staging-devopsy.kinsta.cloud

Category: DevOps Toolbox

  • Oracle Adds Low-Code Tool to Autonomous Platform

    Oracle Adds Low-Code Tool to Autonomous Platform

    Oracle this week extended the scope of the cloud services it manages on behalf of customers to include a low-code application development platform based on the company’s Visual Builder development tools.

    Jeff Price, vice president of product Management at Oracle, said Oracle Autonomous Visual Builder (VB) Cloud makes it possible to employ a tool based on JavaScript to build applications that might be written, for example, in Java or, going forward, Jakarta EE. Autonomous Visual Builder Cloud is available via a managed service that can easily integrated with a variety of back-end services managed by Oracle or running on-premises.

    To complement that effort, Oracle also announced the availability of Oracle Autonomous Analytics Cloud and Oracle Autonomous Integration Cloud. Oracle Autonomous Visual Builder comes with tools for accessing back-end services, while Oracle Autonomous Integration Cloud provides a raft of additional connectors for accessing a wide variety of other Oracle and third-party services, Price said.

    Oracle also committed to delivering additional autonomous services later this year to address mobile and chatbots, data integration, blockchain, security and management and additional database workloads such as online transaction processing (OLTP). Those services will complement existing Oracle autonomous database and platform-as-a-service (PaaS) environments.

    Price said interest in low-code development tools is accelerating as organizations look to extend business processes that have been automated using either packaged applications running on-premises or in a software-as-a-service (SaaS) application. Rather than trying to achieve that goal using low-level application programming interfaces (APIs) that are fragile, Price said low-code tools such as Oracle VB make it simpler for even citizen developers to construct applications leveraging code developed by professional developers.

    Organizations need to decide for themselves when to customize those application environments versus taking advantage of them in a turnkey manner, Price said. Organizations tend to heavily customize customer experience and customer relationship management (CRM) applications, while relying on best practices that have been coded into enterprise resource planning (ERP) applications. Oracle is changing the way it supports those applications—base-level support for these applications is now free, but Oracle will continue to charge for premium services.

    The need to customize applications at scale is driving many more traditional enterprise IT organizations to adopt DevOps processes that now need to span multiple IT environments, Price said. He added Oracle now provides integration with multiple continuous integration/continuous deployment (CI/CD) platforms to facilitate that transition.

    As Oracle assumes more responsibility for managing the underlying platforms, organizations in theory should be able to devote more resources to developing applications. To achieve that goal, however, many of them will need to figure out how to extend their DevOps processes to include Oracle as a managed service provider.

    Oracle also provides access to unmanaged infrastructure-as-a-service (IaaS) and (PaaS) services in much the same way Amazon Web Services (AWS) and Microsoft do. Oracle has been late to the cloud game, but this week announced a slew of new cloud customers, including Atomitech Inc., Edith Cowan University, Future Robot, Barrick Gold Corporation, C’s NEXT, Colegio de Bachilleres, Contribute NV, DP World Ltd., Dubai Airport Freezone Authority, Emirates Flight Catering, Hytera Communications Ltd., Ildong Pharmaceutical Co. Ltd., Konyang University, Land O’Lakes Inc., Leshan City Commercial Bank, McDermott, MCore Group, New Hope Liuhe Co. Ltd., Promata, Stallion Oilfield, Ornua Co-Operative, RecVue, Saga d.o.o Beograd, TCI, TaskUs, University of Wisconsin Hospital and Clinics Authority, and Zeneral Heatpump Industry Co. Ltd. All told, Oracle claims to be processing 55 billion transactions a day on its cloud.

    It may take a while for Oracle to catch up to AWS. But if it doesn’t achieve that goal it won’t be for a lack of development tools.

    — Mike Vizard

  • Google Looks to Simplify Building of Workflows

    Google Looks to Simplify Building of Workflows

    Google this week launched the beta of Cloud Composer, a managed Apache Airflow service for building workflows that promises to simplify management of integrated DevOps processes. Apache Airflow is an incubation project being developed under the auspices of the Apache Software Foundation that enables IT teams to programmatically author, schedule and monitor workflows using directed acyclic graphs (DAGs) that visualize pipelines running in production, monitor their progress and can be used to troubleshoot issues.

