devopsy.kinsta.cloud

Author: Veronica Haggar

  • Kasten by Veeam Announces NEW Kasten K10 V5.0 with Enhanced Kubernetes Security, Streamlined CI/CD Pipelines and Ecosystem Advancements

    New features and capabilities bolster Kubernetes security across the board, help apply shift-left security to data protection and assists with continued ecosystem expansion

    VALENCIA, Spain; KubeCon + CloudNativeCon Europe 2022 — May 16, 2022 — Kasten by Veeam®, the market leader for Kubernetes backup and disaster recovery, today announced the new Kasten by Veeam K10 V5.0 Kubernetes data management platform. Purpose-built for Kubernetes, this latest release is focused on delivering a comprehensive risk management strategy, streamlined CI/CD pipelines and new ecosystem advancement details that optimize and de-risk Kubernetes investments. These advancements all aim to help the expanding Kubernetes community work more efficiently and securely in cloud native applications.

    “As ransomware attacks continue to remain the highest concern for organizations, a comprehensive risk management strategy to help continuously identify risk, protect data, detect attacks and deliver disaster recovery for cloud native applications is crucial,” said Gaurav Rishi, Vice President of Products and Partnerships at Kasten by Veeam. “Our latest release remains focused on helping enterprises minimize the financial impact caused by attacks on data and cloud applications. At the same time, we’re also supporting developer needs for backup solutions that not only integrate with the CI/CD tools they use but pave the way for automation to detect and protect applications as they get deployed.”

    Backing up Kubernetes applications while accommodating agile, shift-left development and distributed deployment environments remains a challenge for many organizations. Appliance-based approaches do not properly account for the unique characteristics of Kubernetes and replication doesn’t protect against infrastructure failures, data corruption, data loss or ransomware. Having a cloud native solution in place ensures secure and reliable backup without disrupting workflows or adding complexity that could inhibit innovation.

    New key features of Kasten K10 V5.0 include: 

    • Security everywhere: Enhanced platform hardening, including KMS integration with AWS KMS and HashiCorp Vault, coupled with the ease of use of Kubernetes-native RBAC objects exposed in UI dashboards, ransomware attack detection with AWS S3 or S3-compatible storage supporting S3 Object Lock, data protection policy guardrails and support for Veeam-hardened Linux repositories with immutability that offers comprehensive ransomware protection.
    • Shift-left applied to data protection: Fully integrated add-ons for newly launched Amazon EKS Blueprints, Level III certified Red Hat OpenShift Operator with full lifecycle capabilities, new built-in Kanister blueprints for MS SQL and PostgreSQL Operator and simplified UX for Operations with new Blueprint Editor for a more intuitive and streamlined workflow, and new Reports Generator for critical metrics.
    • Expanded ecosystem: Enabling integrations with industry-leading technologies and platforms ensures that customers can have freedom of choice in an expanding array of solutions across the ecosystem, including support for Red Hat Marketplace, SUSE Rancher Marketplace, VMWare vSphere with Tanzu and Falco.

    “Cloud native applications are being developed at a pace never seen before, and with DevOps and shift-left principles, application deployment in Kubernetes is proving faster and far more scalable. Yet, at the same time, backing up Kubernetes applications remains a constant challenge,” said Danny Allan, CTO at Veeam. “This latest release provides secure backup and recovery for Kubernetes data and applications while eliminating the complexity in deployment and operations for Kubernetes in the enterprise. As more Veeam customers look to leverage Kubernetes, Kasten K10 V5.0’s ease-of-use will be critical to support data protection and backup in their new environments.”

    “The alarming rate of ransomware attacks and the increased use of cloud-native application development means it’s only a matter of time before cloud-native applications become more heavily targeted,” said Johnny Yu, Research Manager, Storage and Computing at IDC. “Now more than ever, enterprises need a backup solution that is flexible across multiple clouds and can proactively offer visibility into a potential attack before it happens. With its new K10 V5.0 release, Kasten by Veeam has positioned itself as a solid choice for companies that are looking for comprehensive, end-to-end ransomware protection for Kubernetes environments.”

    The capabilities introduced in NEW Kasten K10 V5.0 underscores Kasten’s dedication to Kubernetes users by integrating DevOps and shift-left principles and hardened security. General availability of the new Kasten K10 V5.0 is expected in June. To learn more about Kasten and see Kasten K10 V5.0 in action, visit Kasten by Veeam at KubeCon + CloudNativeCon Europe 2022, as well as at VeeamON 2022.  

    For more information, please visit www.kasten.io or try K10 for FREE.

    About Kasten by Veeam
    Kasten by Veeam® is the leader in Kubernetes backup and disaster recovery. Its solution helps enterprises overcome Day 2 data management challenges to confidently run applications on Kubernetes. Kasten K10, its data management platform purpose-built for Kubernetes, provides enterprise operations teams an easy-to-use, scalable, and secure system for backup/restore, disaster recovery, and application mobility with unparalleled operational simplicity. Kasten is an independent Kubernetes Business Unit within Veeam. For more information, visit www.kasten.io or follow @kastenhq on Twitter.

