Chapter 11 overview

The Future of DevOps and Software Delivery

Learn about the most cutting-edge trends in DevOps and software delivery, including infrastructureless, generative AI, shift left, supply chain security, platform engineering, infrastructure from code, and interactive playbooks.

Key ideas you'll learn

  • Infrastructureless
  • Generative AI
  • Shift left, supply chain security
  • Platform engineering

Examples you'll try

Table of contents

11.1 Infrastructureless
11.2 Generative AI
11.3 Secure by Default
11.4 Platform Engineering
11.5 The Future of Infrastructure Code
11.6 Conclusion

Related Books

Platform Engineering: A Guide for Technical, Product, and People Leaders

By Camille Fournier and Ian Nowland (O'Reilly)

Until recently, infrastructure was the backbone of organizations operating software they developed in-house. But now that cloud vendors run the computers, companies can finally bring the benefits of agile custom-centricity to their own developers. Adding product management to infrastructure organizations is now all the rage. But how's that possible when infrastructure is still the operational layer of the company? This practical book guides engineers, managers, product managers, and leaders through the shifts that modern platform-led organizations require. You'll learn what platform engineering is—and isn't—and what benefits and value it brings to developers and teams. You'll understand what it means to approach a platform as a product and learn some of the most common technical and managerial barriers to success.

Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware

By Cassie Crossley (O'Reilly)

Trillions of lines of code help us in our lives, companies, and organizations. But just a single software cybersecurity vulnerability can stop entire companies from doing business and cause billions of dollars in revenue loss and business recovery. Securing the creation and deployment of software, also known as software supply chain security, goes well beyond the software development process. This practical book gives you a comprehensive look at security risks and identifies the practical controls you need to incorporate into your end-to-end software supply chain. Author Cassie Crossley demonstrates how and why everyone involved in the supply chain needs to participate if your organization is to improve the security posture of its software, firmware, and hardware.

Other Related Resources

Secure by Design

By CISA (Blog post)

It's time to build cybersecurity into the design and manufacture of technology products.

A Brief, Incomplete, and Mostly Wrong History of Programming Languages

By James Iry (Blog post)

recommended

1801 - Joseph Marie Jacquard uses punch cards to instruct a loom to weave 'hello, world' into a tapestry.

Generative AI (GenAI, LLM) Tools

ChatGPT

ChatGPT helps you get answers, find inspiration and be more productive. It is free to use and easy to try.

Claude

Talk with Claude, an AI assistant from Anthropic.

Dall-E

We’ve trained a neural network called DALL·E that creates images from text captions for a wide range of concepts expressible in natural language.

Gemini

Bard is now Gemini. Get help with writing, planning, learning, and more from Google AI.

Llama

The open-source AI models you can fine-tune, distill and deploy anywhere.

Microsoft Copilot

Microsoft Copilot is your companion to inform, entertain, and inspire. Get advice, feedback, and straightforward answers.

GitHub Copilot

GitHub Copilot works alongside you directly in your editor, suggesting whole lines or entire functions for you.

Amazon Q Developer

The most capable generative AI–powered assistant for software development.

Stable Diffusion

Activating humanity's potential through generative AI. Open models in every modality, for everyone, everywhere.

Midjourney

Midjourney is an independent research lab exploring new mediums of thought and expanding the imaginative powers of the human species.

Cursor

Built to make you extraordinarily productive, Cursor is the best way to code with AI.

AI-Powered DevOps Tools Tools

Pulumi AI

Pulumi AI is an experimental feature that lets you use natural-language prompts to generate Pulumi infrastructure-as-code programs in your favorite language.

Honeycomb’s Query Assistant

Announcing Query Assistant, the first introduction of AI into Honeycomb. With Query Assistant, you can describe/ask things in plain English.

Datadog Bits AI

Datadog’s generative AI interface responds to conversational queries to help you explore your observability data and take action.

Datadog Watchdog

Learn how Watchdog, Datadog’s AI engine, proactively uncovers and alerts you to performance issues across your entire stack.

New Relic AI

New Relic AI unlocks the power of observability for all, allowing anyone to turn heaps of complex data into actionable insights using everyday language and seamlessly integrated platform experiences.

Splunk AI

Learn about Splunk AI, including embedded artificial intelligence capabilities, assistive intelligence experiences, and customizable machine learning tools.

Dynatrace Davis AI

Meet Davis, our radically different AI Engine built for today’s web-scale modern cloud with precision you can rely on. Start your free trial today!

Snyk DeepCode AI

DeepCode AI code autofix empowers developers with efficient & accurate AppSec solutions. Book a demo to try the fastest AI code review tool on the market.

Static Application Security Testing (SAST) Tools

FindBugs

A program which uses static analysis to look for bugs in Java code. It is free software, distributed under the terms of the Lesser GNU Public License

Bandit

Bandit is a tool designed to find common security issues in Python code. To do this, Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files, it generates a report.

Brakeman

Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications.

Kubesec

Security risk analysis for Kubernetes resources.

Snyk

Enable developers to build securely from the start while giving security teams complete visibility and comprehensive controls.

SonarQube

Empower development teams with a code quality & security solution that deeply integrates into your enterprise environment that enables you to deploy Clean Code securely, consistently and reliably.

Wiz

Wiz is the unified cloud security platform with prevention and response capabilities, enabling security and development teams to build faster and more securely.

Open Policy Agent

Policy-based control for cloud native environments.

Codacy

Build clean, secure code efficiently and fearlessly with Codacy Platform.

Coverity Scan

Coverity Scan is a service by which Black Duck provides the results of analysis on open source coding projects to open source code developers that have registered their products with Coverity Scan.

Veracode

Adaptive application security for the AI era. Build and run secure software from code to cloud with Veracode.

