staging-devopsy.kinsta.cloud

Category: DevOps Toolbox

  • Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Raspberry Pi 5: Faster, Better, Stronger — Spendier

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    In a cheeky extra post this week: Everyone’s favorite single-board ARM computer, the Raspberry Pi, has a new generation coming soon. Compared to the ’4, RPi5 has double the performance, quadruple the base RAM and far more capable I/O. (more…)

  • Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx Surfaces Threat to GitHub Repositories

    Checkmarx, a provider of application security testing tools, today reported that malicious actors have been able to compromise the free automated dependency management tool for software projects, known as Dependabot, that GitHub provides.

    It’s not clear how prevalent the compromise is, but the attack involves the tokens that GitHub provides to allow access to Dependabot. Once cybercriminals gain access to a repository, they then add additional emails to the account that, once authorized, are used to inject malicious code into a repository that exfiltrates defined secrets to an external server. Cybercriminals can then modify any existing JavaScript files using a password-stealer to steal the credentials of any end user submitting their password in a web form.

    Guy Nachshon, a security researcher for Checkmarx, said Checkmarx was only able to discover the threat because one of the cyberattackers made a mistake. DevOps teams are advised to confirm the identity of each user that has access to both public and private GitHub repositories to ensure their software supply chain has not been compromised, he added.

    In general, attacks against software supply chains are becoming more sophisticated, noted Nachshon. Beyond launching phishing attacks to steal the credentials of individual members of an application development team, it appears cybercriminals are employing tactics and techniques that enable them to steal the credentials of an entire team contributing to a repository.

    These attacks, of course, have become a matter of national security. Governments around the world are crafting legislation that will hold organizations more accountable for the security of the applications they build and deploy. It may be a while before those proposals become law, but it’s clear the pressure on organizations to secure their software supply chains is building. More organizations than ever are, as a result, embracing DevSecOps best practices to better protect their software supply chains.

    The challenge is that many of the components used within those supply chains are from open source projects that organizations don’t have the ability to patch should a vulnerability be discovered. More troubling still, even when a patch is available, many organizations are reluctant to upgrade for fear of breaking an application. In effect, they are betting cybercriminals are not going to discover a potential exploit that exists in their application portfolio or that the damage inflicted will be less than what might otherwise be experienced should an application break following the update of a critical component.

    Playing the equivalent of Russian Roulette with application security is, to put it mildly, inadvisable. DevSecOps teams need to not only address vulnerabilities in applications as they are being built but also address the massive amount of technical debt relating to known vulnerabilities that have been allowed to accrue for more years than most anyone cares to admit.

    Unfortunately, cybercriminals are now clearly aware of the soft underbelly that exists within application environments, so the race to address an issue that has been allowed to fester is now on. And the odds, alas, are already stacked in favor of the malicious actors that are ready and willing to wreak havoc.

  • Dell Taps Microsoft to Simplify Hybrid Cloud Computing

    Dell Taps Microsoft to Simplify Hybrid Cloud Computing

    Dell Technologies, in collaboration with Microsoft, today unveiled a platform that tightly integrates an on-premises IT environment with the Azure cloud.

    Caitlin Gordon, vice president of multi-cloud product management for Dell Technologies, said the Dell APEX Cloud Platform for Microsoft Azure is the first instance of a hybrid cloud computing platform designed specifically to address that requirement using a Premier Solution of the Microsoft Azure Stack hyperconverged infrastructure (HCI) platform that Microsoft added to its portfolio today.

    The Premier Edition of Microsoft Azure Stack HCI makes available an instance of that platform that provides a more turnkey management experience than the existing editions, said Gordon.

    In the face of increased economic headwinds, more organizations are looking to lower the total cost of managing IT by reducing the number of control planes that need to be managed. Each platform that an IT team typically supports today has its own control plane that requires IT staff to manage it. Reducing the number of control planes creates an opportunity to reduce the total headcount currently required to manage multiple IT platforms.

    It also serves to streamline workflows in a way that enables DevOps teams to reduce the current level of friction encountered when managing multiple IT platforms, noted Gordon.

    At the core of Microsoft’s approach to hybrid cloud computing that Dell is embracing is Arc, a management framework that makes it possible to manage Azure cloud instances alongside on-premises IT environments. In terms of the ability to manage hybrid cloud computing environments, Microsoft is significantly more advanced than any other cloud service provider, said Gordon.

