Category: Cloud-Native

  • Is Backstage the Right Internal Developer Portal for You?

    Is Backstage the Right Internal Developer Portal for You?

    There has never been a better time to be a software developer. There is a language and framework to solve virtually any challenges we encounter. New tools, architectural patterns and methodologies like DevOps and Agile have changed how we work, architect our applications and organize ourselves. This has enabled teams to be nimbler than ever before. But this has all come with a hidden cost: Sprawling complexity.

    Sprawl is a complex web of disparate tools, languages and frameworks used across an organization’s projects. While this diversity allows for specialized solutions tailored to specific problems, it creates a labyrinth of interdependencies and varied skill requirements. This complexity often results in developers constantly navigating through a maze of tools, leading to inefficiencies and a steep learning curve for new team members. As organizations adopt more tools and technologies, the cohesive understanding of the entire software ecosystem diminishes. There are two areas in particular where this pain is felt acutely.

    The first area sprawl acutely impacts is the ability to find essential knowledge about systems, which becomes fragmented across tools and resources as sprawl increases. This fragmentation leads to longer incident response times and makes it more difficult for newly hired engineers to ramp up. Knowledge fragmentation also makes it considerably harder for enterprises to measure and manage initiatives to achieve high standards for security and reliability, as well as track migrations to new architectures like containers or clouds.

    Sprawl also impacts frequently occurring tasks for developers, such as managing “day two operations” like changing environment variables, adding secrets or modifying a replica count, or creating something new like a microservice or an environment. Given the complexity required to create and operate infrastructure, many organizations have invested in creating automations via infrastructure-as-code and CI/CD systems; however, these automations are often difficult for developers to discover and use. As a result, developers often file tickets with ops teams to complete these tasks, creating a process bottleneck that slows development velocity while burdening ops teams with mundane, repetitive tasks. This is commonly referred to as TicketOps.

    All of this has made the developer experience worse than ever. Developers report high levels of cognitive overload and burnout, which can cause unwanted developer attrition and reduced overall productivity. But it doesn’t have to be this way!

    Introducing Backstage

    In the early days of the cloud, only a handful of enterprises with lofty valuations could afford to solve these challenges by dedicating 50 – 100 engineers to build internal tooling designed to address the challenges of sprawl. Everyone else was left to suffer with subpar developer experiences or partial solutions like stale spreadsheets, manual processes and information that were often out of sync with the underlying system.

    Just as the pain was becoming unbearable for most enterprises, Spotify donated the tooling it created to address these challenges internally to the Cloud Native Computing Foundation. As a free, customizable, open-source project focused on these pain points, Backstage quickly captured the attention of enterprises worldwide.

    Over 2,000 enterprises have tried Backstage, making the project a tremendous success by promoting a vision for how internal developer portals can alleviate the pain of sprawl. However, a surprising number of enterprises struggle to adopt Backstage. In an interview with the head of engineering for Backstage, it was revealed many companies that have deployed Backstage have achieved only ~10% adoption rates, which is typically equivalent to a proof of concept. Understand why enterprises have struggled to succeed and decide if Backstage is right for you.

    Deciding if Backstage is Right for You

    Here are key questions to help guide your decision.

    Are You Ready to Build a New Product?
    Backstage is a framework to build an internal developer portal, but it is not an off-the-shelf tool or a solution. Many adopters have not understood what this means, at least at first.

    As a framework to build a tool, Backstage requires dedicated product and engineering resources to configure, customize and maintain. It is not uncommon for organizations to require four to six or more fully dedicated resources to succeed with Backstage. The engineers you dedicate to building this framework into a product will need to be skilled in TypeScript and React, and willing to work with an open source community and product.

    Getting up and running with Backstage involves more than 70 steps. It is not intuitive and can result in months of work before you can demonstrate value. Some of the steps and associated time commitments are obvious, such as deploying your instance of Backstage. Other steps may not be obvious to new adopters.

    For example, Backstage has historically relied on open-source plugins to enable organizations to connect their tools. The open-source nature of these plugins has been a key selling point of Backstage; however, the plugins have uneven quality and depth and can require additional customization to enable basic functionality like search. In another example, tuning the Backstage data model to your organization is so difficult that many adopters abandon hope and work with the default data model. Upgrading versions and plugins and the effort required to keep the data in Backstage synced with your system contribute to the engineering resource load required to succeed.

