IBM Feature Trails

The Data Prep Kit (DPK) is an open-source toolkit with 20+ modules for pre-processing data for code and language. It supports ingestion, document annotation, filtering, and redaction of private information, enabling developers to build end-to-end data pipelines from ingestion to tokenization. DPK modules can scale from laptop to datacenter and integrate with frameworks like Ray and Spark, offering APIs for Python, Ray, Spark, and Kubeflow Pipelines. It has been used to produce pre-training data. Elyra extends Jupyter Notebooks with AI-centric extensions, including a visual editor for building Notebook-based AI pipelines, enabling the conversion of notebooks into batch jobs or workflows. It supports hybrid runtime environments via Jupyter Enterprise Gateway for distributed clusters like Spark and Kubernetes, and allows Python script execution. Git integration provides versioning and collaboration, and a shared configuration service simplifies workspace management. Elyra's pipeline visual editor was derived from IBM Watson Studio.

Introduces adapter-based access control for LLM inference, enabling fine-grained, per-query authorization by attaching lightweight, domain-specific model extensions (adapters) to a single shared base model. This approach addresses the challenge of preventing LLMs from leaking confidential information by enforcing access policies at inference time, rather than relying on post-hoc filtering or costly private silos. The secure-inference project integrates with the llm-d framework, utilizing LoRA adapters and Open Policy Agent for policy-enforced routing.

This post introduces the concept of AI accelerating vulnerability discovery and exploitation, highlighting the shrinking response window for CVEs. It discusses the impact of AI on the software supply chain and the challenges posed by widespread open-source dependency reuse. The post also touches upon the need for organizations to maintain dependency inventories, identify unsupported frameworks, and consider extended support models for critical components. It uses the Spring ecosystem as an example to illustrate the volume and severity of disclosed CVEs.

The terraform-ibm-modules project provides a collection of production-tested, IBM-supported Terraform modules for building and managing IBM Cloud infrastructure. These modules encapsulate best practices for service configuration, security, compliance, and scalability, enabling faster and more reliable infrastructure deployments. The project also integrates with AI assistants via the Model Context Protocol (MCP) server to facilitate AI-assisted infrastructure composition.

Cassandra is evolving to meet the demands of AI-driven applications, offering native vector types for Approximate Nearest Neighbor (ANN) searches, ACID transactions for reliable data updates, and an improved Unified Compaction Strategy (UCS) for enhanced performance and resource efficiency. These advancements position Cassandra as a robust solution for large-scale AI data storage and retrieval.

watsonx Orchestrate, an agnostic multi-agent orchestration platform, enhances its developer experience with the Agent Development Kit (ADK) and Agent Builder. The ADK provides a pro-code, Python-based toolkit for building, testing, and deploying AI agents, offering control over agent lifecycle, tool definition, behavior configuration, and connections via Model Context Protocol (MCP). The Agent Builder offers a no-code interface built on the ADK. New features in the June 30 release include agent reasoning modes (Default vs. ReAct), new channel integrations (WhatsApp, Teams), an improved Connections UI for external app management, beta voice configuration, and an ADK native evaluation framework for testing agent behavior through simulated interactions and ground-truth datasets. The platform supports knowledge grounding via document upload or vector databases, custom tools, collaborator agents, and behavioral instructions.

IBM Instana and Lightrun integration enables shift-left observability for developers, allowing real-time telemetry (logs, metrics, traces) to be added to live applications from the IDE. This data is visualized in Instana, streamlining debugging and improving developer productivity in cloud-native environments. The integration involves Lightrun transmitting metrics to its management server, which can then export to a StatsD daemon, and subsequently forward to Instana. This post introduces the App. IBM MQ Developer Edition for Raspberry Pi OS enables running MQ on resource-constrained devices, demonstrating multi-instance queue managers and clustering for system resilience, and includes setup instructions for the MQ Console with local OS authentication.

IBM Z and Cloud Modernization Stack on AWS enables mainframe application modernization by providing capabilities for API creation (z/OS Connect), cloud-native development for z/OS applications (Python, Node.JS, GoLang, COBOL, PL1, Java, Assembler with IDEs, AWS CodeCommit, CodeBuild, Wazi sandbox, Wazi Analyze), and enterprise automation across z/OS and AWS (Ansible cookbooks, GitOps, IaC on Red Hat OpenShift Cloud Platform on AWS). It aims to accelerate modernization, enable new business models, and integrate mainframe systems with cloud services.

SysML V2 is a new, ground-up redesign of the Systems Modeling Language, offering a more precise, expressive, and flexible textual and graphical notation for designing complex systems. It enhances interoperability, automation, and integration with tools (including AI), and provides improved capabilities for modeling system structure, data, behavior, and requirements. It aims to streamline systems engineering processes, boost coordination across domains, and enable real-time consistency.

