devopsy.kinsta.cloud

Tag: open source

  • CNCF Elevates SPIFFE Spec to Secure App Services

    CNCF Elevates SPIFFE Spec to Secure App Services

    The Technical Oversight Committee (TOC) of the Cloud Native Computing Foundation (CNCF) announced that the open source Secure Production Identity Framework For Everyone (SPIFFE) specification and the SPIFFE Runtime Environment (SPIRE) have become incubation-level hosted projects.

    Andrew Harding, SPIRE maintainer and a principal software engineer at Hewlett Packard Enterprise (HPE), said the elevation of a potential standard to authenticate software services using cryptographic identities that are platform-agnostic could go a long way toward advancing the adoption of best DevSecOps practices.

    At the core of SPIFFE specification are short-lived cryptographic identity documents known as SVIDs that are invoked via an application programming interface (API). Workloads employ an SVID when authenticating to other workloads by establishing a TLS connection or by signing and verifying a JSON web token (JWT).

    Previously a sandbox level project, the SPIFFE specification is designed to reduce reliance on hard-coded secrets to authenticate application services, Harding said. Instead, developers will be able to more easily invoke multi-factor authentication to issue and verify identities for any type of application service. Each service is given its own identity, he noted.

    Amazon, Bloomberg, Google, HPE, Pinterest, Square, TransferWise and Uber are all contributors to SPIFFE. Since joining the CNCF last year contributors to SPIRE have added support for Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, Kubernetes and bare-metal servers.

    SPIFFE and SPIRE are designed to work across both monolithic and microservices-based applications. The latter are not likely to completely replace the former anytime soon, so IT organizations need a consistent approach to authentication regardless of how an application is built, noted Harding. SPIFFE and SPIRE together enable an IT organization to implement a zero-trust architecture spanning multiple applications, he said.

    Ultimately, Harding said the goal is to enable better application security without compromising flexibility. As an added benefit, SPIFFE and SPIRE don’t require developers to share application secrets to enable interoperability between services running on different platforms. That’s because SPIRE doesn’t generate SPIFFE identities that can be used to authenticate to other systems nor does it store existing keys such as a database password on behalf of a workload. Each SVID generated is unique to the service use case.

    As the number of services and platforms being employed continues to increase, it’s not practical to continue to rely on approaches to authentication that rely on hard coding. The level of dependency that exists between services requires a more frictionless approach to authentication.

    It may be a very long time before reliance on tokens such as passwords disappear. However, it’s clear specifications such as SPIFFE, in the long run, will transform application security. The challenge now is not only getting developers to appreciate a new approach but also convincing skeptical cybersecurity teams that long have relied on some form of hard or soft token to secure applications. Given the number of times those tokens are misplaced or lost, there are more than a few IT help desk professionals wishing tokens would become obsolete sooner than later.

  • HashiCorp Unfurls Cloud Platform for Managed Services

    HashiCorp today at its online HashiConf Digital event launched HashiCorp Cloud Platform (HCP), through which it intends to make all of its software available as a fully managed service.

    At the same time, HashiCorp announced a public beta of an update to HashiCorp Terraform, a curated instance of an open source tool for configuring IT infrastructure that adds additional workflow capabilities.

    Finally, an update to Nomad, a cluster manager and scheduler for containerized application environments, adds support for multiple clusters as well as the Container Network Interface (CNI) specification defined by the Cloud Native Computing Foundation (CNCF).

    Rob Genova, director of product marketing for cloud services at HashiCorp, said although the company previously made some of its offering available as a managed service, HCP will serve as a foundation on which HashiCorp will manage updates to its software on behalf of end customers.

    The first managed service on HCP, now available in private beta, is an instance of the Consul service mesh deployed on Amazon Web Services (AWS), which will be followed by an instance of Vault, secrets management software developed HashiCorp, that will also be deployed on AWS.

    At the core of HCP is a HashiCorp Virtual Network (HVN), which offers a common abstraction across cloud providers around an isolated single-tenant network. Each HVN can have multiple services deployed within it. In the future, HashiCorp is promising HVN will enable peering across cloud providers and cross-provider clustering of its software. Support for additional cloud services will be added based on customer demand, added Genova.

    HCP will be offered on a pay-as-you-go pricing model to minimize upfront costs, which Genova said should make Consul and other HCP services more accessible to smaller teams and organizations. Costs will increase only when workloads scale. Both development and production pricing options will be made available, he said.

    HashiCorp already provides access to hosted instances of Consul and Terraform, which it will continue to offer alongside HCP, Genova added.

