Tag: application development

  • Red Hat Extends Runtimes Middleware Portfolio

    Red Hat Extends Runtimes Middleware Portfolio

    Red Hat has made available the latest instance of Red Hat Runtimes, a suite of lightweight open source components and frameworks that makes it easier to discover the middleware most appropriate for building a specific type of application.

    James Falkner, product marketing director for Runtimes at Red Hat, said as organizations embrace cloud-native application architectures based on microservices it’s become increasingly challenging to determine what middleware to deploy optimally and where. Red Hat Runtimes not only makes it easier to navigate all those options, Falkner said, but all the components and frameworks are certified to be pre-integrated.

    The latest version of Red Hat Runtimes adds support for Open Liberty, a lightweight runtime for building Java applications developed by IBM. Red Hat was acquired last year by IBM.

    The latest installment of Red Hat Runtimes also provides access to what has become a standard distribution of Node.js based on Red Hat Software Collections that will be implemented across all Red Hat offerings.

    Finally, Red Hat has also added support for Red Hat Single Sign-On, an access control framework based on the Keycloak project.

    Falkner said Red Hat Runtimes also serves to reduce the total cost by providing a single subscription through which organizations can access everything from container runtimes to the 3Scale application programming interface (API) management middleware, which Red Hat acquired in 2016.

    Very few IT organizations these days are standardized on a single class of middleware, especially as they embrace microservices-based applications built using containers. Most IT teams for the foreseeable future will need a flexible way to access multiple runtimes in support of everything from monolithic applications based on Java to applications built using Node.js code deployed using Docker containers.

    Rather than a piecemeal approach to the middleware infrastructure required to build, deploy and integrate all those applications, Falkner said Red Hat Runtimes provides a more holistic approach.

    It’s not clear how much or even whether IT organizations are centrally managing middleware in the age of DevOps and the cloud. Historically, many IT organizations preferred to standardize on a single application server platform to deploy various classes of middleware. However, many developers today are deciding what middleware to include within their application stacks without much input from a central IT function.

    Via Red Hat Runtimes, Red Hat is trying to make a case for providing developers with the flexibility they cherish in the form of a subscription service that provides IT teams with a modicum of control over what middleware gets employed.

    Tensions between DevOps teams and central IT organizations have arguably never been higher. In fact, many DevOps teams are operating within lines of business that are outside the direct control of centralized IT. As such, the level of standardization that can be imposed by central IT organizations has become more constrained. Many centralized IT organizations are now trying to influence middleware platform decisions rather than outright make decrees that might get ignored anyway.

    Regardless of the middleware platform choice that ultimately gets made, however, the one thing that most centralized IT teams will have to come to terms with is finding a way to support it.

    — Mike Vizard

  • GitLab Open Sources Monitoring Tools

    GitLab Open Sources Monitoring Tools

    GitLab has decided to make its monitoring and observability tools available as part of its core open source platform to help reduce the total cost of DevOps. Previously, the tools were available as part of the commercial tools in GitLab’s DevOps platform.

    Kenny Johnston, director of product/Ops products for GitLab, said that as responsibility for observability shifts left, it is clear developers are now exercising more influence over which monitoring tools are employed. As developers begin to employ monitoring tools early in the application development process, most of them prefer open source tools because it’s unclear whether the application being developed will ever make it into a production environment, he said.

    However, if the application does make it into a production environment, it can be challenging for developers to make a case for standardizing on whatever monitoring tools they’re using in place of an existing commercial offering employed by an IT operations team. In addition to reducing costs, the GitLab approach could serve to eliminate any potential friction in the DevOps environment, as applications move from development into production environments.

    GitLab’s move to make its monitoring tools available as open source software comes at a time when more telemetry applications being employed to collect data are also based on open source software. In addition, developers of modern cloud-native applications based on containers are taking advantage of open source Prometheus monitoring software developed under the auspices of the Cloud Native Computing Foundation (CNCF) to monitor their applications. GitLab already provides integration with Prometheus.

    GitLab is also making it clear it expects its monitoring tools to benefit from the contributions of a larger pool of developers. Specifically, GitLab is calling for help in the areas of ongoing integrations with Prometheus along with improved logging, tracing and alerting capabilities.