    The advantage of Backstage is the infinite customization you can accomplish thanks to its open-source code base. You can change anything you want if you write and maintain it. This includes adding custom data sources, customizing the data model, extending plugin functionality and having the UI reflect your corporate brand identity. Again, the trade-off is time and complexity relative to your alternatives. For instance, configure8 and Port offer the flexibility to tailor the portal’s data model to the contours of your organization and process any custom data source for use throughout the porta. Several vendors can support custom logos and color schemes in the portal’s UI (or you can build a more tailored UI on top of their APIs).

    Does it Support Your Scenarios of Interest?
    Internal developer portals as a product category have evolved well beyond their microservice catalog roots. If you are considering Backstage, it is important to ensure it offers functionality that addresses the needs of your enterprise’s stakeholders.

    For example, many organizations leverage functionality called Scorecards to define and measure teams’ compliance with reliability standards, security and architecture. Open source Backstage has a version of this functionality, but it is not intuitive and has a fairly high difficulty level (i.e., writing code, writing data collectors, etc.). The commercial vendor community typically all offer Scorecards. Adopters should consider the breadth and depth of information that can be checked, the ease of creating new scorecards, and the quality of the developer workflow and UI when evaluating Scorecards.

    In another example, Backstage enables users to scaffold new services via the Cookiecutter open-source package. Why take a principled dependency on a code generation solution instead of an open approach that enables you to use the best tool for the job? There is a robust landscape of available solutions to generate code and orchestrate workflows. Having a flexible way to directly integrate these reduces complexity.

    Backstage also offers functionality that enables developers to see the cloud costs of the code they operate. Upon closer inspection, adopters find this module only enables high-level aggregations of costs over a fixed timeframe. To truly provide developers with the knowledge and functionality they need to improve costs, consider closed-source vendors that offer more granular insights and actions, such as drilling in beyond aggregate costs at the microservice level to see the per resource cost drivers, an individual resource’s cost drivers, config settings and blast radius and weave in self-serve actions so developers can safely make changes where appropriate and permitted.

    The resource and environment catalog is another area to consider. Is it necessary to have the environments and resources that power them automatically mapped to each service? Do you want a centralized catalog of your resources across clouds and data centers that you can sort and filter using various keys? Backstage can support some of these scenarios, but not without significant work and at present, the connection to this data is brittle and manual versus automatic. This stands in contrast to certain closed-source vendors, such as configure8 which has extensive functionality.

    In a prior section, we discussed the importance of data model flexibility. This is an important evaluation criterion for organizations that want the flexibility to push in and present any data source, to customize the schema of the catalog, and finally to insert custom keys for results filtration and analysis (i.e., does this resource touch personally identifiable information; show me results related to a line of business, etc.). Ensure you understand whether you are poised to succeed in tailoring Backstage’s data model, which has stymied many adopters, and that any commercial vendor you evaluate can easily support customizations.

    Another consideration is Backstage’s TechDocs, and whether you want to adopt TechDocs for your entire enterprise or allow teams to use best-of-breed solutions. Whereas Backstage locks you into TechDocs (which can also make a future migration to a new portal solution more difficult once end-user behavior becomes entrenched), commercial vendors generally support open and flexible approaches that enable integration with any documentation solution.

    Also, ensure Backstage meets your information security needs. For example, most organizations desire a robust role-based access control model so developers only see permitted services, scorecards and actions in the UI, via search and the API. Backstage does not offer this functionality in the open-source edition. There is a framework to work with permissions included in Backstage but to get real value out of it, you need to budget to license a closed-source RBAC solution from Spotify or build it yourself.

    Finally, evaluate the pace of innovation you desire from your internal developer solution. Closed source vendors, two in particular, have demonstrated an extremely rapid pace of innovation, launching many industry firsts. Compare this to the pace of innovation in the open source community as internal developer portals are sticky once installed and tend to be long-term relationships.

    Are You Prepared for Success?
    Achieving broad internal adoption of an internal developer portal requires more than getting a portal configured, it requires solving the pain points that matter to your organization, demonstrating success, making the organization aware of that success, and creating a feedback loop to overcome challenges. To accomplish this, you must be aware of best practices, create content and forums to engage the organization, and ultimately adopt a product-oriented approach to ensure your platform engineering effort succeeds.

    Success in this area often combines budgeting and access to best practices.

    The Backstage community is vibrant and active, and you can pick up best practices by engaging with community members. But for enterprises and internal champions who need to succeed in driving the adoption of a new internal developer portal, you may wish to consider alternatives to community support.

    This can be accomplished via multiple methods. Consulting firms and individual practitioners specialize in this area and can coach you. Organizations above a certain size often invest in dedicated product management resources to own this function. Finally, certain vendors like configure8 focus on delivering success versus a tool (or framework to build a tool like Backstage) by providing consultative best practices, content and other value-adds packaged with their software to ensure you achieve robust adoption levels.

