devopsy.kinsta.cloud

Category: IT as Code

  • Lenovo Updates Diverse HCI Platform Portfolio

    Lenovo today announced a bevy of updates to its server portfolio that expand the number of options organizations have when it comes to bundling stacks of software with Lenovo hyperconverged infrastructure (HCI) platforms to reduce the total cost of on-premises IT.

    For example, Lenovo in collaboration with Nutanix and AMD, today launched a Lenovo ThinkAgile HX HCI based on AMD EPYC processors, which promises to reduce by 50% the number of servers required to run the Nutanix HCI software stack.

    Lenovo in collaboration with Microsoft today also unveiled Lenovo ThinkAgile MX Azure Stack HCI Edge appliance based on Azure Stack HCI software. That platform runs the same software stack on-premises that Microsoft employs in its Azure cloud to simplify hybrid cloud computing environments.

    In addition, Lenovo added a Diamanti SR630 appliance to its lineup based on storage software developed by Diamanti optimized for instances of Kubernetes running on bare-metal servers.

    Finally, Lenovo in collaboration with VMware added a Lenovo ThinkAgile VX HCI offering that comes bundled with SAP HANA databases running on top of VMware vSphere.

    Kamran Amini, vice president and general manager of server, storage and software-defined infrastructure for the Lenovo Data Center Group, said rather than optimizing HCI infrastructure for one single platform such as VMware, the Lenovo portfolio is designed to provide IT organizations with the flexibility to enable organizations to deploy stacks of Nutanix, Microsoft, Kubernetes or VMware software as they best see fit.

    The economic downturn brought on by the COVID-19 pandemic has been especially challenging for providers of IT infrastructure platforms deployed in local data centers that many IT teams have been not been able to visit in recent months. However, those IT teams have been relying more on the ability to manage Lenovo servers remotely rather than attempting to migrate existing application workloads to the cloud overnight, he noted.

    It’s too early to say what the impact COVID-19 will have had on IT strategies. While many new applications are being deployed in the cloud, there is still a plethora of performance, security and compliance requirements that make it preferable to deploy some classes of workloads in on-premises IT environments. After more than a decade of having public clouds available as an option, the bulk of application workloads in the enterprise continue to run in on-premises IT environments. If it remains relatively simple to remotely manage those systems from home, the pressure to lift and shift workloads to the cloud becomes less intense.

    Amini said the COVID-19 pandemic essentially served as a wake-up call for organizations to modernize IT management processes using platforms that are designed to be managed from anywhere.

    Now that it’s apparent many IT teams will be working remotely a lot more often, many organizations are revisiting their IT strategies. There’s no doubt public clouds will play a larger role in IT going forward. However, the future of IT in general and cloud computing in particular will be, if anything, more hybrid than ever.

  • How Continuous Transformation Can Deliver More Value

    How Continuous Transformation Can Deliver More Value

    Continuous transformation in IT operations is more than just an industry buzzphrase. In fact, continuous transformation is a critical survival tool for any cloud and IT solution landscapes today. To achieve continuous transformation, innovation must continue well beyond a migration to the cloud. This continuous innovation during day-to-day IT operations is the most critical aspect to achieving month-over-month best-in-class operational benefits.

    Simply “lifting and shifting” systems to the cloud without modernizing precludes most of the key benefits that your systems can potentially deliver over the long term. For example, some of the outcomes of this approach, including bug fixes and other common errors, cause downtime and delays that businesses cannot afford in these highly competitive environments. In addition, unplanned downtime and disruptions impact revenue and can damage brand reputations, both of which detract from a business’s ability to compete and win in their market.

    Proactive vs. Reactive 

    To stay ahead of the pack, companies must shift from a reactive to a very proactive posture. Error prevention is far more effective than fixing errors and resolving issues as they happen. To this end, companies should be leaning on service providers that proactively cover the entire application and infrastructure landscape, end to end, through customized, out-of-the-box solutions. For example, proactivity is rapidly enhanced by including predictive analytics and other fault-finding algorithms in software, such as:

    • Analytical anomaly detection.
    • Cloud-enhanced and optimized monitoring templates.
    • Self-healing automated reaction, from disk extensions, cluster and scaling groups to ensure an issue does not result in downtime, simply a post-event investigation.