    It’s not at all clear just yet to what degree DevOps teams will prefer to rely on open source versus commercial monitoring tools. While open source tools have some obvious advantages in terms of cost, many organizations have already standardized on commercial monitoring tools for a wide variety of existing applications. Open source tools often are more difficult to deploy and don’t tend to provide as much observability depth for IT operations teams. In addition, most of the providers of commercial monitoring tools are integrating their offerings with both open source telemetry software and Prometheus to bridge any divide that might occur between when an application is developed and deployed in a production environment.

    The one thing that is clear is a lot more individuals within the IT environments will be accessing these tools now that developers increasingly are being held accountable for the performance of their applications in production environments. In addition, modern applications require monitoring tools to make sense of all the dependencies that existing between microservices. Previously, IT operations teams tended to limit usage of monitoring tools based on commercial software to their most critical applications because of the costs involved. With the rise of open source monitoring tools, the opportunity to apply monitoring more broadly becomes more economically feasible.

    Regardless of the path forward chosen, the more visibility into IT environments provided, the easier it becomes to embrace best DevOps practices.

    — Mike Vizard

  • Testing Emerges as DevOps Hurdle in Mainframe Shops

    Testing Emerges as DevOps Hurdle in Mainframe Shops

    A survey of 400 senior IT leaders responsible for application development using mainframes finds 90% believe automating more test cases could be the most important factor in their success, as the pressure to accelerate innovation increases. However, the same survey finds only 7% of organizations automate the execution of test cases involving mainframe code today.

    The survey, which was conducted by Vanson Bourne on behalf of Compuware, also finds the time required to conduct thorough testing is the biggest barrier to integrating the mainframe into agile and DevOps processes for just over the half the survey respondents (53%), followed by a lack of skills (39%) and lack of understanding how code changes will impact distributed applications (34%).

    A total of 82% said that unless they can automate more test cases, they will not be able to meet the need for speed the business now requires. That may account, in part, for why 56% of respondents said they plan to start automating the execution of test cases on mainframe code within the coming year.

    The biggest benefits expected to be derived from those investments include greater efficiency within the IT team (59%), improved consistency of testing (53% ), reduced chance of human error (47%), reduced pressure on IT teams (47%), accelerated innovation cycles (46%) and less chance of bugs making it into production (40%).

    Primary areas of focus for automated testing are ranked as functional testing (63%), followed by integration testing (53%) and unit testing (37%).

    The survey also finds development teams are spending, on average, more than half their time (51%) on testing during the release of a new mainframe application, feature or function. That compares to 39% of their time testing applications, features or functions on applications that don’t run on mainframes.

    A full 92% said mainframe teams are spending more time testing code than they needed to in the past because of the growing complexity of cross-platform application environments. Issues organizations are contending with are “Manual and time-consuming test processes” (44%), “Mainframe testing processes require specialists that are not always readily available” (40%), “Testing processes are costly” (39%) and “It’s hard to visualize and understand dependencies” (35%).

    Not surprisingly, 77% of respondents find it increasingly difficult to simultaneously increase quality, velocity and efficiency to meet business innovation goals when developing and testing mainframe application code. Top concerns when it comes to mainframe development are introduction of security flaws (50%), impact on customer experience (38%) and disruption to operations (36%).

    A full 85% said it is becoming more difficult to deliver innovative and faster applications without compromising quality or increasing the risk of bugs finding their way into production.

    Steen Brahe, product manager at Compuware, said organizations that have mainframes are usually under pressure to innovate faster now because competition from startups relying on DevOps processes and modern platforms has increased sharply. Rather than incurring the cost of replacing mainframe applications on which the business currently depends, organizations that have mainframes are looking to extend DevOps processes to integrate emerging and legacy applications.

    It’s not clear to what degree those organizations will succeed. However, the one thing that is clear is organizations with mainframes that fail to embrace best DevOps processes are already most certainly doomed.

    — Mike Vizard

  • Raytheon Leans on Red Hat to Advance DevSecOps

    Raytheon Leans on Red Hat to Advance DevSecOps

    Raytheon Company is partnering with Red Hat to drive the adoption of DevSecOps workflows and processes it developed around the OpenShift application development and deployment platform.

    Jon Check, senior director for cyber protection solutions for Raytheon Intelligence, Information and Services, said Raytheon has developed a set of DevSecOps practices for organizations building applications deployed in highly secure environments, involving government contracts.