    Finally, to the extent your scenarios of interest involve self-serve actions to alleviate TicketOps, ensure that you have budgeted the appropriate engineering investment to develop the golden paths or blueprints that are vended inside an internal developer portal. Certain vendors like configure8 offer a solutions layer that creates custom golden paths for you. However you procure golden paths, you must balance your investment to ensure you get a great “razor” and all of the “razor blades” you will need to support the unique needs of your various internal customers.

    Do You Understand Your Total Cost of Ownership and Alternatives?
    One of the considerations of Backstage is understanding its total cost of ownership versus its best alternative.

    While Backstage is open source and free, we have noted that a meaningful engineering investment is required for installation, customization, maintenance, internal support and product management. Quantify the fully loaded cost (i.e., salary, taxes, benefits, facility charges, etc.) of each human resource required to succeed with Backstage.

    We have noted there may be licensing costs from Spotify for any essential features you do not wish to build yourself. There will be internal hosting costs and budgeting for any consulting costs.

    Several enterprises who have evaluated Backstage now realize the total cost of ownership of alternative vendors is much lower and more predictable. Leading vendors offer robust alternatives for catalog and scorecarding, self-serve actions, and collaborative cost management, and two vendors have evolved to provide compelling functionality and high degrees of flexibility. The key is finding a vendor who balances overall functionality and flexibility with ease of use, speed to value, and enterprise-grade support. This is where configure8 has struck a unique balance in addition to a lower cost of ownership relative to Backstage.

    Finally, any return on investment analysis must capture the opportunity costs. Here are some common examples:

    • Time to market trade-offs. Setting up Backstage for your proof of concept can take over a month, getting to a first releasable version can take 3-6 months, and full adoption can take 6-12 months. During this time, you may generate no or minimal business value. Specialist vendors can deliver success faster. The incremental business value you can generate with a specialist vendor versus Backstage related to ‘speed to value’ represents an opportunity cost you need to quantify.
    • Foregone features: Scenarios like Scorecards or RBAC that are important to your organization and you will have to pay for or forgo, you need to factor these incremental costs (or the cost of not having these features) into your analysis.
    • Opportunity cost of internal engineering resources: How many engineers are required to support Backstage over and above what’s needed to succeed with a specialist vendor? What business value could these incremental engineers have generated by instead supporting the unique value your enterprise brings to its customers versus an internal tool in a world of compelling alternatives? This becomes another cost of owning Backstage you need to compare v. the cost of buying a solution from a vendor.

    Understanding the direct and opportunity costs of your best alternatives will help you put your budget to work in the most efficient way and aid in your internal discussions with finance and other stakeholders.

    Carefully Consider Any Clones

    Given the initial popularity of Backstage, it is not surprising to see clones emerge built on Backstage. A clone is a vendor who has taken Backstage source code and added some feature crust on top, often a security wrapper, hosting and maintenance, light UI customizations, and potentially filling in a functionality gap like Scorecards. This approach can alleviate some of the burdens of open source Backstage in exchange for licensing costs you incur, it is important to understand if the clone is the best fit for your unique needs given the highly competitive vendor landscape that is now available. An easy way to think about it might be comparing Jenkins versus hosted Jenkins versus Jenkins with a vendor security wrapper relative to what enterprises get with Azure DevOps and GitHub Actions.

    Final Thoughts

    Building an internal developer portal from an open-source framework can be rewarding for organizations that can achieve value from extensive customization that is impossible elsewhere. For many organizations, however, it is important to properly scope the effort required to succeed with Backstage and compare it to your alternatives in the vendor community. While Backstage does offer certain advantages, DevEx and platform teams are increasingly finding greater success more quickly and at a lower total cost of ownership via specialist vendors like configure8.

  • Using LLMs to Automate Pipeline Conversions From Legacy to Tekton

    Using LLMs to Automate Pipeline Conversions From Legacy to Tekton

    There have been many technological advancements in the market today, but the main hindrance is the cumbersome process of switching from the existing technology/framework to the new one. This is where teams and organizations are left behind in the tech curve. In the DevOps landscape, CI/CD pipelines are the backbone of DevOps, and how you work with them largely dictates your DevOps efficiency.

