Revolutionizing DevOps: The Power of AI with Shawn Ahmed at Techstrong Con 2024

Hello everyone. Really glad you guys can join us for this, uh, keynote. And we're here to talk a little bit about AI and the role that AI is playing in the, uh, developer, uh, landscape, or particularly how it's helping revolutionize and how you can think about DevOps and using AI in there.

So it's exciting times. If you are a developer today, um, you have, uh, a lot of options on the table. Uh, there are coding assistance of all kinds that are, uh, being released into the market, and many developers have already started adopting using actively, uh, solutions like GitHub, uh, copilot and other types of coding assistance.

But behind all of them are large language models with generative AI capabilities, uh, that are being used. And, uh, and the promise is, is, is, is amazing, uh, for what this can do. So if you're a developer, there's so much promise with generative ai, uh, one of the biggest ones being code generation, right?

You are trying to get as many bytes of the apple as you can as a developer. You want to be able to code as much as possible of your time during your day. That's where you really wanna spend your time.

I think developers are passionate about doing that. That's why they became developers to begin with. So whether you're using copilot and generative AI to sort of create snippets of codes, whether you're generating or using templates of certain things or an entire program, um, it's an amazing time to be, uh, using assistance to sort of just generally become a lot more efficient with your code and learning it and taking some types of tasks and, and, and passing them off to the assistance that you are repetitive in nature or, or, or things like that.

And that generally is going to help you generate a whole ton more code than potentially what you were doing, uh, before. Some would say, you know, upwards of maybe 20, 30% efficiency, uh, by using code assistance and not only in the actual generation of code, but you could be using it also for things like being able to test and debug the code that you're doing and automate some of those processes and well, lots of efficiency gains there as well. All in all, if you package it up in the aggregate, uh, look, it's all about the productivity gains that you want to have as a developer, um, so that you can get, uh, to have more bites at the apple that I think.

So it's, it's an amazing time, no doubt about that. But here's the challenge. Many surveys will show and talk about how much time we actually spend coding.

And, uh, depending on what study you you're looking at, your mileage may vary. Some studies like this one have developer time spent of innovating and coding at 11%. Others will talk about them as 20 to 30%.

And I think that that's kind of where the spread between all kinds of studies are, which means that a tremendous amount of time is actually being spent elsewhere doing tasks that have nothing to do with the actual part that a developer we love to do, which is to code. Um, and so the question then is if, uh, we have these assistance, these generative AI assistance, and we can create more code and so on and so forth, but to begin with, our time is limited to this sort of spread between 10 to say 30% of our time being spent on coding itself. What exactly is all the other places we might be ending up spending our time?

It's often around all the things that have nothing to do with coding. It's the around coding things like deployments, um, things like debugging code when it fails, things like regression testing, uh, questions and answers associated with security issues that the code might have. And, and, and troubleshooting, debugging some of that.

Uh, things like ensuring that the code is compliant, that your development practices are compliance when failure occurs, when a release engineer has released the code debugging and, and sort of going on an investigatory trail as to where the underlying root cause for why the code may have not worked as it went into production. What's happening there? Vulnerabilities that are popping up.

The idea that we have to write all this documentation along with the code that we're actually generating and creating and, and, and, and, and all of these requests, that's all the various places where you are spending up the time. So the question is, if we're generating so much efficiency using generative AI assistant to actually code what happens to all the things around it, will it be able to keep up? And that's really where the opportunity I think resides.

So let's examine a few of these areas. Take for instance, your CICD automation pipelines. They play a crucial role.

They're really the system of record for you in terms of how software delivery is done within your organization for a particular application for a typical service, or may it be a line of business or a team. These CIC set CD pipelines have everything from how the actual code's supposed to be built, how it's supposed to be tested, where and how it's supposed to be deployed. And, and, and you run this, uh, over and over again as you commit and, uh, bring code back and are ready to sort of see if it works.

