devopsy.kinsta.cloud

Tag: devops

There’s no One-Size-Fits-All Data Mobility Strategy

Whether you’re a Fortune 500 enterprise or a fledgling startup, there’s one thing every business can expect to confront: Change. This is resoundingly true when it comes to data management. Even greenfield operations will, sooner rather than later, need to change how and where they leverage their data. After all, every business—including those launched with the most cutting-edge technology—is built on a series of choices and compromises. As technologies and business priorities change, so should your data mobility strategy.

In a world of ever-changing variables, what’s the right data mobility strategy? There is no one-size-fits-all solution. It does, however, help to start with a solid foundation on which to build your strategy.

With the right platform that allows for flexibility and change, it’s time to build the structural framework for your data mobility strategy. When creating the framework for your data mobility strategy, there are a few considerations to keep in mind, including your desired use of on-premise storage, your hybrid cloud strategy and “supercomputing” capabilities, and the storage area network (SAN) needed based on your organization’s needs. Let’s review what they might mean for you:

Developing a Hybrid Cloud Strategy

The reality is that the hybrid cloud is now achievable for most organizations. According to Flexera’s 2023 State of the Cloud Report, 72% of organizations have embraced a hybrid cloud strategy. Your data mobility strategy should reflect that.

With a proper hybrid cloud environment, the user experience should be seamless regardless of where your data exists, whether that’s on-premise, in a private cloud, or in the public cloud. As the potential for more dynamic resource allocation grows, your data mobility strategy inherently becomes more critical. Data mobility, in effect, now equates to computing mobility.

Leveraging the “Supercomputer” in the Cloud

Data mobility becomes even more imperative as entities gain more opportunities to take advantage of “supercomputing” capabilities.

The computing power that exists in the cloud now is tremendous, and thanks to modern dynamic cloud pricing, even smaller organizations can tap into it. According to one estimate, the cloud-based high-performance computing market should reach $55 billion by 2030, growing at a CAGR of 7% from 2023 to 2030.

So for example, if you’re a FinTech startup, you could pay by the minute to leverage high-performance computing capabilities to test your trading algorithm. Previously, these powerful capabilities were only available to the biggest customers — think NASA — and came with astronomical costs.

On-Premise Solutions Aren’t Going Away

Even as cloud services and capabilities become more accessible and more valuable, on-premise operations aren’t going to disappear. Customers have all kinds of reasons for keeping data on-premise, whether it’s for compliance purposes, costs or the desire to leverage existing infrastructure. Certain workloads, meanwhile, simply don’t make as much sense on the cloud.

The reality is that even the most compelling alternatives couldn’t eliminate on-premise operations, because business ecosystems and industries evolve organically. Think about it: Many businesses still use landlines, and workers still use desktop computers. Nearly half a century after marketers first coined the term the “paperless office,” it took a full-blown pandemic to push our collaboration tools to the point where we are finally, basically, paperless.

Fiber Channel and iSCSI

When it comes to data mobility, how does an organization decide whether to adopt fiber, iSCSI or both? As organizations manage workloads that require low latency and other networking capabilities, they’re going to be investing heavily in this area.

Traditionally, a significant amount of data management is fiber-channel-based. With iSCSI, an organization doesn’t need to invest in separate physical infrastructure, such as switches or cables. Moreover, iSCSI has become more attractive to entities moving workloads to the cloud. A whole range of products, from Pure Storage, NetApp and even cloud platforms like Microsoft Azure, offer iSCSI-based storage in the cloud. Your data mobility strategy should consider how to move from fiber channel to iSCSI and back again.

Change is the Only Constant

Ultimately, no one can predict all of the major technological innovations that will impact their business down the road. To stay nimble, you need a data mobility strategy that you can execute with the team you have — whether their primary expertise is in storage, networking or elsewhere. This can be especially challenging in large organizations, with teams that have to meticulously plan their projects and stay accountable for their budgets. Now more than ever, it’s important to have a solid foundation on which to build a strategy that fits your needs.

September 15, 2023
Will ChatGPT Replace Human Software Developers? Probably Not

Since the release of ChatGPT, there has been a great deal of hype around generative AI and how companies can leverage it to cut costs and democratize software and application development. Naturally, with discussions of cost-cutting and democratization come whispers about what will happen to software developers.