    CI/CD pipelines, too, like other major technologies and frameworks in the past, have seen various evolutions; the latest among them is being made reusable in an attempt to standardize CI/CD. However, here too, there are several cons:

    1. The pipelines are not proprietary to end-user enterprises and belong to the DevOps platforms which are not open-source
    2. Migrating to these platforms and pipelines is a huge task
    3. They may not be as efficient as depicted

    Speaking of new advancements in technology, most might be familiar with Tekton for CI/CD pipelines: It is Google’s open source framework that is now a graduated CDF project. It redefines how pipelines are built (through reusable tasks) and these tasks are open source and community-vetted. They allow for pipeline authorship, and enterprises can re-use them across platforms that are compatible with Tekton, thus preventing vendor lock-in.

    While this mitigates the first challenge of pipeline ownership and migrations, however, the same problem plagues DevOps teams – transitioning from existing legacy technologies/frameworks to newer, much more capable frameworks like Tekton.

    However, what if there was a way to seamlessly automate your transition from legacy pipelines to cutting-edge, reusable Tekton pipelines without toil? This is precisely what the article aims to explore – automating the conversion of Yaml scripts of existing pipelines to Tekton Yaml scripts.

    Let us consider the three most popular CI/CD platforms for this use case – Jenkins, GitLab and Azure DevOps. Before we proceed to the proposed approach to achieve this (which is detailed in the second half of this article), let us first look at the limitations of Jenkins, GitLab and Azure Pipelines and why one should convert.

    Common Limitations of Jenkins, Azure and GitLab Pipelines

    Resource Intensive: Legacy pipelines can be resource-intensive, especially for larger organizations or projects. Managing server resources, optimizing configurations and ensuring sufficient hardware can be a challenge.
    Complex Setup: Setting up and configuring Jenkins, GitLab and Azure DevOps can be complex, particularly for self-hosted instances. This complexity may require experienced administrators and substantial time investment.
    Plugin and Integration Compatibility: All three platforms may face compatibility issues with certain plugins or integrations.
    Scaling Challenges: Scaling in organizations, especially when dealing with multiple microservices, necessitates a shift from individualized scaling to a template-based approach. Failing to do so leads to a chaotic increase of pipelines, undermining standards and organizational processes.
    Costs: While both Jenkins and GitLab offer free and open-source versions, some advanced features or capabilities may only be available in higher-tier paid plans. This can lead to cost considerations at scale.
    Customization Complexity: These platforms can be complex to customize workflows and integrate custom scripts as they require advanced scripting knowledge.
    User Interface Complexity: Though they have feature-rich interfaces, it can sometimes be overwhelming for new users to navigate the platforms and find specific settings or options.
    Limited Native Integration & Plugins: The native integrations of Jenkins, GitLab and Azure may not cover the full spectrum of tools and services a team may need. Additional integration efforts or third-party tools may be required to bridge gaps in the development workflow.

    As can be seen in the above limitations, many are common including scalability challenges, being resource intensive, limited integrations etc. All the challenges boil down to one common denominator: Complex pipeline management at scale.

    This is where a framework like Tekton can help tackle all the challenges at once, by just easing pipeline management: with its K8s-native pipelines that are reusable, open source and tasks that are community-vetted.

    Tekton Pipelines: Advancing CI/CD with Kubernetes-Native Automation

    Tekton, an open-source project, is rapidly gaining traction as a game-changer in the world of CI/CD pipelines. Its Kubernetes-native design is a standout feature, seamlessly integrating with Kubernetes clusters to harness its scalability and resource efficiency.

    Furthermore, Tekton’s cloud-native roots ensure it can execute tasks in lightweight, ephemeral containers, optimizing resource utilization. The ability to declare CI/CD pipelines as code, coupled with GitOps practices, enhances automation and reproducibility.

    How are Tekton Pipelines Different?

    Kubernetes-Native Automation: Tekton pipelines are deeply integrated with Kubernetes, utilizing Custom Resources and Operators to define and execute CI/CD workflows.

    Declarative and Modular: These pipelines are defined declaratively using YAML manifests, promoting version control, collaboration and code reviews. The modular design of tasks and pipelines enables teams to create reusable components for building, testing and deploying applications.

    Containerization and Isolation: Each task in a Tekton pipeline runs within a dedicated container, ensuring isolation and reproducibility of the build and deployment environment.

    Event-Driven Architecture: Tekton pipelines can be triggered by various events, such as code commits, pull requests, or external events, providing a responsive and event-driven CI/CD process.

    Scalability and Efficiency: Tekton pipelines leverage Kubernetes’ inherent scalability, enabling efficient execution of tasks across a dynamic pool of worker nodes.

    Visibility and Observability: They offer built-in monitoring and logging, allowing teams to gain insights into pipeline execution, track progress and diagnose issues.