  • Sysdig Introduces Sysdig Advisor to Drastically Simplify Kubernetes Troubleshooting

    Single view of performance and events accelerates Kubernetes troubleshooting by up to 10x

    VALENCIA, SPAIN, (KubeCon + CloudNativeCon Europe), May 16, 2022 — Sysdig, the unified container and cloud security leader, announced the availability of Sysdig Advisor, a Kubernetes troubleshooting feature that consolidates and prioritizes relevant performance details in Sysdig Monitor. By providing a single view of performance and event information, Sysdig Advisor enables operations, developers, and site reliability engineering (SRE) teams to troubleshoot issues faster while decreasing the number of tools needed.

    Video: In real-time, watch troubleshooting of the same issue with and without Sysdig Advisor.

    The complexity of Kubernetes – with countless components and variables – makes it extremely difficult to debug problems and prioritize actions. Knowing how to debug, where to begin, or what to look for can be a challenge. Operations teams and SREs are often forced to pull up the command line interface and run tools like kubectl to inspect the situation and search for the root cause. With so many moving parts in Kubernetes-based applications, remediation can take hours or more, decreasing availability and impacting the end-user experience.

    With a click of a button, Sysdig Advisor presents all relevant capacity, event, alerts, and troubleshooting information. Since this information is presented in the context of Kubernetes objects, users can quickly drill down when looking for the source of a performance problem. Sysdig Advisor displays a prioritized list of issues and related live logs to surface the biggest problem areas and accelerate time to resolution.

    Key Benefits of Sysdig Advisor 

    • Accelerates troubleshooting by up to 10x: Sysdig Advisor produces a prioritized list of issues, giving administrators visibility into what problems to address first. When compared to traditional methodologies, teams can resolve Kubernetes issues up to 10x faster with Sysdig Advisor by reducing the time it takes to find critical information, including capacity, utilization, event, and alert data for clusters, namespaces, workloads, and pods. 
    • Reduces troubleshooting resource count: Sysdig Advisor reduces the dependence on a side-by-side comparison of blogs, dashboards, logs, and command line output needed to troubleshoot Kubernetes environments. The simple user interface surfaces all the important details in a single unified tool with a curated, actionable set of steps for remediation.
    • Increases troubleshooting access without increasing security risk: Security teams are often concerned about providing broad access to command-line tools, such as kubectl. Sysdig Advisor provides quick access to the same level of information to users across the organization, without being overly permissive.

    “Kubernetes is complex, with countless components and variables that make it difficult to understand how, why, and when something goes wrong. Any SRE knows the pain of wading through multiple tools and getting multiple teams involved when troubleshooting an alert,” said Loris Degioanni, founder and CTO at Sysdig. “Now with Sysdig Advisor, they can efficiently debug issues and get back to work on deploying new releases.”

    The Sysdig Approach 

    Sysdig is driving the standard for unified cloud and container security so DevOps and security teams can confidently secure containers, Kubernetes, and cloud services. Sysdig offers two products, Sysdig Secure and Sysdig Monitor, and the Sysdig platform architecture underpins both products. Sysdig Monitor provides cloud and Kubernetes monitoring that is fully open source Prometheus compatible. With Sysdig Secure, teams find and prioritize software vulnerabilities, detect and respond to threats, and manage cloud configurations, permissions, and compliance. Sysdig provides a single view of risk from source to run, with no blind spots, no guesswork, no black boxes.

    Availability 

    Sysdig Advisor is available now to Sysdig Monitor users at no additional cost. Additional troubleshooting features will be introduced over the coming weeks.

    Resources

    About Sysdig
    Sysdig is driving the standard for cloud and container security. The company pioneered cloud-native runtime threat detection and response by creating Falco and Sysdig as open source standards and key building blocks of the Sysdig platform. With the platform, teams can find and prioritize software vulnerabilities, detect and respond to threats, and manage cloud configurations, permissions, and compliance. From containers and Kubernetes to cloud services, teams get a single view of risk from source to run, with no blind spots, no guesswork, no black boxes. The largest and most innovative companies around the world rely on Sysdig.

    Media Contact
    Amanda McKinney Smith
    amanda.smith@sysdig.com
    703-473-4051

  • Sysdig Open Source is Extended to Secure Cloud Services

    New integration enables any Falco plugin to be used for Sysdig OSS

    VALENCIA, SPAIN, (KubeCon + CloudNativeCon Europe), May 16, 2022 — Sysdig, the unified container and cloud security leader, announced that Sysdig open source, the incident response standard for containers, has been extended to the cloud. Using system calls, Sysdig open source (Sysdig OSS) traditionally offers deep observability into running applications, as well as file system access and network activity, which speeds incident response and troubleshooting. Teams can quickly filter information from Sysdig OSS and take action. With the announcement of this new integration, these capabilities have been extended beyond containers to any cloud environment.

    The complexity of cloud-native applications – with countless components and variables – makes it extremely difficult for security analysts and system administrators to quickly triage alerts and debug problems. Sysdig OSS captures process, file system, and network activity in real time and with a high degree of granularity. The tool, which has nearly two million downloads and 6,850 GitHub stars, surfaces everything from executed commands and file system activity to network activity. Sysdig OSS then offers advanced filtering and troubleshooting capabilities, supporting root cause analysis for security and performance issues.