This is a real and valid concern, but software developers’ skills, expertise and creativity are still very much needed.

While generative AI and AI code generation tools like ChatGPT have shown some promise and potential benefits, they are still in their infancy—like many other innovative technological advancements. We also don’t know what scenarios they may present down the road or their true abilities when the technology matures. For instance, how will it integrate with other technologies? We don’t know what will happen when a ChatGPT-generated line of code breaks or needs to be changed. We don’t know if it can provide a novel solution to a unique problem or what security threats it will present.

Given these unknowns, technology executives should think twice about replacing experienced and creative technology talent, such as software developers, with AI code generators.

Will ChatGPT create novel code to solve a unique problem never encountered before? Probably not.

A Tale as Old as Time (Or at Least a Decade)

The technology industry has been searching for and developing new ways to make certain software development tasks much easier and more streamlined for years. One example of this is low-code/no-code.

The notion of simplifying application development and replacing software developers with laypeople (citizen developers) has been around for more than a decade now, as low-code and no-code solutions have grown more popular. These solutions have promised that companies don’t need technical talent to get their software and app projects off the ground.

However, if you look at the impact of these solutions today, their use can result in large amounts of technical debt and almost always require the skill of experienced software developers.

The reason? Building complex software and applications is extremely difficult; it’s an art.

Low-code and no-code solutions have their rightful place and can make things easier if a company is looking to launch a simple app or static web page. These solutions can increase the pace of development and time-to-market and enable everyday people without any development skills to facilitate them. However, they are not actually a complete solution and often overlook aspects of development that a human software developer would typically address. Without a skilled expert involved, low-code/no-code platforms often can’t solve a unique problem a company has.

So, how does this relate to AI code generators like ChatGPT? Here’s how.

A Similar Situation—With One Key Difference

When thinking about their place in the development process, AI code generators are not that different from low-code or no-code solutions. The thinking is that they will also enable non-technical individuals to create software and applications with ease.

Yet, there is one key difference—they promise expertise, too. But is the expertise coming from the AI code generator or the person piloting it? The answer is simple; it is not from the code generator.

There have been examples of companies and individuals that have tried using ChatGPT to build code, and they have appeared to be successful. However, without the input of the individuals using it, it never would have been able to create the code on its own unprompted.

This means that the expertise of skilled, human software developers is still very much needed, especially when building intricate software and apps that require complex functionality such as optical character recognition (OCR), internet-of-things (IoT) connectivity and more.

A Future With Software Developers

Because of the expertise still required to create elaborate and innovative software and applications, AI code generators will not replace software developers anytime soon, if ever.

The technology used in these tools is still in its infancy, presenting many lingering questions and potential challenges. We will see this confirmed by the trials and tribulations experienced by the few companies and executives attempting to replace software development teams with tools such as ChatGPT.

Knowing AI code generators follow a similar path as low-code and now-code solutions, companies and executives should use them as developer enablement tools. These tools should complement the work of software developers by empowering them to focus on the complex tasks software and apps today require.

September 14, 2023
Generative AI and Software Testing Tools to Manage Technical Debt

It is easy to take a pessimistic view of generative AI and large language models (LLMs), especially when a growing list of AI experts and public figures have voiced concern about their potential to lead to dire consequences—even to human extinction. But we must also consider how these same technologies might mitigate these risks. There is no doubt that we are living in an accelerated cycle of technological progress and repercussions. However, the intelligence, speed and agility of AI—and particularly machine learning (ML)—may be just what we need to roll with the punches.

As the speed of development outpaces our ability to mitigate potential risks posed by the systems we build, we are set on a path to accruing massive technical debt—the ever-increasing costs associated with modernizing code later rather than sooner. Too often, organizations in the private and public sectors are reluctant to pay off this debt, choosing an “if it ain’t broke, don’t fix it” mentality toward software maintenance and security. The problem is that as technology outgrows and outpaces our critical infrastructure systems, the potential for catastrophe escalates.

Machine Learning: A Tool for the New “Space Race”

Automated testing has proven superior in regression testing, especially in visually recognizing potential issues at the pixel level. If, for example, an important element of your interface is missing from the screen after an update, a visual test script can identify that faster than a human can. AI (and in particular, machine learning) generates test plans that provide more comprehensive coverage of the system under test and more practical coverage.

