Tag: managed DevOps

  • 2nd Watch Allies With GitLab for Managed DevOps Service

    2nd Watch Allies With GitLab for Managed DevOps Service

    2nd Watch today launched a managed DevOps service based on the continuous integration/continuous deployment (CI/CD) platform from GitLab that it will operate on behalf of customers in addition to coaching them on how to adopt best DevOps practices.

    Stefana Muller, a senior product manager, said the 2nd Watch Managed DevOps service combines the managed and professional services capabilities of 2nd Watch into a single offering. That approach is required because when it comes to DevOps most organizations need as much help transitioning their culture as they will operating their CI/CD environment, she said.

    One of the major challenges organizations face when trying to embrace DevOps is they typically spend a lot of money upfront only to see those efforts flounder when changing the internal culture of the organization becomes too difficult, Muller said. As part of an effort to smooth that transition, 2nd Watch DevOps experts will assess an organization’s readiness to adopt DevOps tools and processes and then train internal teams on DevOps fundamentals such as managing infrastructure as code and Git principles. The assessment is based on a Culture, Automation, Lean Practices, Measurement and Sharing (CALMS) methodology.

    The 2nd Watch service is built around an on-premises edition of the GitLab CI/CD platform that it will host and upgrade on behalf of a customer on either an Amazon Web Services (AWS) or Microsoft public cloud platform. The DevOps service will focus on enabling organizations to build both monolithic and microservices-based applications faster because no organization today has fully transitioned to microservices. The company already provides a managed Kubernetes service for building and deploying applications based on a microservices architecture.

    2nd Watch chose to partner with GitLab because of the completeness of that CI/CD platform, which among other things includes integrated security modules that can be employed to advance DevSecOps practices as well, Muller said, noting that longer-term, 2nd Watch is planning to layer a more robust set of managed DevSecOps services on top of the GitLab platform.

    Managed DevOps offerings are starting to proliferate as the number of services providers that have attained certifications from multiple IT vendors has increased. It’s not clear to what degree organizations will prefer to rely on these services just yet. However, it’s is apparent many organizations are trying to shift as much of their limited resources to building application code versus managing IT infrastructure. It’s also possible that as the COVID-19 coronavirus pandemic becomes more widespread many organizations will need to rely on external service providers to manage their DevOps environments.

    Regardless of the motivation, organizations that are at the beginning of their DevOps journey clearly will need more help than those that are further along the DevOps maturity curve. The decision most organizations will need to make is to what degree will they rely on a managed DevOps service to accelerate their transition versus opting to rely permanently on an external IT service provider to manage one of their most critical IT environments.

    — Mike Vizard

  • Cybersecurity Fears May Drive Shift to Managed DevOps

    Cybersecurity Fears May Drive Shift to Managed DevOps

    Should organizations consider using a managed service for DevOps to keep their platforms up to date and secure?

    The recent disclosure of a vulnerability that would allow open source Jenkins continuous integration/continuous delivery (CI/CD) platforms to be employed to launch a distributed denial of service (DDoS) attack highlights how challenging it is to secure the platforms on which many organizations now depend to build their most critical applications.

    The CVE-2020-2100 bug theoretically would have allowed cybercriminals to employ the Jenkins UDP discovery protocol to bounce traffic between servers until they could no longer respond. That same flaw also could be employed to launch DDoS amplification attacks against platforms connected to the internet. Those attacks can’t be stopped unless one of the servers is rebooted or its Jenkins service is restarted. The specific vulnerability discovered was fixed last month in Jenkins v2.219. IT organizations can either upgrade their Jenkins servers, disable the UDP discovery protocol or block the UDP port 33848.

    Tracy Miranda, director of open source community for CloudBees and member of the governing board for the Continuous Delivery Foundation (CDF), which oversees the development of Jenkins, said the bug itself is at best of medium severity. However, now that it’s been disclosed, the race is on to patch Jenkins servers or block UDP port 33848 before cybercriminals exploit the vulnerability on any public-facing instance of a Jenkins server.

