devopsy.kinsta.cloud

Category: Podcasts

  • DevOps Chats: DevSecOps and OpenShift, with Red Hat

    DevOps Chats: DevSecOps and OpenShift, with Red Hat

    In this DevOps Chats, we had a talk with Kirsten Newcomer, senior principal product manager at Red Hat. It is a great discussion on the state of DevSecOps and how the Red Hat OpenShift team is trying to make it easier for developers, DevOps and cyber folks to work together to create more secure applications.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel, devopsy.kinsta.cloud, Container Journal, Security Boulevard—you’re listening to another DevOps Chat. Welcome, and I’d like to welcome to our DevOps Chat Kirsten Newcomer of Red Hat. Kirsten, welcome.

    Kirsten Newcomer: Thank you, Alan. Great to be here. So, I’m Kirsten Newcomer as you said, Red Hat. My focus at Red Hat is DevSecOps for cloud-native applications, been working at Red Hat for about four years now. It’s really kind of fun. I’ve managed to leverage kind of my—all sorts of different elements of my background over the years. I spent time at Rational Software, nine years, working on developer tools.

    Shimel: Sure.

    Newcomer: Yeah. Spent some time with BMC BladeLogic on the operations side of the world, seven years at Black Duck Software focusing on solutions that help companies manage vulnerabilities in open source software, and that led to the move to Red Hat where I get to focus on OpenShift security and DevSecOps and sort of everything comes together. So, DevOps—

    Shimel: It really does.

    Newcomer: Yeah.

    Shimel: I mean, following your career, I think I know just about all of those companies intimately and know a lot of people—I’m sure we even have a lot of people in common that we’ve worked with.

    Newcomer: I bet we do.

    Shimel: It’s funny. So, you were at Rational, left Rational only to return to IBM Rational.

    Newcomer: I know! [Laughter] That is true.

    Shimel: You know, it’s the circle of life right there, man. [Laughter]

    Newcomer: It is the circle of life, yep.

    Shimel: Welcome. So, Kirsten, look, DevSecOps is of course something near and dear to us. We put on every year at the RSA conference our DevSecOps Days or DevOps Connect/DevSecOps Days.

    Newcomer: Uh-huh.

    Shimel: We actually have the virtual event of that live on Thursday, I think it’s the 26th, March 26th.

    Newcomer: Nice.

    Shimel: So, you know, it’s something, quite frankly, this whole security thing is the reason I got into DevOps is, I thought—what a great opportunity for security to cure a lot of original sin.

    Newcomer: Absolutely. [Laughter]

    Shimel: But anyway, you know, when we look at the DevSecOps and the DevOps world, Kirsten, you can’t help—you must take notice of the impact that Kubernetes and the whole cloud-native kind of movement has had on this.

    Newcomer: Okay.

    Shimel: And a great—

    Newcomer: Absolutely, no—big changes, yeah.

    Shimel: And, you know—and it’s really at the core of so much of what is being done right now from an infrastructure point of view. And oftentimes, I don’t know if people—like everything else, right? I remember when the cloud came out and we moved from client-server and all this. Security, there’s always that lag, right, where, “Oh, yeah, we gotta do security with this.”

    Newcomer: Yep.

    Shimel: And we had a little bit of that with Kubernetes, I think, where—

    Newcomer: No, I think that’s fair.

    Shimel: Yeah? You know, people were rushing to do Kubernetes and experiment with it, deploy it, and then someone started saying, “Wait a second, what about security, here? What about compliance? What about this or that?”

    Newcomer: Yeah.

    Shimel: And now, I will tell you, and I’m interested in your opinion—I thought the lag time was much shorter this time than what we’ve seen in the past.

    Newcomer: Oh, I absolutely think so. And I think it’s really interesting. A couple of things that I’ve observed. One is that I really think containers and Kubernetes have created a terrific opportunity to shift security left, and I’ll kinda be more explicit about that in a couple ways. But I, in fact, have worked with a chief of cyber defense in the public sector who believes and evangelizes that containers improve security, and I’ve stolen his line, because I just actually think that that’s really valid.

    Because of the changes in the model, with the OS dependencies and the run time, everything’s kinda packaged together and you have that immutable container image that you’re always deploying from, you really can manage things in a new way and not every team is ready for this, and not every team, not every security vendor is ready for this, either.

    So, I think the opportunity has been twofold. One is to kind of adjust the thinking about security so that it no longer becomes something that happens at the end, but that’s still a process, that’s still a lot of work. And the other thing is, the security tooling space itself has historically been pretty siloed, right? There’s been, you know, the OS layer security, the network layer, there’s been kinda—you know, my SIEM and my SOC that I’m working with, and my cert management and my vaults.

    And none of them really were designed to work with the level of automation that Kubernetes and containers enable, which led to this really interesting opening for smaller companies, a lot of startups that now have been around for a little while, actually, to start breaking down those silos and delivering security capabilities in a new way that kind of really do fit the DevSecOps model, because you get kinda one vendor bringing a set of capabilities that ranges from CI/CD integration to run time security to network security, really fascinating space to see how it’s been evolving.

    Shimel: It really has. The other thing that I will tell you, Kirsten, that I was again encouraged by was when I first started seeing people talk about security through containers and Kubernetes, it really was like—let me scan your container for vulnerabilities, right?

    Newcomer:  Yeah. [Laughter]

    Shimel: And I’m thinking to myself—I don’t care whether my code’s in a container or in a hypervisor or on bare metal. A vulnerability scan is a vulnerability scan. There’s gotta be more to this than just a more vulnerability scan kind of a thing.

    Newcomer: Absolutely. And that’s, I think, where, as you mentioned earlier, that, you know, Kubernetes really has come a long way in that space. So, there are things like, if we think about—so, absolutely. Vulnerability scans are fundamental and kinda, people always understood those. They tended—historically, they’ve happened a little too late in the life cycle, making challenges for the AppDev team and such.

    We’re seeing that shift left a lot, but then there’s all these other range of things that you should be doing and can be doing to build security into the platform. And so, when we saw pod security policies in Kubernetes, for example, that’s a way that the Kube admin can take advantage of the Linux features that enable container isolation at the Kubernetes layer and enforce things like ensure that a container doesn’t run with unnecessary privileges.

    Shimel: Sure.

    Newcomer:  And so, we are seeing more capabilities—now, that’s still beta, so the community still has some work to do there. But as you say, we’re seeing more emphasis and, you know, the open source Kubernetes security audit sponsored by the CNCF is a great example of that.

    Shimel: Oh, absolutely. And look, CNCF has done yeoman’s work here. They’ve really, really done a nice job with the whole Kubernetes project, specifically security.

    You know, but one of the reasons, like—we did a webinar yesterday for instance and it was on, you know, the different cloud providers versions of Kubernetes and—

    Newcomer: Uh-huh.

    Shimel: [Cross talk] environments. And, you know—fantastic, we had 700 and something people sign up for this webinar.

    Newcomer: Great.

    Shimel: A lot of great questions, even on the YouTube afterwards, a lot of great questions. One of the things that became clear to me in listening to people talk is that—you know what? Just going to, whether it’s AWS or Azure or GCP or whatever and setting up my Kube environment may not be the best thing for me because I’d rather get one of the package distributions, if you will, or a more complete solution, of which Kubernetes is a piece, like an OpenShift, but some others were mentioned—Rancher and so forth.

    Newcomer: Sure.

    Shimel: But OpenShift was the most popular one mentioned. And I think one of the reasons is, people want to know that security has been kinda built into it.

    Newcomer: Yeah.

    Shimel: Beyond just the Kube release, whether it’s 1.4, 1.5, what have you, 1.6—you know, what else has been wrapped around that just K8—

    Newcomer: Yeah.

    Shimel: —to make it easier?

    Newcomer: Absolutely, and that’s been a big focus for us at Red Hat, really, from the beginning. You know, an enterprise solution—and this is a place where, so, we’ve talked about changes in the security tooling that needed to be made to adjust to the technology, but by and large, the principles still apply. You know, you still need audit logs, right? You still need, you know, to log data from the cluster itself. You need log data from the applications. You need monitoring tools. And so—and you need to think about host arrest security as well.

    And so, we’ve kind of really looked at the stack as kind of spanning all of those things, and we want to make it as easy as possible to manage that solution as a solution, right? And so, that if you—and plenty of folks do this, you know, and get value from it. But if you’re in a situation where you can afford to kind of do a DIY Kubernetes and add in a logging stack and add in kind of all the different pieces that you really need for the enterprise solution, then you have to maintain them each separately and you’re maintaining the host OS separately as well.

    And so, we’ve really focused recently, especially with OpenShift 4, on automating everything, which includes the host operating system. So, Rel CoreOS, Fedora CoreOS available as an open source project. It’s a container optimized operating system that we manage as part of the full platform. It makes it much easier to apply OS updates across your cluster. You can do that in a way that has zero downtime for your well-behaving apps. You can take a node out of service in the way you would, you know, that Kubernetes manages it. Update that with a patch to OpenShift or its components or the operating system itself, put it back in service.

    And so, kind of a combination of looking at the whole stack holistically, what is an enterprise need in order to ensure that they have a secure environment, a stable environment, a highly available environment and making sure that we kind of leverage the terrific declarative and automation capabilities of Kubernetes kind of throughout the whole stack.

    Shimel: Absolutely. You know, I didn’t realize just really all of—you know, until you just said it, I never kinda put together all the pieces of what you guys are doing with that. It’s pretty amazing, isn’t it?

    Newcomer: It’s really cool. And one of the other fun things that we get to do is, we actually—so, back to, if we think about the host OS layer for a bit, right? If you need to scale your clusters, that means adding a new host and you’ve got the work involved to be sure that you deploy that infrastructure and that you secure that infrastructure according to your standards and then you put Kubernetes on top of it and add it to the cluster and you’re ready to put workloads on it.

    And we’re using the concept of Kubernetes operators to automate the components of OpenShift, including the host OS. So, we have a machine config operator, so if you’re deploying OpenShift in a cloud where you can automate the addition of infrastructure easily, you can use the machine config operator and the declarative nature of Kubernetes, right? It’s a container optimized OS, it’s delivered primarily as container images, the user space is read-only, you’ve got that declaration of what a host should look like and you can just use the machine config operator to spin up new hosts and add them to your cluster.