Traditional testing methods usually begin with a broad and hypothetical analysis of user interactions. Test engineers begin by casting a wide net to cover the many possible user engagement scenarios they imagine. In contrast, AI-assisted systems learn from actual user interaction, building script libraries that focus on known points of weakness and vulnerability. It also does this at speed and scale. This technology is going to be essential to software test engineers as they inevitably find themselves unable to keep up with the abundance of code generated from LLMs using traditional testing methods.

Technical Debt is Inevitable but not Unsolvable

Every new iteration of software has the potential to introduce unforeseen problems ranging from glitchy bugs to catastrophic failures. The risks of releasing new software vary immensely between applications: It’s one thing if the latest release of your music streaming app crashes and quite another if the system that runs the regional power grid fails. One will result in unhappy customers; the other, the potential loss of life.

The most critical systems (e.g., financial, transportation, safety, medical) are more likely to get frozen in time. Once a stable iteration is released, companies are generally not keen to make changes unless absolutely necessary—beginning the cycle of technical debt accumulation that grows until that debt is paid off by modernizing the code.

Deciding when to pay off technical debt has always been a matter of weighing pros, cons, costs and benefits. But sometimes, such as in the case of an epic failure, that decision is forced. Both the risk of breaking the system and the cost of modernization compel developers to leave well enough alone. Meanwhile, the longer a system remains unchanged, the more isolated, outdated, and obsolete it becomes, setting the stage for failure.

By introducing generative AI technology to the development stack along with other tools for authoring, compiling and testing software, developers will soon find themselves driving in the fast lane. With the security of knowing that code can be produced rapidly and released safely, owners of aging legacy systems will be more likely to modernize software sooner, helping them to pay off technical debt more quickly. That, in turn, could lead to increasingly rapid software development and release cycles, more work for developers, and more innovation. Such a workflow could very well become the embodiment of accelerating change, taking us from an “if it ain’t broke, don’t fix it” mentality to one where we anticipate the need for new code and avoid future catastrophic failures, or for that matter, human extinction.

September 12, 2023
Implement Object-Level Encryption and Policy With OpenTDF

With an exponential increase in data being generated, stored and shared online, the issue of data security no longer belongs to IT alone. Software and application developers have been put on notice along with business owners and legal teams worldwide to not only maintain data privacy but to build more secure products. There’s no easy solution. However, there are resources readily available for devs to build security into the fabric of their products. One is called OpenTDF, an open source project that lets you integrate encryption and data policy controls into your new and existing apps to safeguard your data, and the sharing of it, for you as well as your users.

What’s TDF, and Why Should I Use OpenTDF?

TDF, the “trusted data format,” was originally developed by the United States National Security Agency (NSA). It’s an open standard for object-level encryption that keeps data protected and under the data owner’s control, wherever it’s created or shared. TDF includes cryptographically secured metadata that ensures consistent policy control throughout the data life cycle. Picture this: You can grant, revoke or “turn off” data access at any time, even if the data has left your network or application.

OpenTDF is an open source project that evolves the open TDF specification and provides a blueprint for getting started. There are a multitude of example applications that demonstrate the implementation logic, as well as streaming video and IoT use cases.

The OpenTDF project is based on Kubernetes and OCI containers, and there is a quick start guide to get you up and running with a development environment. The quick start process will install supplemental services like Keycloak as well as project-specific services like key access service (KAS) and Abacus (an ABAC front end for configuration and management of attribute-based access control). Once you’ve completed a quick start installation, you’ll have a basic OpenTDF cluster with a Keycloak identity provider, PostgreSQL data store and a single entry point at localhost with an Nginx ingress controller.

There’s an architectural diagram available on GitHub to see all of the services and service interactions.

Several SDKs are available for building on the OpenTDF framework, including JavaScript, Python, C++ and Java. The client SDKs generally include basic examples for identity auth and creating a TDF-protected encrypted object.

Take OpenTDF for a Spin: Secure Remote Storage

Have you ever wondered how to make data access secure and simple? Using OpenTDF, developers can create that experience for their users. Let’s walk through a sample web application that uses OpenTDF to encrypt and upload data to cloud storage.

The application we’ll be using is called OpenTDF Secure Remote Storage. It’s a react-based example that shows developers how to create encrypted data streams. These streams allow you to upload and download files from S3-compatible remote data stores while maintaining data protection. You can even remove encryption if needed.