    A company’s IT needs are also continually changing as business landscapes evolve. For example, being on the cloud and using service level agreement (SLA) measurement has now advanced to become mission-critical in two areas: bottom-up technical SLAs (as per usual) and now, more importantly, top-down business transactional SLAs.

    Here are some ways IT could streamline its operations and deliver the most value back to the business:

    • Operations Analytics – An operations analytics tool allows for capacity planning, monitoring usage trends and patterns over time. Should deviations from the anticipated usage occur, IT teams can react immediately, implementing remedies before the situation escalates to an incident. This early intervention could be done either manually or automated. Automated scripts, triggered by predictive alarms, can restart services and adjust virtual resource allocation or any other remedial action necessary.
    • Predictive Analytics – Future planning is essential to successful business operations. Predictive analytics improves on this by using precursor and antecedent information to predict system failure with an associated confidence level. IT teams know when resources operate outside their anticipated range and how likely they are to fail within the next period. System failure is usually associated with a surge in user activity. This is not easily predicted, driving the need for advanced predictive analytics. Armed with this information, IT teams can carry out preventative maintenance on data centers and associated systems, such as that done for manufacturing machines in industrial applications.
    • Automated Self-Healing Systems – By combining artificial intelligence and machine learning, digital innovation has made it possible for business systems to self-heal. Advanced, automated software packages monitor business systems, finding errors and fixing them without human intervention. These systems address performance variations and restore outages as well.

    Through self-learning algorithms, the software learns and understands the normal business operations and its reactions to irregularities and errors. Using this information, the software reacts appropriately when it detects errors, automatically restoring the business system to normal operations. These automated, exponential self-healing packs utilize innovative, continual logic learning as part of their standard software package. These systems also resolve issues in a fraction of the time it takes through traditional manual intervention. Typically, the end user doesn’t even realize that an error has occurred, improving the user experience dramatically.

    The implementation of self-healing systems is relatively quick and can be done in as little as four weeks. As a result, IT teams will have access to advanced troubleshooting and automated diagnostic, enabling fast, root-cause analysis of any errors that occur—implementing the solution through guided prompts, documents the resolution for future reference. And, if the same error occurs again, the solution will automatically be executed.

    Automated self-healing systems offer a range of benefits, including business and IT cost reduction, decreasing unplanned downtime and risk-free digital footprint expansion for continuous transformation. IT professionals can work strategically, delegating mundane and repetitive tasks to automated processes, freeing time and resources to carry out more advanced tasks aligned to business goals.

  • Volterra Service Mesh Service Automatically Discovers APIs

    Volterra Service Mesh Service Automatically Discovers APIs

    Volterra announced today it has updated a service mesh it makes available via a software-as-a-service (SaaS) platform to include the ability to automatically discover all the application programming interfaces (APIs) in an application using machine learning algorithms, then automatically apply all the whitelist policies that apply to those APIs.

    Service meshes add a programmable layer of abstraction above a proxy server that makes it easier for IT teams to provision networking and security services on demand. The challenge is service meshes tend to be complex to deploy and between the service mesh itself and the underlying proxy server software also consume a significant amount of resources.

    Company CEO Ankur Singla said Volterra addresses that issue by making VoltMesh available as a service that DevOps teams can invoke remotely to simplify the provisioning of network services without having to deploy and maintain a service mesh on their own. Volterra claims VoltMesh has already been embraced by more than 50 enterprise IT organizations and service providers. VoltMesh can also be globally extended to clusters across multiple cloud providers via an application delivery network (ADN) that the company also manages.

    Singla said VoltMesh is shifting control over networking and security services left toward DevOps teams by employing a network fabric delivered as a service that eliminates the need to deploy separate load balancers, API gateways and web application firewalls for each cluster. That network fabric also provides DevOps teams with a zero-trust architecture for networking services that better ensures application security because it is managed by Volterra, added Singla.