    Shimel: Excellent. You know, we would be derelict in our duties, I guess, if we didn’t mention the whole COVID-19 and how that’s affecting things.

    Newcomer: Fair enough, yes.

    Shimel: In my mind—so, first of all, I don’t think a lot of what we’re seeing right now and its effects are necessarily three-week or six-week or, you know, a lot of this stuff is gonna stick.

    Newcomer:  Yeah.

    Shimel: I think one of the things that are gonna stick are, people are gonna want more automation, right?

    Newcomer: Absolutely.

    Shimel: In their deployments, in their operations, in their infrastructure.

    Newcomer: Yep.

    Shimel: And automation, from a security point of view, is kind of a double-edged sword, right? At least we, from—when things are automated from a security point of view, we think we know exactly what’s gonna happen, and so we can plan around that. On the other hand, security people tend to get a little fritzy, you know, when things come out of our cold, dead hands, here.

    Newcomer: Yeah.

    Shimel: What do you think? How—what do you think?

    Newcomer: I know; I agree with you. And I think one of the things that, one of the ways that Kubernetes is kinda pushing the boundaries with security teams. And I talk to a lot of different security teams over time. So, it’s kinda like—you know, they’re a little bit more comfortable with the idea of DevOps for the application layer at this point, right? For those containerized apps that are gonna be deployed, it’s like—okay, they kinda have an idea of, “Yep, security static analysis tools, integrated vulnerability scanners integrated.” There’s some cool new stuff coming out that I’m seeing on the market, they’re tools that are starting to evaluate the configs and the Dockerfiles, too, that’s really great.

    But—and then as we continue to move into the ops space, right, with Kubernetes and the SDN, which is required for any Kubernetes cluster, and now we have service mesh added into the mix, or Istio for microservice based communications. The network security teams are uncomfortable with who’s gonna manage network policies at the Kubernetes layer and now, I’ve got service mesh or Istio policies as well, and who’s responsible for those?

    And in the end, it’s really about visibility. So, if we circle back to automation, we’re really looking at infrastructure as code, you know, GitHub’s model that applies again to the Kubernetes layer, to the configuration of the Kube cluster as well, and we need to put in place, you need the automation to get the best results, but you need to do it in a way that gives the security team visibility into the kinds of things they’re used to seeing.

    And so, I think this is another way where we’re starting to shift left in new ways, and I’m also seeing solutions that help automatically generate network policies based on evaluating an environment or an automatic generating service mesh policies based on evaluating the config for the apps.

    But all of that, you know, the network security guys aren’t necessarily gonna log into the cluster to look at that. So, how do they get the view they need to get, and how do they help the AppDev teams understand that whole risk management and their security perspective? And so, this is where it’s not just about tools, it’s about people and processes, right? And I think there’s so much richness here, but you’re absolutely right—we can’t do it without automation. And so, we’re gonna have to help these people become comfortable with this shift while ensuring that they get the visibility they need to know that things are being done in a way that meets their risk guidelines, their regulatory requirements, and the security posture they want.

    Shimel: So, to me, one of the fundamental things with DevSecOps, one of the fundamental shifts in DevSecOps is, first of all, security people recognizing that they’re not the only ones who care about security.

    Newcomer: Mm-hmm.

    Shimel: Believe it or not, the developers and the DevOps folks, they do care about security. They may not be security trained people, but they care about security.

    I think the second thing with that is, the developer people have to realize, and the DevOps teams have to realize that the security people aren’t there just to be the roadblock.

    Newcomer: Right.

    Shimel: And they aren’t always gonna be the people who say no.

    Newcomer: Right.

    Shimel: And what we’re—so, this has nothing to do with technology, per se. This is a people to people issue.

    Newcomer: Absolutely.

    Shimel: And I think we’re making real progress in that, and as a result, what we’re seeing is security people paying for and approving security tools that developers in DevOps teams are using—

    Newcomer: Yeah.

    Shimel: —on the Kubernetes platform—

    Newcomer: Yep.

    Shimel: —you know, because that’s kinda the platform of choice now, and that, to me, that’s what keeps me optimistic about this.

    Newcomer: Yeah. No, I’d agree, and also, when we think about the broader landscape, I mean, there’s, the security threats are just ever-evolving, ever-changing. And there aren’t enough security trained professionals to go round, right? There aren’t enough cybersecurity folks, et cetera.

    And so, we have to figure out, how do we help teams scale, and collaboration is the way to do that. And you’re right, I see the same thing you do, right, that the security team is approving those tools that are container native, Kube native tools that help to ensure. And in some ways, I don’t mean this in a negative way, but in some ways they kind of are pushed into that because they’re traditional tools that used to be used kinda at the back end of things aren’t effective in the container and Kubernetes world.

    And so, they really do have to go with this shift that we’re seeing in the vendor landscape, and it just opens up this terrific opportunity, though, for that collaboration and that shared knowledge which, you know, is an adjustment for people sometimes.

    Shimel: Yeah, agreed, agreed. Kirsten, when we first started, I said, you know, the time goes really quick, I’m only gonna keep you here 15 minutes—well, that was 21 minutes ago.

    Newcomer: [Laughter] Okay.

    Shimel: We—yeah, we did it. Alright. We’re gonna have to call a wrap on this one. Maybe we’ll have you come back another time and we—

    Newcomer: It’s a plan!

    Shimel: —can continue the conversation there, good?

    Newcomer: Great. It was great fun—thank you so much, Alan.

    Shimel: Thank you.

    Newcomer: Alright.

    Shimel: Kirsten Newcomer, Red Hat, our guest here. This is Alan Shimel for devopsy.kinsta.cloud, Container Journal and Security Boulevard. You’ve just listened to another DevOps Chat. Stay well, everyone.

    — Alan Shimel

  • DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    The current situation with so many working from home has shined a spotlight on potential security issues with many of our collaboration solutions. Adeya, says they have the answer, offering Swiss, simple collaboration on a military grade scale.

    I sat down with Francois Rodriguez of Adeya’s executive team to discuss what makes Adeya both simple and secure, as well as what the offering is all about. This is more than video conferencing by the way. This is a well developed and tested collaboration suite that has been in use by the Swiss military and others for years. Have a listen and check out Adeya.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud. You’re listening to another DevOps Chat. We’ve got a new company to introduce you to on today’s DevOps Chat, and the name of the company is Adeya. I hope I didn’t mispronounce that, but my guest will give us the proper pronunciation. I’d like to introduce you to Francois Rodriguez, he’s the chief growth officer at Adeya. Francois, welcome.

    Francois Rodriguez: Thank you for hosting us.

    Shimel: Thank you. So, Francois, did I get the name right?

    Rodriguez: Yeah, correct. The pronunciation is correct. Americans tend to say Adeya, but yes, Adeya is correct. [Laughter]

    Shimel: Okay. Well, you know, I always thought I had a little bit of a French accent. [Laughter] But I’m glad I got it right, then. So, let’s start with the obvious, Francois. Our audience may not be familiar with Adeya. Why don’t you, if you don’t mind, give us a little background?

    Rodriguez: Yeah, the background of the company is the following. So, it is a spinoff from EPFL. EPFL is one of the top five universities in technology in the world, based in Lausanne, so next door. So, for those that don’t know where Lausanne is, it’s next door to Geneva. And from that spinoff, the ask was for encrypting voice communication for the Swiss Army at that time, using a Symbian Operating System. At that time, Nokia was the leading mobile phone operating system, and that was the foundation of the company.

    With the advent of the smartphones, the application has been enriched with messaging and then the mobile application becomes, as well, a desktop application, a tablet application, enabling as well file sharing, instant messaging and we’re introducing as well video conference calling, end to end encrypted. So, that’s the most important element of the suite is the encryption layer, initially deployed and developed for the Swiss Army, so we are using the highest grade of encryption, so called military grade. And we are bringing that technology to companies and small organizations as well.

    Shimel: Excellent. So, the Swiss Army is already a customer, is that correct?

    Rodriguez: It’s the historical customer.

    Shimel: Okay. And then, at this point, has the company raised venture capital? Is it self-funded? What is the situation?

    Rodriguez: Yeah, it’s a venture capital, which is important in this type of business. You certainly have heard the news of cryptogate that was having some links with governments. So, these days, it’s very important when you provide this type of technology that you don’t have strings with any organization state owned or having any back door.

    Shimel: Sure. Sure, I mean, everyone’s worried about that. And, you know, as—well, before we jump more into that, Francois, what about your personal background, your journey? How did you come to be chief revenue officer—excuse me, chief growth officer at Adeya?

    Rodriguez: So, I started my career in telecom. At that time, I was in charge of developing the multimedia content for the youth and student populations. Before the advent of the smartphones, multimedia was games, ring tones. I don’t know if you remember these days.

    Shimel: Sure, I do.

    Rodriguez: And then we developed the music content, the early days of .mp3s. And moving forward, I professionalized my expertise in multimedia, transforming application into more professional applications. With the arrival of the tablets, we develop more and more professional application for enterprise, and then I joined a brand new spinoff from Airbus Enceda to bring connectivity on airplanes. The company used to be called OnAir.

    Shimel: Mm-hmm.

    Rodriguez: You’ve got Gogo in the U.S., so it’s a similar company, providing connectivity to passengers, multimedia and content to passengers, but as well, professional application for the cabin crew, electronic flag backs for the pilots, and more recently, IUTs connecting landing gear, engines, and any data that the airplane was generating.

    Shimel: Sure. Fantastic.

    Rodriguez: I joined Adeya in 2016.

    Shimel: Also, how long has Adeya been around for? I didn’t realize. When was Adeya founded?

    Rodriguez: 2007.

    Shimel: Oh, really? So, it’s been—so, this is not some fly by night, started yesterday company. You guys have been at this a while.

    Rodriguez: Yeah, exactly. Yeah, the brand awareness is really recent, because the typical client of Adeya used to be governments that are quite shy to do any marketing around, and it’s really when I joined the company that we started the blocking and enterprise product.

    Shimel: You know, in some ways this reminds me of—so, I’m a little older than you. [Laughter] But, you know, back when we had the AOL message rooms or chatrooms, whatever—they called them meeting rooms, maybe, before then. It was a rather innocent time on the internet where people didn’t realize you can’t let your children go online and just go into some chatroom with people you don’t know and what can go on there. And of course, we saw horror stories of what people were writing in chatrooms being made public or used the wrong way or predators, you know, preying on women and children and stuff. And because—well, it’s the reason why we can’t have nice things, right? There’s always bad people trying to take advantage of things.