    It’s not clear whether IT organizations are embracing HCI platforms running an instance of the same core stack of software that Microsoft relies on to provide Azure services. If IT organizations expect to lower the cost of managing IT, there is no doubt they will need to modernize on-premises IT infrastructure. The older the platform, the more expensive it becomes to automate using various third-party frameworks.

    Regardless of the approach, IT teams need to reconcile the need to invest in automating workflows that span multiple IT platforms. Over time, those investments will reduce the total cost of IT, but getting the required funding to start that process will require IT teams to make a strong case for increasing the return on investment (ROI).

    In the meantime, the number of workloads running both in the cloud and at the network edge is only going to increase. At the same time, the bulk of existing workloads continue to run in local data center environments. Most IT teams will be required to find additional ways to automate the management of all those environments simply because the cost of adding additional IT staff to manage highly distributed computing environments as scale will otherwise be prohibitive.

    As such, the issues that IT teams are facing today may be a matter of not if the management of IT will become more automated but how soon.

  • Atlassian Strengthens Jira Navigation and Integration

    Atlassian Strengthens Jira Navigation and Integration

    Atlassian today made it simpler to navigate the Jira Software and Jira Work Management project management applications as part of an ongoing effort to make it simpler for DevOps teams to collaborate with other stakeholders of application development projects.

    Megan Cook, head of product for Atlassian, said the ability to share release dates across multiple calendars, overviews that aggregate views of and summarize multiple projects along with command palette and importer tools make it simpler for, for example, marketing teams and other individuals outside of a DevOps team to keep track of application delivery schedules.

    In addition, Atlassian has tightened integration between Jira and Confluence, a wiki-based collaboration application, and a previously launched Atlassian Intelligence capability that infuses generative artificial intelligence (AI) capabilities will also soon be added to Jira Work Management alongside existing support for Jira. There will also be connectors for Jira Work Management to integrate with Atlassian Admin, Atlassian Analytics, Access and Data Lake offerings, along with advanced security features.

    Finally, Atlassian is adding support for a design tool developed by Figma that can now be directly installed in Jira.

    Collaboration between application development teams and the rest of the business is becoming more crucial as organizations increasingly realize how much they depend on software to drive revenue. One of the primary reasons Atlassian is investing in generative AI is to make it simpler for anyone to understand the status of any given project and the downstream impact any change to a delivery schedule is likely to have.

    Generative AI, of course, has already moved from being considered advanced technology to a set of capabilities that most end users will soon expect to be embedded within every application. One of the primary benefits generative AI provides is it makes a range of applications originally designed for specialists, such as a software engineering team, more accessible to a wider range of end users.

    It’s not clear how much generative AI will change the relationship between DevOps teams and the rest of the business, but with increased visibility, there should be a greater appreciation for the challenges developers and DevOps teams face. Any member of an organization should be able to plainly see, for example, why more resources need to be allocated to a specific project to ensure that an application is delivered on time.

    At the same time, application developers will find project management processes are about to become less disruptive as it becomes simpler to automatically import relevant data from the tools and platforms they use directly into a project management application such as Jira.

    One way or another, software engineers should expect that as generative AI continues to evolve, the divide between them and the rest of the business will narrow. There may be times when that level of additional scrutiny may feel burdensome, but on the whole, it should make it easier for DevOps teams to get the resources required to achieve any given goal. After all, the root cause of any given delay to a project will soon be plain for anyone to see.

  • Digma Leverages ML to Bring Observability Insights to IDEs

    Digma Leverages ML to Bring Observability Insights to IDEs

    Digma has launched a namesake platform the provides developers with continuous feedback from observability data that surfaces directly within their integrated development environment (IDE).

    Digma CTO Roni Dover said the Digma Continuous Feedback platform leverages machine learning algorithms to enable developers to easily analyze their code at runtime to identify issues, anomalies and regressions. Digma Continuous Feedback removes the need to consult a separate dashboard that requires developers to log into an observability platform.

    In fact, the reason developers often don’t make use of the data that observability platforms provide to write better code is that it’s not readily accessible at the time they are writing code, noted Dover.

    In general, it’s become much easier to collect logs, metrics and traces by using open source OpenTelemetry agents that can be embedded within software libraries. The Digma Continuous Feedback platform applies machine learning algorithms to that data to provide developers with insights on improving code in real-time, said Dover.

    The ultimate goal is to make it simpler for IT teams to distinguish when, for example, a software component actually needs more memory or is simply inefficient, he added. Those insights can be applied to code written by developers or code generated by an AI platform.

