Shift left and shift right are core testing concepts of the agile DevOps methodology, which speeds up application development by releasing small builds frequently as code evolves. As part of the continuous cycle of progressive delivery, DevOps teams are also adopting shift-left and shift-right principles to ensure software quality in these dynamic environments.
All this shifting may sound abstract, but I’ll explain how this software verification approach benefits DevOps methods and outcomes—and makes software more reliable.
In DevOps, what is shift-left? And what is shift-right?
To understand shift left and shift right, consider the software development cycle as a continuum, or infinity loop, from left to right.
On the left side of the loop, teams plan, develop, and test software in pre-production. The main concern in pre-production on the left side of the loop is building software that meets design criteria.
When teams release software into production on the right side of the loop, they make the software available to users. The concern in production is to maintain software that meets business goals and reliability criteria.
What does shift-left mean in DevOps?
Shift-left is the practice of moving testing, quality, and performance evaluation early in the development process, often before any code is written.
Shift-left testing helps teams anticipate changes that arise during the development process that can affect performance or other delivery processes. In the process of shift-left testing, teams verify APIs, container configurations, and interactions between microservices, container configurations, and interactions between microservices.
Why is shift left important?
In addition to testing for functionality, shift-left testing also checks that software meets customer requirements. This enables developers and stakeholders to identify improvements that could enhance customer experience and functionality. Making these changes early in the development process reduces the cost of making them after the code is released.
As a result, shift-left testing has become increasingly important as teams face pressure to deliver software faster and more frequently with higher quality. Shift-left speeds up development efficiency and reduces costs by detecting and addressing software defects earlier in the development cycle before they get to production.
What does shift-right mean in DevOps?
Shift-right is the practice of performing testing, quality, and performance evaluation in production under real-world conditions. Shift-right methods ensure that applications running in production can withstand real user load while ensuring the same high levels of quality.
With shift-right, DevOps teams test a built application to ensure performance, resilience, and software reliability. The goal is to detect and remediate issues that would be difficult to anticipate in development environments.
Why is shift-right important?
With shift right, teams can test code in an environment that mimics real-world production conditions that they can’t simulate in development. This practice enables teams to catch runtime issues before customers do. To automate part of the process, teams can use application programming interface (API) calls. Organizations can also apply shift-right testing to code that gets configured or is monitored in the field. The result is more comprehensive testing coverage that better addresses user experience concerns.
Like shift-left testing, the objective of shift-right testing is to fail small and fail fast. The assumption is that problems caught early in the pre-deployment environment are easier to solve than issues caught by customers in live production.
Shift-right testing is especially useful for organizations practicing progressive delivery, wherein developers release new software features incrementally to minimize the impact of unforeseen issues. Testing in a production-ready environment is a crucial final phase before declaring features ready for prime-time.
Want to learn more about DevOps?
Streamline the way IT operates and enterprises grow with observability and AIOps. Read our DevOps eBook – A Beginners Guide to DevOps Basics
Why shift right and shift left are critical for microservices architecture
Both shift left and shift right testing have become more important as software is increasingly built from microservices. Instead of applications being built and run as a monolith, microservices are loosely coupled functions called at runtime. How microservices-based applications perform depends on individual service responsiveness, which complicates testing in a simulated environment.
Shift-left testing allows teams to observe how services interact in a simulated environment and detect potential performance impacts before deploying the code.
Shift-right testing at or near the point of deployment allows teams to observe real-world forces and measure their impact. Shift-right tests typically cover functionality, performance, failure tolerance, and user experience. Teams often automate such production-environment testing and translate feedback into technical specifications for developers.
Together, shift-left and shift-right testing enable testers to isolate issues so teams can fix and tackle improvements in parallel. As an application becomes more stable, teams can start testing and optimizing performance. Notably, shifting left and right have become an important practice in Agile software development. Together, they are part of the continuous feedback loop that characterizes DevOps.
Types of shift-right tests
A shift-right approach may enlist various types of test suites. The following are tests your team might find useful:
- A/B testing. Web designers commonly use this method. Users see two versions of a page and testers measure which generates a greater response. Teams often conduct this type of test in a production environment to gather real-world feedback.