    James Malone, a product manager for Google Cloud, said Cloud Composer leverages Apache Airflow to not only make it simpler to manage workflows, but also port them between various public and private clouds, including on-premises IT environments.

    Cloud Composer also includes the Google Developer Console and Cloud software development kit (SDK), a cloud identity-aware proxy, Stackdriver logging and monitoring, identity access management (IAM) and Python support, along with simplified DAG management and streamlined Airflow runtime.

    Google plans to add support for autoscaling and availability in additional Google Cloud regions over time, Malone said, as well as integrate Google Composer with Kubernetes to extend the reach of Apache Airflow workflows to containers.

    Pricing for Cloud Composer is consumption-based as measured by vCPU/hour, GB/month and GB transferred/month.

    Malone said Cloud Composer will play a critical role in enabling DevOps teams to construct pipelines spanning hybrid cloud computing environments. Today IT administrators regularly make use of text editors or scripts they write to automate a process. But it’s difficult for those scripts to be shared between multiple IT administrators. Cloud Composer and Apache Airflow make it easier to share workflows that automate processes across DevOps teams. Just as importantly, those workflows will be accessible to IT administrators who don’t have the programming skills required to develop a script.

    Those workflows will also play a critical role in unifying DevOps and DataOps processes around a common set of continuous integration/continuous deployment (CI/CD) processes, Malone added.

    Most organizations today are managing multiple clouds in isolation from one another. But as organizations look to build applications faster, they want to be able to deploy those applications on the most optimal platform available without having to develop a unique set of pipelines for each cloud environment. Having an application locked into a specific cloud platform not only is economically unacceptable, it’s also fundamentally inefficient from an application development and deployment perspective.

    Apache Airflow is not the only tool that can be employed to construct pipelines. But Malone noted that because it is an open source Apache project, organizations can be assured that workflows they develop can run anywhere now and into the future. Google chose Apache Airflow to build Cloud Composer largely because an active development community is emerging around this open source project, he said.

    The way IT platforms are managed is transforming rapidly. The days when servers and applications where managed in isolation are over. IT administrators are being asked to manage fleets of server and storage systems running more applications than ever. The tools required to achieve that goal are thankfully now becoming a lot more accessible to everyone in IT.

    — Mike Vizard

  • Dell EMC Bets on Machine Learning to Drive IT Agility

    Dell EMC Bets on Machine Learning to Drive IT Agility

    Dell Technologies announced it is infusing machine learning algorithms across its portfolio of server and storage infrastructure to optimize the performance of each individual application using artificial intelligence (AI).

    At the Dell Technologies World 2018 conference, the Dell EMC arm of Dell Technologies announced it has joined the Intel AI Builders program. Dell EMC and Intel will enable customers to benchmark Deep Learning and high-performance computing (HPC) workloads running on Intel Xeon Scalable processors and Intel field programmable gate arrays (FPGAs) integrated in the company’s PowerEdge R740 servers at the Dell EMC Innovation Lab and the Dell EMC customer Solution Centers.

    Dell EMC also unveiled Dell EMC PowerMax, an NVMe-based storage array that takes advantage of an embedded machine learning engine into the storage operating system to optimize I/O performance. Dell EMC said that engine is capable of making 6 billion decisions related to optimizing 40 million data sets a day.

    Finally, Dell also announced Dell Precision Optimizer software that compares the behavior of each application deployed on a Dell workstation against a machine learning model that automatically optimizes system settings. According to the company, Dell Precision Optimizer can improve workstation application performance band delivery up to 394 percent.

    Ashley Gorakhpurwalla, ‎president and general manager for server and infrastructure systems at Dell EMC, said the plan is make it possible to compare the state of an IT infrastructure deployment against AI models that Dell EMC is constructing in the cloud using all the data gathered from the company’s systems connected to Dell EMC support services. Armed with that data, it will become possible to optimize system settings for every type of application deployed on it, said Gorakhpurwalla.

    He noted that despite advances in DevOps, provisioning resources in a local data center on demand is still too time-consuming. Many IT organizations have adopted converged and hyperconverged infrastructure (HCI) platforms to unify the management of compute, storage and networking. But machine learning algorithms combined with other emerging technologies should make it possible to make IT infrastructure resources on demand in a cloud-like manner. That increased level of automation should enable IT organizations to allocate more resources to developing applications than managing the infrastructure those applications run on.