    Genova said it’s become apparent more organizations would prefer to have HashiCorp manage Consul, Vault, Terraform and Nomad on their behalf. At a time when many organizations have limited IT resources, Genova said many organizations want to devote the bulk of their limited internal resources to building and deploying applications rather than the infrastructure required to maintain them.

    It’s not clear how many organizations will opt to rely more on managed services in the wake of the economic downturn brought on by the COVID-19 pandemic. At a time when many organizations are either reducing or freezing headcount, all options are being considered. Many internal IT teams may occasionally employ a managed service to extend their own capabilities. In other cases, developers may bypass an IT operations team altogether.

    In the wake of the pandemic, Genova noted more organizations simply want to deploy resources in the cloud to ensure availability while gaining increased flexibility.

    Regardless of the path chosen, the days when IT teams felt more compelled to do everything themselves are, for better or worse, changing utterly.

  • CD Foundation Touts Spinnaker CD Progress

    CD Foundation Touts Spinnaker CD Progress

    At an online Spinnaker Live event today, the Continuous Delivery (CD) Foundation revealed the open source CD platform is gaining significant momentum since being contributed by Netflix late last year.

    There were on average 842 merged pull Spinnaker requests a month in the first quarter of 2020. A total of 1,183 contributors participated in the project in the last year, with 40% of those contributors participating in the first quarter. Since the first quarter, the project has added at least two new contributors a week.

    Rosalind Benoit, chair of the CD Foundation Outreach Committee and director of community at Armory, a provider of an enterprise edition of Spinnaker, said the bulk of the increased contributions to Spinnaker are coming from Amazon Web Services (AWS), which the cloud service provider is already employing to orchestrate software delivery across multiple platforms.

    Benoit said Spinnaker represents an effort to finally address CD issues that have been difficult for most organizations to solve. While continuous integration (CI) is a solved problem, Benoit says CD remains problematic. Each platform code is deployed on within enterprise IT environments is a snowflake; as such, not much progress has been made toward automating the delivery of code across different platforms, said Benoit.

    The goal for Spinnaker is to create a foundation for CD that will achieve groundswell support that was achieved for Kubernetes by the Cloud Native Computing Foundation (CNCF), she noted. Both the CD Foundation and CNCF are arms of the Linux Foundation.

    Last year, the CD Foundation was launched to advance development and adoption of Spinnaker alongside Jenkins, an open source CI/CD platform; Jenkins X, an opinionated open source CI/CD platform for Kubernetes; and Tekton, an open source project and specification for creating CI/CD components.

    While many DevOps teams have attempted to address CD challenges using Jenkins, progress has been uneven at best. Spinnaker was built by Netflix specifically to automate software delivery across multiple clouds using a framework that can be integrated with any CI tool. As such, it serves to provide a clearer line between where CI ends and CD begins.

    Historically, most application code is pushed from a CI tool out to a deployment platform. As Spinnaker and other cloud-native platforms such as Kubernetes continue to evolve, the process of pulling images from CI tools to achieve CD goals will become much more automated.

    It’s not clear just how much depth of support for Spinnaker there is among providers of DevOps platforms. Members of the CD Foundation in addition to Armory include CloudBees, CircleCI, Google, Huawei, IBM, JFrog, Netflix, GitLab, Harness, Puppet, Rancher Labs, Red Hat, SAP and Sysdig. AWS has yet to formally join the CD Foundation. However, few of these vendors have detailed how they intend to incorporate Spinnaker in their respective platforms.

    In the meantime, DevOps teams should be paying close attention to how best CD practices will evolve alongside existing CI processes because it’s clear the next major phase of their continuing DevOps adventure is only now just beginning.

  • DataStax Brings AIOps to Cassandra Database Management

    DataStax Brings AIOps to Cassandra Database Management

    DataStax today unveiled a private beta release of artificial intelligence tool dubbed Vector that provides advice on how to optimize clusters running the open source Cassandra wide column store database.

    Vector analyzes individual nodes and then compares behavior to other nodes in the cluster to identify opportunities to improve deployments.

    Ed Anuff, chief product officer for DataStax, said the goal is to enable IT teams to take advantage of AIOps for things such as improving performance and query techniques.

    Available for both instances of Cassandra downloaded by IT teams as well as the curated instance of Cassandra that DataStax makes available as DataStax Enterprise, Vector is intended to augment rather than replace IT teams managing Cassandra databases, said Anuff.