    In general, service meshes are emerging as a critical linchpin in the convergence of network operations and DevOps processes. Most DevOps teams can provision virtual machines in a matter of minutes. However, outside of a public cloud it can still take days or sometimes weeks to provision networking and security services. Service meshes provide a mechanism for programmatically exposing networking and security services to APIs without requiring networking staff to manually provision each individual appliance, router and switch using command-line interfaces (CLIs) that are unique to each device.

    It’s too early to say to what degree IT organizations may decide to rely more on external networking services. However, more organizations are showing a marked preference for devoting more of their limited resources to developing and deploying applications. Everything required to run those applications simply becomes yet another cloud service that can be programmatically invoked.

    Naturally, the implications of that transition for network operations teams could be profound. Many organizations have “sunk costs” in enterprise networks measured in multiple millions of dollars. However, at a time when DevOps teams are being challenged to deliver applications faster than ever, tolerance of rigid networking services is declining. Many DevOps teams will simply opt to rely on external networking services in much the same way they opt to employ virtual machines in the cloud versus waiting for internal IT teams to make resources available in a local data center. When it comes to traditional approaches to networking, time and patience are running out.

  • Envoy Proxy Server Project Comes of Age

    Envoy Proxy Server Project Comes of Age

    The momentum behind the open source Envoy proxy software project is increasing as the number of platforms it can be deployed on continues to expand.

    Developed under the auspices of the Cloud Native Computing Foundation (CNCF), Envoy has most recently been extended to include support for Arm64 CI processors and Postgres databases.

    Envoy provides a layer 7 edge and service proxy that can be employed to provide a layer of network abstraction for both cloud-native applications based on microservices and existing legacy applications based on virtual machines.

    Initially developed by Lyft, there are now more than 180 IT vendors and more than 155 companies making contributions to Envoy. Matt Klein, a software engineer for Lyft who is also a maintainer for the Envoy project, said at that level it’s clear Envoy has achieved a critical level of mass. In fact, that level of support is why so many providers of service meshes have elected to deploy their frameworks on top of Envoy.

    Klein conceded Envoy is a complex piece of software that requires a significant level of engineering expertise to master. However, as IT teams look to become more agile, the need for a layer of abstraction that reduces network complexity has become more apparent, especially as organizations move to embrace edge computing.

    That agility now also can be extended to software platforms via plugins. In the case of Postgres, for example, Envoy can now decode and interpret the wire protocol format for Postgres to extract data and metrics from Postgres traffic. That capability will not only route database traffic more efficiently but it also offloads the management of that task from the Postgres server without any changes to the database platform required.

    Envoy makes it possible to extend many of the infrastructure-as-code concepts first put forward to manage virtual machines in the cloud to networks. DevOps teams have been able to provision virtual machines in a matter of minutes for years. However, in on-premises IT environments it can take days, sometimes weeks, to provision networking resources. Envoy provides a layer of abstraction that makes it possible to manage network services at a higher level of abstraction.

    Klein said in addition to making Envoy less complex, the team overseeing its development is working to add deeper support for WebAssembly, a platform that makes it easier to build applications on top of Envoy. The Envoy team also plans to tighten integration with multiple observability tools to enable DevOps processes to be applied more easily to networking services, added Klein.

    As Envoy continues to evolve, the rate at which network operations and DevOps will converge is only going to accelerate. DevOps teams will be able to employ Envoy in concert with a service mesh to programmatically manage network services at will. It may take some time for roles within enterprise IT organizations to be redefined to reflect that new reality, but the days when networks were managed via command-line interfaces that had to separately accessed for each router, switch or appliance on the network are coming to a close. In its place, a new era of software-defined networking based on commodity processors is finally starting to rise.

  • What It Takes to Succeed in a Multi-Cloud Environment 

    What It Takes to Succeed in a Multi-Cloud Environment 

    A multi-cloud strategy offers the best possible scenario for ensuring business continuity and helping improve innovation

    Business problems are not “one size fits all,” and neither are cloud architectures. Organizations are looking for specific solutions that deliver on their bespoke needs—a driver for many of them shifting from one cloud provider to working with multiple providers. In fact, 84% of organizations have a multi-cloud strategy. This offers them additional resilience and security when it comes to ensuring business continuity and protecting their business and customer data.