    Integration and Extensibility: Tekton pipelines can be easily extended with custom tasks and integrations, enabling teams to connect with various tools, services and cloud platforms.

    Cloud-Native Best Practices: By embracing Tekton pipelines, organizations align with cloud-native best practices, promoting the use of Kubernetes and containerization for streamlined application delivery.

    Why Transition From Jenkins, GitLab, and Azure Pipelines to Tekton Pipelines?

    Migrating from Jenkins, GitLab, or Azure pipelines to Tekton pipelines can be a strategic choice, especially for organizations deeply entrenched in Kubernetes and cloud-native methodologies.

    Optimize Kubernetes-Centric Workflows: Projects tightly integrated with Kubernetes may find Tekton pipelines more aligned with their ecosystem.

    Accelerate Cloud-Native DevOps: Organizations aiming to embrace a cloud-native approach and leverage Kubernetes infrastructure.

    Performance and Scalability: Tekton pipelines run on clusters that can dynamically be created and destroyed according to demand, thus taking resource optimizations to the next level.

    Cloud-Native Best Practices: Best practices, such as containerization, declarative configuration and infrastructure-as-code are a natural fit due to their Kubernetes-native design.

    Proposed Workflow for Automating Pipeline Conversions at Scale

    The overarching objective of this workflow is to facilitate a seamless conversion process using large language models (LLM) without delving into the intricacies of fine-tuning but rather using the benefits of prompt engineering. Central to this approach is the use of the chat context and the strategic application of roles for LLM models to establish context. Along with this, sample pipelines are leveraged to train and fine-tune the model to define how the corresponding YAMLs of all these platforms look for any given pipeline.

    The use of prompts and instructions tailored to fit the use case of generating contextual pipeline YAML and conversion of Jenkins/Gitlab pipelines to Tekton pipelines makes this workflow possible. We maintain a context and a contextual mapping of real-world examples and the most appropriate prompt designs to produce the most accurate responses. The role of users in this context adds weight and further refines the response received.

    However, before proceeding into details and examples, let’s set the base for what exactly generative AI means and its context in our use case:

    Generative AI and LLM for Automating YAML Script Conversions

    Generative AI, such as LLMs, create content like text, benefiting from patterns in large datasets. Large language models (LLMs), with billions of parameters, excel in generating human-like text by understanding language structures. They have broad applications, including natural language understanding, summarization, translation and content generation, promising automation and human-like interactions with AI.

    Adapting the Model to Solve Real-world Use Cases

    Fine-tuning and prompt engineering are two common methods used to train large language models (LLMs) like GPT-3, BERT and others. These methods help adapt pre-trained models for specific tasks or generate contextually relevant responses. Both fine-tuning and prompt engineering play crucial roles. Fine-tuning helps the model comprehend complex use cases, while prompt engineering provides detailed requirements, extracting the best results from the model.

    Why Prompt Engineering?

    Prompt engineering stands out as a highly advantageous approach in specific use cases where precision, control and customization over AI model behavior are paramount. This method empowers developers and users to meticulously design input prompts, effectively guiding AI models to produce contextually relevant and desired responses.

    Prompt engineering is both an AI engineering technique for refining large language models (LLMs) with specific prompts and recommended outputs and the term for the process of refining input to various generative AI services to generate text or images.

    The process of prompt engineering to fit our use case includes :

    Defining the goal: The first step in the process of AI prompt engineering involves setting a clear objective.

    Crafting the initial prompt: With the goal in mind, it’s time to draft an initial prompt. This could take the form of a question, a command or even a scenario, depending on the goal.

    Testing the prompt: The initial prompt is then input into the language model, and the response is analyzed.

    Analyzing the response.

    Refining the prompt: With the insights gathered from testing and analysis, it’s time to revise the prompt. This could involve making it more specific, adding more context or changing the phrasing.

    Iterating the process: The testing, analyzing and refining steps are repeated until we are satisfied that the prompt consistently guides the model toward generating the desired response

    To conclude, here’s an example of typical YAMLs from Jenkins, GitLab and Azure DevOps, and how the same YAML looks when converted to a Tekton YAML. This goes a long way in facilitating teams to finally make a jump from their existing pipelines to cutting-edge reusable pipeline frameworks:

    Jenkins YAML

    GitLab YAML

    Azure YAML

    Converted Tekton YAML

  • Microsoft kills Python 3.7 ¦ … and VBScript ¦ Exascaling ARM on Jupiter

    Microsoft kills Python 3.7 ¦ … and VBScript ¦ Exascaling ARM on Jupiter

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: VS Code drops support for Python 3.7, Windows drops VBScript, and Europe plans the fastest ARM supercomputer. (more…)

  • IBM LLM AI: COBOL to Java ASAP ¦ ARM IPO is GO!