    And then, as a result of that, you know, we saw a locking down, if you will, somewhat, of a lot of that kind of technology. But then, I guess it’s just human nature, people want to communicate, right? People want to communicate—even, God knows now, when we’re all locked in our houses, right, people want to still communicate. Being alone and isolated is just kinda foreign to the human condition.

    Rodriguez: Yeah, you’re right. So, I used to put an application on my daughter’s phone to lock the phone after an hour. These days, we’re up to three hours, because, you know, they need to communicate. They don’t go to school any more, so they need to be connected to friends, they need to chat, they need to send pictures, to send videos, to do video calling. These days, video calling is very important for the youngsters. I’m usually not a very big fan of video calling, but they are, so those are—

    Shimel: No, they’re native. They’re native to this, right? To us, we look at it and—actually, I was having this conversation with my COO this morning, talking about, we both  have children who are in high school, college now and in university.

    Rodriguez: Yes.

    Shimel: And, you know, they’re net native people who, the idea of doing video calling, the idea of listening to podcasts and so forth, this is how they’re used to consuming, right? And [Cross talk].

    Rodriguez: They’re used to the technology, they’re used to the technology and they’re also very tech savvy in terms of what features and functions those tools can bring, and they are very, very, I would say, picky on which tools they’re gonna use. And we’ve seen that in certain companies that there is a kind of step back when they propose traditional tools that are quite clunky, quite difficult to use, very slow that you need to put the VPN around and all these old fashioned or traditional tools have been rejected by the young population of workers.

    Shimel: Yeah.

    Rodriguez: And more so now with these days of remote workers where you have, you know, a layer of Bring Your Own Device on top of it where people are installing their own favorite applications, too. It’s very difficult to control. It’s very difficult to put security around when you don’t have a clear policy on what is allowed, what is not allowed, and more so when you don’t bring options. People are starting to download their favorite tools online. Obviously, security is not their top priority, it’s to make their work easy and fast and provide agility to the organization. So, that’s a real issue.

    Shimel: I agree. And you know, I mean, but this is a classic security conundrum, which is, if we just think we’re gonna lay down on the tracks and say, “Stop!” the train runs us over, right? We can’t stop that, so what we need to do is, instead of being the people who say no, we need to be the people to say, “Yes, you can, but here’s a secure way of doing it that maybe isn’t too cumbersome, too expensive, and still allows them to do what they need and want to do from a communications perspective.”

    And I guess, really, that’s what the whole Adeya thing is about, right, is—hey, you wanna video or do voice calls or, you know, messaging, you can still do that, and we understand it’s important. But here’s a way of doing it in a more secure fashion.

    Rodriguez: Yes, security is important, but what we’ve been putting at the heart of the development is the user experience. Because there is a lot of tools in the security space in the market, but very few of them are really providing a seamless experience for the users, and more so when they’re not IT people. Because IT people will always tell you, “That’s very easy, you go in Settings, you configure that, and you put the VPN around and it’s working,” when in fact, nobody knows how to do it.

    So, what we’ve been doing is to bring in one unique application, I’m calling the Adeya like a Swiss Army knife. In one tool, you have got different features. You don’t need to have, you know, upswinging. You don’t need to have configuration. The security layers are ___, you instill it in your device, and you start triggering the feature that you want to use.

    Shimel: Absolutely. Francois, if you could share with our audience, you know, how easy and how much does it cost if you wanted to use the Adeya solution? Let’s say—look, I’m a little worried about our use of Slack and/or Zoom for corporate communications; you wanna use what you wanna use with your kids or whatever, that’s one thing. What does it take to stand Adeya up?

    Rodriguez: So, we’ve got four packages, depending on the security layer that you want to activate. So, the starting price point is $4, the $4 is already, you know, the starter package that provides you one to one video calls, security voice over IP, instant messaging, and as well, you know, all the Dropbox and Lockbox where you can store some documents.

    If you want to have the video conferencing with multiple users, you have an extra option, and if you want to install everything on premise on your own data center, and this is what we do for governments, there is an extra cost to deploy the system, but it’s your entire system, okay? You have no backdoors, no cloud act to open up your data center to foreigners, and you have everything in your house. So, that’s the model that we do.

    So, we’re starting with a very easy to set up cloud solution based in Switzerland and we use the strength of the cloud infrastructure in Switzerland with the data sovereignty, and we go up to deploy your own system on prem.

    Shimel: Really, okay. So, there’s sort of a cloud-based system, if you will, SaaS or cloud-based, and then you have a choice of on-prem. Because I know in many government situations, as you mentioned, they don’t want to share public infrastructure, right?

    Rodriguez: Yeah.

    Shimel: And so, that’s a real requirement. So, Francois, I’ve got to ask you, I mean, it seems like the Adeya system would find a very fertile ground in today’s environment with what’s going on with COVID, with people working from home and everything else—how has this affected, or how has Adeya responding? What are you seeing in the market recently now, just in the last couple weeks, as a result of the pandemic?

    Rodriguez: So, what we see is a variety of demands coming from the historical clients which are government administrations that are really expanding the fleet. It’s not, you know, just to secure a certain special project, but it’s really to provide everyone the tool to work from home, and in the most important security layers. Because, as soon as you leave the government institutions, you need to be connected from whom, with high level security, because then you bring the formation outside the typical firewalls, and this is what the governments are fearing.

    Now, the diversity that we’re seeing is that we start having—hello?

    Shimel: No, no, it’s okay. People are blogging, I have a meeting coming on.

    Rodriguez: Okay, understandable. What we see is, enterprises now coming to equipping their entire organization and not just the top executives that used to travel a lot or go to countries where they need to shield their communication, but as well to protect their messaging, to protect their messaging, to protect the documents that they’re sending, avoiding sending them over e-mail because even though e-mail has been encrypted for several years, it’s very difficult to have the IPs working because the systems are not interworking together, depending on the operator that you use. If one side is using Gmail, the other side is using Microsoft, you don’t have interworking with encryption, for instance.

    Shimel: Sure.

    Rodriguez: This is the—we try to ease the experience with this type of situation. What we see now is the remote workers as well, the employees themselves are contacting us to, “Hey, I heard about your solution. Give me some documentation that I can bring to my IT people.”

    Shimel: Well, that’s the way it always comes in. You know, it’s almost that open source mentality, but very good.

    Rodriguez: Exactly. So, that’s the number—

    Shimel: Francois, as I mentioned to you when we started, the time goes really quick, here. I apologize, but we’re way past 15 minutes.

    Rodriguez: Okay.

    Shimel: I wanna thank you for introducing Adeya to our audience. I wish you will in these uncertain times, both personally and with the company. And as I mentioned to you, maybe we could do a video interview for our TechStrong TV—

    Rodriguez: Yeah, sure.

    Shimel: And have you join us. Maybe we even could use a day or we could record the video through there or something, show people it in action.

    Rodriguez: Yeah. Okay.

    Shimel: Sounds good?

    Rodriguez: Yeah, perfect. Looking forward.

    Shimel: We’ll work on that. Alright.

    Rodriguez: Thank you, Alan.

    Shimel: Thank you.

    Rodriguez: Pleased to meet you. [Cross talk]

    Shimel: Chief growth officer for Adeya, Francois Rodriguez, here on DevOps Chat, this is Alan Shimel, and you just listened to another DevOps Chat.

    — Alan Shimel

  • DevOps Chats: What Is Your Data Really Worth? with Splunk

    DevOps Chats: What Is Your Data Really Worth? with Splunk

    Gaining real insights can catapult companies ahead of the competition, but that’s easier said than done. Splunk recently released its new report What Is Your Data Really Worth? which produced some very compelling results.

    Leading-edge data innovators use data to raise gross profits by 12.5%. Ninety-seven percent of this top tier meet or beat their customer retention targets. Mature organizations are almost 10 times more likely to draw more than 20% of their revenue from new, innovative products and services. A select group of companies, categorized as data innovators, achieved impressive and measurable results.

    Andi Mann, Splunk chief technology advocate, joins Mitch Ashley on DevOps Chats to share some of the key insights in the report and discuss how companies are utilizing their data to achieve higher revenue growth, improved customer experiences and gain cost savings.

    As usual, the streaming audio is immediately below, followed by the transcript of the conversation.

    Transcript

    Mitch Ashley: Hi, everyone, this is Mitch Ashley with devopsy.kinsta.cloud, and you’re listening to another DevOps Chat podcast. Today, I’m joined by Andi Mann, chief technology advocate with Splunk, and our topic is a report that just recently released called, “What Is Your Data Really Worth?” The ultimate question, you know? It’s kind of, from, do you remember—what’s the, 42? Is that the answer? Okay, anyway, another topic. [Laughter]

    So, welcome, Andi—good to have you on DevOps Chat.

    Andi Mann: Hi, Mitch. It’s so good to be with you again.

    Ashley: Absolutely. Andi and I are friends from way back, so we’ve known each other for quite some time now. [Laughter]

    Mann: Yeah, this could get a bit squirrelly, mate. Let’s see how we go. [Laughter]

    Ashley: I made sure I didn’t have too much caffeine before we recorded, so hopefully that will kinda keep me in check, anyway, we’ll see. [Laughter]

    Mann: [Laughter]

    Ashley: So, for folks who don’t know you, tell us a little bit about what you do and what you do at Splunk and a little bit of your background.

    Mann: Sure. So, Mitch, I’m chief technology advocate at Splunk for our IT Markets Group. What that means, as an advocate, I spend my time explaining stuff to other people and advocating for technology mostly. So, I talk a lot. A lot of people will see me doing podcasts like this, they’ll see me at conferences and keynotes, writing, and other things. A lot of outbound talking about Splunk and our data delivery platform and all the great solutions we’ve got to bring data to everything.

    But a lot of people don’t see the other side of it, which is me advocating for my customers. It’s one of Splunk’s core values that we have two ears and one mouth, and we should try and use them at least in that proportion. So, I try to listen a lot to experts like yourself, like other analysts and pundits, customers, market makers, and try and help Splunk create the best possible products and solutions to make our customers successful.