    Using a new plugin framework – originally developed by the open source community for the CNCF project Falco – Sysdig extends the number of sources Sysdig OSS can be connected with to anything that generates logs or events, including Azure, Google, and AWS CloudTrail logs. Going forward, every plugin developed for Falco can also be leveraged by Sysdig OSS. Using one tool, like Sysdig OSS, to observe events from the entire cloud-native environment streamlines investigations. Using a different tool for each environment adds complexity, which makes it massively harder to troubleshoot.

    Learn more about this framework in the Sysdig OSS 0.29 new release blog

    Sysdig’s Commitment to Open Source

    Sysdig was founded as an open source company and Sysdig Secure and Sysdig Monitor were both built on an open source foundation to address the security challenges of modern cloud applications. Both projects were created by Sysdig to leverage deep visibility as a foundation for security, and they have become standards for container and cloud threat detection and incident response. Falco, which was contributed to the CNCF in 2018, is now an incubation-level hosted project with more than 45 million downloads.

    Sysdig OSS and Falco can be used together as a powerful open source solution to reduce risk at runtime. Sysdig OSS acts as a flight recorder, capturing a detailed record for inspection. Falco acts as a security camera, continuously detecting unexpected behavior, configuration changes, intrusions, and data theft in real time. Teams can use Sysdig OSS and Falco together to detect and respond to threats.

    “If you want to see what is going on inside an application, Sysdig OSS gives you that record,” said Loris Degioanni, Founder and CTO of Sysdig. “Sysdig open source was the inspiration for Falco. While Falco will monitor and alert based on your policies, Sysdig open source will tell you what happened at a particular time, before and after the event. Having the ability to use both open source tools in the cloud is extremely powerful.”

    Resources

    ●  Read the New Release of Sysdig Open Source Leverages Falco Plugins.

    ●  Find Sysdig OSS on GitHub.

    ●  Join the Sysdig OSS Slack community.

    About Sysdig
    Sysdig is driving the standard for cloud and container security. The company pioneered cloud-native runtime threat detection and response by creating Falco and Sysdig as open source standards and key building blocks of the Sysdig platform. With the platform, teams can find and prioritize software vulnerabilities, detect and respond to threats, and manage cloud configurations, permissions and compliance. From containers and Kubernetes to cloud services, teams get a single view of risk from source to run, with no blind spots, no guesswork, no black boxes. The largest and most innovative companies around the world rely on Sysdig.

    Media Contact
    Amanda McKinney Smith
    amanda.smith@sysdig.com
    703-473-4051

  • Calyptia Announced the General Availability of Calyptia for Fluent Bit, a Long Term Support Version and Professional Services Plan For Enterprises Running Fluent Bit as Part of Their IT Infrastructure

    San Francisco, CA, May 16, 2022 – [Calyptia](https://calyptia.com) today announced the general availability of Calyptia for Fluent Bit, a long term support version and professional services plan for enterprises running Fluent Bit as part of their IT infrastructure. Calyptia Fluent Bit customers receive security updates, patches and bug fixes, and basic support for a defined period of time while running a standardized, security-hardened, stable version of Fluent Bit.

    Calyptia is uniquely positioned to offer long term support for Fluent Bit users as it was co-founded by the creator of Fluent Bit and the company is the primary maintainer of the Fluent Bit project.

    Fluent Bit is the industry standard open-source engine for enterprise observability of logs and metrics, and it is included in major Kubernetes distributions, including Google Kubernetes Engine (GKE), Amazon Elastic Kubernetes Service (EKS) and Azure Kubernetes Service (AKS). It collects and processes event data from any source and routes that data to any destination–even multiple destinations–for storage and analysis. It is the preferred choice for cloud and containerized environments and recently surpassed one billion deployments.

    Fluent Bit is becoming increasingly mission critical in observability environments due to its high performance and lightweight footprint, allowing it to process petabytes of data a day while consuming few resources. Fluent Bit also takes a vendor-neutral approach to the systems with which it interacts, helping enterprises avoid costly vendor-lock solutions.

    Open source software offers innovation, features and rapid speed; however, these same advantages become challenges to enterprises struggling to stay up to date. Calyptia Fluent Bit addresses these challenges by combining innovation with stability, support and hardened security for enterprises that require predictable upgrades and an SLA.

    “We have had several companies approach us about offering support services,” said Eduardo Silva, Calyptia co-founder and creator of Fluent Bit, “so there is definitely a need. The more we thought about their requests we realized that Calyptia Fluent Bit is a logical expansion of our current and planned offerings. As organizations adopt distributed, dynamic, cloud-native services, the challenge is how to quickly and efficiently get insights out of the mountain of log and event data created across the enterprise. Providing solutions to that challenge is what Calyptia does and Calypia Fluent Bit is an ideal option for some organizations.”

    Last month, Gartner, a leading technological research and consulting firm, named Calyptia a “Cool Vendor” for monitoring and observability solutions, a rapidly growing sector that prompted Gartner analysts to write that “this trend may lead to the 2020s being known as ‘the decade of observability.’”