    IBM LLM AI: COBOL to Java ASAP ¦ ARM IPO is GO!

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Translating legacy COBOL code to a slightly more modern language, and Arm will go public (again) next month. (more…)

  • Google’s Shiny New AI Dev Environment — the ‘Experimental’ Project IDX

    Google’s Shiny New AI Dev Environment — the ‘Experimental’ Project IDX

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Google’s full-stack, browser based development environment in the cloud. It’s not just a Copilot clone, but aims to help you “get an app from zero to production.” (more…)

  • Google Calls Microsoft Azure Anti-Competitive ¦ Gen-Z Can’t Email

    Google Calls Microsoft Azure Anti-Competitive ¦ Gen-Z Can’t Email

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Google complains to the FTC about Microsoft market abuses, and new graduates don’t know how to office. (more…)

  • Techstrong TV: Styra Declarative Authorization Service

    Techstrong TV: Styra Declarative Authorization Service

    Styra’s new launch of Styra Declarative Authorization Service (DAS) for Cloud-Native Entitlements. With this solution, IAM teams can move to cloud-native technologies while still using existing systems-of-record as well as scale to the level that their organization requires. The video is below followed by a transcript of the conversation.

    Alan Shimel: Hello, everyone. Thanks for joining us on another TechStrong TV segment. Oh, I’m happy to have back on TechStrong TV today our friend, Tim Hinrichs, from Styra.

    Hey, Tim, welcome. How are you? 

    Tim Hinrichs: I’m doing great, Alan. Thanks for having me back on.

    Shimel: Yeah, it’s a pleasure to have you here. Tim, we always enjoy actually having the Styra folks on, whether it’s Bill, or you, or anyone else. Of course, Styra is a company that in the cloud native space has really kind of made a name for themselves. But though our audience is a cloud native audience and technical, they may or may not know Styra. They probably maybe have heard of Styra. They probably heard of OPA, but why don’t we kind of make sure everyone’s level set, Tim, and give them a little background?

    Hinrichs: For sure. Yeah, great. So, yeah, what Styra does is we help enterprises by providing them a unified solution to authorization. And so for folks that don’t know and don’t work on authorization every day like I do, just remember that authorization is this problem of controlling what actions that people and maybe software can take within a piece of software.

    So let me give you an example or two here. Every time I log onto my bank online, I can see all my bank accounts, but I may not be able to see my wife’s bank accounts. I may not be able to move money between her bank account and mine, and so that’s an authorization problem. It’s controlling what actions I can take. Can I withdraw money? Can I deposit money? So on and so forth. And so that’s one kind of authorization that we work on at Styra.

    But another good example is sort of at the developer level. So those websites that we all use every day, those are built by developers and developers are also taking action. And so one kind of action that they might want to take is they’re upgrading the software, or they’re deploying a database, or they’re changing some network configurations. Again, all of those are actions and there needs to be authorization controls in place to make sure that the right actions are being taken by the right people at the right time.

    And at Styra, we provide software that helps an organization sort of manage all of those permissions, all of those authorization policies across all those different kinds of decent software.

    Shimel: Excellent. Love it. And we might as well get it out of the way while we’re here, Tim. People who want to get more information on Styra, it’s Styra, S-T-Y-R-A, and it’s styra.com, correct?

    Hinrichs: Absolutely, yeah. Definitely check that one out.

    Shimel: Cool. All right, we’ve gotten that. Oh, you know what else, Tim? We didn’t even tell them about what your position at Styra is. We should give them that, too.

    Hinrichs: For sure, yeah. So my name’s Tim Hinrichs. I’m the CTO and co-founder at Styra and I spend part of my time working on our commercial product offerings, but then I spend the other part of my time on our open source efforts. And one of the things that we do in open source is we started the Open Policy Agent project, or OPA, as we like to call it, and then we donate it to the CNCF. So I’ve got a foot in both of those areas of work.

    Shimel: Love it. Hey, Tim, are you gonna be out at KubeCon in Spain in May, or planning it, not sure yet?

    Hinrichs: Not sure yet, but yeah, it would be great. I’d love to get back out, and start going back on that conference circuit, and seeing people, chatting with them about policy and authorization, and just seeing folks, again. I think it would be great.