    Anuff said by employing algorithms and heuristics, Vector provides IT teams with predictive guidance, which they can determine whether to implement or not.

    As IT becomes more complex the need to rely on AIOps tools such as Vector is becoming more pronounced. The number of variables that could adversely impact the performance of applications deployed on Cassandra or any other database exceeds the ability of most IT teams to monitor manually. AIOps tools such as Vector essentially provide IT teams with a digital assistant to help optimize database deployments.

    Anuff said there will always be a need for a human to be in the loop, but each IT organization will determine the degree it trusts the recommendations being surfaced by AIOps tools such as Vector. In some cases, IT teams will use those recommendations to inform frameworks to automate the management of databases.

    Given the commitment to ruthless automation by IT organizations that have embraced DevOps, Anuff said DataStax expects DevOps teams to be at the forefront of embracing AIOps. In many cases, those DevOps teams have already assumed management responsibilities for both applications and the underlying databases on which they depend.

    Of course, AIOps is still in its infancy. However, in the wake of the economic downturn brought on by the COVID-19 pandemic interest in AIOps as a means to reduce the total cost of IT is rising. Many IT teams are becoming smaller as organizations downsize, while others are limiting headcount. AIOps provides a way to manage IT at scale without necessarily having to expand the size of the current IT staff.

    Regardless of the motivation, AIOps is here to stay. Many of the rote tasks that conspire to turn IT into drudgery should soon be eliminated. That may reduce the number of entry-level jobs that historically have been available. However, as schools adjust to this new reality, it may also mean that new entrants into the field may be able to take on more complex challenges sooner than later.

    In the meantime, IT professionals might want to consider what part of their job might be better handled by a machine and plan the next step in their careers accordingly.

  • The Linux Foundation Adds Free Jenkins Training Course

    The Linux Foundation Adds Free Jenkins Training Course

    The Linux Foundation, in collaboration with the Continuous Delivery Foundation (CDF), today launched a free introductory course to the open source Jenkins continuous integration/continuous delivery (CI/CD) platform as part of what it plans will become a series of free and paid online DevOps tools courses.

    Clyde Seepersad, general manager of training at the Linux Foundation, said that while the foundation already provides access to some higher-level conceptual DevOps courses, the launch of the CDF last year provides a knowledge base from which the Linux Foundation can now provide online courses specific to DevOps tools. The CDF is an arm of The Linux Foundation.

    The Linux Foundation will also provide courses on Spinnaker, a CD platform, and other DevOps tools that, along with Jenkins, are now being developed under the auspices of the CDF, he added.

    In general, Seepersad said demand for DevOps expertise is increasing as organizations more aggressively embrace digital business transformation initiatives in the wake of the COVID-19 pandemic. At the same time, IT teams are adopting a wider range of cloud-native technologies to build more flexible and resilient applications. DevOps platforms such as Jenkins make it possible for IT teams to build those applications faster.

    The challenge many organizations underestimate is the extent of changes to their internal IT culture required to make that transition, Seepersad said—too many organizations still put tools into the hands of developers without really thinking through the workflow issues between developers and IT operations teams.

    The most important thing for any organization to do, he said, is to make sure there is an open DevOps dialogue versus tiptoeing around issues that will tend to increase resistance only further.

    Ultimately, free training should help expand the overall size of the DevOps community at a time when many IT professionals are trying to increase their skills. DevOps professionals not only command higher salaries, but they are also less likely to be laid off. DevOps teams oversee the development and deployment of applications and can also programmatically manage levels of infrastructure that IT administrators relying on traditional graphical user interface (GUI) tools can’t match. That’s a critical issue when many IT organizations these days are trying to do a lot more with even less.

    There’s nothing quite like an economic crisis to focus everyone’s mind. The biggest DevOps challenge any organization typically faces is overcoming inertia. Too many IT professionals have relatively narrow skillsets that conspire to increase the total size of the IT organization. In addition to relying on increased levels of automation to reduce costs, IT leaders want to be able to scale IT environments without having to increase headcount.

    It may take a little while longer for the transition to DevOps to fully play out. However, it’s now more of a question of existential survival rather than if or even to what degree to embrace DevOps. Organizations that don’t embrace DevOps processes to ruthlessly automate the management of IT now might very well never get another chance.

  • MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB Inc. and Storj Labs announced today they have jointly created a backup service for the open source MongoDB database that leverages a global network for excess storage capacity.