This post introduces the Granite 3.2 models, which include new reasoning capabilities for language models and the first vision model. These models enable developers to build applications that can process and reason over multiple data types, such as text and images. Examples include turning PDFs into FAQs using multimodal RAG, debugging code from screenshots, building personal stylists, creating AI research agents for image analysis, and managing budgets from images of spending history. The post also points to tutorials and a cookbook for further exploration.

IBM Envizi Suite's Supply Chain Intelligence Scope 3.1 module and Product Carbon Footprint (PCF) 3.1 module have achieved full certification within the Catena-X ecosystem. This integration enables seamless data exchange and compliance with Catena-X principles, including data sovereignty and interoperability, for automotive manufacturers. The solution provides capabilities for tracking product carbon footprints, optimizing supply chains, and enhancing data-driven decision-making through advanced analytics, AI, and IoT technologies. Key data types mapped to Catena-X standards include compliance, product, and organizational data, streamlining processes and improving sustainability tracking.

This post introduces a new capability for IBM AIX 7.3 TL3 and later, allowing live kernel updates to be performed while maintaining active Internet Protocol Security (IPsec) tunnels. This is achieved through a new `ipsec_auto_migrate` attribute in the live update configuration, which automates the disabling and re-enabling of IPsec subsystems during the update process. The post details the changes in live kernel update stages, configuration steps, and outlines limitations such as a brief window of unencrypted traffic and the re-establishment of fresh tunnels.

IBM has released a suite of open, performant, and trusted LLMs under the Granite family, including Granite 3.2 which adds new reasoning capabilities and the first vision model. These models are available on Hugging Face and can be deployed locally. IBM has also contributed to Hugging Face projects like Text Generation Inference server (TGIS) and Parameter-Efficient Fine-Tuning (peft), and created the Caikit open-source project for serving, training, and deploying models with consistent APIs. This post details how to leverage the Matrix Math Accelerator (MMA) on IBM Power10 processors for AI inferencing, demonstrating performance gains through optimized libraries and a container-based demo framework across various real-world scenarios like image detection, action recognition, and fraud detection.

The IBM Cloud Deployable Architecture Builder extension for VS Code allows developers to manage projects, create and manage private catalogs, validate and deploy Deployable Architecture (DA) products using modifiable templates, and set DA inputs and outputs directly within the VS Code environment. This streamlines the DA workflow from product creation to deployment.

Helm 3 introduces a client-only architecture, removing Tiller and enhancing security by delegating access control to Kubernetes user cluster security. Release storage has been updated to use Secrets in the release's namespace, with a new naming convention. Chart dependencies are now declared in Chart.yaml, and library charts are supported. CRD support is simplified, and the test framework has been updated. The XDG base directory specification is now supported for Helm state information.

This post introduces the integration of IBM watsonx.data with Cloudera, focusing on unified data management, analytics, and AI-driven innovation. It highlights how the combined platforms enable seamless data access across hybrid and multicloud environments, support unified analytics and AI workloads, ensure interoperability with open data formats, enhance data governance through integration with Apache Atlas, optimize performance for diverse workloads, and leverage low-cost object storage. Use cases in telecom and financial services are presented, emphasizing cost optimization, improved data integration, and faster time-to-value. The goal is a unified metadata repository.

IBM Granite.Code is an AI coding companion that integrates with VS Code, powered by the Granite LLM for code. It offers features like code generation, explanation, documentation, translation, and unit test generation. It supports numerous programming languages and offers a self-hosting option via Ollama.

IBM Wazi as a Service provides on-demand access to z/OS virtual server instances in the IBM Cloud for development and testing. It integrates with the Wazi family of editors and DevOps tools, offering a cloud-native development experience. Users can spin up pre-configured z/OS development systems, customize them using Ansible playbooks for tasks like code compilation and debugging, and build custom Wazi images with the Wazi Image Builder. The service aims to streamline z/OS development workflows and align with cloud-native best practices.

This post introduces best practices for optimizing Apache Spark applications, focusing on reducing I/O, improving CPU utilization, and leveraging in-memory computation. It covers techniques such as optimizing file formats (Parquet, ORC), tuning parallelism and shuffle partitions, filtering data early, appropriate caching strategies, optimizing join operations (BroadcastHashJoin), tuning cluster resources, avoiding expensive operations, addressing data skew, and utilizing efficient UDFs (pandas UDFs). It also details how to use the `explain` API and Spark UI to analyze query execution plans for debugging and performance tuning.