    Having a multi-cloud strategy could mean many things. It could mean using different cloud data warehouse (CDW) providers such as Amazon Redshift and Snowflake. It might mean hosting operational data stores in AWS, but transferring and performing analytics on that data in Azure. Or, the underlying cloud platforms could differ, such as two different Snowflake instances—one on Google Cloud Platform and a second on Microsoft Azure. These different CDWs could be hosted in different parts of the world. Sometimes, having a multi-cloud strategy means all of these at once.

    Common Mistakes

    Organizations often lock themselves in (often inadvertently) to a single cloud vendor by choosing tools or technologies that are very difficult to make portable. It can be very tempting to go for the most simple, seamlessly integrated piece of technology that a cloud vendor has to offer, but if that limits your choice of vendor later and does not interoperate with other clouds, it can lead to regret.

    While there is an uptick of adoption for multi-cloud strategies, it is still in the early days—especially for many organizations that are still coming to grips with moving on-premises workloads to the cloud. Expect a lot more in this area as more customers demand that clouds work better together and resist services that lock them in.

    Another mistake organizations make is that they do not account for the complex challenges that come with more data and differing technologies. Integration between data sources and solutions will be tough since not all providers offer seamless connections with other tools. That is why it is so important that organizations use technology that is cloud-agnostic, saves on costs and seamlessly provides better transition between clouds.

    Enterprises need to have the right technical expertise, technologies and tools in place or they run the risk of failure. As businesses increasingly move to a multi-cloud strategy, the specialized skills they need to turn data into value are changing at staggering speed. Managed tools that leverage the power of the cloud enable us to handle more varieties of data, in larger amounts, at greater speed and scale than ever before. But the platform and the tools aren’t the only things that have changed—the techniques and resources on data teams are also shifting.

    A data team focused on hand-coding and retrofitting technologies for cloud migration is not necessarily one that is prepared for modernizing data architecture and implementing a multi-cloud strategy. The data team needs to include people with the ability to organize data for cost-effective analysis and reporting that leads to intelligent conclusions—that is, data engineers with cloud training and experience as well as the ability to understand the data itself.

    How to Gain Control Over a Multi-Cloud Channel

    Organizations adopt multi-cloud strategies for a multitude of reasons. They may be sensitive to cost, have preferred partners, have adopted different grassroots technology in different departments and so on. However, sometimes the strategy is about the capabilities that are available. Cloud computing is an innovative space. While core cloud platforms for the major clouds such as Amazon AWS, Microsoft Azure and Google Cloud Platform are very similar in functionality for their core services such as storage, compute and databases, when it comes to the more advanced services such as machine learning (ML), artificial intelligence (AI) and advanced analytics, there are real advantages to being able to work across multiple clouds. For example, you might find that the data warehouse platform that best suits your needs is on AWS but the best ML tool for processing that data and inferring meaning is on Google Cloud Platform.

    To have a successful multi-cloud strategy, companies need to use cloud-agnostic tools and technology that works with more than one cloud data warehouse and are able to support all the different environments with as little friction as possible.

    Enterprises will need to embrace the best of what cloud technology vendors have to offer as opposed to watering down their offerings for a lowest-common-denominator, works-everywhere-but-limits-functionality-approach.

    With a multi-cloud approach, all the advantages of cloud remain but you avoid many of the pitfalls. You still have the cloud scaling and cloud pricing to keep costs down. However, there is danger in being limited to a single cloud vendor and their ecosystem. Particularly for companies that want to lead by innovation, especially innovation with data, where the accelerating pace of technical improvement continues across all the major cloud vendors. Maintaining the flexibility to work on the best cloud platform to solve a particular business problem or process will give them the competitive edge.

    Working With Multi-Cloud Environments

    Here are some tips for making multi-cloud environments more manageable:

    • In general, work with existing, open, and emerging standards wherever possible.

    • Use containers for compute—ideally on Docker or Kubernetes.

    • Cloud storage such as Amazon s3 or Azure Blob Store are usually quite simple and migration is manageable. However, stick to common open data standards such as AVRO, Parquet or even CSV.