Trivy

Use Trivy to find vulnerabilities (CVE) & misconfigurations (IaC) across code repositories, binary artifacts, container images, Kubernetes clusters, and more. All in one tool!

Mend

Mend.io gives you all the tools you need to build a mature, proactive AppSec program that effectively manages application risk.

Dynamic Application Security Testing (DAST) Tools

Zed Attack Proxy

The world’s most widely used web app scanner. Free and open source.

Invicti

Get accurate, automated application security testing that scales like no other solution. Secure 1000s of web assets with less manual effort. Reduce your risk with the only….

Veracode Dynamic Analysis

Discover Dynamic Application Security Testing (DAST) from Veracode to detect runtime vulnerabilities and secure your applications.

PortSwigger

PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.

Nuclei

A fast and customisable vulnerability scanner powered by simple YAML-based templates.

Supply Chain Security Tools

Chainguard

Discover Chainguard's hardened, vulnerability-free container images designed to keep your infrastructure secure and efficient.

Snyk

Enable developers to build securely from the start while giving security teams complete visibility and comprehensive controls.

Mend

recommended

Mend.io gives you all the tools you need to build a mature, proactive AppSec program that effectively manages application risk.

DependaBot

You can use Dependabot to alert you when your repository is using a software dependency with a known vulnerability.

Patcher

same-author

Keep IaC up to date, even with breaking changes.

ReversingLabs

Software Supply Chain Security, Threat Intelligence, and Threat Analysis Solutions.

Ox Security

Scale your AppSec with continuous scanning and analysis of software vulnerabilities.

GitGuardian

recommended

Secure your SDLC and Non-Human Identities (NHIs) with GitGuardian 🔐 — detect secrets in code, repos, and tools. Available as SaaS or Self-Hosted.

Anchore

Anchore's SBOM-powered modern SCA platform is trusted by the U.S. department of defense and Fortune 500 companies around the globe.

Syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems.

Sonatype

Accelerate innovation with secure software supply chain management from Sonatype, a Leader in Forrester Wave: for SCA. Trusted by 2000+ organizations.

RapidFort

Build secure containers with RapidFort's near zero CVE images and automated CVE remediation. Support for Java, Python, Go, and more. Speed up releases and simplify compliance. Start your free trial today!

Secure Application Framework Tools

Tauri

The cross-platform app building toolkit.

Deno

Deno features improved security, performance, and developer experience compared to its predecessor. It's a great time to upgrade your Node.js project to run on Deno.

WebAssembly System Interface

The WebAssembly System Interface (WASI) is a group of standards-track API specifications for software compiled to the W3C WebAssembly (Wasm) standard. WASI is designed to provide a secure standard interface for applications that can be compiled to Wasm from any language, and that may run anywhere—from browsers to clouds to embedded devices.

Internal Developer Platform Tools

Backstage

An open source framework for building developer portals. Powered by a centralized software catalog, Backstage restores order to your infrastructure and enables your product teams to ship high-quality code quickly — without compromising autonomy.

Humanitec

Humanitec empowers platform engineers to build the perfect Internal Developer Platform for the enterprise. Our products enable platform teams to reduce cognitive load, drive standardization and slash time to market.

OpsLevel

Boost developer experience with OpsLevel – an internal portal unifying tools, knowledge, and tasks to help teams focus on coding, not operational roadblocks.

Cycloid

Cycloid's engineering platform helps you revolutionize software delivery, unlock hybrid cloud, and bring the best experience to your end-users.

Cortex

Cortex is the internal developer portal that cuts noise for developers with paved paths to production. Catalog, score, and drive action to improve software.

Roadie

Roadie is the most customizable Internal Developer Portal with built-in best practices, automated workflows, actionable insights built on Backstage.

Port

Port allows developers and DevOps to build a service/software catalog, and enable developer self-service actions.

Compass

Try Compass, the internal developer platform from Atlassian to improve your developer experience, catalog all services, and increase software health.

Qovery

Qovery is a DevOps Automation Platform that eliminates your DevOps hiring needs. Provision and maintain a secure and compliant infrastructure in hours - not months!

Interactive Playbook Tools

RunDeck

Enable anyone to safely execute self-service operations tasks that previously only subject matter experts could perform.

Runme

recommended

Runme turns your documentation into interactive notebooks for operating cloud infrastructure. Put another way, you can use your docs the way you use your terminal, instead of just as a reference that tends to go out of date.

Stateful

DevOps process made easy to run and share through Runme Notebooks.

SmartPlaybooks

Discover the art of automation with Business Playbooks and Runbooks. Simplify complex tasks, optimize processes, and achieve business excellence.

Doctor Droid

Doctor Droid is an AI teammate that continuously monitors your alerts, and investigates issues by integrating with your monitoring tools & understanding your company's context (Playbooks).

Jupyter Notebooks

The Jupyter Notebook is a web-based interactive computing platform. The notebook combines live code, equations, narrative text, visualizations, interactive dashboards and other media.

Infrastructure from Code (IFC) Tools

Ampt

Ampt helps teams rapidly build, scale, and manage JavaScript apps on AWS by automatically configuring and optimizing cloud environments.

Nitric

Nitric Open Source Cloud-Native Framework auto-provisions infrastructure for your app from any language for any cloud. Launch now with AWS, GCP and Azure.

Modal

Bring your own code, and run CPU, GPU, and data-intensive compute at scale. The serverless platform for AI and data teams.

Shuttle

Develop backends with zero infra setup using Shuttle: Code-driven cloud provisioning.

Klotho

Klotho is a modern developer-first infrastructure-as-code tool for public cloud.

Encore

Encore is an AI-native Open Source Framework for building robust distributed systems, using a declarative approach ensuring performance, security, and quality.

« Previous chapter | Full outline | Next chapter »

Comments