    Storj Labs has created a Tardigrade Decentralized Cloud Storage Service based on an open source object storage system that is compatible with the S3 application programming interface (API) defined by Amazon Web Services (AWS). That object storage system distributes 80 slices of a file across a subset of thousands of nodes that each contain only a slice of the data required to reconstruct that file when needed. Only 29 of those slices are needed to reconstruct a file, which enables IT teams to secure data without having to manage encryption keys.

    Via a connector from Storj Labs, the Tardigrade Decentralized Cloud Storage Service now can be invoked via MongoDB DevOps Manager, which is made available in the commercially supported enterprise edition of the open source databases provided by MongoDB Inc.

    Storj Labs CEO Ben Golub said the Tardigrade Decentralized Cloud Storage Service provides a less expensive alternative to backup and recovery platforms based on the cloud, as excess capacity on devices ranging from servers to individual desktops is readily available, The challenge has been finding a way to marshal all that excess capacity in a way that makes it simple for IT organizations to consume, he said.

    IT organizations, Golub said, should expect Storj Labs to build additional connectors to databases and other platforms that require a less expensive approach to data protection. In the wake of the economic downturn brought on by the COVID-19 pandemic, he noted, more organizations than ever are open to innovative approaches to reducing storage costs.

    Of course, most IT teams are well-used to employing a range of data protection platforms to back up and recover data. The Tardigrade Decentralized Cloud Storage Service is likely to be viewed as one more option that might find traction at a time when the number and types of databases being deployed across the enterprise continue to expand rapidly. Developers are especially fond of adopting open source document databases that don’t require a database administrator (DBA) to get approval for a license from a central purchasing organization. It’s usually not too long, however, before developers look for help from central IT to manage all those databases, especially after an application is deployed in a production environment.

    Naturally, not all those applications are of equal value, so given the current economic climate, there might be a greater willingness to at the very least experiment with alternative approaches to data protection.

    Regardless of platform, however, the one thing that is clear is data protection alongside the rest of IT infrastructure is being driven more by APIs. As such, responsibility for data protection is also being pushed further left toward DevOps teams, who have the expertise required to continuously automate back up and recover using APIs. That might not always sit well with traditional IT administrators who have been using tools based on graphical user interfaces (GUIs) for decades. Nevertheless, IT times are clearly changing.

  • Hasura Launches Beta of GraphQL-Based Remote Joins Tool

    Hasura Launches Beta of GraphQL-Based Remote Joins Tool

    Hasura today announced the public beta of Remote Joins, which makes use of an open source GraphQL query language for application programming interfaces (API) to join disparate data sources residing in different repositories.

    Company CEO Tanmai Gopal said Remote Joins extends a GraphQL engine the company has developed around a project that is now hosted by the GraphQL Foundation, an arm of the Linux Foundation. The GraphQL Foundation counts among its members Airbnb, Amazon Web Services (AWS), Apollo, Coursera, Elementl, Facebook, GitHub, IBM, Intuit Hasura, Paypal, Prisma, Shopify and Twitter.

    Originally developed by Facebook, GraphQL has emerged as the basis for a more streamlined alternative to REST APIs. GraphQL provides a complete description of the data made available via an API and is organized in terms of types and fields rather than traditional endpoints. In addition to making it more clear what data is available via that API, developers can employ types to avoid writing manual parsing code.

    Hasura is now taking that concept a step further by enabling IT organizations to join data residing in different databases and microservices to enable that data to be queried as if it were a single data source. The core Hasura engine automatically generates the GraphQL engine, which enables those remote joins to be created in a few minutes.

    Gopal said joining data across a complex portfolio of modern applications based on microservices and legacy monolithic applications is becoming increasingly difficult as the number of microservices in an IT environment continues to proliferate. The Hasura engine addresses that issue by providing data access and flow tool base on a GraphQL type system for managing APIs that can be applied to GraphQL APIs as well as REST APIs or other protocols, he said.

    The join, authorization logic and consistency checks are all managed by the Hasura engine. Hasura also provides data change management, observability, auditing, security and performance management capabilities. That approach makes it possible for data sources and APIs to evolve independently while still allowing organizations to query data flexibly, noted Gopal.

    As DevOps and DataOps processes continue to converge, IT organizations will need to find a way to advance application and API development in a way that doesn’t result in data access becoming a major bottleneck. Too many DevOps teams are rapidly building applications and APIs only to find themselves waiting to be given access to data. GraphQL could provide a foundation on which IT teams can manage DevOps and DataOps processes more collaboratively.