To make things easy, we’ll be using OpenTDF’s client-web SDK, which authenticates against Keycloak using OpenID Connect (OIDC). Keep in mind that this example runs on your local machine. It’s not designed for cloud or enterprise services.

Prerequisites: You’ll need an S3-compatible storage object, like an Amazon S3 bucket. (You can create one for free here.)

Set it Up

First, install two CLI tools: Kind and Tilt. These will be used to deploy the OpenTDF services to your local machine. If you’re on macOS, you can install them with a simple Homebrew command: brew install kind tilt.

Next, you will need the sample code on your local machine. You can either download the zip or clone the OpenTDF GitHub Repository using the following command: git clone git@github.com:opentdf/opentdf.git. This will create a directory called “opentdf” in your current location.

Now, navigate to the root directory of the sample application: cd opentdf/examples/secure-remote-storage. To deploy OpenTDF, you’ll need a local Kubernetes cluster. Use the Kind CLI to create one: kind create cluster --name opentdf.

Finally, start the application using Tilt: tilt up. This will launch the necessary OpenTDF services.

Steps to Run the Application

1. To begin, go to http://localhost:65432/secure-remote-storage in your web browser. This is where the Secure Remote Storage webpage is hosted.

2. Now, it’s time to log in. Use the following credentials (defined in the bootstrap’s config file):
○ Username: user1
○ Password: testuser123

3. Then, choose a file from your computer to upload. It can be anything – a text file, a PDF, or an image. Let your creativity flow! If you don’t have a file handy, no worries. You can download an image by right-clicking on it and selecting “Save As” from this link.

4. Next, tell the application where to store your encrypted file. Provide the necessary JSON object that defines your S3-compatible object store. You can refer to the prerequisites for more details. (Optionally, you can save the configuration for future uploads. Just give it a name and click “Save.” This way, you won’t need to define the object store again in the future.)

5. Now, it’s time to encrypt and upload. Click the “encrypt and upload” button, and watch the magic happen!

What’s happening behind the scenes? When you click “encrypt and upload,” the application uses the OpenTDF API to convert your selected file into a .tdf file. It applies AES-GCM encryption and attaches access controls to ensure that only authorized users, like you (in this case, testuser123), can access the data. Even if your data store is public, your data remains secure.

6. Ready to view and download your uploaded file? The table on the webpage lists all the files you’ve successfully uploaded. Each file has a download button next to it. Click that button, and the hosted file will be downloaded and decrypted on your local file system.

Excited to explore more? Now that you’ve seen OpenTDF in action, you can dive into the source code of this application. Use this sample application as a starting point to integrate OpenTDF into your own secure applications.

What Else is Possible With OpenTDF?

From a secure webcam app to a privacy-forward menstrual tracking app and more, the possibilities are endless with OpenTDF and the future is in developers’ hands. By building on OpenTDF, the valuable data flowing through your applications will be protected forever.

Learn more about OpenTDF at openTDF.io, and get the full quick-start guide, including more detailed instructions and other sample apps at the OpenTDF GitHub.

Cassandra Zimmerman, technical product manager at Virtru, contributed to this article.

September 12, 2023
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

CareerBuilder.com

Cognizant Technology Solutions
Phoenix, Arizona
Senior DevOps Architect
$130,000 to $180,000

Indeed.com

IBM
Research Triangle Park, North Carolina
SAP DevSecOps SME
$126,000 to $235,000

Dice.com

DGN Technologies
Dallas, Texas
Azure DevOps Engineer
$110,000 to $115,000

SimplyHired.com

Sabre Systems
Lexington Park, Maryland
Cloud Engineer – DevOps
$106,000 to $134,000

LinkedIn

Deloitte
Miami – Fort Lauderdale, Florida
Junior Cloud Infrastructure Architect
$65,000 to $97,000

September 11, 2023
The Great CentOS Linux Migration: How We Got Here and What’s Next

The recent news regarding Red Hat’s decision to limit access to the source code of their Red Hat Enterprise Linux (RHEL) distribution has garnered considerable attention. In order to understand the ramifications and subsequent changes, it is important to look back at CentOS, its historical alignment with RHEL and the options moving forward.