    • Security is a place where cloud vendors would love to lock you into their technology and can be painful to move. Use a third-party security provider such as Auth0 or PingIdentity.

    • For more cloud-agnostic and future-proof configuration management, consider Terraform over Cloudformation and other templating systems.

    • Writing serverless functions can be a huge advantage in terms of simplifying management; however, it’s also a place where a cloud vendor can heavily lock you in. Think carefully and keep your logic in a widely supported language such as Python or Node (Javascript).

    • When running images avoid cloud vendor operating systems over popular third parties such as CentOS or Ubuntu.

    • Whenever you engineer software that interacts with cloud APIs, design the layers of abstraction from the start and think about how you could migrate to another cloud. Once an application has been written to operate in two clouds, adding support for the third and fourth becomes incrementally easier.

    • Choose tools that are built specifically for and also enhance the major cloud platform to ensure you have the right strategies aligned to the right platform. As mentioned above, different cloud providers do certain things better. Make sure to understand what tools work best in which cloud environment—or better yet, find solutions that are purpose-built for cloud data warehouses to maximize your ROI.

    • Implement tooling to track usage across clouds for budgeting and resource allocations and latency to identify architectural pain points that may need remediation.

    •  Evaluate independent software vendors’ offerings that extend the capabilities and scope of what is available in a native cloud service provider offering.

    • Select a solution that extends the cloud object store to multiple clouds, as a default multi-cloud deployment tier, to allow for the greatest degree of flexibility.

    While a multi-cloud strategy may seem overwhelming and difficult to manage at first, it ultimately offers the best possible scenario for ensuring business continuity. Having the right tools in place will ensure manageability while empowering you to lead in innovation, ensuring the best possible return for your investment.

  • VMware Expands Reach of IT Management Portfolio

    VMware Expands Reach of IT Management Portfolio

    VMware today announced a bevy of updates to its portfolio of IT management tools that is now at the heart of its overall approach to both DevOps and AIOps.

    VMware vRealize Operations 8.2 and VMware vRealize Operations Cloud, the on-premises and software-as-a-service (SaaS) editions of the same IT automation platform, provide deeper support for Kubernetes distributions, including the VMware Tanzu Kubernetes Grid, as well as tighter integration with application performance management (APM) platforms from AppDynamics, Datadog and Dynatrace.

    VMware is also providing tighter integration with its VMware vRealize Network Insight to bridge the divide between IT and network operations and tools to better monitor instances of VMware software running on the Amazon Web Services (AWS) public cloud.

    Enhancements to the capacity and cost management tools that VMware makes available as part of the platform include more visibility into daily virtual machine (VM) costs, enhanced metering capabilities and support for non-VMware vRealize Automation workloads.

    At the same time, VMware is making updates to VMware vRealize Automation and VMware vRealize Automation Cloud. The latest updates to the VMware automation platform add support for VMware Cloud Templates, a way to manage infrastructure as code that is compatible with configurations created using Terraform tools.

    Other enhancements include self-service provisioning of Kubernetes namespaces via the service catalog, including support for VMware vSphere with Kubernetes, as well as more granular role-based access controls and application programming interfaces through which policies for VMware NSX network virtualization software can be applied.

    Updates to VMware vRealize Log Insight and vRealize Log Insight Cloud add enhanced Kubernetes support, deeper integration with VMware Cloud on AWS and other usability enhancements.

    Finally, VMware is streamlining the onboarding process for VMware Skyline, a predictive analytics tool the company makes available as an extension of its operations management portfolio.

    Ken Lee, senior director of product marketing for VMware, said VMware vRealize Cloud Management portfolio is evolving in a way that makes it accessible to both traditional IT administrators and DevOps teams. Each function in the platform can be invoked via a graphical user interface or application programming interface (API), he said.

    At the same time, VMware is infusing machine learning algorithms across the portfolio to enable AIOps, eliminating the need for IT organizations to acquire a separate IT management platform to employ AIOps or embrace best DevOps practices, he said.

    While the number of IT organizations that employ virtual machine software from VMware numbers in the hundreds of thousands, the number of organizations employing its IT operations platform is still measured in the hundreds. The company clearly enjoys the inside track in terms of relationships with those customers. However, it’s clear that the number of IT organizations relying on tools other than those provided by VMware to manage their environments is significant.