    Raytheon and these customers have been challenged by a chronic shortage of IT professionals with the appropriate level of clearance to work on these classified projects. To overcome that issue, Check said Raytheon developed what it describes as a “code low, deploy high” approach to DevSecOps. Developers who lack security clearances can still build applications; however, those applications can only be deployed by IT professionals having the appropriate security clearance.

    In addition, Check said Raytheon has developed integrations between its DevSecOps framework and various IT tools based on the ITIL framework, which so many IT operations teams depend on to foster collaboration across the application development and deployment process. For example, he said, whenever code gets checked into a repository, an alert can be sent to an IT service management application from ServiceNow.

    That approach enables organizations to build applications quickly without compromising the integrity of the deployment platform, Check noted. Now Raytheon is working with Red Hat to drive adoption of its approach to DevOps to organizations beyond the core vertical industry and government sectors it serves.

    Check said Raytheon chose to work with Red Hat because organizations are now building applications employing microservices based on containers that they want to be able to deploy on any cloud computing environment. Those environments include edge computing platforms to process data in near real-time closer to the point where data is collected.

    In addition, Check noted Red Hat OpenShift is built on Red Hat Enterprise Linux (RHEL), the first operating system to achieve Common Criteria certification with Linux Container Framework Support. Red Hat also assumes responsibility for curating the underlying open source operating system and application deployment platform.

    In general, Check noted that while there’s a lot of interest in deploying code faster these days, the deployment of insecure applications is counterproductive. Organizations too often find themselves rolling back application deployments to deal with one cybersecurity issue or another. By separating application development and deployment, Raytheon is making the case for a DevSecOps approach that enables more secure application code to be deployed faster, he said.

    Each organization will have to determine what rate of application deployment is fast enough for them. The more sensitive the application is, the more an organization is likely to want to be more deliberate when it comes time to deploy and update an application. However, the need to be deliberate doesn’t necessarily mean organizations should continue to rely on legacy approaches to application development and deployment based on waterfall methodologies.

    — Mike Vizard

  • Oracle v. Google and Its Impact on APIs and Code

    Oracle v. Google and Its Impact on APIs and Code

    What, if any, impact will the Supreme Court’s rulings on Oracle v. Google have on the industry at large?

    TL/DR: It is unlikely to impact the vast majority of us, vendor and enterprise developer alike.

    Disclaimer: I am a technologist, not a lawyer. I have done some research, and talked to lawyers, but all that I say here is opinion—even my direct quotes of lawyers are their opinion. The Supreme Court can and has caught people off guard and taken cases in different directions than expected. Though I believe this path is the one it will follow, nothing is assured until the Court rules.

    Throughout this blog, references to The Case are actually using Harvard’s case document.

     

    Background

    On Nov. 15, the U.S. Supreme Court agreed to hear a dispute between Oracle and Google. The Oracle v. Google case has been going on for nearly a decade. And its roots go further back than that.

    The origins of the case go back to 2005, when Google and Sun Microsystems discussed the licensing of Java for Android. This will likely be important because it shows that Google knew it was someone else’s intellectual property (IP). More on this later.

    The crux of the case falls into three parts:

    1. Eight files that were decompiled and used. In one court case, these were found to never have made it into distribution and only used for testing (which limits liability).
    2. Two source files from Java used directly. These were found to be infringing, but damages were set to zero with consent of both legal teams.
    3. The part at issue: the copying of the entirety of Java’s interface from 37 modules. Most tech writers imply this as 37 APIs. It is not—it is hundreds of classes and thousands of methods. The 37 is the number of Java packages.

    The case has been through four court hearings/rulings so far. To sum up the relevant parts of these cases:

    1. The first case (split between a jury and district court, running at the same time) included patent violations. Those were defeated and Oracle has not appealed that defeat. On copyright infringement, the court found that Google did violate copyright on the 37 packages and the directly copied source code, but not on the eight decompiled files. The jury could not settle the issue of “fair use” of the 37 packages.
    2. The district court decided that the eight decompiled files and the copied source code for one function were violations, but remanded the rest back to the jury trial to settle the issue of fair use.
    3. In the end, the district court determined that APIs are not protected by copyright. Their decision involved two parts:
      1. That there is only one way to write a given API.
      2. The interface code and hierarchy can be replicated by third parties without violating copyright because it is an interface and not content.
    4. On appeal, the finding was reversed, and APIs were deemed copyrightable, sending the case back again.
    5. At this point, Google asked the U.S. Supreme Court to intervene. The court chose not to.
    6. Back at jury trial, the court found that while APIs may be copyrightable, Google’s use was fair use in the legal sense. This is the one topic the jury could not originally agree upon.
    7. Oracle appealed this decision, and the District Court ruled that it indeed was not fair use to copy the structure and exact interfaces.
      1. Where the jury and the district court appear to disagree is in the idea of APIs. Calling a publicly documented API is obviously fair use, and the jury latched onto that idea. The District Court appears to acknowledge the difference between calling an API and copying it.
    8. And after some tumultuous hearings and years in the court, the Supreme Court has agreed to weigh in on the issue.

    The real problem here is that copyright law is not a great fit for software. It never has been. If I rewrite your Java application in Python, using the same exact structure and naming, is that protected? All of the “words” have changed. It is akin to rewriting your Hindi book in English without a direct translation  … except that in software there is the added issue of it behaving exactly the same.

    But we can’t fix the misapplication of copyright law to software—only Congress can. So what to expect?

    A fair number of people, from the open source community and from businesses that see opportunity in a ruling that favors their world  view, are advocating that affording copyright protection to APIs is a horrible idea because it would hurt independent developers. This is not quite true. Independent developers are not generally copying Java. While this case does have bearing on coding practices and what developers can do, it does not have a huge impact on innovation, just on copying others’ work and how that is achieved—much like the “reverse engineering” court cases of the ’80s.

    There are good arguments on both sides of this case, but it seems to me that fair use will lose. They are public APIs in the sense that anyone can call them; indeed, some of these packages are so core to the system that you could argue every app must call them. But calling a function is not the same as re-creating it. In that sense, they are not in the public domain. Anyone can read a book, but that does not make it public domain.

    But no matter how this turns out, it is all good for the industry. This uncertainty has hung over the IT sector for nearly a decade. Just like when a new boss comes along and there is uncertainty in the department until everyone adjusts to the new demands/style of the boss, a solid ruling will allow settling to start. The industry can adapt once it knows what the rules are and we can move along.

    The real long-term answer is to have an equivalent to copyright and patent that is designed around the unique parts of computer code. Clearly, software is not the same beast as a book or magazine. The considerations are half-patent and half-copyright, and trying to bend those two to meet the needs of software has created some serious issues. Oracle quoted a 1995 case to showcase this problem—the company is quoting it to win the appeal, but it should be quoted as the reason the protections need to be designed for this medium that is not a publication and yet consists of words whose sequence matters: “Applying copyright law to computer programs is like assembling a jigsaw puzzle whose pieces do not quite fit.” (attributed by Oracle to the concurring opinion of J. Boudin in Lotus Dev. Corp. v. Borland Int’l, Inc., 1995).

    One interesting bit that the courts thus far have ignored, and I would love to see the Supreme Court take up, is this: If Google entered into licensing negotiations, the company knew it was Sun/Oracle’s IP. To then go and copy parts of it without licensing appears wrong on its face. It would be interesting to understand the process that ended in the copying and hear whether that bears upon the legal standing of the case. I can think of both malicious and innocent routes to get there; it would be interesting to hear testimony about motivations and thought processes.

    But even without delving into the licensing negotiations, this case stands to redefine copyright with regards to software. J. Michael Keyes, a partner at the international law firm Dorsey & Whitney, had this (and more) to say:

    “One of the issues that the court may decide is the scope of copyright protection for software. Google had early success below in convincing the trial judge that the snippets of copied code were not copyrightable. Google may urge to have the court take a look at this issue anew. Another huge implication is the scope of fair use. The jury found that Google’s use was “fair” and that it was not liable for infringement. The appellate court overturned that jury conclusion and found that Google’s use was not fair as a matter of law. The Supreme Court will likely wade into this thicket and provide guidance on the scope of fair use in the context of software code and what role an appellate court plays in reviewing jury decisions in that regard.”