    Ashley: Sounds like when I was a kid, the saying was, “God gave you two ears for a reason, Mitch.” [Laughter]

    Mann: [Laughter] Exactly, right? Oh, you weren’t the only one who got told that as a kid, huh?

    Ashley: No, I’m guilty as charged. [Laughter] So, let’s just jump to the report. Tell us a little bit about, obviously, you’re in the data aggregation analysis collection, all kinds of interesting parts of the data world and lots of different sources. How did you decide to try to answer the question of what’s your data really worth? What was the genesis of this report?

    Mann: Well, the first thing we did was, we decided to find an independent expert to help us. So, we went to Enterprise Strategy Group. Now, you know them, they’re an analyst firm out of Boston.

    Ashley: Yeah. Good folks, good folks, yeah.

    Mann: Really good folks. Their key areas where they focus on is data and security. And so, for the data part of this survey, that was a very obvious choice. So, they hope to figure out a bunch of questions to ask to see if companies were using their data in advanced ways or not. So, we were looking at things like how much data they use, where do they get their data sources from, which business departments use data in their decision making and a whole bunch of other outcomes.

    And we were able to figure out from that with working with ESG, within Enterprise Strategy Group, we were able to figure out a certain percentage, around about 10% of the survey respondents out of 1,300 respondents were what we call data innovators. So, they were taking more data, they were using it in more deliberate ways, they were using it in more business departments and more business decisions.

    And so, we were able to figure out, well, if they’re using data in better ways, what are the good things that happen when you do that, and comparatively, for the companies that are using data in sophisticated ways, what are the down sides for them?

    So, it’s a really interesting set of questions and answers that we managed to find some really interesting data on.

    Ashley: Great question to ask. So, tell us, what was the number one thing that jumped out to you? What was the learning you didn’t expect to get from this study?

    Mann: So, I think the, one of the learnings that I think we did expect to get was that using data better helps you in your business, in all sorts of ways. So, the one big area I think I was a little bit surprised at was that using data better is not just gonna help you save money, it’s gonna help you make money. So, for these data innovators, on average, they had a profitability of around 12% gross, across different sizes of businesses as well. That meant about $38 million average total gross profit for these innovative organizations who are collecting, managing, and analyzing data to improve their business.

    I think the second thing that surprised me was that this wasn’t even split between top line and bottom line. You know, in IT especially, we often look at ourselves as a cost center. We’re often told to do more with less. We’re often told to find ways to save. What we don’t hear a lot about IT is how important it is to making money, to adding revenue, but that’s what we’ve found from this research. Data innovators added on average over 5% to their annual revenue because they were using data better, and that added to reduction of cost of around 5% as well.

    So that’s how we get up to that 10 to 12% on the bottom line, but it’s a combo of making more money and saving money, which is—you know, there’s not a lot of technologies which you can point to for that.

    Ashley: Definitely both sides of the line, now. There was 5.32% over 12 months as a result of their data use. Talk about—how do you define a data innovator?

    Mann: So, some of the things we looked at for the data innovators—are they more or less sophisticated in their strategy? So, do they have a data strategy, do they have a chief data officer? Do they have specific plans over a 12 to 24 month period of how they’re gonna get more data in and use that data? Do they have analytics programs in place? Do they have a data science program in place? You know, these are some of the signals that we looked at to see what they were able to do with data.

    And then in terms of the outcomes, we looked at things like revenue growth, we looked at operational cost reduction, the ability to innovate. How long does it take to get new products or new ideas to market? We looked at outcomes as well, like customer satisfaction, customer retention, ability to make faster decisions.

    So, all of this sort of gave us this picture of what does a data innovator look like?

    Ashley: Now, just to give folks an idea here, this isn’t like baseball, everybody gets an award and gets to be called a data innovator. This is 11% of global organizations was your measurement. So, it is kinda top 11% kinda cream of the crop of folks.

    I found another interesting stat that I read in the report that said one in five data innovators generated more than 20% of their annual revenue from products and services developed in the past 24 months, compared to just 2% of data innovators. So, if you have really invested in analyzing, assessing, using, and applying data, that number is backing up what you said about—yes, it does add to topline growth.

    Mann: Yeah. Because, I mean, when you’ve got data to go on, you can make these rapid decisions. If you’re talking about innovation in life, you obviously have written about innovation quite a lot and we’ve talked about it directly a couple of times and, you know, to innovate, you’ve got to be able to make fast decisions. You don’t try things out.

    You know, typically, 95% of innovation will fail. That’s okay, as long as you fail fast, fail small, fail cheap, and fail forward. But if you don’t have the right data to make decisions, then all of a sudden, you’re in a data paralysis. You’re in a decision paralysis. You can’t make those rapid decisions. You end up having to get more information. You end up going with the loudest voice in the room, or you end up going with the loudest person in the room which, by the way, tends to work against some of the greatness of diversity and inclusion about getting different opinions, about getting different, diverse opinions and viewpoints.

    Ashley: Mm-hmm.

    Mann: So, if you—but if you have data, the data speaks for itself, and you can set gates for innovation. There’s a classic innovation theory—you try stuff out, you do it small, you set gates, you pass the gate.

    One example, for example, and directly for this audience as well, is thinking about what is a high quality release? Is it a release that has no bugs? Well, that might be too high a bar to get over, but to understand what level testing has it gone through, what is the pass/fail rate? What is the code quality? What is the compliance quality in your code? These sorts of things, they’re data points that you can then make decisions on.

    Even more so, you can automate decisions based on data points. If I’ve passed 99.92% of my tests and I’ve run 100% of the tests that I expect, that’s a really good mark and I’m probably gonna go straight into production with it.

    Ashley: Mm-hmm.

    Mann: So, I can iterate faster, I can do new things in new ways, because I have surety that the decisions I’m making are real and based on substantive information that will matter when I get to prod.

    So, innovation is absolutely a strong outcome that we see in this research as well, coming from these data innovators.

    Ashley: Now, I kind of threw the trick question at you first. What didn’t you expect to learn from this? I mean, let me toss that one out there again, since we talked about some things you did expect to learn. Were there any small, medium, large surprises that you walked away from some of the answers that came out of the research?

    Mann: Yeah, look, I think some of the surprising stuff was just sort of around the vertical side in the industries that were good and industries that were bad. I would’ve expected some other, some industries who are lower on the ability to get data insights, I would’ve expected them to be higher. Specifically, higher ed and public sector. They have a lot of access to data, they don’t necessarily have the same issues with data analytics and aggregation that private sector do. You know, they’ve got things in place around privacy and protection of data.

    So, there’s some really positive things. Higher education especially, I would’ve thought, well, they have investigative units. Research is something they do. I was a little surprised by that. What we saw was that technology organizations do really well by using data better. I sort of got that, that makes sense. They’re involved in machine learning programs and AI programs and things like that. They’re on the cutting edge. Somewhere around two-thirds of financial organizations had really good results in terms of higher revenue through better utilization of data assets.

    Ashley: Mm-hmm.

    Mann: And again, financial organizations are often on the cutting edge of technology and so forth, so that made sense. But for me? Higher education and public sector were only down around 50% at this ability to use data in operational ways. And honestly, that surprised me. I think they could do a lot better. I think they’ve got the fundamentals, the people, the technology, the inquisitiveness and the opportunity, certainly, to be able to use data in better ways. So, yeah, I’d love to see those numbers come out better.

    Ashley: Now, I wonder if, do you think there’s a correlation or a connection to this idea that those folks that were data innovators, their culture is, what you termed in this report, quote-unquote data obsessed. It was just data driven company, everything is—you know, decisions are driven by data, you know, collecting and using, it’s not just the loudest voices in your room. It seems like that’s a pretty high correlation there to the folks that are really in a place and are leveraging data in a very successful way.

    Mann: Yeah, the cultural aspect is really interesting. You know, we’ve talked about culture in the DevOps community for a decade or more, and how important the cultural change is. And, you know, we know from DevOps you can throw all the tools at the problem. If you don’t have a culture of collaboration and sharing, then you won’t have a collaborative environment to work in regardless of what tools you throw out there.

    Data is the same. The data’s there. The big difference between the data innovators and companies that aren’t necessarily as innovative with data, you know, the companies we call the data detractors and so on. One big difference is if they’re inquisitive about the data that exists and go looking for it and look for ways to use it. It’s not necessarily that they have more data, it’s not necessarily that they have different data, it’s not even necessarily that they have data that people don’t understand or understand better or worse. It’s that they have a culture that values data driven decisions.

    And so, when the decision comes to the—you know, the meeting comes to a decision factor, they have people in that room who deliberately put their hand up and go, “What is the data saying?” Rather than having the people in that room go, “Okay, I think we’ve got everything we need. What do we all think?”

    Ashley: Mm-hmm.

    Mann: Right? And that’s a cultural change, Mitch. That’s a cultural difference. Having that data obsession as we’ve termed it in the report means that your culture is looking for data, actively looking to make those data driven decisions. Actively looking to get data from everywhere and bring it to every decision. Not just the important or less important or whatever, every decision. And that absolutely is a cultural difference.

    Ashley: So, don’t take this—this is not a trick question at all. I’m interested or curious about your thoughts on data, data, data—extremely important, this report showed the value and the impact that can have. I’m thinking in an analysis standpoint, sometimes you can get into analysis paralysis or maybe the insights aren’t always just in the data, but from other factors and things.

    How do you blend both the tools, the experience, the knowledge, the capabilities of the organization and infuse that with data in a really healthy way? What are your thoughts about that?

    Mann: Yeah, look, that’s a super question, Mitch, because you know, there are lies, damned lies, and statistics, right?

    Ashley: Wow. Yeah, we—

    Mann: You can make data say whatever you want. [Laughter]

    Ashley: Yes, we can make it say whatever we want—true.

    Mann: So, you’ve gotta be careful about stuff, right? You’ve gotta be careful about bias, you know? I talked about diversity and inclusion a little bit. If all your algorithms are written by people that look and sound exactly like you, then they’re certainly gonna reflect who you are and what [Cross talk].

    Ashley: Mm-hmm.

    Mann: So, having a variety of data, but having a variety of algorithms created by a variety of people from different backgrounds—so, you’ve gotta have diversity in your teams. Again, it’s a cultural thing, right?

    Ashley: Mm-hmm.