    As IT organizations look to modernize those IT environments, however, there is clearly an opportunity for VMware to gain additional traction. The challenge is the race to embed AI and DevOps practices into IT operations platforms is already quite heated.

  • Accurics Adds Compliance Control Support to Code Analyzer

    Accurics Adds Compliance Control Support to Code Analyzer

    Accurics, at the online KubeCon + CloudNativeCon 2020 conference today, launched an update to its open source Terrascan static code analyzer that adds support for Open Policy Agent (OPA) engine to make it easier for developers to create custom compliance policies in addition to leveraging more than 500 out-of-the-box policies based on the CIS Benchmark.

    In addition, Terrascan is now available as a GitHub Action and is included in the popular Super-Linter GitHub Action. It can be installed as a pre-commit hook to help detect issues before code is pushed into a repository as part of a DevOps workflow.

    Cesar Rodriguez, head of developer advocacy at Accurics, said the latest version of Terrascan has also been rewritten in the Go programming language to improve overall performance.

    Terrascan analyzes the code created to manage infrastructure as code for vulnerabilities as well as indicators of drift. It then creates a threat model for cloud application workloads and, if necessary, will share data with third-party tools to automatically roll back cloud settings to their last known approved state. Once the model is constructed, Accurics monitors the application workload for changes that introduce risks and generates a topology for each workload in real-time to identify any potential indicators of drift.

    A recent report based on an analysis of cloud services published by Accurics finds misconfigured cloud storage services are commonplace in a stunning 93% of the cloud deployments analyzed, with most also having at least one network exposure in which a security group was left wide open.

    The report also finds hardcoded private keys turned up in 72% of the deployments analyzed. Unprotected credentials stored in container configuration files were found in half of these deployments. A total of 41% of the organizations had high privileges associated with hardcoded keys. In 100% of deployments, an altered routing rule exposed a private subnet containing sensitive resources such as databases to the internet.

    Overall, the report suggests that only 6% of cloud configuration issues are being addressed using manual remediation processes.

    Ideally, developers should be implementing cybersecurity and compliance controls as they deploy applications in the cloud. The challenge is that while developers have ready access to tools to automate the configuration of those services, not many of them have tools to verify whether those services have been implemented properly.

    IT organizations will still need to scan for vulnerabilities in runtime environments. However, tools such as Terrascan will enable IT teams to advance the adoption of best DevSecOps practices by providing developers with access to scanning tools that can be incorporated easily with a continuous integration (CI) workflow.

    Of course, the biggest DevSecOps issue remains culture. However, most developers don’t intentionally want to deploy insecure cloud applications. If given access to the right tools, most developers will do the right thing as long as it feels like a natural extension of an existing workflow rather than an unnatural act that was defined by a cybersecurity team that has little to no idea how applications are actually constructed.

  • Why Service Meshes Are Security Tools

    Why Service Meshes Are Security Tools

    Are service meshes overhyped, or do they solve a real puzzle for enterprise IT systems? Service meshes are a relatively new technology, and many people have found it challenging to fit them into predefined tooling categories. That’s because service meshes have a wide variety of functionality, from load balancing to securing traffic. But service meshes do more than securing your traffic via mTLS, and they can be very important security tools for your enterprise.

    Service meshes help organizations improve their security posture, working to both proactively prevent attacks through encryption and access control as well as to provide visibility into anomalous behavior when security incidents do happen. Service meshes can be a strong addition to organizations’ security tooling and are especially important for securing applications that have both cloud-native and legacy components.

    In the past, controlling the perimeter of the network was considered “good enough” when it came to network security. There are two problems with this: First of all, even in legacy systems getting through the firewall was often not that hard and, once in, attackers could access the entire system. Just as importantly, this approach simply does not work for distributed, cloud-native applications that don’t even have a clear perimeter to protect. A service mesh makes it possible to tighten control over traffic inside the virtual network, so even if a malicious actor gets in, its presence is easier to detect and the extent of the damage can be limited.