IBM Cloud Projects offers features for managing infrastructure, providing insights into account billing, security, and compliance. It integrates with tools like Event Streams for reliability engineering alerts and helps identify and remove unused resources. The system allows users to bring existing resources into a project by providing credentials (API key or Trusted Profile) from the relevant account, selecting resources to tag, and applying changes. This streamlines account management and cleanup processes.

This post details the installation of Red Hat OpenShift 4 on a laptop using Red Hat CodeReady Containers (CRC), an open-source alternative to Minishift and Minikube. It covers prerequisites, hardware requirements, installation steps, configuration options (memory, pull secret), starting and stopping the cluster, accessing the cluster via CLI and web console, and notes on certificate expiration. It also mentions a sample project, Cloud Native Starter, for testing deployments on CRC.

This post introduces watsonx Discovery, an add-on to watsonx Assistant that leverages generative AI for informational tasks. It utilizes an IBM-packaged Elasticsearch for semantic, federated, and vector search over business content. This enables conversational search powered by retrieval-augmented generation (RAG), combining a chat interface, a robust retrieval system, and enterprise-ready LLMs. It contrasts with Watson Discovery, which focuses on document understanding and processing for intelligent business processes. watsonx Discovery is designed for scalable, content-grounded conversational answers, supporting English language and available on Cloud Pak for Data.

IBM BAMOE v9 is a cloud-native business automation solution integrating BPMN and DMN with open-source tools for hybrid clouds. It offers enhanced collaboration via wider Git repository support, rapid coding with Quarkus and Kogito for hot-reloading and auto-generated APIs, cost-efficient serverless decisions, seamless event-driven capabilities with Kafka integration, and cloud-centric design with Red Hat OpenShift support. The process engine supports straight-through process scenarios and integration with external services. Migration paths are provided for Red Hat V6.x, V7.x, and V8.x, as well as from IBM BAMOE v8.0.x to v9.0.1. Prerequisites include JDK 11+, Maven 3.8.6+, VS Code, and IBM BAMOE Developer Tools.

Kubeflow Pipelines V2.0 introduces a platform-neutral Intermediate Representation (IR) for ML workflows, improving portability and metadata richness. Optimizations for the Tekton backend include a dedicated custom task controller to reduce latency and throughput for drivers and publishers, and integration of driver and task construction logic into a single reconciliation cycle to decrease the number of queued tasks. The `finally` clause in Tekton Pipelines allows for guaranteed execution of tasks. This post extends Tekton Pipelines to support Python applications by integrating with OpenWhisk Python runtimes and leveraging Knative.

This post introduces a method to enable SFTP integration for containerized applications, allowing legacy applications that rely on SFTP to be migrated to cloud-native environments like Kubernetes. It explores three solutions for managing SSH private keys: external vaults (AWS Secrets Manager), Kubernetes Secrets, and packaging keys within the container image, recommending the external vault approach for better security and key rotation management. The solution is demonstrated using Amazon EKS and a Kubernetes CronJob.

COBOL Check is a unit testing framework for COBOL that enables testing of individual code sections. It supports test-driven development (TDD) and test-driven learning (TDL), allowing developers to refactor code, create test scenarios, and learn through testing. The framework can be integrated into CI/CD pipelines using tools like Bitbucket and Jenkins for automated testing and quality gates. It is available for z/OS systems and can be downloaded from its GitHub repository.

This post argues that serverless computing is the future of cloud computing, driven by environmental and cost efficiencies. It highlights Knative as an example of a serverless implementation on Kubernetes, detailing how it automates resource scaling to match demand, thus reducing waste and energy consumption. The post also touches upon the potential for further energy savings by suspending worker nodes when data center capacity is high.

This post details the migration of a Python monorepo from Bazel to Pants, focusing on improving CI times, developer experience, and reducing build metadata. The migration was phased, starting with formatters and linters, then tests, then binary rules, and finally Docker images. Key technical achievements include dependency inference, changed file detection, and the reduction of Bazel metadata from 19,000 lines to 2,400 lines of Pants metadata, resulting in CI times dropping from 10-12 minutes to under 4 minutes.

The IBM z15 is a mainframe system featuring a new IBM Telum processor with integrated AI acceleration. The system supports up to 40TB of memory and 200 processors across four frames. It also includes a Crypto Express7S adapter for quantum-safe cryptography. The z15 also introduces a 19" rack form factor and options for air-cooled or water-cooled configurations.

The AI Privacy toolkit provides a method to reduce the amount of personal data needed for machine learning model predictions by removing or generalizing input features without significantly impacting accuracy. This helps adhere to data minimization regulations like GDPR and reduces security risks associated with large datasets. The toolkit can determine the minimal set of features and their required detail level for a given trained model. It has been applied to classification models and research is ongoing to extend it to regression and integrate with XAI and interpretability techniques. The technology is also being evaluated within the iToBoS project.