    Shimel: We are currently planning on being there. We’re going to hopefully try to do some videos but a different sort of setup. I forgot what they’re calling it, something topist talks or something, so short, little, smaller segments. Again, assuming the world is right, we’ll be there.

    Anyway, but Tim, let’s focus in on what we want to talk about today, which is you guys recently announced a new offering. Tell us.

    Hinrichs: Yeah, for sure. So the new offering that we just released a little while ago, we call it the Entitlements Offering as part of our normal product called the Declarative Authorization Service. And so the idea behind this new offering is that it’s really designed to help organizations take custom applications and migrate them from on-premise data centers into the cloud more effectively, more quickly.

    And so the problem we kind of saw happening over and over was that if you’ve got one of these on-prem applications, especially an application that’s focused around helping your employees interact with each other or the organization as a whole, these employee-focused applications, a lot of those apps are dependent on what folks will call an on-premise entitlement service. So that entitlement service is often backed by LDAP, or Active Directory, or something, and it’s sort of just those applications sort of need to know which groups that employees are a member of in order to sort of grant permissions within the application.

    And so the challenge when you’re mind reading those kinds of applications into the cloud is that the cloud, what you don’t want to be doing is having an application running on the other side of the world and having to make a request all the way back to your on-premise LDAP or AD. The roundtrip time, the availability, the performance and availability, are just too poor. It’s sort of an anti-pattern in the cloud. And so these folks that we’re talking to are struggling because they want to migrate these applications in the cloud, but in order to do that, they also have to migrate those on-prem entitlement services to the cloud.

    And so this new offering from Styra really makes that easy. You sort of just hook it up to your LDAP or AD and then you can deploy that thing in as many cloud regions as you like.

    Shimel: Excellent, excellent. Back at the end of last year, I told our team here and I think we said it on our predictive that I thought IAM was going to be the battleground, the most important thing for us to be focusing on, especially as it relates to cloud native, and security, and stuff like this. Of course, this was before the software supply chain builder management, and the ransomware, and a lot of the stuff that we’ve seen come down.

    But I still believe that IAM is the kind of the soft, white underbelly. It’s where cloud security gets down in a lot of ways, right? You have cloud providers who are investing billions, literally billions of dollars, into their infrastructure and their security, and we count on them to deliver the security to a certain level of that stack. The rest of that stack, through a good chunk of it, is protected by our IAM.

    I mean, I’m not blaming anyone, but just this week, we’ve seen Okta with a problem, and I’m not blaming Okta. Any one of us can be the next Okta, or the next Solar Winds, or the next take your pick. We’re all vulnerable, at some point. But it goes to show you how vulnerable we really are through the IAM stuff.

    Tim, what made you guys kind of go down this path? I mean, obviously with what you do, it was kind of adjacent and it wasn’t out of left field, but what made you say, hey, we need to do this?

    Hinrichs: Yeah, there are a couple of things. You mentioned a whole bunch of things and one in which I want to respond to before I get to your question.

    Shimel: I’m sorry.

    Hinrichs: I think that the recent stuff around Okta was interesting because I think one of the things that should remind all of us of is just this idea that there are two kinds of companies in the world, those that have been compromised and those that don’t know they’ve been compromised, to your point.

    Shimel: Exactly, yeah.

    Hinrichs: And so this thing with Okta just I can highlight this idea that once you sort of understand and sort of internalize this idea that you’re gonna be compromised, the only sort of thing you can do is put defensive in depth in place. And so authentication, proving that you are who you say you are, which single sign-on vendors have done a tremendously good job of, is that first level of defense. But then authorization is that second level where what you want to do is sort of control the amount of damage that is done once one of those user accounts is compromised and that’s the notion of authorization. You limit the amount of permissions that every one of those accounts have.

    And so that’s, to your point, one of the foundational principles of security, that you layer levels of security in place so that when any one of them gets compromised, you have several others to put in place.

    Shimel: Absolutely. We hear the term zero trust getting thrown around and it’s funny, with zero trust, to a lot of people’s idea, I do my single sign on, so now I know Tim is Tim. And now, Tim, here’s the keys to the castle. Have at it. But I think what people miss is with zero trust, is just because Tim is Tim, Tim doesn’t get the keys to the castle. Tim should get just what Tim needs, not what Tim may want. He doesn’t get everything. So if Tim is compromised, I still limited my exposure.

    And, again, to me, that’s really when we start getting into the permutations of zero trust and how we do IAM, it’s so important that we have that. Not everybody’s access is created equal.