    It’s not likely IT teams will be replacing existing REST APIs wholesale overnight. However, it’s also apparent that REST APIs may not enable IT environments to scale as efficiently as GraphQL, which is the primary reason why Facebook developed it. Of course, it’s still early days as far adoption of GraphQL is concerned. However, with more IT teams under pressure to innovate faster, interest in a more streamlined approach to building and managing APIs is likely to gain additional momentum.

  • AWS Looks to Accelerate Windows Migrations to the Cloud

    AWS Looks to Accelerate Windows Migrations to the Cloud

    Amazon Web Services (AWS) is ratcheting up pressure on Microsoft by devoting more resources to enable IT organizations to migrate Windows workloads to the cloud.

    Fred Wurden, general manager for enterprise engineering at AWS, said a Migration Acceleration Program (MAP) for Windows, now generally available, provides IT teams with prescriptive guidance, consulting support, tools, training and service credits to help reduce the risk and cost of migrating to the cloud.

    The service is being delivered in collaboration with partners including Rackspace, 2nd Watch, Accenture, Cloudreach, Enimbos Global Services, Onica and Slalom. Wurden said AWS has been migrating Windows workloads to the cloud for more than a decade now and claims to have more than half of all Windows workloads deployed in the cloud.

    Microsoft has clearly been making strides in recent years to close the gap between it and AWS by running both Windows and Linux workloads on its cloud alongside instances of Microsoft Office 365. Microsoft most recently reported a 39% year-over-year growth in commercial cloud revenue, reaching $13.3 billion for its fiscal third quarter. However, Microsoft does not break out Azure revenue from Microsoft Office 365 revenue or disclose what percentage of the workloads running on Azure is based on Windows versus Linux.

    At the same time, Microsoft now charges more for instances of SQL Server that run on other clouds. AWS contends that decision will only accelerate the rate at which organizations are transitioning to open source databases deployed on Windows or Linux.

    Competition for Windows workloads is growing in ferocity in the wake of the COVID-19 pandemic because more workloads are being lifted and shifted into the cloud as organizations realize that on-premises IT environments can be rendered inaccessible. IT staffs in many geographies will be working from home at least through the end of the year. Many organizations are also moving workloads to the cloud in anticipation of a second potential outbreak of the pandemic.

    At the same time, the rate at which new workloads are being deployed in the cloud is also accelerating. Many of those cloud-native workloads are based on containers running on Kubernetes. Support for containers on Windows platforms is still relatively nascent when compared to Linux platforms.

    AWS and Microsoft, along with a host of rival cloud service providers, are focusing on legacy workloads because the expectation is that monolithic workloads running on Windows will be re-engineered to run as a set of microservices that can be updated more flexibly within the context of a larger digital business transformation initiative. It may be a while before that transformation fully manifests; however, it’s clear the battle for control over millions of workloads in anticipation of that transition is reaching a higher level of intensity.

    There’s no doubt many of those workloads will run on the Microsoft Azure cloud. However, the degree to which Microsoft might be winning in the cloud era may not be as great when everything that is being lost to AWS and other cloud service providers is taken into consideration.

  • Cisco Acquires ThousandEyes to Advance Network Visibility

    Cisco Acquires ThousandEyes to Advance Network Visibility

    Cisco Systems this week announced its intent to acquire ThousandEyes, provider of an internet monitoring platform that Cisco plans to leverage to embed ThousandEyes agent software into a range of devices including network routers and switches, security tools and application performance management (APM) software from AppDynamics.

    As part of that effort, ThousandEyes will become the foundation of a newly formed Networking Services business unit in Cisco led by ThousandEyes CEO Mohit Lad. The terms of the acquisition were not disclosed.

    Todd Nightingale, senior vice president and general manager for enterprise, networking and cloud at Cisco, said the goal is to employ the data collected by ThousandEyes agent software to drive intent-based automation across the entire IT environment.

    ThousandEyes provides a networking intelligence service by deploying its software on points of presence across the internet. The data collected is then fed back to data centers operated by ThousandEyes to help organizations understand why, for example, a particular software-as-a-service (SaaS) application is performing suboptimally in one geographic region versus another.

    Nightingale said with multi-cloud computing now becoming a reality in the enterprise, the need for that level of insight into what are becoming highly distributed computing environments has dramatically increased.

    Once the deal closes, it may take Cisco a while before it can embed agent software from ThousandEyes across its portfolio. However, DevOps teams that deploy applications in IT environments with Cisco networking equipment should be able to troubleshoot applications more easily once the agent software from ThousandEyes is embedded in Cisco networking hardware and software.