CentOS Then and Now

Starting in 2004, right from its inception, every iteration of the commercial RHEL offering triggered a corresponding release of CentOS. These iterations mirrored RHEL, albeit with modifications to eliminate the Red Hat branding and other minor updates. The presence of open source CentOS Linux facilitated swift installation of a free RHEL variant, rendering it accessible for diverse purposes spanning from development to production environments.

In January 2014, Red Hat joined the CentOS project. Under a new CentOS governing board, they became the main sponsor and driver of the CentOS project. They continued to be an open source downstream alternative to RHEL.

On December 8, 2020, the CentOS project and Red Hat set a new end-of-life (EOL) date for CentOS Linux 8. They shifted focus and investment into a new Linux distribution, CentOS Stream, with a rolling release model. EOL means that the community stops releases regardless of the severity of a bug or a vulnerability. Today, CentOS versions 6 and 8 are already EOL, and version 7 is the last, with EOL set for June 30, 2024. This announcement immediately sparked new projects to fill the CentOS gap. New open source projects such as Rocky Linux and AlmaLinux took off quickly, gaining contributors, sponsors and users.

Fast forward to June 21, 2023, when Red Hat announced it would no longer publicly publish RHEL on git.centos.org.

Previously, the source code was accessible to all, and it was used by various RHEL-compatible alternative open source projects such as Rocky Linux and AlmaLinux. It also affected other distributions, including Oracle Linux, which was a RHEL derivative for many years. All of these open source Linux distributions offered an alternative for applications; they were equally compatible with both free open source Linux and the commercial RHEL offering.

According to the 2023 State of Open Source Report, 15% of all organizations and 20% of large organizations globally still have CentOS Linux deployed in their environments. Organizations have to move off EOL CentOS 6 and 8 and, in less than a year, off CentOS 7. Running EOL versions of any software can pose a substantial risk and cause failure in IT internal and external compliance. New vulnerabilities are constantly disclosed, and without updates or patches to CentOS, it is critical to plan for the “Great CentOS Linux Migration.”

CentOS Migration Planning and Challenges

Migration can be challenging. If organizations have legacy applications, they might encounter significant challenges making them work properly on a different Linux distribution. Even a small change in the individual packages that form the Linux distribution can impact and delay testing. While every application is different, and many are not dependent on low-level Linux functions, others could be significantly impacted. The number of CentOS deployments and applications has an exponential impact on the migration efforts. Evaluating different Linux distributions also takes time and will depend on the use cases, the skills developers have within each organization and the results of testing. The actual installation of a new Linux distribution is the easy part—the testing of all the layers on top of the operating system is what will take time. Some might be straightforward while others will require significant changes. Those are the reasons why it is helpful to stay with compatible distributions that will minimize the migration challenges.

As organizations navigate the CentOS EOL and the migration period, it will be helpful to find options to extend CentOS long-term support. This means finding the expertise to generate patches that address newly disclosed high-severity vulnerabilities post-EOL. In other words, organizations must expand the community’s long-term support to address security.

Wait for What’s Next

The biggest question about alternative distributions is how closely they resemble RHEL. Are they going to continue to be bug-for-bug compatible? Or are there enough differences to no longer consider them application-compatible? The Rocky Linux Enterprise Software Foundation announced its plan to access RHEL source code and its intentions to continue to be bug-for-bug compatible. AlmaLinux OS Foundation announced a different approach. It is working with the CentOS Stream community while maintaining binary compatibility. This means not strictly bug-for-bug but focusing on applications to continue to be compatible.

It is possible we’ll see other potential changes from Red Hat with regard to the access to RHEL’s source code. Today, it’s only available to customers under a commercial license agreement.

The big test will be the next minor version, RHEL 9.3. It will be interesting to review the corresponding 9.3 versions of Rocky Linux, AlmaLinux, Oracle and others, including SUSE, who announced their intention to offer an open source compatible Linux distribution. The analysis and comparison of how applications run with the new minor version will reveal how close they are to RHEL.

To mitigate uneasiness, organizations have to plan and test alternatives. Finding post-EOL support and patches will allow organizations to have a runway for migrating CentOS to different Linux distributions.

As everyone in the industry with CentOS deployments waits for the next release or the next few releases, extending long-term support becomes a very viable solution. It is wise to make sure security and IT compliance aspects are addressed. Perhaps more open source Linux distributions will appear in the near future and offer another alternative to CentOS Linux.