    Mann: Your data will tell you what you want it to if you ask it. So, you’ve gotta have the ability to get more data, you’ve gotta have the ability to ask data, ask continual questions of your data. So, it’s not just the first answer. Typically, when you’re doing data analytics and inquisition, the first answer just pops up more questions for you. So, you’ve gotta be able to go through that iterative cycle of asking more questions. That’s a very fundamental and practical thing to do with how do you structure your data, what tools do you use to inquire after your data. You’ve also gotta have the understanding that some things are not necessarily a data decision. Some things actually don’t have data, and you do need to have personal experience.

    I’m a big believer, Mitch, in letting the machines make the right call on stuff they’re good at. Complex data, time series data, high cardinality data, long periodic data—you know, humans are awful at things like pattern matching, we’re awful at looking at long term data about patterns. Machines are really good at that stuff. So, let machines—

    Ashley: Also really good at large volumes of data where we, as humans, love a data point of one. You know, my kids—

    Mann: Exactly. [Laughter]

    Ashley: Those millennials … I have two data points at home, so I’m super set. [Laughter]

    Mann: Oh, yeah. anecdata, yeah, it’s the bane of our existence, I think. But it’s important to understand that machines can’t make intuitive leaps, either.

    Ashley: Mm-hmm.

    Mann: Machines have no imagination whatsoever. Have you ever seen some of the Harry Potter scripts that have been written by machine learning engines?

    Ashley: I have not.

    Mann: Oh, my goodness—it’s so awful, Mitch. It’s so bad. [Laughter] Because machines have no imagination. So, there is a cutoff point, and it’s a fair question to ask, and I don’t think there’s any definitive answer of where that cut point is. But at some point, you need to have a human to interpret and bring imagination, bring intuition, bring experience to that data driven decision.

    But I would certainly posit that you bring that human experience to the data, you don’t just go with a human gut feeling.

    Ashley: Mm-hmm.

    Mann: The data will tell you what to do.

    Ashley: I don’t recall this as looked at or at least talked about in the report—I would imagine those data innovators have figured out where that balance is, it’s not just about having the most data or the data, the answer is always in the data, right? It’s that balance of, you know, it’s the right sources, it’s the negative validation as well as the positive validation, the correlation, the analytics, how statistically valid is the information. So, all kinds of things that data scientists know how to do that help you be really good about how to use that data, and of course, that’s probably a maturity curve that you work up to.

    Mann: Yeah, exactly right. I mean, we see—and it’s not necessarily specifically in the data, but we absolutely looked at that maturity curve and what it means to be a data innovator versus a data adopter versus a data deliberator, someone who’s in the early phase, for example. We deliberately looked at what it was like as a company, what patterns. And again, in the DevOps community, they’re very familiar with this concept of patterns and anti-patterns.

    Ashley: Mm-hmm.

    Mann: And the patterns that the data innovators took gave us a sense for what is a mature business. You know, we’re not necessarily gonna be able to tell you exactly what those gates are that define good innovation or define a good test outcome, or define a good marketing campaign or whatever it is, a product that will be successful.

    But what we can do is help you understand what the data told us about data maturity. And so, that’s why we’re actually working on, we actually loaded up onto the Splunk.com website a data maturity calculator. So, it’s a free—it’s a web based assessment tool, it’s free, obviously, so you can actually compare yourself against some of these data innovators.

    You know, a really easy way to assess what’s your data use, what tools you need to get the most out of your data, what data you’re missing and how do you compare on this data maturity curve to be able to make those decisions between smart, experienced individuals and definitive or maybe not so definitive data and data driven decisions.

    Ashley: Mm-hmm. Interesting. Great. Well, we’ve used our time pretty well here. Let’s certainly find out how do folks get this information? You talked about this assessment tool of kinda where are you on the data innovator curve—how about getting the report, information about it?

    Mann: Yeah, absolutely. So, it’s all available up on Splunk.com. In fact, if you go there on the homepage right now, you will see the data-to-everything platform, and you’ll see links there to be able to get that video. You’ll be able to get, also, stories from some of our customers who have used data and turned data into delivery. And, you know, household names like Domino’s and others are really using data to create an impact, to be a data driven organization.

    So, yeah, jump onto Splunk.com, you’ll be able to see the report there, you’ll be able to jump on, read the report. You can also take that assessment for yourself. It’s gonna be really fascinating to understand how you line up with those data innovators and where you can go to try and get a slice of that extra money that those innovators are getting.

    Ashley: Great. Splunk.com, great place to go for lots of other information as well as this report. Say, by the way, before we end things, I hope you come back. I’d love to have a conversation with you about data in the DevOps world. One of the challenges—data has such a different nature, right, than—

    Mann: Yeah.

    Ashley: What we can do, you know, more flexibly with software and configuration automation and things around software, oftentimes developers sort of struggle with this amorphous, large piece of data or collections of data and how that’s evolving along with things like DevOps. So, I’d love to have a conversation about that.

    Mann: Yeah, that would be a great conversation. Yeah, I would love that, Mitch. That’d be cool.

    Ashley: Awesome! Well, hey, thanks a lot, Andi, for joining us today.

    Mann: Thank you, Mitch. It’s a pleasure. Always great to talk to you, mate.

    Ashley: Always great to talk with you. And I won’t talk about where Australia fell on the list of data innovators, but that’s another topic, so.

    Mann: [Laughter] I know! Don’t—please, don’t! Thank you!

    Ashley: Okay, alright. [Laughter] Well, you’ve listened to another DevOps Chat podcast. I’d like to thank my friend, colleague, someone I’ve known for quite a while, Andi Mann, chief technology advocate with Splunk for joining us. And thank you, of course—you, our listeners. This is Mitch Ashley with devopsy.kinsta.cloud. You’ve listened to another DevOps Chat podcast. Be careful out there.

    — Mitchell Ashley

  • DevOps Chats: CloudBees Remains at Top of DevOps Market

    DevOps Chats: CloudBees Remains at Top of DevOps Market

    In this special DevOps Chats video edition, we speak with Sacha Labourey, CEO of CloudBees. From the very beginning of the DevOps movement, CloudBees has been one of the companies at the top of the DevOps market and, based on its latest business metrics, the company remains there.

    Being the enterprise Jenkins company helped CloudBees early on to be a leader at the top of the DevOps market. But with Jenkins and Jenkins X handed over to the Continuous Delivery Foundation (CDF), CloudBees can no longer count on its Jenkins connection to stay on top.

    Sacha, like any good CEO, did not allow CloudBees to rest on its laurels. An aggressive acquisition strategy including acquiring Electric Cloud, Rollout.io and others, has kept CloudBees on top. At the same time, Sacha has led the product and engineering teams as they roll out a new generation of DevOps products and services including the upcoming Software Delivery Management (SDM) and Software Delivery Automation (SDA).

    In this video, Labourey lays out what the past year has seen for CloudBees and what the coming year could bring. Of course, with Covid19 everyone is sailing into unchartered waters. But Sacha has the course in mind for CloudBees to follow.

    Have a listen to our conversation with Sacha to understand CloudBees’ plan to stay at the top of the DevOps market.

    [video src="https://videos.files.wordpress.com/TNgFIQ9x/2020-03-19-interview-with-sacha-labourey-1_hd.mp4" /]

    — Alan Shimel

  • DevOps Chats: Liquibase, Open Source and Databases, with Datical

    DevOps Chats: Liquibase, Open Source and Databases, with Datical

    Datical has been a leader in DevOps for databases since even before the term was used. What many may not realize was that the open source Liquibase project was a major contributor to Datical’s success. So it should be no surprise that in filling the open president’s seat, they would tap an open source veteran.

    Dion Cornett, has open source credibility from his time at Red Hat and MariaDB. In his new role, he is responsible for marketing, sales and product. He is determined to see the same kind of success with open source business models he has been part of before, succeed at Datical.

    In this discussion we hear from Dion on his plans and views.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    [soundcloud url=”https://api.soundcloud.com/tracks/771223528″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel for devopsy.kinsta.cloud. You’re listening to another DevOps Chat. We’ve got a nice DevOps Chat for you today, happy to introduce you to the newly minted president at Datical, Dion Cornett. Dion, I didn’t mess that up, did I?

    Dion Cornett: You didn’t, and thank you very much for the introduction, and I’m very happy to be on your podcast today.

    Shimel: Thank you, Dion. So, listeners of our podcast are no strangers to Datical. You know CTO Rob Reeves is a frequent guest here, and you know, we make fun of him and his Big Lebowski sweaters, but it’s always refreshing to hear Robert’s take on DevOps and databases, the DevOps market in general, and pontificating on anything Robert likes to pontificate about.

    But it’s also nice to have a fresh face from Datical. So, first of all, welcome aboard.

    Cornett: Thank you.

    Shimel: And I always like to give my audience a flavor for who’s talking. Dion, would you mind—I’m not asking you to read your bio, but would you share a little bit of your background for the audience?

    Cornett: Yeah, you know, I think what is more pertinent to Datical, I’d say if I had to characterize myself as that, I’m an open source guy. I bleed open source, I believe it’s a better production model for software, you know, this combination of a meritocracy of ideas and transparency leads to more elegant code.

    And so, you know, my background has been one of sort of having a career that aligns with this philosophy. So, I spent nine years at Red Hat in a couple different executive roles, run North American non-named account sales, and then ran global strategic alliances. I moved from there to take over sales at MariaDB, an open source database company that was—

    Shimel: Sure, [Cross talk] well.

    Cornett: Yeah. [Laughter] It wasn’t quite so popular in 2013, but we literally grew that business sevenfold in three years. That set me up for a CEO job. I did do something outside open source, but it was sort of a big data challenge, a company called ReachForce, that we successfully sold to another company in this space called Leadspace.

    And then, I was actually taking some time off, and introduction through a board member, spent some time with Datical, and just sort of fell in love with the concept. So, you know, my work at Red Hat, which obviously covers the very foundations of sort of IT into all the challenges as it relates to data at MariaDB and really sort of seeing the struggles that go on in building and maintaining a big, powerful database and how central that is to virtually any application. And you look at some of the top banking or telecom type customers we have, you know, data is the core of some of the value that many of these companies create.

    And then, even at ReachForce, right, big data company in the martech space, data is just paramount. It’s all maintained in databases and trying to update, upgrade, you know, maintain those databases in the context of fast changing application requirements is a non-trivial exercise.