    For more information including pricing about Calyptia for Fluent Bit visit (https://calypta.com).

  • New Training Course Explores Ethics in Open Source Development

    As we build new software and other technologies, we do not often consider the ethical implications of these tools. Considerations like how a piece of code may be used by a malicious actor, whether a hardware design could be modified for a nefarious purpose, or simply how an algorithm might affect different classes of person differently are not always top of mind. However they should be. That is why Linux Foundation Training & Certification has partnered with the Cloud Native Computing Foundation (CNCF) and Ethical Intelligence to develop a free online training course, “Ethics in Open Source Development”.

    The course is designed primarily for product managers who want to learn how to effectively incorporate ethics-by-design techniques into their workflows, and developers wanting to apply ethics through critical thinking techniques and proven mental frameworks. It explores how to operationalize ethics as a tool for efficient and effective decision-making when developing and using open source technology as you explore critical thinking techniques and proven mental frameworks.

    Topics covered in the 2-3 hour course include the case for ethics, safeguards, evaluation, action planning, monitoring and more. Upon completion, participants will be able to:

    • Assess and address current technology for any ethical blind spots 
    • Apply ethical critical thinking techniques to design workflow 
    • Understand and utilize the Ethics Journey Cycle in open source development 
    • Operationalize ethics as a decision-making tool for risk mitigation and innovation 

    When it comes to developing open source technology, there are certain essential ethical principles, such as transparency and accessibility, that will thrive in the open source format. At the same time, other principles, such as responsibility and privacy, will present unique challenges that must be addressed. The key is to understand how to develop the technology in a way that innovation is maximized while challenges are expertly navigated and solved. 

    The course was developed by Olivia Gambelin, Rahaf Albalkhi, Dr. Michael Klenk, and Rand Hirmiz. Olivia is an AI Ethicist who works with entrepreneurs and technologists to ensure emerging technology is designed with human values at the core, and serves as the Chief Executive Officer of Ethical Intelligence where she leads a remote team of over sixty experts in the Tech Ethics field. Rahaf is a member of the IEEE P7003-Algorithmic bias considerations working group where she leads the evaluation section, and volunteers as a research assistant on employment equity in the tech sector of British Colombia at the Inclusion Project. Michael is a moral philosopher and former management consultant who works with organizations to help them legitimately meet their ethical challenges. Rand is a philosophy Ph.D. candidate at York University, specializing in the ethics of AI in healthcare.

    Upon completion of the course, participants will be prepared for specific roles such as Responsible Technologist or Ethics Developer Lead, but will also help developers who want to incorporate responsible innovation and ethics into their work. Enroll today and start thinking about how to better incorporate ethics into your development practices.

  • Snapt Announces the One Security Package to Run Kubernetes in Public Cloud

    Snapt sponsors KubeCon Europe and brings AI-powered threat intelligence, WAAP, and bot protection for Kubernetes ingress in public cloud – all in one click.

    Valencia, Spain, May 16, 2022 — Snapt, the leading provider of future-proof, cloud-neutral, and platform-agnostic load balancing and security solutions, demonstrates a powerful, AI-powered platform for securing Kubernetes ingress in public cloud environments at KubeCon Europe in Valencia. Snapt Nova is a centrally managed load balancing and application security platform designed for cloud-native and hybrid environments and includes real-time threat intelligence, web application and API protection, and bot protection. Snapt demonstrates Snapt Nova at KubeCon Europe, 16-20 May, at booth S32 on the show floor or our virtual booth here: https://bit.ly/38VKVwo (link for registered attendees only).

    Attendees at KubeCon can also talk to Snapt to request a free health check to test their infrastructure’s security, scale, and speed. This offer is exclusive to attendees at KubeCon Europe 2022.

    Snapt Nova is Application Delivery Control as a Service, providing load balancing, global traffic routing, and web application and API protection on-demand to every node from a centralized controller and UI. Snapt Nova’s centralized control plane enables Software-Defined Load Balancing with a real-time low-latency connection to millions of data plane nodes. Snapt Nova meets the needs of DevOps, NetOps, and SecOps teams securing Kubernetes ingress at scale in public cloud environments – including multi-cloud.

    “Snapt Nova makes it a breeze to get public cloud Kubernetes into production,” said Dave Blakey, Co-CEO at Snapt. “Snapt Nova ensures your application is highly available, secure from threats like Denial of Service, and optimized for performance. It provides visibility into Kubernetes and other platforms, even in multi-cloud environments. We designed Snapt Nova for modern application teams, so we built it with a full REST API, centralized control plane, monitoring in a single pane of glass, and integration with modern tool stacks.”

    Snapt Nova simplifies securing and scaling Kubernetes applications in the cloud. It integrates easily with all public clouds and Kubernetes, including native upstream service discovery for rapid configuration and deployment of application services. Snapt Nova’s centralized controller provides elastic scalability with extremely low latency in response to demand, so application services always keep pace with application traffic. Snapt Nova’s worker nodes are lightweight, containerized, and fast, even supporting deployment on ARM architectures.