    Service Mesh and Security

    Here’s why services meshes should be considered security tools—and how they work to secure modern enterprise applications.

    Central Control Over Communications

    Modern engineering organizations need to give individual developers the freedom to choose what components they use in applications as well as how to manage their own workflows. At the same time, enterprises need to ensure that there are consistent ways to manage how all of the parts of an application communicate inside the app as well as with external dependencies.

    A service mesh provides a uniform interface between services. Because it’s attached as a sidecar acting as a micro-dataplane for every component within the service mesh, it can add encryption and access controls to communication to and from services, even if neither are natively supported by that service.

    Just as importantly, the service mesh can be configured and controlled centrally. Individual developers don’t have to set up encryption or configure access controls; security teams can establish organization-wide security policies and enforce them automatically with the service mesh.

    Developers get to use whatever components they need and aren’t slowed down by security considerations. Security teams can make sure encryption and access controls are configured appropriately, without depending on developers at all.

    Cross-environment Microsegmentation

    The ability to control access to different parts of the infrastructure is a key part of any organization’s security posture. But in most modern enterprises, each business unit will have applications running both on-premises and in the cloud—potentially in multiple clouds.

    With an agnostic service mesh to bridge environments, organizations can segment networks in a way that still creates a seamless experience for users and doesn’t become too complex for security teams to manage effectively.

    Inside each segment, the service mesh can be used to create attribute-based access controls (ABAC), role-based access controls (RBAC) or even next-gen access controls (NGAC). A service mesh allows organizations to tune this access control very granularly, including inside individual network segments and across different deployment environments.

    Detailed Telemetry

    In addition to providing consistent encryption and access controls, service meshes can also provide the telemetry that organizations need to identify potential security incidents and respond appropriately to anomalies.

    Because all traffic moves through the service mesh, the mesh is able to collect and display granular information about network traffic. This includes the ability to track the origin and destination of every request sent through the mesh, which is important both for security as well as for passing compliance audits.

    With a service mesh that connects both legacy and cloud-native environments, detailed traffic information is available for the entire system. Security teams can use a single dashboard to see how traffic is moving through the system and to correlate signals to users, IP addresses and content as it moves from one environment to another. Having all the information in one place reduces the risk of miscommunications or miscorrelations as traffic moves between environments, either obscuring a real security risk or raising red flags unnecessarily.

    Consistent Cross-environment Security Postures

    Most modern enterprises have a hybrid/multicloud IT system that includes legacy monoliths in data centers, cloud-native infrastructure in private clouds as well as workloads running in at least one public cloud. There are legitimate business reasons for all of these infrastructure choices, but organizations need to have a strong, consistent security posture across all of them. Service mesh technology allows organizations to connect all of the services, applications and components in the system, regardless of environment, and ensure encryption, access controls and visibility into traffic flows extend throughout the entire system.

    Conclusion

    Adding a service mesh to your security toolkit is a way to ensure consistency and compliance across the entire, heterogeneous system, no matter what kind of environments and deployment architectures you have. Ultimately, your security posture is only as strong as your most vulnerable deployment. A service mesh is the best way to ensure that every part of your infrastructure complies with your internal security policies.

  • Evolving from FaaS to a Truly Serverless Paradigm

    Evolving from FaaS to a Truly Serverless Paradigm

    True serverless helps alleviate some of the administration and management issues related to FaaS

    Creating distributed applications demands a thorough understanding of cloud infrastructures and architectures. Engineers must address complex operational issues, including provisioning, configuration and how their code will behave over a distributed architecture.

    The current standard is to architect programs into microservices, before deploying to cloud hardware. Docker and similar technologies ensure that the microservices are strongly isolated in-terms of access, dependencies, and the potential overcommit of resources.

    However, containerization is an imperfect solution that masks rather than addresses the core problems of running cloud applications. As an application scales, scripting architectures and defining how different containers communicate with one another becomes exponentially complex. The solution—orchestration technologies such as Kuberenetes—adds yet another layer to an already bloated stack ill-designed for the needs of distributed computing.

    These problems were, in theory, to be alleviated by the concept of serverless—not the removal of servers, but rather the removal of their administration. However, since its emergence in the early part of the last decade, the term has become conflated with function as a service (FaaS).