    And so, when a company came along that had this combination of the open source that’s sort of in my DNA, and then solving this challenge around database change management, it just seemed like a great fit.

    Shimel: Absolutely. So, you know, another thing let us get out of the way early on, Dion, is—in today’s world, when we appoint a president, you know, there was a time, as we were talking, CEO and president were one person. And then, from a governance point of view, that’s a bad model. We have, for the most part, split off CEO from president. And presidents have various responsibilities. Some are more of a COO, some are more of a CRO, you know, meaning responsible for all revenue kind of activities.

    Just, what—where is your, you know, what are you responsible for at Datical?

    Cornett: Yeah, so, formally, my responsibilities are sales, marketing and product. And sort of the genesis here, and I have a great relationship with Derek, the CEO of the company. We’ve been on the job for a month now and I think we’ve teamed well, even through my recruitment process and through that.

    But Derek has built an amazing culture here. And this is one of the things you never know when you start a new job is just sorta, you know, what is the synergies between the team, and Derek’s a very effective leader, he’s built a great culture. In terms of the depth and the value of the solution that Datical has, it’s sort of undisputed, right? We’ve got multiple high six figure customers and even a seven figure customer. I mean, these are solving demanding problems in big enterprises, and the company’s been very good at that.

    I was brought on for a very specific charter, right? How do we better engage and collaborate with our community to push innovation out to the market faster? And as your listeners may know, Alan, the real foundation for Datical is an open source project called Liquibase. Liquibase is—and one of the things I also did at Red Hat was, I ran the venture portfolio there. I’ve looked at literally hundreds of open source business plans, made a dozen plus investments and sat on a few boards of companies that Red Hat invested in. And Datical was sort of a top 10—or Liquibase was sort of a top 10 project as you look at the thousands and thousands of open source projects.

    And so, how do we work with that community, again, in a collaborative fashion that we’re really pulling innovation, pushing it back, and driving as much value into this challenging database problem as we can?

    Shimel: Absolutely. So, you said a lot, there. Let’s pick ‘em off one by one.

    So, first of all Liquibase. It’s something we’ve mentioned in past podcasts and in past content type webinars and stuff that we’ve done with Datical. But—and maybe you’re gonna change this, and I hope you will, Dion. I know in my mind, when I think of Datical, I don’t think Liquibase. And though Liquibase has a tremendous following, I just don’t—it seems like, and I’m not blaming anyone or anything like that, but I just, I don’t connect the two. And maybe that’s part of what your mission needs to be.

    Cornett: Absolutely. We want this connection to not only exist, but be robust. Again, we’ve got a great team here, great culture, great people. We wanna use that to be excellent stewards of the community.

    You know, part of what motivates people here is, this is a big challenge to solve. You sort of commented earlier about sort of the maverick kinda style that Robert has, and I think it’s properly so, right? We’re breaking some glass. We’re trying to create a new mold, a new direction for how and a very important development of how IT operates.

    And so, that’s Liquibase. And, you know, Datical is a set of capabilities built on top of that. We need to make it clear, though, that that core is our foundation, and that, you know, we wanna be, again, as good of stewards as we can of that Liquibase community, 15 million plus users, and you will see this become much more of our identity, in everything we do, how we act, behave, where we invest and what we do to try to push value forward into our customers.

    Shimel: Excellent. So, Dion, let me throw another thing along the open source stuff out at you. You know, as I spoke to you earlier, I have my own views of where the market is, you know, builders, the democratization of IT, as I call it.

    I also have a view of where the open source movement, you know, the whole open source community is. And that is, you know, we’ve moved from the cathedral and the bazaar to what I call the big brother stage of open source where, seemingly, every open source project was kinda sponsored or in fact owned by a single vendor. And that kind of inhibits collaboration on an industry basis, right? It’s like, Oracle wasn’t gonna contribute to MS SQL. I mean, MS SQL was far from open. [Laughter]

    But let’s say, once Oracle bought—

    Cornett: MySQL.

    Shimel: MySQL. Look, that was the reason Maria and a host of others popped up, right? Because people weren’t sure that Oracle was gonna play nice, frankly.

    But that’s old. The model is what I call the foundational era of open source, where we have, like, the Linux Foundation or the Eclipse Foundation or the Cloud Foundry Foundation. You know, they’re these not-for-profits that are, they quote-unquote own the open source project to the community’s benefit.

    I’m not aware of a foundation in, like, the Liquibase kind of playing field. Are you, or is that—

    Cornett: No, you know, and I’m very familiar with the foundation model. Yeah, obviously, Red Hat was sort of a pioneer in this with Fedora.

    Shimel: Sure, yeah.

    Cornett: And we actually implemented a foundation model at MariaDB as well. And so, even if you look today, MariaDB.org is a separate legal entity—

    Shimel: Yep.

    Cornett: Separate president and set of engineers. And the real purpose there is to provide confidence to the users that, regardless of vendor acquisitions as you discussed, that the capabilities of that project will go forward.

    And we don’t—again, I’m a month on the job here—we don’t have a foundation today with Liquibase.

    Shimel: Right, I’m not asking you to—don’t say anything you can’t [Cross talk]. [Laughter]

    Cornett: Yeah. [Laughter] It’s certainly a consideration. [Cross talk] But it’s, you know, it’s a measured one, right? So, what are the trade-offs, what are the value? And as you talked about the different phases of open source, I think it’s—it’s unfortunate that there was a point where open source was sort of a, you used the phrase democratization of technology; that was a phrase also used by Matthew Szulik, the former CEO of Red Hat.

    Shimel: Uh huh.

    Cornett: And he also talked about this fashion statement thing where people, open source is a success. I mean, everything you use on the Internet, IT today is open source for the most part. So, it’s clearly won, right? That battle’s sort of over, and people said, “Hey, I wanna glom onto this.”

    And so, there was sort of a group of companies that attempted to co-opt the branding around open source without really understanding the nuance of what it meant to be a steward of the community and collaborate well. And in some ways, I think that sort of provided a skewed vision. And we’ll avoid that at Datical. You know, again, we’re gonna be good stewards of the community. We recognize that it’s gotta be participatory. Most of the community members are people that have jobs at companies you would recognize in IBM or SAP or other places like that. And they’re taking time to be part of this community, because it provides some value to what they’re doing and their professional life.

    And so, we’ve gotta recognize that we have to contribute to that value, attempt to sort of usurp what they’ve done, and go off and monetize it without the, never work, because if it really is important functionality, someone will just do a fork and monetize that around.

    It’s really about providing these synergies—and I used this phrase earlier where you have a meritocracy of ideas and that sorta lifts everyone up, right? So, we can provide higher value to customers that need the specifics of an enterprise offering or as we have brands, as you say, Liquibase Pro. And then the people that are, they’re part of the community for their specific needs that they’re getting multiples of return also on that investment for the problems they’re trying to solve.

    And it really is sort of this, community is the perfect word for it, because it really is this joint effort to make everyone better off.

    Shimel: Great. Dion, we’re running out of time. I wanted to give you one more thing to chew on. I want you, in your mind, to fast forward six months, 12 months, take your pick—what effect have you had on Datical?

    Cornett: You know, I think that we have to look at—so, part of what we’re doing is, we’re taking a blank sheet and we’re saying, hey, if we were gonna start today and look at the trends in the market, cloud, microservices, NoSQL, NewSQL, you know, these are all things that weren’t necessarily the case when Liquibase was originally founded by Nathan 10 years ago, what would it look like today versus where we are? And where are the gaps between the perfect DevOps solution for database and what we have in the community today, and sort of how do we help guide and steward that into a place that really solves the problem that we’re facing and we’re going to face as the IT infrastructure continues to evolve?

    And so, I think, if we can look back in a couple years and say, “Look, this has been the evolution of the product, and it’s much easier to use, it’s much easier to implement, the time to value is relatively quick,” and it’s really allowing, at the end of the day here, we’re trying to let database keep up with all of the DevOps advances that have been made around the application. If we see the database not being the drag on application, timeliness, speed, effectiveness that it can be today, then I know we’ve been successful in sort of this re-instillment, re-engagement in the community, and pushing that innovation into the product.

    Shimel: Yep. I agree with you. Dion, I promised I’d get you out of here in 15 minutes. I know you have another appointment. But I want to invite you back. Maybe we’ll do a video next time and we can dig in a little deeper. And, you know, I love talking about open source, as do you, it appears, and our audience does, too.

    Cornett: [Laughter]

    Shimel: So, I think it’s a great topic for us to continue. I wanted to wish you all the success in the world, though, with Datical. It’s a great bunch of folks over there, and you’re a great addition to the team.

    Cornett: Oh, thank you very much. I appreciate the kind words, Alan. And yeah, I look forward to future conversations. It’d be great.

    Shimel: It certainly well. Alright, Dion Cornett, new president at Datical, joining us here on DevOps Chat. This is Alan Shimel, and you’ve just listened to another DevOps Chat. Have a good day, everyone.

    — Alan Shimel

  • DevOps Chats: Solving Complexity in Continuous Testing, with Sauce Labs

    DevOps Chats: Solving Complexity in Continuous Testing, with Sauce Labs

    SauceCon 2020 by the good folks at Sauce Labs is just about a month and half away (April 27). As part of our lead-up to the show and our coverage including live broadcasting on Digital Anarchist, we caught up with newly minted Chief Product Officer, Matt Wyman.

    Matt discusses how continuous testing, automation and DevOps has led to better testing. With that though, we are more complex and sophisticated than ever in how, what and when we test. Can’t we just keep it simple? Do we want to keep it simple? Have a listen to what Matt has to say, as well as why he is so excited about this coming event.

    If you are interested in testing at all, do check out the great lineup for SauceCon. Hope to see you there.

    [soundcloud url=”https://api.soundcloud.com/tracks/770790922″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud, and you’re listening to another DevOps Chat. Today’s DevOps Chat is meant to give you a little bit of a flavor, a preview for the upcoming SauceCon put on by Sauce Labs, which will be at the end of April. So, about a month and a half away, almost two months—well, a little less than two months away. It promises to be another great event from the folks at Sauce, and they have, really, just a packed lineup of speakers from a wide range of enterprises and startups and tech companies, manufacturing companies. I mean, just a whole gamut.