    Each IT organization today is at a different stage of maturity when it comes to IT infrastructure. Dell EMC has one customer with a single administrator who manages more than 80,000 servers, Gorakhpurwalla said. Over time, IT infrastructure will become increasingly automated across a much broader range of customers, he noted—critical because it will allow local IT teams to be as agile as any cloud service providers. Today, many workloads are deployed in the cloud because of the perceived agility of the cloud, regardless of the actual costs.

    It may take some time for developers to regain confidence in the agility of local IT departments. But as AI models continue to evolve it’s now a matter of when rather than if local IT infrastructure will become much more responsive to the needs of any given application.

    — Mike Vizard

  • Puppet Expands Scope of Pervasive Automation Initiative

    Puppet Expands Scope of Pervasive Automation Initiative

    Puppet today unveiled a series of initiatives as part of a continuing campaign to make IT automation available pervasively across the enterprise.

    Omri Gazitt, chief product officer for Puppet, said the first step in that effort is making it easier for IT organizations to discover what assets they need to manage. Puppet Discovery is an agentless tool through which organizations can monitor their IT environments continuously. Any changes or additions are captured immediately in a database.

    Scheduled to be available in May, Puppet Discovery replaces a traditional configuration management database (CMDB) with a platform that more accurately reflects the state of the IT environment because it’s always up to date, Gazitt said.

    Puppet is also extending the reach of its IT automation framework to include modules spanning platforms from Barracuda Networks, Cisco Systems and Nutanix, as well as the Azure cloud service from Microsoft.

    Modules for Cisco ACI software-defined networks (SDNs) and Cisco Meraki wireless networks are now available, along with a private beta of a module for the Cisco IOS operating system widely employed on the Cisco network infrastructure.

    Similarly, Puppet modules are now available for security and data protection offerings from Barracuda Networks and the hyperconverged infrastructure (HCI) platform developed by Nutanix.

    Puppet, in the context of the cloud, is now adding a module for Azure Resource Manager, as well as adding support for Windows PowerShell Desired State Configuration (DSC) and the Microsoft Task Scheduler 2.0 application programming interface (API) used in Windows.

    In related news, Microsoft, Barracuda Networks and Puppet also announced they are combining their respective capabilities to create an Azure Accelerator program to automate and secure mission-critical workloads. Organizations that participate in the program can get started at no cost, with free software from Puppet and Barracuda and no Microsoft Azure infrastructure charges while migrating workloads to Azure Cloud.

    Other new members of the Puppet Technology Alliance Partner program include Lenovo and xMatters.

    Finally, Puppet announced scheduled June availability of Continuous Delivery for Puppet Enterprise (PE), an update to Puppet Enterprise that includes role-based access control for Tasks, which can define node groups corresponding to business functions or units to limit who can run tasks within a specific node group. Puppet also has added Puppet Bolt Task Plans, which enable customers to orchestrate a set of tasks across thousands of Puppet Enterprise nodes using Puppet Orchestrator. Continuous Delivery for PE is based on a continuous delivery platform developed by Distelli that Puppet acquired last year.

    Puppet Enterprise has also been enhanced with easier backup and recovery capabilities to automate disaster recovery and support for a Puppet Development Kit (PDK), which includes a new resource application programming interface (API) that Gazitt said can be used to create custom Puppet modules to automate the management of any platform.

    In general, Gazitt noted that IT automation and DevOps increasingly are becoming synonymous. The biggest issue now, he said, is unifying all the independent silos of DevOps implementations that now span many enterprise organizations.

    Of course, IT organizations can apply IT automation without necessarily embracing DevOps. But once an organizations begins to adopt DevOps, it’s pretty clear IT automation quickly becomes indispensable.

    — Mike Vizard

  • Eclipse Foundation Charts Cloud-Native Path Forward for Jakarta

    Eclipse Foundation Charts Cloud-Native Path Forward for Jakarta

    A new era begins for the Java community today with a commitment to a Jakarta EE specification that the Eclipse Foundation expects will become cloud-native in short order.