September 8, 2023
3 Ways to Achieve Faster App Development Without Compromising Security

Bringing products to market quickly, efficiently and safely is key to brand success, and elite DevOps teams minimize the lead time for changes by quickly and efficiently moving new products and software updates from concept to deployment. DevOps teams often measure lead time in hours, not days, weeks or months, which underscores the centrality of speed in today’s hyper-competitive online environment. Customer experience and brand loyalty are constantly changing as new products and services come to market, and DevOps teams are under immense pressure to stay as agile and efficient as possible. Increased technology development velocity can lead to heightened security risks. As of early 2023, as many as nine out of 10 companies have detected security risks in their software supply chain. This is why companies cannot ignore the rising number of attacks targeting software development teams.

High-profile incidents at SolarWinds, NetBeans IDE, Kaseya and Codecov demonstrate the risks facing software development teams at every company.

These threats exploit the continuous integration and continuous delivery (CI/CD) process to sneak harmful software into authentic applications and install risky and harmful components whenever possible.

The risk of code injections makes safeguarding internal and external dependencies crucial. If not appropriately protected, compromised software pipelines can lead to data leaks, code tampering and system exploitations, putting the entire business at a heightened risk.

Simply put, DevOps teams must maximize development speed without compromising security. This is an undoubtedly tall order, but one that’s achievable with the right processes in place. Here are three strategies DevOps teams can implement immediately to reach this goal.

Streamline Privileged Access Management

Streamlining privileged access management is vital for enhancing cybersecurity in DevOps teams, particularly with the growing threats to software supply chains. This requires adopting stringent security practices, including temporary access permissions that can be granted and revoked as needed—a strategy ideal for managing temporary services in DevOps workflows.

This approach facilitates automatic management of access privileges, including revoking password permissions when team members leave the organization or project and thorough scrutiny of who has access to what.

At the same time, enforcing least privilege access, a principle that aims to minimize the attack surface by eliminating unnecessary permissions and adjusting overly broad ones, is also essential, reducing the chances of account hijacking or theft of static API keys.

Similarly, zero standing privileges are also essential, relying on just-in-time access management that ensures minimal active permissions at any given moment, enhancing security by reducing potential vulnerabilities.

Leverage AI Solutions for Security

The cybersecurity AI sector is soaring alongside escalating cybersecurity threats to DevOps teams.

Deloitte expects cybersecurity AI solutions to become a $19 billion market by 2025, as the technology’s “ability to adaptively learn and detect novel patterns can accelerate detection, containment and response, easing the burden on SOC analysts and allowing them to be more proactive.”

AI can help DevOps teams detect and prevent cybersecurity incidents by quickly identifying and monitoring applications at risk, ensuring greater resilience in their DevOps processes through CI/CD, applying analytics to streamline data challenges, and identifying potential hot spots before they escalate and present real risks.

AI can also help combat alert fatigue within security teams, reduce analyst workloads and cut down on false positives, saving valuable time. According to a 2022 IT industry study, 60% of respondents receive more than 500 cloud security alerts every day, and alert fatigue is “causing critical alerts to be missed at an alarming rate.”

By leveraging AI for cybersecurity, DevOps teams can enhance their defensive posture without diluting their team’s impact, allowing them to best balance speed and security in the app development process.

Enable Communication and Collaboration in DevOps Teams

In the realm of DevOps, success relies not only on implementing the right tools and technology but also on fostering an adaptive culture that encourages seamless communication and collaboration among team members.

Effective communication forms the bedrock of this cultural shift. By establishing clear lines of communication, development and operations teams can better understand each other’s challenges and perspectives. Open dialogues can foster mutual respect and create a shared understanding of common goals, thereby encouraging a collaborative problem-solving approach.

Meanwhile, fostering a collaborative culture is equally vital. When teams collaborate effectively, they can identify and resolve issues more quickly, improve the quality of the software, and accelerate delivery times.

Embracing Speed and Security in App Development

Achieving faster app development without compromising security is a complex yet achievable goal in today’s competitive environment.

By investing in streamlining privileged access management, leveraging AI and fostering a culture of effective communication and collaboration, DevOps teams can enhance both speed and security.

To be sure, in the face of escalating cyberthreats, speed and security are not mutually exclusive but, rather, two sides of the same coin. By implementing these strategies, DevOps teams can navigate this delicate balance, accelerating development timelines while ensuring robust security.