    What we (all of us) do not want to do is confuse “good for the industry” with “legal standard.” It is not the court’s job to do what we think is best for the industry; it is the court’s job to determine applicable law and what that implies needs to happen. Presumably, the Supreme Court will do just that. And it may not please any of us. But if we think the current iteration of the law is flawed, that is something to take up with elected representatives, not ask a court to “fix” on the fly.

    For the vast majority of us, though, it impacts our development not at all. Using APIs or forking open source projects are all still perfectly acceptable, and no ruling by the Supreme Court is going to change that—because copying someone’s APIs is the issue here, not using them. And open source licenses allow for copying and improving projects. So carry on. Get the job done. And read about the Supreme Court’s final decision with a smile, because either way, the industry will adapt to the new normal and continue forward.

    — Don Macvittie

  • The Battle for the Frontend: Rethinking APM

    The Battle for the Frontend: Rethinking APM

    With the battle for the backend between data centers and cloud largely over, application development is the next frontier ripe for innovation. Studies project mobile app revenue at $935.2 billion by 2023 and Internet of Things (IoT) installations at $75.44 billion by 2025. It’s no surprise that software innovation is ramping up around application development in a big way. At the same time, the desktop is still a primary interface in the workplace, which has given rise to a wave of browser-based applications for enterprise collaboration and efficiency.

    Apps—both on devices and in-browser—are effectively what businesses run on. New JavaScript-based Single-Page Applications (SPAs) are replacing legacy cloud stacks, where the software runs primarily in a customer’s browser. However, this approach creates an observability gap for teams under pressure to deliver better software more quickly. Because no application is siloed, the distributed nature of modern applications adds further complexity—and increases the risk for defects—for developers, who must code faster, smarter and better to keep their businesses competitive in an application-centric world.

    The Battle for the Frontend

    IDC predicts that by 2022, more than 60% of global GDP will be digitized, with growth in every industry driven by digitally enhanced offerings, operations and relationships—and applications will be the primary method of delivery. Companies in all industries are battling for users, revenue and reputation only, but only those companies with the best software will remain contenders. To innovate continuously, ensure optimal user experiences, and ultimately, retain their competitive advantage, enterprises must ship code quickly, every day and with fewer errors.

    Application errors and crashes will dramatically spike churn rates, kill conversions and impact brand reputation and customer retention. As tolerance for faulty performance is rapidly diminishing, user experience becomes a business-critical concern that has a substantial impact on a company’s bottom line. While companies with faulty code are dealing with the fallout, those that rely on modern application performance monitoring (APM) are shipping better code more quickly and with less risk.

    These new business drivers, along with an explosion of devices—from smartphones to IoT devices—have led developers to move their code closer to customers to increase code speed and improve scale. But this shift means software is run on customer devices over which developers have no control, a reality that inevitably creates its own set of new problems to monitor. To win this battle for the frontend, development teams that create games, mobile applications, IoT and other high-performance applications need rich insights into application health in order to quickly and continuously fix software errors, all with minimal impact.

    Rethinking APM

    Unfortunately, many legacy application monitoring tools do not solve for the frontend. They are fragmented, or specialized, and missing support for JavaScript, mobile, desktop apps or embedded IoT devices—despite these platforms being a significant part of the application ecosystem. Legacy tools focus more on system behavior, offering performance metrics on availability, throughput and latency, but miss the mark when it comes to actionable insight that helps frontend developers make sense of complexity and quickly get to the root cause of errors.

    Modern applications require a holistic approach to monitoring that provides deep context and understanding about how to address issues when they arise, instead of simply displaying the symptoms of a problem. This approach should involve collecting and analyzing transactional traces, scaling search and storage to handle full traces, and building intelligent algorithms to detect and analyze issues. By moving monitoring from production environments to test environments, development teams can accelerate the software development lifecycle and reduce the impact on customers. APM must integrate with continuous delivery tools to monitor continuous health mechanisms.

    — David Cramer

  • Developers Are Gaining Clout, and We Need to Pay Attention

    Developers Are Gaining Clout, and We Need to Pay Attention

    I’ve been watching the ascent of developers for quite some time. A few years ago, I wrote an open letter to developers in which I noted their power and collective influence over the direction of technology across industries. As creators of our digital future, developers hold incredible power—and with that power comes great responsibility.

    Developers now directly influence technology decisions within their organizations. They have achieved widespread recognition for their expertise and, as such, have frequently acquired a broader role in their company’s digital trajectory.