    Snapt Nova also reduces the complexity of deploying Kubernetes alongside other platforms and architectures, enabling NetOps and SecOps teams to ensure the reliability and security of every part of their network. Centralized policy, security, and global traffic routing help organizations keep global networks and hybrid architectures consistent, simple, and compliant. A modern web GUI with one-click deployment, wizards, and data visualization enables operators to get started quickly and address problems efficiently without deploying infrastructure as code.

    Snapt Nova provides a full REST API for complete automation and integration with CI/CD workflows for DevOps practitioners.

    Role-Based Access Control allows NetOps or PlatformOps teams to set global policy using Snapt Nova’s GUI and delegate per-application control to multiple DevOps teams using the API. This capability enables application teams to develop, test, and launch applications quickly and automatically while enabling NetOps teams to set the guardrails and monitor overall network health, security, and performance.

    Snapt Nova includes real-time threat intelligence, so Kubernetes deployments benefit from application security that is always up-to-date with the latest emerging threats and trends, allowing automatic pre-emptive blocking of current and potential threats. Snapt Nova’s threat intelligence, powered by advanced machine learning and unique real-time, real-world threat data from Snapt’s worldwide network of threat sensors, identifies, tracks, and blocks botnets, malware, cybercriminals, and platform abuse.

    Snapt Nova includes robust Layer 7 Web Application and API Protection that blocks hackers, denial of service (DoS), bots, data leaks, SQL injection, XSS, CSRF, and more while ensuring your Kubernetes ingress is compliant, safe, and secure. Mutual TLS enables end-to-end encryption for protecting sensitive data. The API gateway enforces API access controls and SLAs and protects against the OWASP Top 10 API vulnerabilities. Snapt Nova’s application security is enhanced by machine learning and AI-powered autonomous response, enabling sophisticated traffic profiling, anomaly detection, continuous self-learning, and lightning-fast reaction when threats are detected.

    Snapt Nova automatically detects and blocks malicious bots in real-time. It combines on-node activity recognition, centralized AI-powered behavior profiling, and a global database of known bots. Snapt Nova’s distributed application delivery controllers (ADCs) use a powerful activity recognition engine to identify suspicious browsing patterns, non-human input, and traffic from questionable sources.

    The distributed ADCs can also submit a suspicious user for central evaluation by the Bot AI. Using machine learning to develop an in-depth profile of normal and automated browsing behavior, Snapt Nova can consistently identify bots where other systems fail. This self-learning system constantly evolves, improving its speed and intelligence.

    For users ready to learn more about securing and simplifying Kubernetes ingress, Snapt will be demonstrating Snapt Nova at booth S32 at KubeCon Europe on 16-20 May. For more information, download the Snapt Nova and Kubernetes datasheet.

    Snapt is a Silver Sponsor of KubeCon Europe.

    About Snapt
    Snapt provides future-proof load balancing and security solutions that are cloud-neutral and platform-agnostic. Snapt eliminates downtime and automatically scales your sites and applications to ensure maximum responsiveness. Using a single pane of glass, our solutions deliver centralized control and intelligence for all your clouds, platforms, architectures, and applications.

    Snapt lets you embrace change on your terms — we grow, shift, and evolve with you. Snapt provides the lowest total cost of ownership while providing high performance and fast, expert support from day one.

    For more information, visit www.snapt.net.

    Media inquiries
    Iwan Price-Evans
    +1 404 618 1201

  • Envoy Gateway Makes Using Envoy Proxy Easier for Developers and Reverses Fragmentation

    San Francisco, CA and Valencia, SPAIN — May 16, 2022 — Members of the steering group for Envoy Gateway (EG), including Envoy creator Matt Klein and representatives from Ambassador Labs, Fidelity Investments, Tetrate, and VMware, Inc. today announced their joint commitment to the project, which launched today at KubeCon + CloudNativeCon, Europe 2022, under the auspices of the Cloud Native Computing Foundation® (CNCF®). Envoy Gateway is a new effort within the Envoy proxy open source project to simplify Envoy use in cloud-native application development. 

    Envoy Gateway will reduce existing, redundant efforts around Envoy and make it much easier for application developers to use Envoy as a basic API gateway “out of the box” and as a Kubernetes Ingress controller. Exposing a simplified set of APIs, and implementing the Kubernetes Gateway API, EG makes it easier to extend Envoy. Developers will now have a cost-free, unfettered way to provide external access to their work in progress. At the same time, Envoy Gateway will not replace API management features currently found in commercial products.  

    “Envoy has achieved a great deal of success since we first released it in 2016,” said Matt Klein, founder of the Envoy proxy project. “And community has been at the heart of Envoy from the beginning. With the community-driven Envoy Gateway project, we see the opportunity to make Envoy accessible to many more users through the addition of simplified APIs and new capabilities explicitly targeted at north-south / edge proxy use cases.”

    Envoy is already widely used for traffic between separate services in a microservices application – that is, east-west traffic. With Envoy Gateway, Envoy will also be easy to use for north-south traffic—that traffic between an application and the outside world, as with consumers of an application’s APIs. 

