Is Tool Integration in DevOps Doing More Harm Than Good?

Managing an ever-expanding DevOps toolset can be both a blessing and a burden. With organizations navigating a diverse IT landscape and striving to stay competitive, the question arises: Are we overcomplicating our tech stacks, or are we genuinely leveraging these tools for meaningful progress? 

To get a deeper understanding of these challenges and the path forward, we spoke with Prashanth Nanjundappa, VP of Product Management at Progress. With over 20 years of experience in the tech industry, Prashanth shares his insights on optimizing tool integration, balancing automation with human expertise, and ensuring that modern DevOps practices deliver real value.

1. With DevOps teams swimming in tools, are we reaching a point where tool integration is doing more harm than good? How can we rethink integration to give teams time back while keeping the system cohesive?

The current IT landscape is heterogeneous, with a mix of public cloud, private cloud, SaaS products, and devices on edge. Additionally, buying decision-making is decentralized from CIOs to multiple teams within an organization. This requires a strategic approach to streamline tool integration.

• Implement an extensive strategy at the corporate or organizational level. Examples include adopting policy as code, prioritizing API-first integration, creating an in-house self-service portal, or integrating everything into a unified platform such as ServiceNow, Salesforce, or Jira.
• Choose products that support the chosen strategy instead of purchasing tools first and trying to fit them into the strategy. For instance, consider API-first tools, Code-first tools, SaaS tools, or ones that integrate with your existing toolchain, like Jira, ServiceNow, IaC, or Salesforce.
• Minimize the number of vendors. Since many vendors offer multiple solutions, explore the offerings from existing vendors in your system rather than acquiring new tools for every new requirement. This approach will reduce both vendor management complexity and integration challenges.

2. Unplanned tasks seem inevitable in complex infrastructures, but how do we stop them from becoming the norm? Are we overcomplicating solutions by relying on in-house fixes, and what alternatives exist that can scale without constant firefighting?

Organizations often fall into the trap of thinking they can build their tools. If your company doesn’t specialize in infrastructure management, don’t create tools for it. While open-source software seems free, it requires significant engineering effort to develop, maintain, scale, and secure. Avoid these costs by partnering with a trusted provider so your team can concentrate on core business goals.

Secondly, tools should be incorporated into the system of records or configuration management database (CMDB) tools during the initial setup process. This provides management with visibility into infrastructure usage, tool usage, and planned or ongoing tasks. By gaining this visibility, organizations can better understand and continuously optimize their processes.

3. Orchestration control often gets overlooked, yet it’s the backbone of efficiency. What’s the most common orchestration bottleneck that DevOps teams don’t discuss, and how do we break free from these delays?

I would not say orchestration gets overlooked; effort for orchestration is almost always underestimated. Multiple tools and workflows make it difficult for administrators to maintain and manage IT devices in large and complex environments. To handle such scenarios, orchestration is required. Orchestration brings people, tools and workflows together and streamlines IT processes. With an enterprise orchestration platform, administrators have flexible and granular control over numerous fleet actions, including targeting and timing dimensions. Processes, from routine tasks to critical incident responses, become fast and efficient.

In case of an incident, following these steps will help reduce the impact of the incident and remediate the root cause:

• Orchestrate responses to endpoint security incidents by automatically isolating compromised devices or initiating a threat-hunting process.
• Orchestrate the deployment of security patches to vulnerable systems or isolate systems until they can be patched.
• Develop and implement incident response cookbooks that define specific actions to be taken during different types of incidents.
• Launch a job responding to situations like compromised user accounts or login failures by automatically resetting passwords, logging out of sessions, or taking other pre-defined actions.
• Maintain shared responsibility among incident response teams by facilitating communication and collaboration.

4. Is the shift from traditional DevOps to modern environments really delivering on its promises, or are we just adding more tools to the pile? How can we ensure that a ‘modern’ setup is truly more efficient rather than just more complex?

DevOps adoption is a journey to accelerate the development and deployment process to reduce time to market without compromising quality. Traditional DevOps focuses on effectively integrating Development and Operations teams; this doesn’t factor in Security teams as key collaborators. Modern DevOps doesn’t consider security an afterthought but integrates it into key workflows. It’s also referred to as DevSecOps.

DevSecOps empowers organizations to optimize the deployment of secure, efficient, and responsive software. Embedding from the outset to Dev and Ops teams helps fortify software against threats, enabling robust protection. This approach also leads to quicker delivery times, providing organizations with a competitive edge in dynamic markets.

Collaborative teamwork across departments enhances efficiency and resilience, while continuous monitoring bolsters rapid incident response. Automation streamlines processes, reduces errors, and promotes consistent quality. Modern DevOps (AKA DevSecOps) doesn't just adapt to change—it thrives in it, aligning software with current needs and future aspirations.

5. How can we optimize the use of multiple automation tools to ensure they enhance productivity rather than becoming a time-consuming burden for IT teams? 

Transitioning to a fully integrated model is an ongoing journey, even for the most advanced organizations. The DevOps maturity model is one framework that guides this journey, helping to evaluate and enhance the incorporation of security into DevOps practices. 

A key challenge is efficiently identifying and improving crucial areas in DevSecOps practices, which requires regular assessment, process adaptation, and gap identification. Through continuous evaluation and improvement, organizations strive to achieve speed and high-security standards in their DevOps practices. As a result, they maximize the benefits of multiple automation tools and productivity.

A typical DevOps-based automation process involves multiple operations captured in the following image.

We recommend organizations focus on these elements from the DevSecOps Maturity model to measure their own DevSecOps maturity and find areas of improvement to reduce time to market and optimize costs:

1. Organization Cultural Alignment: An identified champion, the level of collaboration and communication between teams. 
2. Development Agility: Capability to deliver incremental functionality at a cadence that can react to market pressures.
3. Automation: How well are processes automated, and what is the extent and effectiveness of automation in the overall lifecycle?
4. Security: Integration of security with other functional areas and in the overall lifecycle. 
5. Testing: Integration of testing methodologies with overall processes and effectiveness of practices involved. 
6. Monitoring: How is monitoring integrated with overall processes, and how is it effective?
7. Operations Measurement and Compliance: Operational effectiveness, including governance, comprises measurement and compliance.

The DevSecOps Maturity Assessment is an essential tool for organizations looking to evaluate and enhance their implementation of DevSecOps practices. This assessment provides a high-level evaluation of an organization's operational maturity, explicitly tailored to its use of DevSecOps tools. It assesses how effectively an organization utilizes these methodologies to their fullest potential, offering insights into evolving areas and those that have matured.

Takeaways

As DevOps continues to evolve, thoughtful integration, continuous evaluation, and striking the right balance between automation and human expertise will keep you ahead of the pack.

Prashanth emphasizes the importance of leveraging a cohesive strategy and understands that adopting more tools doesn't necessarily mean better outcomes. Instead, success depends on optimizing the tools and the teams using them.

By focusing on DevSecOps maturity and aligning automation with organizational culture, DevOps leaders can build a system that enhances productivity and resilience, truly thriving amidst rapid change.

Subscribe to The CTO Club’s newsletter for more DevOps interviews, tools, and best practices.