    While developers have always been first and foremost in feature and functionality development at the Cloud Foundry Foundation, we’re starting to see this approach bubble to the surface across the business landscape and in other open source communities. Cloud-native technologies often focus on operators, but it’s just as important to empower developers.

    If our goal is, as it should be, to enable developers to be more productive and give them the freedom to create more applications to production as quickly as possible, a developer’s workflow needs to be seamless and intuitive.

    Developers Need Widespread Support

    The long-tail impact of developers gaining a seat at the table and influencing technology decisions is a positive shift that demands widespread support. It’s critical that we recognize the important role developers play today and give them accompanying responsibilities to meet our common goals.

    Think about who is creating the software that’s changing how organizations operate and interact with customers: It’s the developers. Developers, above anyone else, know the technologies that make them most productive and impactful. Putting them in the driver’s seat is paramount because we all benefit when they are given space and time to be as productive as possible.

    Enterprises of all shapes and sizes are taking notice and shifting strategies as a result. Indeed, a significant majority of organizations are empowering developers with the freedom to choose the tools they use. In our most recent research, we found that 59% of respondents said their company is giving development teams more authority to choose their tools.

    Perceptions Are Evolving

    It’s no coincidence that this change is happening when software development becomes more critical for companies across all industries. Organizations realize the biggest hurdle to improving application development productivity is culture. More than a third (37%) of survey respondents feel that way today. We’ve been tracking this sentiment since 2016 and only a quarter of respondents felt that way then.

    Just three years ago, 39% of respondents said technology was the biggest hurdle for their organizations to overcome. That number has dropped to 29% today.

    That’s quite the inverse from 2016, and it indicates the levels at which software development is becoming a greater priority for businesses. As such, it’s increasingly common for organizations to give developers resources and influence to shape the direction of their business.

    Let’s not become complacent. We all need to double down on giving developers the best possible experience. It’s the developers who are driving transformational change in our organizations. The more power we give them to do so, the better off we will be as a result.

    — Abby Kearns

  • Serverless and GraphQL: Build and Launch at the Speed of Thought

    Serverless and GraphQL: Build and Launch at the Speed of Thought

    Websites and apps are now, often, one and the same. Traditional development methods for an online or downloadable app can take months, given the backend development aspects that need to be managed—infrastructure provisioning and management, security, scalability, consistency and more, particularly for companies that have users around the globe and potentially very high usage demands.

    In addition, once the app is built, it can take several days to launch and ensure global availability. Once launched, the app can require ongoing maintenance and supervision to ensure availability and performance, as well as constant fine-tuning of the balance between over- and under-provisioning to manage costs.

    Serverless computing, when combined with GraphQL APIs, is the Holy Grail of application development. These technologies make it possible for developers to build and launch apps lightning fast by removing server provisioning and management concerns. Developers need only worry about building a compelling app with usability features that optimize engagement. Additionally, with serverless and GraphQL, an app can essentially be launched to a global user base within hours or even minutes, rather than days, while avoiding the need to manage servers. Let’s take a look.

    What is GraphQL?

    GraphQL is an API standard for building modern, data-driven applications based on the widely known HTTP Protocol. First created by Facebook in 2012, GraphQL was key to the social media giant shifting its mobile app from HTML5 to a native mobile app. Based on its success, Facebook made GraphQL available to the public as an open-source project in 2015.

    With GraphQL, you define an agnostic Domain Specific Language (DSL) around your data structure in terms of:

    • The programming language you use. As an API standard, GraphQL is open for implementations in many languages, such as JavaScript, Java and C#. You can essentially use the standard with your language of choice.
    • The database engine you use. GraphQL is only concerned with having the data ready, rather than the source of the data and where it is coming from, so you have the freedom to implement a GraphQL API with almost all database engines.

    What’s All the Fuss About Serverless?

    Serverless represents a major paradigm shift in the way we create and run web services and apps. Serverless computing operates in the cloud, freeing developers from the burden of thinking about back-end tasks, such as managing infrastructure, scaling servers and provisioning capacity and resources.