    Jakarta EE formally marks the end of a Java era. While the term Java will still apply to any technologies developed prior to Oracle transferring stewardship of the venerable programming language to the Eclipse Foundation, all future innovations will be delivered under the Jakarta brand.

    A survey of 1,800 Java developers shows that in addition to increasing the overall pace of innovation, the top two priorities of the developer community is to see more emphasis being placed on microservices and integration with the emerging de facto Kubernetes container orchestration platform.

    A full 95 percent of the respondents building microservices said they are employing Java as part of those efforts, while nearly one-third of respondents are already working with Kubernetes. Mike Milinkovich, executive director of the Eclipse Foundation, said that although it’s yet to be determined precisely how Java and Kubernetes will be more tightly coupled, it’s clear the Jakarta community wants to be able to deploy cloud-native applications based on Jakarta. Half of survey respondents said they ran only one-fifth of their Java applications today in a cloud. But more than 30 percent said they expect to be running 60 percent of more of their applications in the cloud within the next two years.

    Milinkovich said with Jakarta under the auspices of the Eclipse Foundation, many more developers from different vendors will be contributing code to advance it. Previous advances to Java have been slow in coming over the years because all contributions to the code base were controlled by Oracle. One of the first things to change under the stewardship of the Eclipse Foundation, he noted, is that Oracle has committed to open-sourcing the Test Compatibility Kits (TCKs), which vendors previously were required to license at significant expense.

    Also expected to witness a faster innovation cycle, Milinkovich said, is Eclipse MicroProfile, a Java framework developed by IBM and Red Hat optimized for microservices, which the Eclipse Foundation expects to be as widely embraced as the Spring framework based on Java that Pivotal Software helped popularize. In fact, there will be a lot more cross-pollination of ideas and concepts across all the major frameworks from writing applications, he added.

    Tighter integration between Jakarta and Kubernetes and a general simplification of the effort required to develop microservices is likely to have a significant impact on DevOps for years to come. Many organizations today are contemplating the degree to which they may want to lift-and-shift existing Java application into the cloud versus rewriting them completely in a new language. With the Eclipse Foundation’s commitment to a cloud-native implementation of Jakarta EE, it’s clear that organizations can have greater confidence that existing investments in Java applications likely will remain relevant in the age of the cloud. In fact, the only decision left for many of them to make is the degree to which they might want to turn monolithic applications written in Java into highly portable microservices based on Jakarta EE.

    — Mike Vizard

  • How Python is Transforming the DevOps Landscape

    How Python is Transforming the DevOps Landscape

    DevOps is the combination of operations and software development which reduces or almost eliminates the disconnect between systems administrators who run the infrastructure and software developers who develop applications.

    During software development, when the Agile methodology is utilized properly, a bottleneck often occurs during the frequent operations and deployment phases. New fixes and updates are produced so rapidly in every sprint that the infrastructure teams can be swamped with deployments. To eliminate few of these issues, the operations personnel and application developers are asked to work closely to automate the code delivery to production from deployment.

    As DevOps is an approach for handling change and agility, engineers must master multiple languages. The Python programming language is one of the most crucial components of the DevOps toolchain. Many DevOps teams utilize it for building web applications for visualizing custom data, building custom utilities and more.

    Ansible and other tools are written in Python, which means you can build custom scripts or modules to automate your tasks, for example, or do other things.

    Reasons for Using Python for DevOps

    The accessibility and flexibility of Python are reasons why it is a preferred language for the DevOps toolset. If you are working in the role of DevOps, you must require an adaptable skillset; you must know how to work with multiple languages. For anyone looking to explore new tools and languages, and are curious about technology, the language can form a solid foundation, as it doesn’t require the commitment levels that a specialist language requires.

    In addition, it is a great scripting language, and scripting refers to automation. A few major configuration management tools, including SaltStack and Ansible, are written in Python underscores. This shows how useful the language is when it comes to orchestration and infrastructure automation.

    Python and Ruby are compared often, and with good reason: Both are highly accessible and utilized in applications developed by many organizations. They also feature in the DevOps toolset. We can do almost all the things with Ruby that we do with Python. But, when it comes to syntax, Python gains the upper hand, as it is much more direct than the syntax of Ruby.