    Envoy Gateway—Core Open Source Infrastructure for the Cloud-Native Future

    IT organizations worldwide want to establish and use a rich, robust, modern stack of open source software for cloud-native application development and delivery, under the management of organizations such as the Linux Foundation and the CNCF. Commercial offerings and projects within each IT team can then add value on top of this core infrastructure.  

    Envoy is fast becoming the go-to networking substrate within this modern, cloud-native stack. However, recently, the need for API access, traffic routing, and other ingress capabilities has led to fragmentation in the Envoy ecosystem. Envoy Gateway will bring this needed functionality back into the main Envoy project and make it less confusing and time-consuming for developers to access Envoy. 

    Implementation Via Kubernetes Gateway API

    Envoy Gateway will expose a version of the Kubernetes-native Gateway API, with Envoy-specific extensions. This is an expressive, extensible, role-oriented API well-suited to use by developers. Gateway API is either implemented, or in progress, for Istio, the Contour project (which originated at VMware), Emissary-Ingress (which originated at Ambassador Labs), and others. 

    When users create Gateway API resources, they will be translated into native Envoy API calls, so Envoy and its native API, xDS, will not need to be changed to add this new support. 

    Advantages for Developers, Infrastructure Administrators and Business Decision-Makers

    Application developers will experience the most positive impact from Envoy Gateway. They will be able to run Envoy Gateway and begin routing traffic to their applications. They will no longer need to build their own control plane, or extend an existing control plane such as a Go or Java control plane, or bring in a vendor solution at the early stages of their projects. They can just configure routes for the application and share them.  

    Infrastructure administrators will be able to easily offer an Envoy-native experience to application teams, without needing to adopt a vendor solution just to get basic gateway functionality. They will be able to manage instances of Envoy Gateway without interfering with developer access to them. Envoy Gateway will allow them to deliver consistent application networking capabilities across heterogeneous environments.  

    Executives and decision makers will have Envoy as a standard and, we expect, widely used solution for API access and Kubernetes ingress. They will also benefit from faster and easier development and delivery of more secure and robust software and services. 

    Additional Resources

    • Explore CNCF announcements. 
    • Review the official blog of the Envoy project.
    • Learn more about Envoy Gateway goals.

    About Envoy

    Originally created by Matt Klein and built at Lyft, Envoy is a high performance C++ distributed proxy designed for single services and applications, as well as a communication bus and “universal data plane” designed for large microservice “service mesh” architectures. Built on the learnings of solutions such as NGINX, HAProxy, hardware load balancers, and cloud load balancers, Envoy runs alongside every application and abstracts the network by providing common features in a platform-agnostic manner. When all service traffic in an infrastructure flows via an Envoy mesh, it becomes easy to visualize problem areas via consistent observability, tune overall performance, and add substrate features in a single place. 

    Contact Matt Klein at mattklein123@gmail.com. 

    About Ambassador Labs

    Ambassador Labs, the cloud native developer experience leader, enables developers to code, test, ship, and run applications faster and easier than ever. Maker of top Cloud Native Computing Foundation (CNCF) open source projects, including Emissary-ingress and Telepresence, Ambassador Labs delivers a developer control plane for Kubernetes that integrates the development, deployment, and production infrastructure for developers and organizations worldwide including Microsoft, PTC, NVidia, and Ticketmaster. Ambassador Labs is backed by top investors including Insight Partners and Matrix Partners. Learn more and get started for free at www.getambassador.io.

    Contact Lisa Williams of Ambassador Labs at lisawilliams@datawire.io.

    About Fidelity Investments

    Fidelity’s mission is to inspire better futures and deliver better outcomes for the customers and businesses we serve. With assets under administration of $11.3 trillion, including discretionary assets of $4.2 trillion as of March 31, 2022, we focus on meeting the unique needs of a diverse set of customers. Privately held for over 75 years, Fidelity employs more than 57,000 associates who are focused on the long-term success of our customers. For more information about Fidelity Investments, visit www.fidelity.com/about-fidelity/our-company. 

    Contact Kathleen Bentley of Fidelity Investments at kathleen.bentley@fmr.com. 

    About Tetrate

    Started by Istio founders to reimagine application networking, Tetrate is an enterprise service mesh company managing the complexity of modern, hybrid cloud application infrastructure. Its flagship product, Tetrate Service Bridge, provides an edge-to-workload application connectivity platform to deliver business continuity, agility, and security for enterprises on the journey from traditional monoliths to the cloud. Customers get consistent, baked-in observability, runtime security and traffic management in any environment. Tetrate remains a top contributor to the open-source projects Istio and Envoy Proxy. Find out more at www.tetrate.io. 

    Contact Annie Fink of Bospar at annie@bospar.com. 

    About VMware 
    VMware is a leading provider of multi-cloud services for all apps, enabling digital innovation with enterprise control. As a trusted foundation to accelerate innovation, VMware software gives businesses the flexibility and choice they need to build the future. Headquartered in Palo Alto, California, VMware is committed to building a better future through the company’s 2030 Agenda. For more information, please visit www.vmware.com/company.

    Contact Eloy Ontiveros of VMware Global Communications at eontiveros@vmware.com.