    Below, I’ve listed some specific benefits that serverless provides, looking specifically at serverless databases—many of these advantages are part of other serverless offerings as well. The overall impact is that with serverless technologies, developers only pay for what they use, or what the app uses depending on user demand. Developers can scale up to virtually infinite disk space and compute loads in seconds when traffic spikes hit, and scale back down when users go offline. The NoOps aspect of serverless means maintenance costs and burdens are removed. Additionally, global availability zones allow for replication between different locations and allow you to keep data where it’s needed—close to the user to minimize latency. Built-in encryption means developers can secure their apps with only basic security know-how.

    • Consumption-based billing.
    • Auto-scaling.
    • No operations overhead.
    • Global low latency.
    • Secure by default.

    When these benefits are combined with the advantages of GraphQL, one will notice a perfect synergy between the two technologies. Not only does the process become more automatic, the standard facilitates communication between internal teams and makes it easier for clients to integrate with your software, through:

    • API discoverability and automatic documentation.
    • Consolidation of data.
    • Language and data source-agnostic.
    • Type safety.

    Serverless Plus GraphQL Equals Developer Nirvana

    There are numerous examples of companies that have managed to build faster and cut costs with serverless. One of the most impressive demonstrations is when students in Australia managed to rebuild the census application and handle loads that the official $9 million system could not handle, at a fraction of the cost using serverless technology. GraphQL takes these advantages a step further.

    Airbnb, a company already known for its serverless adoption, claims to be moving 10x faster thanks to GraphQL, while Coursera noticed that their frontend developers found it easier to discover and query new data as their API evolves. These benefits are not just limited to a developer’s own company. For example, GitHub clients can now fetch data more efficiently and more easily thanks to the GraphQL-based public-facing API. GraphQL is even competing with SQL—when databases such as FaunaDB offer a native GraphQL API, users move to GraphQL at a rapid rate.

    Given the advantages of serverless in removing server provisioning and maintenance, and the freedom GraphQL gives developers when it comes to using programming languages and database engines, developers are essentially able to build and launch apps on a global scale as quickly as they think of them. And in the end, don’t we all want our customers to have a better experience?

    — Brecht De Rooms

  • Is Release Management Dead in the DevOps World?

    Is Release Management Dead in the DevOps World?

    In the world of enterprise application development and delivery, release management was born from the operations team attempting to reduce risk in the delivery pipeline. It’s the operations team’s job to ensure all production runs are stable, while the development team focuses on creating and shipping new products and applications.

    While this seems well-defined, integrated DevOps teams are left to wonder if they need release management, and how it fits into their processes. The answer is a resounding yes–release management is a crucial aspect of continuous delivery. Enterprises that fail to implement faster and carefully coordinate release cycles, will ultimately fail to keep up with their competitors.

    What is Release Management?

    The aim of release management is to consider the bigger picture, and to view software not only in relation to how the technology works in its production and during development, but also how it relates to the overall business objectives. It’s about much more than coordinating the creation of new and improved software–it’s also about coordinating all of the resources required, the features and the testing, and understanding how applications progress through the lifecycle. Essentially, true release management is not just about risk. It involves everything required to facilitate software moving into production while coordinating all of the different teams to ensure every release follows company procedures. It also makes sure all of the stakeholders are in communication to understand how the outputs of each individual team work together in the production environment.

    For a DevOps team to fully embrace release management, there needs to be a change in the traditional structure that the teams are used to. Product managers need to take ownership of the deployment process with the ultimate goal to ship finished software. They should own the entire process from start to finish, and thereby become the connection between the business, the customer and the development team. However, product managers are unlikely to be experts at release management, so they need help to fulfill this role effectively. This is where the product-oriented team comes in. As DevOps adoption matures, release management responsibilities need to be transferred to the product-oriented team, though there may still be guidance from a release management group.

    Why Does Release Management Still Exist?

    For businesses that either don’t have a release management system in place, or that struggle with how to make it work effectively, they may question why release management is still a concept, and whether it still needs to be one. Release management is necessary for teams to manage the complex amalgamation of DevOps and distributed microservice-based architectures.

    Businesses today frequently still have monolithic applications, independent from all other applications. Having these monoliths means there are dependencies, and dependencies are the death of anyone trying to run autonomously, as you still have to connect these applications with all of the others. Teams also tend to still have more stable systems of record, including ERP (Enterprise Resource Planning) applications, which are more complex to manage, particularly when changes are being made and if there is a hybrid environment involved with both on-premises and cloud. If DevOps teams do not integrate a suitable release management strategy to cope with this landscape, there can be potentially severe disruptions to day-to-day business processes.