    In the realm of learning to debug problems and code, Python has the advantage over Ruby, as it takes a much more direct approach to programming. Its directness and simplicity are invaluable if you are working in DevOps environment and agility is highly important.

    Conclusion

    As a growing number of engineers and developers take on decision-making responsibilities, Python can be the stabilizing language. And not only for DevOps—the language also can be used for developing blockchain, which is the underlying technology for various cryptocurrencies such as bitcoin wallet. As it can be utilized in various ways, it enables you to be open to broad range of technical possibilities. Python is the go-to programming language for the DevOps landscape.

    — savaramravindra

  • 4 Amazing Quantum Computing Applications

    4 Amazing Quantum Computing Applications

     Researchers across the globe, from the quantum researchers at University of Maryland synthesizing time crystals, to the research team at the University of New South Wales who are embedding atoms and their electrons into silicon, are pushing quantum computers forward, attempting to arrive at the most powerful quantum computing technology.

    IBM, Google and Microsoft are racing for quantum supremacy. IBM expects to create a 50-qubit general purpose quantum computer “within the next few years.” Indeed, the next iteration in quantum computing may be near.

    Why? Quantum computing could be the best path to ultra-powerful computers, and our best bet to solve unimaginably difficult problems. As our need for powerful processors continues to increase, and problems become larger in scope and complexity, we’ll need more complex computational systems to power solutions.

    Quantum Computers in Use

    Here are four amazing applications of quantum computers:

    Machine Learning

    Artificial intelligence needs to be able to pull from large datasets of image, video and text. Thankfully, there doesn’t seem to be a shortage of content. In fact, there may be an overabundance. Big data is out there to be analyzed, but we need more powerful computers to process the petabytes of unanalyzed data.

    Quantum computers could empower machine learning by enabling AI programs to search through these gigantic datasets concerning medical research, consumer behavior and financial markets—and make sense of them.

    Optimization

    Imagine, say, you are a traveling salesman. You wish to visit a handful of cities and want to know what the most optimal routes would be. This would be an example of an optimization problem. It sounds simple enough, but, in reality, the process can get quite involved as you up the number of variables. With only 270 destinations, for example, there are more combinations of travel than atoms in the universe.

    With quantum computers, however, we could expect a machine to be able to handle almost innumerable permutations and combinations, which could advance system design and analysis in massive ways.

    Biomedical Simulations

    With quantum computers, we can create, simulate and model molecular structures. Researchers at Harvard University used a D-Wave One quantum computer to solve the puzzle of how some proteins fold in 2012.

    “The model consisted of mathematical representations of amino acids in a lattice, connected by different interaction strengths,” writes Geoffrey Brumfiel in a news article for Nature about the Harvard researchers’ protein folding models. “The D-Wave computer found the lowest configurations of amino acids and interactions, which corresponds to the most economical folding of the proteins.”

    While the technology was nowhere near perfect—as the researchers cited that “10,000 measurements using an 81-qubit version of the experiment gave the correct answer just 13 times”—it was able to accomplish an amazing feat by modeling the behavior of protein folding with some degree of accuracy.

    Financial Services

    Quantum computing is already on its way. D-wave, a company backed by Goldman Sachs and Bezos Expeditions, among others, deployed its first commercial quantum computer: the D-Wave 2000Q, a quantum annealing system with 2000 qubits and advanced feature controls.

    Despite their prohibitive price, these computers are being utilized by a small niche, as illustrated by Harvard’s use of D-wave’s first model back in 2012. The systems could be used for complex financial modeling and risk management within the financial industry as well. Quantum computing could be used to find “new ways to model financial data” and isolate “key global risk factors,” according to IBM.

    “It would be great to build systems to help Wall Street better manage risk using this type of technology,” D-Wave Systems President and CEO Vern Brownell told Bloomberg. “They spend a lot on computing power [to manage risk].”

    Conclusion

    From managing money to massive datasets, quantum computing’s applications are seemingly endless. Advances in machine learning and optimization could boost efficiency dramatically. Biomedical and chemical simulations could help us land more drug discoveries and uncover new medical treatments in record time. Advanced computing power could lead to more than just innovation; it also could lead to lessened risk. Indeed, enhanced financial services could fundamentally change how we invest.