    Anyway, speaking with me today about SauceCon, about maybe some new developments and trends in the testing market is Matt Wyman. Matt is chief product officer at Sauce. And Matt, welcome.

    Matt Wyman: Thank you. Glad to be here.

    Shimel: My pleasure. So, Matt, let’s get this out of the way first. You recently joined Sauce in, like, January, correct?

    Wyman: I did, January 6th. I am a recent addition to Sauce Labs, and very excited to be here. I’ve been in the DevOps community for some time, worked as the head of product for CircleCI, so definitely a space that I know well.

    Shimel: Sure

    Wyman: But I see this massive opportunity and impact around test, and this fragmented space, and hopefully, we’ll get into this and talk about complexity a little bit. But it just really seems like a huge opportunity and a company that I love and a great reputation, so I’m excited to be here.

    Shimel: Very cool. You know what’s interesting? I mean, of course, CircleCI is in and of itself a great company, too. We’ve—you know, I’ve done a couple podcasts with Rob, the CTO over there.

    Wyman: Yep.

    Shimel: And, you know, they recently, they raised a bunch of money, they’re really becoming a player in the CI/CD space. But it’s interesting that you moved from CI and CD to testing here, and you know, when we look at, let’s say, CloudBees, right, and Jenkins, the Jenkins founder, KK, you know—I’m not even try to pronounce his name; let’s just call him KK. But anyway, KK recently left CloudBees and the Jenkins community to start a new company also focused in the testing space.

    So, I think your move here, KK’s move—I think it shows that, as the whole CI/CD, you know, software delivery pipeline type of industry and community matures, people are recognizing that testing is kinda where it’s at right now, right? That’s the new battleground. And maybe it is, as you mentioned, Matt, because you know, the mission has grown so much more complex than, you know, let’s say pre-DevOps, right?

    Wyman: Absolutely.

    Shimel: So, why don’t you—if you don’t mind, give me or give our audience an idea of where you see or how you see testing has become, you know, more complex.

    Wyman: Absolutely. So, speaking to the CI/CD platforms just for a moment, orchestration in CI/CD has become a very complex problem, and that’s reflective of changes in the software landscape and how people build software, which itself is a reaction to where we started.

    So, we had all these monoliths, these, you know, large systems, we’ve all talked about it, they still exist out there in the world. Most every system that says that they do microservices actually has a monolith somewhere, like, micro-monoliths all around.

    When you’re in the monolith world, testing is all about end-to-end testing. You’re trying to put all the pieces together, validate that everything works top to bottom, and that’s really where quality and test have their roots. And as much as possible, it’s all about trying to automate those difficult processes and make it easier and more efficient to move through all your different test cases.

    But as those entities split up, and as we started to recognize that each component of a larger application needed different types of tests, testing itself became more complicated. And furthermore, it became more than just clicking buttons. At one point, testing was about validation, that if you click a button, you go to the correct page. If you click a button, the right business logic executed.

    But these days, it’s a lot more than that. It’s also validating that the CSS is correct, that the experience is performant and is wonderful and delightful. Companies that have bad user interfaces and bad user experiences don’t win.

    And so, you have this testing world that, on the one hand, is trying to move faster, dealing with a more complex software landscape, and on the other hand, is now broadening in the types of tests that are being run, not just functional testing, but also, if you will, delight testing and trying to validate that the user experience, the customer experience is going to be an excellent experience at the end of the day

    Shimel: Yeah.

    Wyman: And so, that’s how I see this space splitting up.

    Shimel: Absolutely. I don’t disagree with you there. You know, Matt, I almost wanna put myself in the shoes of the test professional and the QA person who, you know, maybe six or seven years ago was hearing that DevOps and this move, you know, agile to DevOps and beyond was gonna somehow make them obsolete. And then other people were saying, “Oh, no, it’s not gonna make you obsolete, it’s gonna free you up to do higher level kind of tasks that are more worthy of your talent and skill set.”

    And I think that has come true, certainly. I think what we’ve seen with test automation has freed up testers to do higher level stuff, but I also think it shifted the—not the burden, but the emphasis on people who know how to set up automated testing, right? You’ve gotta know maybe a little bit of coding, a little bit of scripting, you gotta know some of these open source tests.

    Wyman: There’s a bit of all of the above, don’t you think?

    Shimel: Yeah, it is. That’s exactly it.

    Wyman: The—and it’s further complicated by the fact that the number of devices and environments we’re testing on has also fragmented and increased. And you can’t run the same type of test in every environment, so most software applications have some sort of mobile component to them.

    Shimel: Yeah.

    Wyman: And yet, mobile testing is not automated in the same way that you would automate browser testing. And in fact, in some cases with mobile testing, it’s more effective to be manual and to go through it piece by piece, or to use visual testing to go through it.

    And so, you have to pull together all these different techniques. I think there’s often this perception that, with any new technology or any new change, that it’s going to somehow upset the apple cart and suddenly everyone who has a job doesn’t. And it just doesn’t typically work out that way. I think what we’ve seen is just this increasing complexity, and then also the opportunity to use the right type of testing in the right place. Meanwhile, a lot of the people out there doing quality testing continue to do so, because the number of applications has only multiplied.

    You know, the fact this whole digital transformation and all the buzz words that you hear about that—fundamentally, it’s true. Every business is now a software business, and one of my favorite examples recently is, where I live, there’s a highway called 101, a pretty big highway, and there’s a big billboard on the side that has a, it’s from Wells Fargo, and it has a mobile app on it. And the billboard is not advocating or talking about Wells Fargo’s core business, they’re not talking about loans or lending or savings accounts, it’s talking about their mobile app and the experience of their mobile app. And you better believe that they care about testing it, right?

    And so, it’s more than just—again, I covered this earlier, it’s more than just feature function right now. You have—you need more people who need to look across all the different touch points and then utilize the right type of testing in each area. And so, there isn’t one test solution that solves all of it. You have to use different techniques, because ultimately, you’re managing business risk, and you have to do it all the way from the moment a developer checks in code all the way through to production and validate, if you will, a virtual user. Someone has to go validate that it’s actually working as expected when a customer reaches out to interact with the tool.

    Shimel: Yeah, yeah. And, you know, Matt, you hit on a couple—you hit on web testing, mobile testing. I think one of the things, you know, thinking back to when I was running software companies, testing was always something that meant that we were a day late and a dollar short with, you know?

    Wyman: Absolutely.

    Shimel: It seemed like we never had enough budget to do all the testing we thought we should do, and we never had enough time to finish the testing at least we were going to do. But when I look at the kinds of testing and the amount of testing that goes in today, and all of it pre-deployment and everything—yeah, it’s grown more complex, but I think just beyond pure complexity, I mean, would you say we’re testing more now than we did before.

    Wyman: Well, I think part of the answer there is to dig in on what does it mean to test. So, these days, it’s about risk management. And so, if we’re going to have developers able to check in code and 10 minutes later update production, then we’ll need mechanisms to ensure the production is safe. And typically, that’s done with feature flagging, it’s done with canaries. There’s all sorts of ways to ensure that each change doesn’t blow out production.

    But along that path, it’s also about automating as many of the different possible negative outcomes as you can. And that is what we would typically call testing. So, there’s visual testing, there’s browser testing, there’s unit testing, there’s end to end testing, integration testing. All these are necessary, and you’re trying to compress them all into that 10 minute window, which—you know, most organizations can’t hit that kind of number, but that’s the gold mark if you can hit that 10 minutes from change to production.

    And so, I believe that it’s a matter of thinking about risk and saying it’s not about quote-unquote test coverage with a go/no go meeting where you look at the test coverage—and frankly, there’s so much peer pressure to go that typically organizations do. It’s more about saying, “What is the possible negative outcome, and how do I ensure that I have appropriate coverage for each of those negative possibilities?” And in some cases, you’re going to build tests to simply block and fail that particular change, and in other cases, you’re going to provide monitoring and observability to ensure that, if something negative happens, you can pull it back quickly.

    And if I go very meta for a moment and go well above even what Sauce Labs is doing as a platform, I would suggest that all of that is a part of the overall test or risk management perspective. And ultimately, I think our goal is to then create visibility across the whole thing, so you can manage your risk, manage your test all from one place.

    Shimel: Got it. Makes sense. Now, Scott—Matt, excuse me—let’s talk a little bit about SauceCon. How is all of this manifesting itself, you think, at SauceCon?

    Wyman: Well, one of the fun things for me is, this is gonna be my first SauceCon. So, I haven’t had the opportunity to see—

    Shimel: Oh, you never went? Okay.

    Wyman: I’ve never been, so, this is gonna be my first one. I mean, I’ve seen the lineup, it looks fantastic. I’m hoping to see not only a whole series of really good conversations within our existing community, but also, there are quite a few people that are coming who are Selenium, who are Appium users, developers and whatnot, to share in some of their experiences.

    I know, as a product person, one of the conversations I’m very eager to have is in how we help people shift left. And so, it’s more than just running Selenium tests, it’s about the headless tests, it’s about getting earlier upstream so that we can provide a little bit more of a developer oriented experience. And so, I’m very excited to go have those conversations, and I think the lineup looks good to have it.

    Shimel: I agree as well. So, I’ll tell you, my experience is, you know, if you’re looking for conferences around testing and how—like, what’s pushing the frontiers there, right, and also pulling in the open source testing community, SauceCon is one of the best. And I’ll tell you what I like about what Sauce Labs has done there is, you will see other testing companies represented, mentioned, participating, right? I remember, you know, CA who had bought BlazeMeter, for instance, was involved in SauceCon. I don’t know if BlazeMeter will be there this year or not, but they were there. I know the Tricentis folks also like to participate.

    And part of the reason is because testing is such a big world with so many different facets today, you know, everyone kinda does—you know, they’re not necessarily head on competitors. A lot of this is sort of complementary. And so, it’s really nice to see the community come together. You see it a lot—and maybe this is something that is specific to DevOps in general, I don’t know, but you see it a lot at these DevOps events where, yeah, it’s Sauce Labs throwing the party, but the whole testing community partakes. And that, I think, to me is one of the things that makes SauceCon really special.

    The other thing is, is just the speakers. I mean, you know, like in any vendor/user type conference, you’re gonna get the CEO, the CTO, and I’m sure Matt, you’ll do some presentation. But when you look at the speaker lineup here, you know, you have everything from, like, Google kind of engineers to startups to large enterprises, you’re really getting a good 360 degree view.