ModelMesh, a model serving management layer for Watson products, is being contributed to the open-source community as ModelMesh Serving. It is designed for high-scale, high-density, and frequently changing model use cases, intelligently loading and unloading AI models to balance responsiveness and computational footprint. ModelMesh integrates with KServe, becoming the backend for Multi-Model Serving. It features distributed LRU cache management, intelligent placement and loading of models, resiliency through retries, operational simplicity with decentralized control, and scalability supporting hundreds of thousands of models.

Node.js 15 introduces significant changes to how unhandled promise rejections are handled, defaulting to termination rather than warnings to improve debugging. It also includes N-API Version 7 with new methods for array buffer manipulation, and refinements to the experimental Async Local Storage APIs. npm 7 is integrated with default peer dependency installation. The release also updates V8 to version 8.6. This post details the integration of TLS 1.3 support into Node.js, requiring an update to OpenSSL 1.1.1 and addressing protocol-level differences in handshake, session tickets, and event timing. TLS 1.3 offers improved security through simplified cipher suites, assured forward secrecy, and AEAD cipher modes.

This post introduces Certificate Transparency (CT) as a mechanism to protect domains from mis-issued certificates by Certificate Authorities (CAs). It explains that CT relies on Merkle Trees to log issued certificates, allowing for integrity verification and immediate alerting of domain owners to mis-issuance or CA compromise. The post details implementation steps for web and mobile app developers, noting that modern browsers enforce CT. For web apps, no extra implementation is needed beyond ensuring the CA logs certificates. For mobile apps, it outlines client-side checks, including default enforcement on newer iOS versions and the use of a third-party library for Android. Server-side CT requires a valid Server Certificate Timestamp (SCT) from the CA.

The OpenAPI Comment Parser is a new tool that allows developers to generate OpenAPI specifications directly from comments within their code. This aims to simplify API documentation, ensure it stays up-to-date with code changes, and reduce the amount of spec writing required. It supports Node.js and can work with any language using a similar comment style. The generated documentation can also be used for API testing.

This post introduces the Drain3 log-template mining project, an open-source tool for extracting structured information from unstructured log files. It details the refactoring of the original Drain tool into Python 3, enhancements for streaming support and resiliency (using Kafka for state persistence), and the addition of masking for improved accuracy. The post explains how log templates can be used to create time-series data for anomaly detection, enabling early identification of network outages in large-scale data centers like IBM Cloud. Future posts will cover the analytics pipeline for correlating anomalies.

The Cloud Annotations project has introduced an AI-assisted autolabeling feature. This capability leverages a user-trained model to automatically label new images, significantly reducing manual effort in data preparation for object detection models. The process involves users labeling a subset of images, training a model, and then using the 'Auto label' button in the GUI to apply labels to the remaining dataset, followed by a review step.

This post details the implementation of two-factor authentication (2FA) for SSH access using libpam-google-authenticator on Debian-based systems. It covers the installation of the authenticator, configuration of PAM and sshd_config for public key and keyboard-interactive authentication, and provides guidance on automating the setup with command-line options. The post emphasizes the security benefits of adding an extra layer of authentication beyond passwords and public keys.

The Kubernetes Container Runtime Interface (CRI) was introduced to standardize the interaction between the kubelet and various container runtimes. This abstraction layer allows Kubernetes to support multiple container runtimes beyond Docker by defining a common interface that runtimes must implement. Compliance with OCI specifications and passing CRI validation tests are key requirements for a runtime to be integrated with Kubernetes. Popular CRI implementations include containerd and cri-o, which abstract away the underlying container runtime engines like runc. This evolution aimed to decouple kubelet from specific runtime implementations and their evolving interfaces, ensuring greater flexibility and stability in container orchestration.

ytt is a YAML templating tool that understands YAML structure, using comments for annotation. It supports declarative and imperative operations via Starlark, modularization of configurations, data injection, and data validation. It offers syntactic sugar for conditionals, loops, and functions, and provides an 'overlay' feature for configuration management. ytt aims to simplify configuration and deployment on Kubernetes and other platforms.

MQTT is a publish-subscribe messaging protocol built on TCP/IP, designed for efficient communication between IoT devices. It utilizes brokers to route messages from publishers to subscribers. Initially developed for SCADA systems, it has become a de facto standard for IoT communication. MQTT v3.1.1 became an OASIS standard in 2014 and an ISO standard in 2016. MQTT v5 was published in late 2018, introducing new features while maintaining its core principles of being compact, easy to understand, and implement.