    Hinrichs: Right. I totally agree and I think, well, one of the more interesting things that we’ve seen is that part of why I think a lot of folks end up with maybe more permissions than they need is just that these authorization systems today traditionally have been hard to use. Every product, every project, every service on the planet has a unique way of solving authorization.

    So if somebody needs additional permissions for some small period of time and I’m the admin, well, I’ve got to go poke around and figure out how to give them additional permissions and then there’s this back and forth. “Okay, I gave you more permissions. Did that work? No, okay, I’ll give you more permission. Did that work? No.” And at some point, you just say, “Forget it, you’re an admin.”

    [Crosstalk]

    Shimel: You know what? I’ll give you everything.

    Hinrichs: “You’re an admin.” And then what happens is you’re supposed to pull those permissions back a week later, but then you forget because you get busy. And so I think there’s this very real notion of permissions creep where people just have more and more permissions over time. Because everybody’s definitely gonna ask for more permissions when they need them to do their job. Very few people are gonna say, “Oh, you know what? I’ve got too many. I don’t need those, anymore.”

    And so I think one of the things that we do at Styra, by trying to provide a unified solution, a foundational solution for authorization, is help with this. Because we say, look, there’s one collection of tools and technologies you need to learn in order to deal with permissions. If you can apply those to all your 57 different products and services, well, you just are more conversant with being able to give rights correctly and being able to revoke them. And so I think that speaks well to why in part we’re doing what we’re doing at Styra.

    Shimel: Absolutely. So if you don’t mind, Tim, let’s talk a little bit about kind of the business aspect of this new offering. How’s it packaged? How’s it offered? How’s it priced? Is there a free open source version, that kind of thing?

    Hinrichs: Yeah, and maybe I’ll also offer the answer to the question about why did we end up doing this ’cause I didn’t get to that.

    Shimel: Yeah, please.

    Hinrichs: Yeah, so it’s one of these nice things that because we have an active user base in the open source world and because we have active customers on the commercial world, we can just watch what they do all the time and then when we see a pattern emerge where we see the same people having to address the same kinds of authorization problems, then we realize, well, that’s a systemic problem throughout our community and organizations. And so then we can go ahead and put the energy into building a new offering, and that was exactly what happened with this entitlements solution.

    We just saw a number of our open source and commercial customers and users having to solve this problem and using OPA and DAS to do that. And so then we just realized, well, hey, if they’re kind of piece-mealing things together, why don’t we just put forth a real offering around this design specifically to solve this entitlements problem. So that’s how it came about.

    To answer your second question, how’s it packaged, and priced, and all that good stuff. Well, so typically what we do is this is another feature, so to speak, or a solution, or sometimes we call it a use case, for our product, our declarative authorization service. So that declarative authorization service was designed to provide a unified solution to authorization. It helps you with Kubernetes authorization, with microservice authorization service mesh. It helps you with public cloud through terraform, and now entitlements. And so in that sense, it’s yet another feature, so to speak, in the product that exists.

    And so in that sense, if you’re just using DAS, then you can kind of just pick that out of a list and put it in place. DAS is available as a SAS offering so everybody can run it and you can sign up for free, as well, so I definitely suggest if you want to try it out, go log in and do that. We do, for the enterprise version, also offer an on-prem solution. And so if folks want to actually run DAS on prem, it doesn’t have to be on prem. It could be in their private cloud accounts, then they can do that, as well.

    Shimel: Excellent. Once again, proving the old axiom, it’s not a product, it’s a feature, and it’s good when you can have a product, whether people can’t decide, well, it’s a platform, not a product, but you have a product that has multiple features like that that handle this kind of thing.

    Tim, it’s available now? So I assume it’s been beta tested, hardened, gotten the feedback, and it’s ready to rock and roll.

    Hinrichs: Yeah, it’s one of our earlier releases, for sure, but yeah, we definitely want people out there trying it and giving us feedback, for sure.

    Shimel: How do people go sign up and give it a whirl?

    Hinrichs: Yeah, just go to styra.com. There’s a signup link, and then when it drops you into the product, you’ll get to pick from one of several quick starts that help you sort of walk through putting stuff in place, and you can kind of kick the tires.

    Shimel: I love it. Tim, thanks for coming on and telling us about this exciting new feature in the Styra product line. Looking forward to hearing more. I do hope we get to see you at KubeCon in May in Valencia, hopefully, fingers crossed.

    Hinrichs: That would be absolutely fantastic, and thanks. It’s been a pleasure chatting with you, again, Alan.

    Shimel: All right. Say hello to all our friends at Styra. Tim Hinrichs, CTO co-founder at Styra here on TechStrong TV. We’re gonna take a break. We’ll be right back.