Um, questions you need to then ask yourself is, is is really how static are those, or how dynamic are these pipelines? Very often you're looking at linear processing of, of, of a pipeline and, and, uh, and a processing pattern that is very EC static in nature. It's, uh, input codes that says, uh, either you succeeded, uh, or exit codes that say you didn't succeed.

And very often the task of a failure in the CICD pipeline, uh, is up to you to debug and have to figure out where did it fail, why did it fail? Uh, think also about sort of the, uh, processing part of it. Um, you have certain amount of hours time during the day as you're coding, and these build pipelines are gonna, uh, run.

And if you are generating say, 30, uh, 40% more code that has to be tested, that probably means that you're executing these ci cd pipelines to run an equivalent amount of times more often. And so to ensure that you're sort of chunking down your code into manageable pieces that are being tested, uh, to see if it works or not, uh, quite more often than than possibly today, uh, will it be able to keep up? Do you have the compute?

Do you have the compute to be able to do it? Do you have the storage associated with that? Uh, with the time being one thing that you can change.

So if you're in an eight hour day, do you have the compute time to, uh, you know, merge code 2, 3, 4, 5 times maybe more often than you did before and run the CICD pipeline? What is that requirement going to be for you? And, and given that these are static, um, will you be stuck more?

Think about the idea of quality of the code. Uh, a lot of times these generative AI assistance will generate the code, but can you, um, conceivably say that the quality of them, uh, are exactly what they need to be? Uh, and, and should they, for instance, have some sort of failure?

Uh, how much time would it essentially take you to ensure that the code that has been generated by the generative AI assistant, uh, is actually accurate? And given that you didn't write it? Odds are you're gonna have to look at the code and understand what act actually happened, what was written and, and, and how it was written.

So the time, uh, that goes into learning the code you didn't write, because you still have the responsibility of the quality of that code is another question in determinant that you have to think about as you go through the process of using generative AI assistance. So that's another factor. Maybe consider it almost as a shift of time that you're spending, you know, you gain back a whole much more code so you, so you're so much more efficient on that side.

But that's that mean that that productivity and efficiency gain you gained in the coding practice itself now has shifted to more time needing to be spent elsewhere. IE understanding code that you didn't write, what's the actual assurance of quality that you can give to the people who are gonna use that code? And how much of that can you, for instance, automate think about security issues, compliance issues?

Think about the challenges that that presents itself. For instance, um, when you have rules and you're, you, you have certain security practices, odds are that you probably have certain scans that you are running throughout the process, whether it's SaaS scans, desk scans, or if you think sort of broader across the actual software development life cycles, you might be thinking about binary issues and security issues that you're scanning for and feedback you're getting from infrastructure specifically. Uh, all of these, uh, sort of security vulnerabilities go back and they're executed very often in the pipeline and comes back to, to you the developer, uh, the developer has to kind of think through and go, well, uh, now that I'm generating an extraordinary amount more code and we have gained all this efficiency, have we, uh, made ourselves less secure?

Or have we made ourselves more secure? Or are we in a neutral state? Uh, assuming that you are in a neutral state, let's think about the next step, which is now these security vulnerabilities that are coming up.

Uh, if there's so many more of them, do we actually have the time to actually go through and deal with them, uh, as they are popping up in case certain things around the software development process has changed, maybe a database has changed, maybe some security settings in the infrastructure has changed, and so on and so forth. And as these CVEs gets raised based upon the code changes that you didn't write, compare that and add an aggregate to the fact that this is running in a static CI slash CD pipeline and the fact that your responsibility for the actual assurance of the quality of the code, uh, what does that mean in terms of the time that you're now going to spend towards security issues and so on and so forth. Uh, and how automated is that process for you?

And finally, I think another area that is definitely worth, uh, sort of asking yourself what the impact is going to be is on the actual software releases itself. So you created the binary, you've written the software, it's gone to the quality assurance, it's gone through the testing. Every organization today has a certain sort of model for how often they release software into production and so on and so forth.