  • Introducing Envoy Gateway

    Today we are thrilled to announce Envoy Gateway, a new member of the Envoy Proxy family aimed at significantly decreasing the barrier to entry when using Envoy for API Gateway (sometimes known as “north-south”) use cases.

    History

    Envoy was released as OSS in the fall of 2016, and much to our amazement quickly gained traction throughout the industry. Users were drawn to many different aspects of the project including its inclusive community, extensibility, API-driven configuration model, powerful observability output, and increasingly extensive feature set.

    Although in its early history Envoy became synonymous with “service mesh,” its first use at Lyft was actually as an API gateway / edge proxy, providing in-depth observability output that aided Lyft’s migration from a monolithic to a microservice architecture.

    Over the last 5+ years, we have seen Envoy adopted by a tremendous number of end users, both as an API gateway and as a sidecar proxy in “service mesh” roles. At the same time we have seen a large vendor ecosystem spring up around Envoy, providing a multitude of solutions both in the OSS and proprietary domains. Envoy’s vendor ecosystem has been critical to the project’s success; without funding for all of the employees that work part or full-time on Envoy the project would certainly not be what it is today.

    The flip side of Envoy’s success as a component of many different architecture types and vendor solutions is that it is inherently low level; Envoy is not an easy piece of software to learn. While the project has had massive success being adopted by large engineering organizations around the world, it is only lightly adopted for smaller and simpler use cases, where nginx and HAProxy are still dominant.

    The Envoy Gateway project was born out of the belief that bringing Envoy “to the masses” in the API gateway role requires two primary things:

    • A simplified deployment model and API layer aimed at lighter use cases.
    • Merging the existing CNCF API gateway projects (Contour and Emissary) into a common core that can provide the best possible onboarding experience, while still allowing vendors to build value-added solutions based on Envoy Proxy and Envoy Gateway.

    We strongly believe that if the community converges around a single Envoy branded API gateway core, it will:

    • Reduce duplicative efforts around security, control plane technical details, and other shared concerns.
    • Allow vendors to focus on layering value added functionality on top of Envoy Proxy and Envoy Gateway in the form of extensions, management plane UI, etc.
    • Lead to a “rising tide lifts all boats” phenomenon in which more users around the world enjoy the benefits of Envoy, whether their organization is large or small. More users feed the virtuous cycle of more potential customers, more support for the core Envoy project, and a better overall experience for all.

    Project outline

    At a high level, Envoy Gateway can be thought of as a wrapper around the Envoy Proxy core. It will not change the core proxy, xDS, go-control-plane, etc. in any way (other than potentially driving features, bug fixes, and general improvements!). It will provide the following functionality:

    • A simplified API for the gateway use case. The API will be the Kubernetes Gateway API with some Envoy-specific extensions. This API was chosen because deployment on Kubernetes as an ingress controller is the initial focus for the project and because the API has broad industry buy-in.
    • A “batteries included” experience that will enable users to get up and running as fast as possible. This includes tooling to provision controller resources, control plane resources, proxy instances, etc.
    • An extensible API surface. While the project will aim to make common API gateway functionality available out of the box (e.g., rate limiting, authentication, Let’s Encrypt integration, etc.), vendors will be able to provide SaaS versions of all APIs, provide additional APIs and value added functionality such as WAF, enhanced observability, chaos engineering, etc.
    • High quality documentation and getting started guides. Our primary goal with Envoy Gateway is to make the most common gateway use cases trivial to stand up for the average user.

    On the topic of APIs, we believe that one area that has led to significant confusion is the effective reimplementation of Envoy’s xDS APIs in other projects when targeting advanced use cases. This pattern causes users to have to learn multiple sophisticated APIs (which ultimately translate back to xDS) in order to get their job done. As such, Envoy Gateway is committed to a “hard line in the sand” in which the Kubernetes Gateway API (and any permissible extensions within that API) is the only additional API that will be supported. More advanced use cases will be served by an “xDS mode” in which existing API resources will be automatically translated for the end user, who can then switch to utilizing the xDS APIs directly. This will lead to a crisper primary API while allowing an escape hatch for organizations that might outgrow the expressiveness of the primary API and wish to utilize the full power of Envoy via xDS.

    Next steps

    Today we are thankful for the initial sponsors of Envoy Gateway (Ambassador Labs, Fidelity, Tetrate, and VMware) and are excited to start on this new journey with all of you. The project is very early with the focus so far having been to agree on goals and high level design, so it’s a great time to get involved, either as an end user or as a system integrator.

    We also want to make it extremely clear that existing users of Contour and Emissary will not be left behind. The project (and VMware and Ambassador Labs) is completely committed to ensuring a smooth eventual migration path for users of those projects to Envoy Gateway, either via translation and replacement or via those projects becoming wrappers around the Envoy Gateway core.

    We are extremely excited about bringing Envoy to a larger group of users via the Envoy Gateway project, and we hope you will join us on our journey!

  • Deepfactor Partners with Synopsys to Help Developers Resolve Cloud Native Supply Chain Security Risks

    Valencia, Spain at KubeCon + CloudNativeCon EU 2022 – May 16, 2022 – Deepfactor, a leading developer security platform, today announced it is integrating with the Synopsys Black Duck® software composition analysis tool to help developers prioritize and remediate application vulnerabilities and license risks in Kubernetes and cloud native applications early in development and testing.