    Given the fact that most IT organizations may not have resources at hand to patch their Jenkins servers quickly, Miranda said these and other potential future cybersecurity issues are a testament to why more organizations should rely on instances of Jenkins that are managed by third-party providers on their behalf. Organizations are spinning up more Jenkins servers than ever as they move to accelerate application development, and by relying on a managed service provider (MSP) to manage Jenkins, IT teams can focus more of their efforts on building and deploying applications rather than on managing CI/CD platforms.

    These days, more organizations are looking at DevSecOps as a best practice. Much of that focus, however, is on securing the applications that DevOps teams create; not nearly as much attention is being paid to securing the underlying platforms on which those applications are being built and deployed.

    It’s too early to say to what degree cybersecurity concerns might push IT organizations toward managed DevOps platforms. However, the more that cybersecurity teams participate in the DevOps process, the more they will ask questions about the fundamental security of the underlying platform.

    Of course, many IT teams often view managed services provided by third-party vendors as a threat to their existence. Nevertheless, DevOps platforms are among the most complex and expensive platforms to manage. In fact, that complexity is one of the main reasons so many organizations have hired site reliability engineers rather than relied on traditional IT administrators to manage DevOps platforms such as Jenkins. The issue that often comes up is just how many SREs an organization needs to hire before the cost of a managed DevOps platform becomes economically more appealing.

    — Mike Vizard

  • Eficode Adds Analytics to Managed DevOps Service

    Eficode Adds Analytics to Managed DevOps Service

    Eficode has added an analytics module to a DevOps platform it makes available as a managed service.

    Tuomas Keränen, product manager for Eficode ROOT, said Eficode ROOT Insights provides different types of end users with access to an analytics module designed to make it easier to understand how changes to a software development project will impact delivery timetables. To make that capability more accessible throughout the organization, Eficode has created dashboards for specific types of end users such as project managers.

    Eficode has crafted a DevOps platform from various tools and platforms to create a toolchain based on best practices it has defined that the company then manages on behalf of end customers. Organizations can choose to have that DevOps platform hosted on-premises or in a public cloud. That approach frees organizations to devote more time and resources to building applications versus managing the DevOps platforms, said Keränen. Eficode ROOT Insights is provided as a complement software-as-a-service (SaaS) application.

    As DevOps continues to evolve, it’s apparent that an alternative approach that relies on external IT service providers to manage the underlying platforms is gaining traction. Many IT organizations simply don’t have the expertise required to build and maintain a DevOps platform. The trade-off is that the best practices are defined by the external service provider, which means the IT organization needs to bend its culture to align with those best practices.

    Another factor that potentially will push organizations toward managed DevOps services is analytics. As the amount of data that needs to be collected to drive analytics applications steadily increases, it becomes apparent that DevOps analytics applications are going to be invoked more easily as SaaS applications. Once an IT organization moves down that path, it’s not too long before the case is made for using the analytics platform to also host the DevOps platform. In addition, as machine learning algorithms and other forms of artificial intelligence (AI) are applied to DevOps, the volume of data required to drive an AI model may require an organization to rely more on external service providers to provide that expertise.

    It’s not at all clear how many organizations may prefer a managed service approach to DevOps. Many of the earlier adopters of DevOps have built custom workflows that are designed specifically to optimize their software development life cycle. However, the adoption of DevOps has been uneven at best. As managed DevOps services proliferate, the number of organizations that can effectively embrace DevOps should increase significantly.

    Of course, managing the tension between internal and external IT service providers is nothing new. However, given the complexity of DevOps processes, relying on a managed service requires a level of collaboration that is not easy to achieve. Just as importantly, once an organization decides to partner with a provider of a managed DevOps service, unraveling that relationship later may prove to be all but impossible.

    — Mike Vizard