September 7, 2023
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

LinkedIn

Icertis
Phoenix, Arizona
Principal Azure DevOps Engineer
$132,000 to $199,000

SimplyHired.com

Decision Sciences International
Remote
DevOps Engineer
$130,000+

Indeed.com

Hewlett-Packard Enterprise
Durham, North Carolina
DevOps Engineer
$124,500 to $286,300

CareerBuilder.com

CACI
Oklahoma City, Oklahoma
DevOps Platform Engineer
$104,200 to $229,200

Dice.com

SPECTRUM
Greenwood Village, Colorado
DevOps Engineer
$78,900 to $139,500

September 5, 2023
Driving DevOps Excellence: Implementing SLOs for Your DevOps Team

In today’s fast-paced world of software development, when continuous deployment and frequent releases are the norm, DevOps teams are essential to facilitating smooth communication between development and operations. In a blog post on LinkedIn, I talked about the importance of service level objectives (SLOs) for the testing team to improve the overall product quality. On top of that, let’s look at how adding SLOs to your DevOps team can improve productivity, dependability and client happiness.

The Role of SLOs for DevOps Teams

• Aligning DevOps Goals with Business Objectives:

SLOs help DevOps teams coordinate their efforts with business objectives. The DevOps team can concentrate on delivering real business value by setting precise performance indicators, such as deployment success rates or infrastructure provisioning timeframes.

• Promoting Collaboration and Accountability:

By implementing SLOs, several stakeholders—including development, operations, quality assurance and business teams—are encouraged to work together. Over each stage of the software development life cycle, this shared responsibility promotes a sense of ownership and accountability.

• Driving Reliability and Stability:

SLOs play a key role in ensuring the stability and dependability of the system. You can be sure that your services consistently fulfill client expectations when your DevOps pipeline adheres to defined SLOs.

• Proactive Issue Mitigation:

Monitoring and alerting systems are used together with SLOs. The DevOps team could avoid service outages and downtime by aggressively identifying possible problems and resolving them before they become more serious by regularly monitoring important indicators.

• Data-Driven Decision Making:

Decision-making is driven by quantitative data. With the help of such indicators, the team is able to identify bottlenecks, prioritize improvements and streamline processes based on quick feedback.

Now, let’s explore some key areas where DevOps teams can set SLOs to improve their performance:

1. Continuous Integration (CI):
SLO: “xx% of builds complete within Y minutes.”
Measurement: Monitor build times and queue times regularly.
Action: Optimize CI infrastructure and configurations to meet the SLO.

2. Continuous Deployment (CD):
SLO: “xx% of deployments are successful.”
Measurement: Track deployment success rate.
Action: Improve the deployment process to meet the SLO and reduce deployment failures.

3. Infrastructure Management:
SLO: “xx% of infrastructure is provisioned within Y minutes.”
Measurement: Monitor infrastructure provisioning time.
Action: Optimize infrastructure provisioning scripts to meet the SLO.

4. Monitoring and Logging:
SLO: “DevOps tools and system uptime should be at least xx%.”
Measurement: Monitor the availability of the DevOps pipeline, deployment system and other tooling, including monitoring and logging systems.
Action: Ensure high availability for DevOps tools and components.

5. Artifact Management:
SLO: “Artifact retrieval time should be less than x seconds on average.”
Measurement: Monitor artifact retrieval time and availability.
Action: Optimize artifact storage and distribution mechanisms.

6. Testing and Quality Assurance:
SLO: “Code must have at least xx% unit test coverage.”
Measurement: Track test coverage regularly.
Action: Encourage developers to write more tests.

7. Security and Compliance:
SLO: “xx% of compliance checks must pass.”
Measurement: Monitor the results of compliance checks.
Action: Ensure necessary security measures to meet the compliance SLO.

8. Standardized Tools Selection:
SLO: “xx% of teams must use the approved CI/CD tools stack.”
Measurement: Track the percentage of teams using the approved tools stack.
Action: Encourage teams to adopt standardized tools and provide necessary training and support.

9. Training and Skill Development:
SLO: “xx% of team members should undergo relevant DevOps training annually.”
Measurement: Monitor training completion rates.
Action: Provide training opportunities and resources to help team members enhance their skills.

Initially, teams should baseline which percentage values to track by observing the current state. In the event they don’t have the bandwidth to baseline, start with any reasonable arbitrary number over a period of time, and it will be automatically refined.

