition is available, he said, including among IT organizations in highly regulated industries that are not allowed to employ cloud services. In fact, at least 70% of all application workloads are still deployed in on-premises IT environments.

Chef Habitat appeals most to organizations that have embraced best DevOps practices to programmatically deploy applications, said Krasnow. There are rival automation platforms that make use of declarative approaches to automation that appeal more to IT generalists. However, he noted, organizations that want to empower DevOps teams tend to prefer a more programmatic approach.

For more than a decade now Chef has been driving adoption of IT automation. However, it’s only relatively recently that organizations have been employing IT automation at scale as part of their efforts to embrace best DevOps practices. As interest in IT automation frameworks has risen, so too has the number of options. Some organizations are even employing multiple IT automation frameworks within different business units. They may one day standardize on a single IT automation framework, but many DevOps teams will simply opt to employ the IT automation framework the members of their team already know. If the members of that team in charge of IT operations don’t have a lot of programming expertise, chances are high they will opt for a more declarative approach. DevOps teams that have developers who deploy applications on their own are likely to prefer a more programmatic approach.

Regardless of the platform chosen, it’s clear the days of manually deploying applications using custom scripts are coming to an end. IT organizations now require an industrial approach to managing IT as a factory. The biggest challenge achieving that goal is no longer the technology but rather the culture of the IT organization.

— Mike Vizard

January 29, 2020
CircleCI Extends Orbs Ecosystem for CI/CD

CircleCI announced today it has added integrations in collaboration with 20 partners to the family of connectors, known as Orbs, that it makes available for its continuous integration/continuous delivery (CI/CD) platform.

Thomas Trahan, vice president of business development for CircleCI, said integrations are now available with Heroku, AWS, Cloud Foundry, Google Cloud, Red Hat, Helm, Kublr, Alcide, Azure, DeployHub, Fairwinds, VMware, Kubernetes, Rafay Systems, Pulumi, Convox, Spinnaker, realMethods, Quali, Pantheon, LaunchDarkly and Salesforce.

Since launching Orbs a year ago, CircleCI claims there are now more than 13,000 organizations using Orbs across nearly 40,000 repositories and 9 million CI/CD pipelines. There are also more than 1,200 Orbs provided by more than 116 partners listed in the CircleCI registry. In the future, Trahan said the company plans to begin surfacing recommendations concerning which Orbs to employ based on the nature of the workflow being constructed.

Trahan said Orbs are gaining traction because they reduce the amount of custom code that needs to be written to set up workflows across a CI/CD pipeline. Without the existence of Orbs, DevOps teams are forced to rely on application programming interfaces (APIs) that are more liable to break, he said.

Competition between CI/CD platform providers is expected to become fiercer as adoption of CI/CD platforms continues to accelerate. A report published by Data Bridge Market Research this week forecasts demand for continuous integration (CI) tools alone will grow to $18.9 billion by 2025, representing a 19% compound annual growth rate. While the current CI/CD market is dominated by open source platforms managed by internal DevOps teams, CircleCI is betting interest in accessing a managed CI/CD service delivered via the cloud will rise as organizations opt to devote more resources to building applications versus managing the platforms they are built on.

A recent CircleCI study of more than 30 million workflows spanning 1.6 million jobs runs per day on its platform found 80% of all workflows finish in less than 10 minutes. Those jobs spanned 150,000 projects launched by more than 40,000 organizations.

The report noted 50% of those organizations start six workflows per day across their projects and that 50% of CircleCI projects never had a failure during pipeline changes made over the 90-day period when the study was conducted. When a failure did occur, 50% recovered in less than an hour, with 25% of organizations recovering in 15 minutes or less, according to the report.
As organizations embrace best DevOps practices more broadly, CircleCI is betting these kinds of metrics will become more important as a platform differentiator.

Naturally, it’s too early to say how the CI/CD platform wars will play out in the months and years ahead. But the amount of code organizations will need to deliver at increasingly faster rates is only increasing. The challenge organizations are facing now is finding a way to deliver all that code at an unprecedented level of scale.

— Mike Vizard

January 22, 2020