- Synthetic monitoring. Synthetic monitoring is a form of shift-right testing that uses software tools to emulate the paths users might take when engaging with an application. Synthetic monitoring can automatically keep tabs on application uptime and tell you how your application responds to typical user behavior. It uses scripts to generate simulated user behavior for various scenarios, geographic locations, device types, and other variables.
- Chaos engineering. With chaos engineering, also called chaos testing, developers intentionally “break” the application by introducing errors to determine how well it recovers from disruption. DevOps and IT teams set up monitoring tools to see precisely how the application responds to different types of stresses. Teams perform these tests in a controlled production environment to minimize the impact on mission-critical systems.
- Canary releases. This strategy is named for the canaries that miners use to lower into coal mines to detect toxic gases. Technology has thankfully rendered this inhumane tactic obsolete. But the term survives to describe slowly rolling out changes to a small subset of instances for testing before applying them to the full infrastructure.
- Blue-green deployment. With a blue-green deployment, an organization runs two nearly identical production environments, shifting users (real or synthetic) between the two as they make small changes to one or the other. This practice is important to shift-right methodology as it can minimize downtime. It also provides a mechanism for rapid rollback should something go wrong with the latest version.
Types of shift-left tests
The four basic types of shift-left testing are the following:
- Traditional shift-left testing. The traditional approach focuses on unit and integration testing, typically involving APIs and cross-browser compatibility. This approach focuses more on unit testing small pieces of code to deliver information early and often, rather than more systems-level operational and acceptance testing.
- Incremental shift-left testing. This is a popular approach for teams migrating away from a waterfall development approach toward one that breaks complex projects into smaller pieces. In this scenario, teams conduct systems-level operational and acceptance testing on a smaller, more incremental scale. Incremental testing is popular for validating large and complex systems.
- Agile/DevOps testing. This is a series of short, continuous sprints during the development stage. This approach does not intend to address operational performance, but rather validate adherence to basic requirements architecture.
- Model-based shift left. Model-based testing aims to reduce errors introduced during the requirements definition, architecture, and design phases. It tests for executable requirements, architecture, and design. The advantage of model-based testing is that it can begin almost immediately instead of after completing all other test cycles.
The application security dividend of shift right and shift left
An important benefit of shifting right is improved application security. “Scanning a static image, either in a repository or in a development environment, can’t give you the same rich insights you can get if you observe the application running in production,” a Dynatrace report on security evolution in the cloud notes. “For example, you don’t get to see what libraries are actually called, how they are used, whether a process is exposed to the Internet, or whether a process interacts with sensitive corporate data.”
The growing use of software containers has complicated aspects of cybersecurity. Containers can obscure the processes running in them, and attackers even containerize exploits. Production testing exposes the behavior of container-based software, even if the contents of containers are obscured. Organizations can also use shift-right testing to test for the presence of novel zero-day exploits, such as Log4Shell.
From a shift-left perspective, security testing during development helps identify vulnerabilities as early in the life cycle as possible, when they are easiest to remediate.
Shift left, shift right, or both?
As organizations modernize their application stacks around cloud-native constructs like microservices and containers, a best practice is to adopt both shift-left and shift-right strategies. Shift-left testing reduces software defects and speeds time to market. Shift right better ensures reliability in production by testing under real-world conditions to affirm that software is doing its job where it matters most: serving the user. The combination of the two moves the organization closer to the ultimate goal of continuous integration and continuous delivery using automation and interdisciplinary communication. The result is a faster and more agile organization.
An essential capability for comprehensive shift-left and shift-right testing is automated full-stack observability and monitoring. With the capacity for end-to-end analysis at all phases of development, DevOps teams can monitor all requests and processes. Automatic analysis of all services across a sprawling complex of multi-cloud applications from a single interface enables teams to automate. Testers can push deployment information and metadata to the monitoring environment using scripts to track builds, revisions, and configuration changes.
The better an automated DevOps platform understands the full context of an issue, the better it can detect root causes, flag with the proper parties, and even implement self-healing measures.
Whether your organization has shifted testing left to the development phase or right in production — or simply wants to monitor performance in the field—an AI-driven, full-stack observability solution can take your software development to the next level.
To learn more about how Dynatrace helps developers automate testing and release, join us for the on-demand performance clinic, Why Devs Love Dynatrace – Episode 3 – Automated Release Comparison.