    As tech companies, computer scientists, and theoretical physicists help to perfect this technology, these truly amazing applications of quantum computing could become ubiquitous—and drive us further into a quantum age.

    — Ellie Martin

  • Akamai Extends Scope of DevSecOps Reach

    Akamai Extends Scope of DevSecOps Reach

    Akamai pressed its case for becoming a strategic DevSecOps platform by adding a range of security capabilities to its network service platform that help isolate applications from cybersecurity threats.

    The company has added support for scripting to automate application security using its Kona Site Defender web application firewall as well as improved management and versioning support for application programming interfaces (APIs). Those capabilities complement an Akamai API Gateway for securing and managing APIs.

    Akamai is also updating Akamai Bot Manager, adding a client SDK for mobile applications to help mitigate distributed denial of service (DDoS) attacks. The company also is adding capacity to its scrubbing centers to further defend against large-scale DDoS attacks.

    Ari Weil, vice president of product marketing for Akamai, said the company is evolving into a platform that securely provides web applications with access to caching software and network infrastructure that dynamically scale up and down as required.

    The goal is to make the Akamai network a seamless extension of any DevOps processes that developers can programmatically invoke on demand regardless of whether their applications reside in a public cloud, on-premises or in a third-party hosting center, said Weil. Because Akamai sits between users and production applications, Akamai now plays a critical role in terms of bother DevOps and DevSecOps, he said.

    In term of accomplishing that goal, Weil conceded Akamai doesn’t have as much visibility in the DevOps community as it would like. The company has integrated its platform into continuous integration/continuous development (CI/CD) platforms such as Jenkins to reduce as many steps as possible for DevOps teams. But developers are not always fully cognizant of the security services that Akamai makes programmatically available, he said.

    Weil noted that as DevSecOps continues to gain ground, Akaimai expects many developers will increasingly appreciate those security services, especially as cyberattacks become both more frequent and lethal. A 2017 security report published by Akamai finds DDoS and web application attacks rose 14 percent and 10 percent, respectively, year over year.

    In effect, Akamai turns web application security into a large-scale zero-trust managed service that is available on thousands of points-of-presence (PoPs) around the world. In time, developers will only have to express their intent concerning the level of security to be applied. The execution of that intent will all be automated, Weil said.

    In an ideal world, all cybersecurity battles would be fought as far away from applications as possible. Rather than focusing solely on the edge of the corporate network, Akamai is encouraging DevOps teams to think in terms of layers of defense that starts where applications are cached at the edge of the network. In theory, platforms such as Akamai provide a lot more visibility into what types of cyberattacks are circulating in the wild hopefully long before they ever get a chance to impact an application. The challenge, however, lies in distinguishing between what security technology needs to be embedded in the application itself versus an on-demand service that’s only a simple API call away.

    — Mike Vizard

  • Google Taps Netflix for Open Source Canary Analysis

    Google Taps Netflix for Open Source Canary Analysis

    Google and Netflix today jointly announced an open-source automated canary analysis service, dubbed Kayenta, that applies statistical analytics to optimize DevOps processes.

    Andrew Phillips, a product manager for Google Cloud Platform (GCP), said goal is to make it easier to consume advanced analytics by integrating Kayenta with the open source Spinnaker continuous delivery pipeline platform developed by Google. However, because Kayenta is based on software developed by Netflix, an IT organization can feed data from any cloud or on-premises IT environment into the canary analysis service, said Phillips. Kayenta also can ingest data from a broad range of monitong tools, including Stackdriver, Prometheus and Datadog.

    Phillips said the goal is to continually iterate on Kayenta to make it simple enough for almost any organization to take advantage of canary analysis, which enables DevOps teams to track metrics such as memory usage of a critical component. Kayenta fetches user-configured metrics from their sources, runs statistical tests and provides an aggregate score for the canary. Kayenta can automatically promote or fail “the canary” or trigger a request for human approval based on those test results.

    Specifically, Kayenta creates a pair of control/experiment time series datasets and calls a canary judge, which performs statistical tests, evaluating each metric individually and returns an aggregate score from 0 to 100 using preconfigured metric weights. Depending on the configuration, the score is then classified as “success,” “marginal” or “failure.” Success promotes the canary and continues the deployment, a marginal score triggers a human approval path, and a failure triggers a roll back.

