devopsy.kinsta.cloud

Tag: google

  • Google Adds GenAI Tool to Automate DevOps Workflows

    Google Adds GenAI Tool to Automate DevOps Workflows

    Google this week added a generative artificial intelligence (AI) tool dubbed Gemini Cloud Assist to automate a wider range of tasks across the software development lifecycle, including troubleshooting applications running on the Google Cloud Platform (GCP) to surface recommendations to improve performance and enhance security.

    Announced at the Google Cloud Next ’24 conference, Gemini Cloud Assist is integrated with an existing publish and subscribe capability to enable DevOps teams to launch generative AI prompts to automate tasks that previously would have required them to develop a script. Gemini Cloud Assist can also generate architecture configurations based on the code being deployed.

    At the same time, Google is making available via a private preview an update to Gemini Code Assist tool to generate code that has been trained on a large language model based on one million tokens.

    Brad Calder, vice president and general manager for GCP and technical infrastructure told conference attendees that version 1.5 of Gemini Code Assist will now generate code based on the largest LLM trained using code vetted by Google to generate more reliable outputs.

    The challenge going forward will be determining where the line between generative AI tools provided by a cloud service provider such as Google leaves off and where the generative AI tools provided by Google partners such as GitLab begins.

    GitLab has been working closely with Google to develop its Duo AI capabilities using core services that Google makes available via its Vertex platform for managing machine learning operations (MLOps).

    David DeSanto, chief product officer for GitLab, said as AI continues to be applied to DevSecOps workflows the routing capabilities developed by GitLab will make it simpler to orchestrate prompts that can be applied to multiple LLMs. That approach provides a layer of abstraction from the underlying LLMs that makes it simpler to swap out as new capabilities are added, he noted. Most DevOps teams are not going to need to access an LLM directly because the natural language prompts they create will be executed by the underlying platform, DeSanto added.

    It’s not clear to what degree AI is capable of automating DevSecOps workflows, but as the reasoning engines embedded in LLMs become more advanced, the ability of these platforms to automate manual tasks is only going to increase. As those manual tasks are eliminated, developer productivity should substantially increase because much less time will, for example, be needed to spin up a remote development environment.

    Rather than tracking outdated metrics such as the amount of code generated, however, IT leaders should be focused on the rate at which test failures are declining as the quality of code being written steadily improves, said DeSanto. Too many developers are spending the bulk of their time trying to get code that runs on their laptop to execute in production environments, he noted.
    In addition, it will become a lot easier to onboard new members to a software engineering team as, for example, summarizations of how existing code works become readily available, said DeSanto.

    Ultimately, the number of applications any DevOps team can build, deploy and manage is about to substantially increase in a way that doesn’t require IT organizations to add a small army of software engineers to build, deploy, manage and secure.

  • Cycode Discloses GitHub Actions Vulnerability in Google Bazel Project

    Cycode Discloses GitHub Actions Vulnerability in Google Bazel Project

    Cycode today revealed it discovered a command injection vulnerability in the way the GitHub Actions continuous integration/continuous delivery (CI/CD) platform was used to update the open source Bazel project that many organizations employ to build and test software.

    The vulnerability, now remediated, could have been used to create a backdoor through which malicious code could have been inserted into a codebase that is managed by Google.

    Cycode researchers shared their discovery with Google, which has since updated the way it employs GitHub Actions to manage the Bazel codebase. Specifically, Google updated the base permissions to embrace least privilege principles to resolve the vulnerability discovered by Cycode.

    The vulnerability was discovered using RAVEN, an open source tool for scanning CI/CD platforms for vulnerabilities that Cycode makes available.

    Elad Pticha, senior security researcher for Cycode, said the vulnerability is the latest example of an instance of an open repository for building software that has been shown to be potentially vulnerable to an attack on a software supply chain that could theoretically impact any number of downstream applications and projects, including Kubernetes, Angular and platforms and services provided by Uber and LinkedIn.

    A Custom Actions capability that enables application development teams to create their own workflows presents any cybercriminal attempting to compromise of software supply chain with a tempting target, noted Pticha. A few changes to lines of code in a workflow can translate into thousands or even millions of lines of code, many of which an organization may never detect. Out of 3.4 million workflows examined by Cycode, nearly all (99%) make use of one or more Custom Action.

    Cycode has previously identified dozens of vulnerabilities in open source projects by mainly focusing on vulnerabilities within workflows. This latest research shows those vulnerabilities extend to indirect dependencies, such as Custom Actions, noted Pticha.

    Each DevOps team should review its own workflows for similar vulnerabilities at a time when more cybercriminals than ever are intent on compromising software supply chains. While many organizations have embraced DevSecOps workflows to improve application security, there is a natural tendency to overlook vulnerabilities that might exist in the workflows used to build and deploy software. The challenge is that DevSecOps workflows are still immature. A recent survey of 500 U.S. CISOs, AppSec directors and DevSecOps team members conducted by Cycode found 78% admitted application security attack surfaces are unmanageable, with 90% acknowledging relationships between their security and development teams need to improve.

    It’s not apparent if the vulnerability discovered by Cycode was actually ever exploited, but as most cybersecurity professionals know, if it can be imagined, someone has tried it. As such, any organization that uses Bazel might be well-advised to conduct a code review.

    In the meantime, it’s already apparent that regulations pertaining to securing software supply chains are only going to become more stringent in the months ahead. In the wake of the executive order from the Biden administration requiring federal agencies to lock down their software supply chains, it’s now only a matter of time before similar requirements are baked into legislation and various other regulations are implemented. The challenge and the opportunity now is to get ahead of this issue before a mandate with a hard deadline that can’t be ignored winds up disrupting the entire software development life cycle.