Implementing service-level objectives empowers DevOps teams to focus on delivering reliable and high-performing services that meet user expectations. By setting clear performance and reliability targets, teams can proactively identify and resolve issues, leading to improved collaboration, efficiency and overall user satisfaction.

SLOs are not rigid constraints but are a means to drive continuous improvement and foster a culture of excellence within the DevOps ecosystem. As organizations strive to keep up with the ever-changing demands of the digital world, embracing SLOs is a crucial step toward achieving DevOps excellence and ensuring a competitive edge in the market.

August 25, 2023
How Platform Engineering Can Drive Digital Sobriety

If we’re being honest, the “green issue” currently isn’t the priority it needs to be for a lot of companies. At best, they are ticking the box marked ‘sustainability’ and paying lip service to a trendy topic. At worst, they are engaging in nothing more than greenwashing.

Considering carbon emissions from cloud computing have now overtaken those from commercial aviation, this is disheartening for the IT sector. Unsurprisingly, most of these emissions come from inefficient use of the cloud due to overly complex processes and a lack of centralized oversight over cloud infrastructures. And if “emissions” sounds a bit vague, here’s a translation into dollars–$147 billion was wasted in 2022 in cloud spend.

So, when it comes to reducing an organization’s cloud carbon footprint, there is clearly a financial incentive. Even for those who don’t believe in individual responsibility or worse, simply don’t care what kind of world we’ll leave future (and some present) humans to live in, there is money to be saved.

The truth is that companies need to put sustainability first across the whole enterprise, and they need to do it now.

A New Kind of Business

Tackling departments one-by-one or singling out individual processes to make them more sustainable is not going to work. What organizations need is to stop thinking of sustainability as an afterthought and start incorporating it in the decision-making process from the get-go, maybe even as part of their very business model.

This is the sort of business that places its people and the planet above profits. Progressive, modern companies that want to stay in business longer need to invest in their people and take care of the planet instead of chasing endless growth and ever-increasing profit because that, simply put, cannot last.

As a culture, we’re currently at a turning point–late-stage capitalism is running its course, and more people are realizing that constant growth at the expense of well-being and the planet’s dwindling resources is not sustainable (in all senses of the word).

For this to work, it’s about looking at business through a new prism.

Driving Digital Sustainability From the Ground Up

It’s not too late for businesses to become more sustainable. In fact, it is the best time to make life-saving changes. When it comes to tech specifically, there are a couple of things you can do, starting with two key things that need to change.

First, cloud waste has been costing companies billions of dollars for years now. Organizations are set to spend nearly $600 billion on the cloud in 2023, but it seems that most people are still in the dark about the real environmental impact of cloud usage. As with most big corporate changes, it’s all about a change of mindset. We need to accelerate awareness and promote digital sobriety to inspire transformation and decision-making with GreenOps on the enterprise level.

A cloud-first approach has long been the holy grail of IT. However, what we couldn’t anticipate is the sheer volume of resource usage and complexity that comes with it. We simply do not have the planetary resources to support this growth much longer. It’s time to become smarter, leaner and more environmentally conscious by using the “consume better” approach.

Second, think about the KPIs. Change without success parameters will not work. While organizations have a key role in decreasing global cloud spend, they must have the right tools and references. They need to be able to assess the environmental impact of their digital choices at all decision levels.

For the IT sector, this is where platform engineering comes into play. An internal developer platform can act as the critical piece that connects DevX, deployments, governance, security and observability.

With green best practices and cloud carbon footprint visibility at every stage–from the dev deploying a new environment on the cloud to the CFO checking the monthly cloud bill–a platform engineering approach ensures not only organizational but also individual responsibility. When all tools are accessible and processes transparent, nothing gets lost in translation. This means less room for error and cloud waste.

Ultimately, it’s About Consuming Better and Consuming Less

Right now, these KPIs will be financially motivated, and rightly so. But there will come a time when progressive organizations will put their environmental impact at the forefront of their mission statement.

The B-Corp certification, which evaluates companies in terms of their social and environmental performance, grew 63% in 2022. This shows the trend toward moving to a more inclusive and sustainable economy. Partly because it’s in the interest of the businesses’ long-term success and reducing costs, but partly because it is simply the right thing to do.

August 25, 2023