Uh, and it's sort of keeping up pace often with and trying to have an equivalence sort of from a process perspective to how much code is being generated and how much points of code if or points of work that we have and, and, and how often we wanna get that into production. Uh, for some companies, large companies, that could be multiple number of releases a day, but for others it could be a release a week, it could be a release a month. It all depends on the business type of application and so on and so forth.

But odds are that if you're generating, uh, more code, uh, then you're gonna be releasing more often as well. And what is the impact of those releases into the production environment, to your user experience and so on and so forth. These are all areas that are absolutely worth thinking about as it, um, becomes more and more common to be using generative ai, uh, in your process.

So that kind of leads me to the opportunity itself. What is it? It's really, how do we answer all these challenges?

It's actually answering AI with injecting AI into the DevOps process. And that really, truly, in many ways is the true big opportunity I see ahead for the market for, for companies, for, for DevOps team members and platform engineers, operations teams. It's really thinking about this DevOps process no longer as a static set of pipelines.

But what does it mean to have a continuous DevOps systems? And this is where I think that AI equally can play a part for the DevOps part as well, not just for the code generation. And that is how do I make all the operational systems that operate my CICD pipeline more autonomous?

How do I integrate AI into them so that they can be a little much more self looping? This idea that a pipeline and a system that is continuous has the ability to self-soothe. In other words, if errors occur, do I have the opportunity in a system that allows me to use generative AI to actually take the result of a failure and be able to analyze what is it that failed?

And is it a known error? Is it something that we know how to fix? Have we had these types of errors in the past?

And if so, can we automatically fix them? Because we know with a very high degree of certainty that we can fix these things. That could be things like, uh, imagine a security vulnerability that pops up.

Uh, if we know that a security scan in the pipeline, uh, that was automated filled and a CBE was generated, can you create automatically a ticket, uh, for what that is? Can you propose essentially affixed to the code that would be simple enough to actually fix it? Can the system automatically then generate a merge request and fix the code for you and rerun the pipeline again and show the history of how it went about doing a full autonomous loop of the tasks itself?

And think about that as a continuous DevOps system. That means that you can take each one of these various areas that are out there, whether it might be the debugging step, whether it's the release step, whether it is the actual security and compliance step, whether it's the CICD pipelines, each one of these various specific tasks that you are operating, self looping. Can each one of these be, and if so, what are the opportunities for me to make self-healing end to end?

That's sort of how I think about what we can do as DevOps practitioners to ensure that the systems can actually keep up with the tremendous amount of productivity gains, efficiency gains that developers are having on the generative AI side, because this will be the only way that we can keep up in terms of both speed compute, uh, with, with the, the efficiency gains that we're seeing on the code, uh, side and not fall behind. Uh, so many of these things will have to be a lot more triage centric and oriented in order to be executed. That is my, uh, challenge to you.

That is my challenge to us as an industry on the tool side as well, which is to say these tools have to evolve, right? So, uh, don't, uh, think that the, you will have to inject and build all of this autonomous nature on your own, but I would also look at the systems itself that you're using and ask the question how much of these systems, uh, and tools that you use for your CICD, how well are they around these horizontal use cases? How do they provide me with the opportunity to generate a rule system and a regulation system for how these CICD pipelines can be automated such that the system can actually operate and keep up with these code changes that will occur and this additional efficiency gain that is there?

And many, many, many vendors and tools in the market are integrating generative AI and some of the logic and evolving sort of this into sort of a autonomous agent type of infrastructure. So don't ignore that, that is a huge opportunity as well. So the tools, the self looping nature of your, uh, systems and creating a DevOps, that is how we then keep up with all the dev, uh, developer efficiency and gains on the front end, which is the coding side.

All the best to you. Good luck and enjoy the conference. Thank you.