    The basic canary concept involves routing a small subset of production traffic through a deployment that reflects the changes (the canary) and a newly deployed instance that has the same code and configuration as production environment, which serves as the baseline for testing. The analytics engine then compares the metrics between the canary and the baseline to identify any significant impacts the changes might have on the production environment. Kayenta in effect provides a mechanism for modeling risks based on proposed changes to the production environment, said Phillips.

    Google and Netflix expect third-party vendors will soon be incorporating Kayenta into a variety of DevOps tools and cloud platforms. In the meantime. Google views Kayenta as one more way of enticing DevOps teams to take advantage of Spinnaker to manage their DevOps pipelines in the cloud.

    Historically, setting up a canary analysis system has been a complex endeavor requiring significant engineering skills. Google is moving to democratize canary analysis by making it available as a service that can be invoked on demand, said Phillips.

    Phillips said Kayenta provides access to data that can be used to drive a wide range of predictive analytics applications that can be used to automate DevOps processes. It will be a while before Kayenta data is used to drive artificial intelligence (AI) models to automate those DevOps processes.

    Given the rate at which applications are being added and updated in production environment relying on manual testing is quickly becoming unfeasible. The days when DevOps teams needed to manually create their own statistical analytics models are clearly coming to a merciful end.

    — Mike Vizard

  • Early Automation: A Key Requirement for DevSecOps Success

    Early Automation: A Key Requirement for DevSecOps Success

    According to the “2017 DevSecOps Community Survey,” by Sonatype, almost 60 percent of the respondents consider security to be an inhibitor to DevOps agility, while more than 50 percent of developers say they do not have sufficient time to allocate to security.

    Hence arises the need for enhanced security automation in DevOps. Security automation helps in refining and improving application security by reducing the time taken for detecting an attack and responding to any identified issue.

    Tools for Security Automation

    Organizations looking to implement DevSecOps by integrating security into their DevOps pipelines have an increasing number of tools such as Tanium, InSpec, Splunk, Checkmarx, Metasploit, FireEye and Contrast Security for security analysis and testing throughout the software development life cycle (SDLC), right from source-code analysis to post-deployment monitoring.

    Early Automation, A Key Requirement for Success Through DevSecOpsFor security to become an integral part of the DevOps workflow, which includes continuous integration and continuous deployment (CI/CD), automation is essential. As most organizations are pushing tens of new versions of code into production for each application every day, it becomes necessary to embed security controls early in the development life cycle, which is possible only through automation.

    Around 40 percent of the 2,300 IT professionals surveyed have said that they have deviated from the waterfall development model, where automated security tests are run just ahead of production, by running them throughout the development life cycle.

    Using SAST Tools

    Static application security testing (SAST) tools help in scanning code and providing instant feedback to developers on security-related issues who, in turn, can remediate the potential vulnerabilities as part of the standard workflow.

    However, static analysis may not be alone sufficient for detecting all problems in the code.

    Automating DAST

    Automated dynamic application security testing (DAST) searches for vulnerabilities in real time while the application is running and is really a major improvement over static analysis that only looks for potential security issues in the code.

    Inclusion of automated security analysis helps in limiting the introduction of vulnerable code earlier in the development life cycle. The runtime analysis of the issues detected through automation enables developers to prioritize the code problems that need to be fixed.

    Red Teaming and Threat Modeling

    Organizations have begun to employ the concept of red teaming, a military terminology, by having separate teams to simultaneously take up attacking the code and performing security testing respectively. This ensures that any potential flaws are uncovered in the production stage itself and code fixes are pushed as soon as possible.

    Threat modeling is critical for the success of DevSecOps as it leads developers to look at software from an attacker’s perspective. While the threat modeling process cannot be automated, it helps in identifying flaws in the application design and architecture better than other security approaches.

    Are You Ready for Automation?

    Organizations can automate the provisioning and commissioning of DevSecOps environments to achieve a predictable, consistent and secure service delivery.

    While the goal of DevOps Services automation is to help development teams in faster deployment and monitoring of applications, DevSecOps adds security to the automation and contributes to enhancing the quality and efficiency of the software.

    DevSecOps adoption provides organizations with a strong foundation for mitigating risk in a proactive, efficient and streamlined manner.

    — Veritis