    Whether code is written by a human or generated by a machine, quality is often in question. Developers with varying levels of experience will naturally write code that can differ substantially in quality and efficiency. At the same time, developers may be asked to fix code someone else wrote; the original author no longer works for the organization, noted Dover. In either use case, the Digma Continuous Feedback platform immediately surfaces issues that will enable organizations to set higher baselines for code quality, he added.

    That baseline is especially critical as more code starts to be generated by generative AI platforms based on general-purpose large language models (LLMs) trained using code samples of varying quality collected from across the web. Developers will be able to immediately determine any issues that may arise should they choose to incorporate that code within an application.

    Developers, of course, don’t deliberately set out to write bad code, but the tools that enable them to identify issues are not easily accessible. In fact, too many developers tend to view observability platforms designed for IT operations teams as being overly complex, noted Dover. The Digma Continuous Feedback platform takes that issue off the table by identifying issues without increasing the level of cognitive load developers are expected to carry, he added.

    Eventually, thanks to the rise of machine learning algorithms and generative AI platforms designed specifically to write high-quality code, the overall state of software engineering will improve. The issue is determining the best way to get the benefits these technologies provide directly to the developers who write code—an issue that is at the heart of so many DevOps challenges.

  • Tray.io Automation Framework Leverages AI to Build Integrations

    Tray.io Automation Framework Leverages AI to Build Integrations

    Tray.io today added an automation framework to an integrated platform-as-a-service (iPaaS) service that leverages an existing Merlin artificial intelligence (AI) engine to identify the most efficient way to automate a workflow.

    The Tray Universal Automation Cloud service can be invoked via three distinct application programming interfaces (APIs) to programmatically create those workflows using a Tray Code low-code or Tray Build no-code tool or via a Tray Chat natural language interface. A Connectivity API provides access to more than 600 connectors, while a Trigger API enables developers to drive event-driven processes. An Authentication API provides a method for managing authorizations. The platform also provides access to testing, error handling and debugging tools.

    Tray.io CEO Richard Waldron said that approach provides IT teams with a composable framework for building integrations that leverages a set of large language models (LLMs) that the company has embedded within its Merlin AI engine to enable IT teams to optimize workflows.

    In addition, the underlying platform takes advantage of Kubernetes, Docker containers and serverless computing frameworks to dynamically scale as required, he added. In contrast, rival legacy iPaaS environments are not as elastic, which enables Tray.io to base its pricing on actual usage of a modern IT platform, noted Waldron.

    The overall goal is to provide a single platform that any type of developer, including business professionals, can invoke to automate workflows, said Waldron.

    As the overall codebase that DevOps teams manage continues to increase, the number of required integrations between applications and processes continues to increase exponentially. Rather than relying on lower-level code to create those integrations, an iPaaS provides the means to automate and simplify building integrations and enable developers to spend more time writing the business logic that will drive a new application. Historically, most of the integrations required to drive, for example, a digital business transformation initiative required a significant amount of low-level code to be developed and maintained.

    Tray.io is now making a case for an iPaaS that takes advantage of AI to more easily invoke generative AI capabilities to optimally create those integrations based on workflow attributes.

    Each organization will need to determine how heavily to rely on AI platforms to build integrations, but these advances—alongside generative AI tools that developers have already embraced to build software—are making developers more productive than ever. That accelerated pace of application development will require DevOps teams to automate as many processes as possible. One option for achieving that goal is for organizations to rely more on an iPaaS to enable developers to build integrations in a way that doesn’t necessarily always have to flow through a DevOps pipeline.

    One way or another, thanks to the rise of AI, the way software is built is about to change drastically. The challenge and the opportunity now is to determine how best to reengineer workflows in a way that best aligns with the goals of the organization.

  • Cisco Acquires Splunk to Create Observability Powerhouse

    Cisco Acquires Splunk to Create Observability Powerhouse

    Cisco today revealed it has signed a definitive agreement to acquire Splunk for $28 billion in cash. The deal will add Splunk, one of the most widely-used platforms for managing IT operations, to Cisco’s portfolio, joining the AppDynamics observability platform in addition to a wide range of IT infrastructure equipment.

    Chuck Robbins, CEO of Cisco, told industry analysts the combined entity will be one of the largest software companies in the world. The Splunk and AppDynamics platform creates a comprehensive observability platform spanning applications, networks and hybrid cloud computing environments, Robbins added.