    According to the Gartner report How to Manage Open-Source Software Risks Using Software Composition Analysis, “Application leaders are mired in escalations due to open-source software security vulnerabilities and licensing risks,” wrote Anne Thomas, Distinguished VP Analyst, Gartner. “They should mandate the use of software composition analysis tools to detect and remediate risks early and continuously throughout the software development life cycle.”

    With engineering teams embracing cloud native development and rapidly adopting open source software, releases are increasing in both frequency and complexity. Deepfactor Developer Security integrates with the Synopsys Black Duck tool to reduce SCA alert volume and provide developers with contextual security insights to prioritize and remediate application vulnerabilities and license risks discovered during development and testing.

    “We at Synopsys look forward to collaborating with Deepfactor to further support our mission to improve the security mechanisms within the software supply chain for cloud native and Kubernetes workloads,” says Vatsal Sonecha, Synopsys VP of Business Development for the Software Integrity Group. “The Deepfactor solution provides engineering teams using Black Duck with valuable context, priority, and remediation information that can accelerate the reduction of applications risks.”

    Deepfactor is now a member of the Synopsys Technology Alliance program, which helps partners collaborate, integrate, and interoperate with Synopsys application security solutions to transform how software is built, deployed, and operated.

    “We are honored to partner with Synopsys and integrate Deepfactor Developer Security with Black Duck to help developers of cloud native applications deliver secure and compliant code faster,” said Kiran Kamity, CEO and Founder, Deepfactor. “The integration provides engineering teams with unique security insights that will make it faster and easier to resolve critical security risks.”

    Availability

    The Deepfactor integration with Synopsys Black Duck is available immediately.

    Additional Resources

    • Partnership Brief – https://www.deepfactor.io/product- brief/deepfactor-synopsys-black-duck.pdf
    • Integration Documentation – https://docs.deepfactor.io/hc/en- us/articles/4411814713875-Synopsys-Black-Duck-

    About Deepfactor

    Deepfactor is a developer security platform that enables engineering teams to quickly discover and resolve security vulnerabilities, supply chain risks, and compliance violations early in development and testing. For more information, visit www.Deepfactor.io and follow us on LinkedIn and Twitter.

    Gartner is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the US and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

    Deepfactor is a registered trademark of Deepfactor, Inc. All other product and company names are trademarksTM or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

    Press Contact
    pr@deepfactor.io

  • KubeCon EU: Preview Cosmonic PaaS Built Atop wasmCloud

    Demos, Cloud Native Developer’s wasmCloud Presentations and Networking

    Arlington, VA, and Valencia, SPAIN – May 16, 2022 – WebAssembly pioneer Cosmonic invites you to preview Cosmonic wasmCloud Platform-as-a-Service.  Attend WasmDay and Kubecon Rejekts presentations, when cloud native developers present their Wasm- and wasmCloud-related efforts. And network with wasmCloud pioneers over cocktails.

    What: Preview truly portable business logic for distributed applications with WebAssembly + Cosmonic PaaS for wasmCloud. Imagine the rapid development of platform-agnostic multi-cloud, multi-edge and far-edge platforms that run at near native speeds that runs anywhere, at any scale. Fast, secure-by-default, distributed application development that eliminates entire classes of development challenges at significant cost savings.

    WasmDay passes can be arranged at no charge.

    Who: Liam Randall, CEO of Cosmonic and CNCF Cloud Native WasmDay Chair invites you to a 1:1 product preview and cocktail hour networking event. 

    Adobe, BMW and indie games developers will present their wasm- and wasmCloud-related efforts.  

    When: Product preview and 1:1 briefings:  May 18-20 10:30 am – 4 pm CEST

    Developer Presentations:

    • BMW: Dynamic routing of ML workloads with wasmCloud (KubeCon Rejekts – May 14, 12:15 pm CEST) 
    • Adobe: Wasm beyond the browser:  Use cases at scale (WasmDay May 16, 3:15 pm CEST)
    • Indie games: Low-cost cloud platforms for game servers (WasmDay May 16, 3:15 -3:25 pm CEST)

    Cocktail Hour Networking: May 18, 6:00 – 7:00 pm

    Where: Product preview and 1:1 briefings: Banco 105, Mall Level of Feria Valencia (1 Level Above Solutions Showcase)  

    Cocktails: Deskarat, Avinguda de les Corts Valencianes, 28, 46015 Valencia

    Contact: To schedule a briefing, to secure complementary WasmDay passes and to RSVP for cocktails, contact pr@cosmonic.com or call +1 650-200-0292.

    About Cosmonic
    Founded by open source veterans Liam Randall and Kevin Hoffman, Cosmonic is helping develop and promote wasmCloud PaaS, a universal runtime platform that enables developers to use cloud native technologies and Web Assembly to build portable, pluggable business logic that runs anywhere, including multi-cloud, multi-edge and far edge environments.  For more information, visit www.wasmcloud.com.