    At the same time, Cisco will be feeding that data into AppDynamics, the application performance management (APM) platform it acquired in 2017. The AppDymanics platform is employed mainly by cloud operations teams to optimize the performance of applications deployed on various cloud computing platforms, noted Nightingale.

    Lad said by becoming part of Cisco, ThousandEyes will become the central nervous system through which organizations will be driving user experiences.

    Less clear at the moment is to what degree open source networking software initiatives may have on Cisco’s long-term ambitions. Open source agent software is now being widely deployed to instrument applications that in turn feed metrics back to a wide variety of platforms, including AppDynamics. It’s not only a matter of time before various open source initiatives extend agent software to the networking level.

    Regardless of that approach, DevOps teams should be able to count on attaining deeper insights into how network congestion is impacting application performance. As that analytics data becomes more accessible, it should become more feasible to dynamically reroute application traffic to maintain service levels.

    In the meantime, network operations and DevOps teams will continue to move closer together. The NetOps team may not necessarily be completed folded into DevOps. However, as networking becomes more programmable, it’s apparent DevOps teams will be exercising more programmatic control over networking services. The challenge and the opportunity now are to find a way to bring those disparate cultures together to minimize the inevitable friction that will ensue.

  • GitLab Releases Massive Update to CI/CD Platform

    GitLab Releases Massive Update to CI/CD Platform

    GitLab has updated its continuous integration/continuous delivery (CI/CD) platform with a raft of capabilities spanning everything from value stream management to cybersecurity.

    In addition, GitLab announced it is making generally available Gitaly Clusters, which enable DevOps teams to create a warm replica of a Git repository.

    Brendan O’Leary, senior developer evangelist at GitLab, said with release 13 GitLab continues to build on a single code base that allows the platform to be managed and accessed as an integrated set of applications rather than disparate components that DevOps teams need to pull together and then manage.

    In terms of core DevOps capabilities, the latest release adds the ability to customize the Value Stream Analytics module to specific workflows. GitLab is also planning to make it possible to visualize stages of a workflow.

    GitLab is also improving traceability between requirements and has added the ability to visualize the workflow associated with a specific release. A future release will enable DevOps teams to employ feature flags to conduct both A/B testing based as well as create feature flags from merge requests and to filter feature flags by status, according to the company.

    Other capabilities added include more customizable dashboards, with security dashboards now being shareable outside of GitLab to foster collaboration with IT security teams. Future releases will add Kubernetes Clusters to the dashboard to show all clusters and pods in use.

    DevOps teams now can route existing monitoring alerts to GitLab for triage and incident resolution. At the same time, GitLab has moved design management to the core platform.

    GitLab is also now making AutoDevOps, which provides pre-defined CI/CD pipelines, available on Amazon Web Services (AWS).

    In terms of cybersecurity, GitLab has revamped the way the platform manages vulnerabilities to make it easier in a future update to prioritize remediation efforts.

    GitLab also has static application security testing (SAST) support for .NET frameworks and has expanded support for offline environments. There’s also now support for dynamic application security testing (DAST) for REST application programming interfaces (APIs) and access to full commit history scan for secrets. Fuzz testing support will be introduced later this year, according to the company, along with an ability to secure secrets across services. GitLab also plans to add integration with security tools that track container behavior analytics, as well as an out-of-the-box container network policy.

    Thanks to GitLab’s collaboration with Okta, there is now also tighter integration with Okta’s System for Cross-domain Identity Management, which can be provisioned for a GitLab group.

    In terms of compliance, GitLab also plans to enable DevOps teams to establish a compliance framework, adopt its regulatory controls and simplify audit reporting. The company is also working on an initial security policy user interface to simplify setting up security guardrails.

    Finally, GitLab has become a Common Vulnerabilities and Exposures (CVE) ID Numbering Authority (CNA). GitLab users can request a CVE from GitLab, either for GitLab itself or for any project hosted on GitLab.com. In the future, users can request CVE IDs directly from within GitLab.

    O’Leary said GitLab is working toward increasing developer confidence in their security skills. By making it easier to embrace best DevOps practices, developers no longer will have to tiptoe around security issues that they today largely have little to no familiarity with, he said.

    In general, O’Leary said GitLab’s biggest challenge is getting organizations to move beyond simply using it to manage source code. Once organizations do make their first foray beyond source code management, however, it’s not too long before they are employing a wide range of modules, he noted.

    Of course, encouraging organizations to dive deeper DevOps has as much to do with the culture of the organization as it does the capabilities of the CI/CD platform employed.