    Where Do Autonomous Teams Fit in?

    Though autonomous teams are becoming increasingly self-sufficient, aspects of the business such as accessibility, security, usability and architecture reviews will never be 100% autonomous. Therefore, these teams will still require some level of guidance. Release managers are beneficial here because they have an overview of the entire process to see how every tool operates individually and alongside others, and can easily spot where bottlenecks are occurring so they can be resolved.

    Not only this, but as mentioned, release management accounts for all of the areas that can’t be automated for one reason or another. To make this work efficiently, businesses will ideally introduce either a coach for the product manager, or a part-time release manager in the product team.

    Whenever people are not available, there are also tools that can be implemented to make this process easier. Having a virtual release manager tool spans all of the delivery teams–it’s a combination of release process orchestration matched up with templatized and standardized releases approved by the release management team. The templates are like the blueprints for the release–they provide an example of how the release should look, creating a foundation that developers can then build on with the specifics of the desired release.

    In addition to templatized releases, you should shift left governance, risk and compliance requirements left in the development and delivery. Create a series of non-functional requirements that help ensure development performs necessary tasks during the development cycle. Tasks such as accessibility reviews of the design, threat modelling or architecture review performed early can reduce risk later on, since any problems to those areas have the potential for large changes.

    So, is release management dead? The answer is no. Though some businesses may be struggling to find a way to implement or adapt this methodology to fit around their existing teams, having the support and visibility of release management and any tools that are introduced can enable applications and the teams working on them to work in harmony, and ultimately improve the value that is delivered to customers.

    — Jeffrey Keyes

  • Survey: IT Striking Balance Between Innovation, Reliability

    Survey: IT Striking Balance Between Innovation, Reliability

    When it comes to managing IT, most DevOps teams are locked in an eternal struggle to balance innovation with reliability. There’s always a keen interest in being able to take advantage of the latest and greatest IT platform. However, new IT platforms don’t achieve the level of maturity required to build and deploy mission-critical applications overnight. Enterprise IT organizations often build an application on one platform and deploy it on another platform that is perceived to be more reliable.

    But a global survey of 505 IT and other executives published by the Cloud Foundry Foundation (CFF) suggests that, at a time when adoption of microservices based on containers and serverless computing frameworks is rising, the need to strike a balance between innovation and reliability has never been more acute.

    Conducted by ClearPath Strategies on behalf of the CFF, the survey finds serverless usage and container usage are now at 14% and 37% respectively. At the same time, adoption of platform-as-a-service (PaaS) environments such as Cloud Foundry has increased to 47% from 41% in the last six months.

    The study also suggests the rate at which organizations are adopting serverless computing and containers is starting to plateau. However, organizations that have adopted serverless computing frameworks and containers are making greater use of these capabilities as they continue to mature, according to the survey results.

    CFF CTO Chip Childers said it’s not uncommon for organizations now to deploy a PaaS and Kubernetes platforms alongside each other. In some cases, applications built using containers on a Cloud Foundry PaaS will be deployed on a Kubernetes run-time at the network edge. In other cases, applications built using development frameworks running on Kubernetes will be deployed on a Cloud Foundry PaaS that is perceived to be more reliable.

    Of course, the percentage of organizations that are employing a PaaS environment is not nearly as high as those using a less opinionated framework for building applications. However, whatever the path chosen, Childers said multiple types of abstractions that simplify IT complexity will live alongside one another for many years to come. At the same time, the underlying technologies that enable those abstractions increasingly will converge. For example, the Cloud Foundry PaaS was built before Kubernetes existed. Now the CFF is moving toward replacing much of the Cloud Foundry substrate with Kubernetes.

    According to the survey results, 65% of respondents place the most value on a platform that delivers a consistent experience. However, 59% also said a platform that integrates innovations is of the greatest value to their ability to develop software applications. In addition, almost two-thirds (63%) said a technology’s ability to integrate with their environment is the “touchstone” that makes technology better.

    As is often the case, what constitutes a touchstone is in the eye of the beholder. However, DevOps teams are not likely to sacrifice reliability no matter how cool that next big thing in IT may or may not be.

    — Mike Vizard