    By combining AppDynamics with the data collected by the Splunk platform, the combined company will be able to provide greater insights into IT operations than any other company, added Robbins.

    Splunk CEO Gary Steele said the acquisition represents the next natural, logical step for Splunk and furthers its long-term partnership with Cisco to keep IT environments secure and resilient. The two companies will also be able to apply artificial intelligence (AI) more effectively to IT operations, he added.

    In its most recent quarter, Splunk reported revenues of $911 million, with cloud revenue accounting for $445 million, or 29%, of the total. Total Splunk revenues are forecasted to be between $3.925 billion and $3.95 billion for fiscal 2024.

    Splunk previously acquired SignalFX, a provider of an observability platform, in 2019. It’s not yet clear how the platform might be integrated into the AppDynamics platform, but Robbins said there is little overlap between the observability platforms the two companies currently provide.

    The Splunk acquisition comes at a time when it’s becoming more apparent that the need for observability extends well beyond DevOps workflows as organizations become more dependent on software.

    Each IT organization will need to determine how long it will wait for the Splunk acquisition to close before investing further in observability. Historically, acquisitions of this scale have been accompanied by price hikes to help fund the merger once the deal is concluded.

    In the meantime, IT and DevOps leaders will likely revisit the way IT is managed in the months ahead. Splunk came to prominence at a time when most workloads were running in on-premises IT environments. While the bulk of workloads continue to run in those environments, many workloads deployed in the cloud are being managed using platforms designed specifically for those environments. Splunk has been making a case for a hybrid cloud computing approach that assumes the management of on-premises and cloud computing environments will become more unified.

    In theory, economic headwinds are driving more organizations in that direction to reduce the total cost of managing IT. But it’s just as feasible to extend cloud tools to on-premises IT environments as it is to extend legacy tools to the cloud. Despite the inevitable outcome, Splunk rivals will spend the better part of the next year coming up with offers to switch platforms both before and after the deal eventually closes.

  • Nobl9 Unfurls Reliability Center for Managing SLOs

    Nobl9 Unfurls Reliability Center for Managing SLOs

    Nobl9 today launched a next-generation platform for managing service level objectives (SLOs) in a way that promised to improve overall reliability.

    Brian Singer, chief product officer for Nobl9, said in addition to enabling DevOps teams to meet SLOs, the Nobl9 Reliability Center also now provides a single source of truth about the state of reliability in an application environment.

    That capability is critical because as DevOps teams add new features to applications, they need insights into how they are impacting the reliability of the software environment, said Singer. No matter how great any new capabilities might be, it won’t matter much if the application environment slows to a crawl or outright crashes, he added.

    Nobl9 Reliability Center addresses that need by providing dashboards and reports to assign reliability scores based on the metrics collected from the SLOs defined. Those scores can then be shared with senior business and IT leaders so they can better understand the actual state of an application environment, noted Singer.

    In addition, the platform will recommend SLOs and policies and can be used to automate runbooks to improve reliability. The goal is to enable DevOps teams to continuously monitor and manage using SLOs via alerts that are received in a way that is timely enough to act on, added Singer.

    That approach enables DevOps teams to make sense of conflicting alerts generated today by multiple monitoring and management tools. A recent survey published by Nobl9 found 72% of respondents are using six or more monitoring and observability tools.

    The Nobl9 platform collects SLOs by tracking workflows through more than 50 integrations with various DevOps tools and platforms.

    SLOs, of course, are not a new idea. They have been used as a metric to track the performance of IT services for decades.

    However, as more microservices-based applications are built and deployed, it’s becoming more challenging to maintain SLOs across applications that have many more dependencies than legacy monolithic applications. Ultimately, each IT team needs to provide some sort of objective benchmark that assesses their overall effectiveness at delivering application services. The Nobl9 platform makes it simpler to track whether SLOs are achieved and maintained.

    That’s crucial because as more organizations depend on software to deliver digital services, any disruption is likely to have a direct impact on profit and revenue. As such, the reliability of application environments has become a major concern. The issue, of course, is that many of those application environments have dependencies on legacy platforms that, in some cases, have been running for years. Each feature and application programming interface (API) added over time conspires to adversely impact performance. In an era where IT teams are now trying to manage distinct services rather than individual applications, latency can significantly slow down response times.

    Each organization will need to determine for themselves how aggressively they need to manage SLOs. But thanks to the rise of digital business transformation, more senior IT and business leaders are focused on them than ever.