    FaaS tools such as AWS Lambda break code into computational event-driven units, which only run when called. The event-driven logic scales quickly, efficiently and dynamically, driving down costs as the provider takes care of all server updates and administration, while developers only pay for what is used.

    However, functions run on their own custom framework and are limited in memory and execution time, rendering FaaS an inappropriate approach for scaling an entire application. Regularly scheduled database tasks, CPU-bound processes and long-running persistent connections to a server are examples of common patterns that map poorly onto FaaS.

    Serverless Is More Than Just FaaS

    A platform that looks after the infrastructure of an entire application (as opposed to specific functions) is the logical evolution of FaaS, and represents a truly serverless paradigm. Serverless, in this sense, takes the dynamic scaling properties of FaaS, but without fragmenting the application.

    Rather than simply linking together different components of a larger system, a serverless platform ensures long-running processes and fast discovery, enabling services to communicate and cooperate with one another quickly and reliably. Arbitrarily large memory capacity and unbounded execution time are underpinned by predictable execution and robustness guarantees well beyond the layered stack approach of FaaS. Developers can altogether ignore the management and configuration of servers, treating computation in purely algorithmic or data terms.

    Whereas containerization and FaaS solve pieces of the distributed computing puzzle, they also introduce new issues as the user must engineer their own infrastructure stack to carry out even basic tasks. By contrast, serverless could reduce an application engineered with Chef, Docker, Kubernetes, the JVM and Akka to a single abstraction. It allows for programs to be easily scaled up and down, harnessing almost limitless computing power, without compromising runtime.

  • HashiCorp Adds Business Tier to Managed Terraform Service

    HashiCorp Adds Business Tier to Managed Terraform Service

    HashiCorp today announced it has added a Business tier to the HashiCorp Terraform Cloud that expands the managed service in a way that provides advanced security, compliance and governance capabilities along with the ability to execute multiple runs concurrently and take advantage of more flexible service level agreement (SLA) options.

    Meghan Liese, director of product marketing for HashiCorp, said this new tier addresses the requirements for enterprise IT organizations that are looking for a way to enable teams of developers to more securely provision IT infrastructure using open source Terraform tools.

    For example, the Business tier of the service provides integration with single sign-on tools provided by Okta, while auditing of logs is provided via integration with tools from Splunk. This tier also provides access to private networks with fixed IP addresses as well as self-hosted agents to interact with other management planes if required.

    HashiCorp reported that since launching a managed service last year for IT organizations that don’t want to provision the servers, it is now adding more than 5,000 new users per month, with 500,000 runs to provisioning infrastructure executed monthly.

    The other two existing levels of services provided by HashiCorp are free instances aimed at individual developers and a Team and Governance services that can be employed to create teams that manage and govern reusable instances of configurations.

    Liese said HashiCorp launched the Business tier in part to respond to the needs of enterprise IT organizations looking to automate the provisioning of IT infrastructure at scale. While there is a lot of free-rein usage of open source Terraform tools, Liese said enterprise IT organizations need to ensure security and meet compliance requirements.

    Those same enterprise IT teams also tend to provision IT infrastructure concurrently, which, Liese noted, means waiting for one configuration to be completed before another is launched isn’t practical.

    Terraform has gained a lot of traction among individual developers who have shown a tendency to prefer open source tools to provision IT infrastructure. That momentum has enabled HashiCorp to provide IT organizations with both commercial support for instances of Terraform they deploy and manage as well as via a service through which instances of Terraform are managed and updated by HashiCorp.

    Regardless of the path chosen, the number of IT teams provisioning IT infrastructure as code has increased substantially. Less clear is to what degree that provisioning is being done by developers versus IT operations staff who have mastered Terraform. At a time when many organizations are unable to add more IT personnel, the need to automate the provisioning of IT infrastructure has never been more acute.

    Of course, there are still more than a few IT teams who prefer to rely on IT administrators to provision IT infrastructure using legacy tools. However, as the pressure to become more agile continues to steadily increase, it’s now only a matter of time before the manual workflows constructed using those tools are rendered obsolete.