    Wyman: What excites me is that the way in which we think about this event, we don’t see it as a sales event. We’re not sending salespeople there.

    Shimel: Right.

    Wyman: A number of my product folks will go, because we’re interested in having conversations. The test market overall is fragmented, but it’s fragmented for a good reason, which is, there are a lot of different use cases, a lot of different problems that people are trying to solve, and quite a few of those folks are going to be there, and so, it’s a good chance to have a conversation if you wanna do, if you wanna know more about visual testing, if you wanna know more about how to use headless effectively or deal with the grid.

    So, there’s this opportunity to share that information and share that knowledge, and I think that’s really what we’re aiming for is an environment that’s a practitioner’s environment. It’s [Cross talk].

    Shimel: Yeah, definitely, in years past—in years past, you know, SauceCon, that’s exactly what it’s been, and I think Sauce Labs has done a great job fostering that, right? It’s good stuff, all around.

    We don’t have a lot of time left, but you know, you just joined in January, you’re fairly new, your first SauceCon, you’re getting a handle around product. But do you feel up to giving us a little projection, maybe, of what we’ll see coming out from Sauce Labs over the next, you know, six months?

    Wyman: Well, I don’t wanna give away too much, but we will have something that I expect to be quite exciting, a new beta labs experience that I think people will be able to go get their hands on and play with, something that moves, let’s call it shift left, a bit.

    And we’ll continue to talk a bit about our analytics and in particular, there’s a new report that we are going to be showing. I think some folks may be aware of it already, but it’s relatively new, it’s called Failure Analytics, where we’re able to aggregate all of the different log outputs and provide intelligence and cohorting of different common errors so that, instead of having to hunt through hundreds, potentially, of failures, we will highlight the common problems, which gives developers an easier time of going and fixing things. Also, it makes it a lot easier to debug across large automated test suites.

    So, we’ve got quite a bit that we’ll be showing from a product standpoint, and like I said, there is gonna be a pretty exciting unveil around a beta project that we’re moving forward with.

    Shimel: I think that’s enough of a tease right there. Hey, Matt, you may not know this, but I’ll mention it for our audience—anyone interested in going to SauceCon, it’s actually SauceCon, S-A-U-C-E-C-O-N dot com, and you can go on there and you can still register to attend. I should also mention that our MediaOps, devopsy.kinsta.cloud team will be there under our Digital Anarchist platform. We will be broadcasting live interviews from SauceCon.

    So, if anyone listening is going to be in Austin for the event—hey, come find the Digital Anarchist broadcast booth or me, and we’d love to hear what you have to say and maybe interview you. You never know. So, yeah, please do that, but check out SauceCon.com for more information.

    Matt, before we wrap up, anything else you wanna add?

    Wyman: I think this is great. I appreciate the opportunity to have the conversation.

    Shimel: Well, now that you’re part of Sauce, you know, we’d like—we do these DevOps Chats pretty regularly, so maybe we can have, maybe we’ll do another one even before SauceCon itself.

    I’d like to—you know, I didn’t wanna put you on the spot today, [Laughter] but maybe in the future, I’d like to hear, what are your top three sessions at SauceCon that you’re looking forward to. You don’t have to answer now, though, but I’m gonna give you a chance to do a little digging, but I’m gonna invite you back on in about two weeks and let’s talk about it.

    Wyman: That sounds great. I think it’d be a good idea to, I assume that we’re at the end, here?

    Shimel: Yeah, we’re wrapping up, and you know what, for our next one, Matt, I’m gonna pick three, too. So, folks, there you have it—stay tuned for our next chat with Matt where, between us, we’re gonna highlight his three and my three—

    Wyman: That sounds like fun.

    Shimel: Favorite talks for SauceCon that we’re looking forward to. Sound good?

    Wyman: Alright, sounds great. I look forward to it.

    Shimel: Alright! Hey, Matt, welcome aboard to Sauce Labs, I think—and you already know it, but you joined a great outfit, a great bunch of people there, and looking forward to seeing you in person at SauceCon.

    Wyman: And likewise—thank you.

    Shimel: Okay, and we’re looking forward to seeing you, our listeners, there at SauceCon, but if you can’t make it, do log onto digitalanarchist.live and you can follow along with us from there.

    Until then, this is Alan Shimel for devopsy.kinsta.cloud, and you’ve just listened to another DevOps Chats. Have a great day, everyone.

    — Alan Shimel

  • DevOps Chats: Sumo Logic Continuous Intelligence, with Bruno Kurtic

    DevOps Chats: Sumo Logic Continuous Intelligence, with Bruno Kurtic

    Sumo Logic has been one of the pioneers in DevSecOps and log analysis for many years now. In this DevOps Chats, we speak with Founding VP of Product and Strategy, Bruno Kurtic, about the Sumo Continuous Intelligence Platform and how it is taking security into the next era.

    Have a listen to this DevOps Chats as Bruno explains how Sumo is trying to meet the challenges of keeping up with the speed of business, today.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    [soundcloud url=”https://api.soundcloud.com/tracks/764360107″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hi, everyone, it’s Alan Shimel, devopsy.kinsta.cloud. You’re listening to another DevOps Chat. Today’s DevOps Chat features Bruno Kurtic, Founding VP of Product Management and Strategy over at Sumo Logic. Bruno, welcome to DevOps Chat.

    Bruno Kurtic: Thank you, Alan.

    Shimel: It’s a pleasure to have you here. Bruno, as we were talking off mic, I think our audience is plenty familiar with Sumo Logic, you know, they’ve been one of the—not founding, but one of the building block vendors within the DevOps and DevSecOps kind of movements. But just in case, maybe there are some people who aren’t, do you wanna give us just a quick background?

    Kurtic: Sure. So, Sumo Logic is a cloud based machine data analytics platform. We help customers collect data, telemetry, machine data, infrastructure data, application data from all of their mission critical applications and infrastructure. We process that data and provide them with a scalable and secure technology to deliver operational intelligence, use cases such as monitoring, troubleshooting, root cause analysis, security intelligence use cases such as SIM compliance, threat detection and resolution, and also business intelligence use cases for sort of understanding how their customers are using their digital services, how their products are being adopted and so on and so forth.

    So, that’s essentially what we do. We deliver this as a cloud based service, so it’s SaaS. Our customers essentially tap into our infrastructure, send us the data, and they then get to use their data and get the insights in real time.

    Shimel: And you just joined the company last month?

    Kurtic: No, I’m—

    Shimel: I’m kidding. [Laughter]

    Kurtic: I’m a Founding VP. [Laughter] So, a little bit longer than a month, I’d say maybe two months, maybe close to 10 years—here we go, right?

    Shimel: Close to 10 years. Ten years goes in the blink of an eye, doesn’t it?

    Kurtic: It does, it really does. It’s really astonishing. Sometimes, it feels like a really long time, and sometimes, it’s like it was yesterday, right? And so, it depends on the day.

    Shimel: Unbelievable. Yep. I agree. I’ve been there and done that. The last startup I did before MediaOps, I did nine years, and it just—

    Kurtic: Oh, okay, there you go.

    Shimel: I know how that goes. Anyway—so, Bruno, thank you for joining, thanks for the background. But let’s, I wanted to jump into continuous intelligence, which is, you know, kinda the phrase that Sumo Logic is gathering around. And of course, you know, in DevOps, we have continuous everything, right?

    Kurtic: Yep.

    Shimel: But continuous intelligence—continuous intelligence, excuse me. What do we mean by it? What does it mean in the terms of the way Sumo uses it?

    Kurtic: That’s a great question. And actually, sort of, this whole, the purpose of this platform that we’ve built, it really is to provide the continuous intelligence through a digital enterprise, right? And what we mean by continuous intelligence is the following.

    As you just said a couple seconds ago, in DevOps, everything is continuous, right? You continuously push code to production, you do continuous testing, continuous integration, right? And you’ve got continuous feedback from your application services that you deliver and then you take that feedback into your product development cycle and you continue to improve, right?

    When we talk about continuous intelligence, we recognize and see that in this world of high speed software development and digital economy that the data generated by production application, mission critical applications and services that serve customers and generate revenue—collecting that data is important in real time, and this data is ubiquitously applicable, right? This is not just for DevOps teams to manage the applications, it’s not just for security teams to secure those applications. This data is relevant to the entire digital business, right? It’s useful to product managers to understand how their products and services are being used. It’s useful to sales and marketing teams to understand how the customers and prospects are leveraging their digital services. It’s useful to finance teams to understand how the—what’s the cost, behavior, and other things related to those digital services.

    So, continuous intelligence, it basically refers to this continuous need for data in the business to continue to improve how it operates, how it competes, how it delivers value to the customers, how secure, how to secure those properties and so on, right? So, it’s ubiquitously applying the data that’s generated by the digital services across all those use cases.

    Shimel: Fantastic. You know, an aspect to this and an aspect to a lot of DevOps as well as DevSecOps is automation.

    Kurtic: Yep.

    Shimel: But, you know, Bruno, my time in security, if I learned anything is, sometimes, people don’t embrace automation because they’re afraid of security run amok, right? I’m gonna block the CEO’s email or I’m gonna shut down a critical application or, you know, business process.

    Kurtic: Yep.

    Shimel: So, how do you reconcile, right—and so, it’s one thing to gather intelligence, actionable intelligence, as we used to call it, right, and on a continuous basis make adjustments and stuff, but to really, to move at the speed of business today, you then have to, you almost are forced to automate, right, responses and so forth.

    Kurtic: Right, absolutely. So, you know, you bring a very valid point. Like, you know, my entire career has always been in enterprise software and the last 12, 14 years has been in this specific area of sort of monitoring and troubleshooting security. And it has always been the case that—not just on the security side, that our remediation, you know, people are scared of, it’s also on the operation side, right?

    Shimel: Yeah.

    Kurtic: You know, should I—when do I trigger auto scaling, when do I not and all this stuff, right? And, you know, we’re now getting much better at that, but you know, if you look at the history just this last decade, it has been a tricky area for enterprise to adopt.

    And so, you know—but I don’t think it’s possible to not. Like, we, just like you said, the speed of business demands that we make automated actions based on data that we are observing, and there are some insights we get from that data.

    The challenge has been, is how good are your insights, right? The tricky part is, I used to be in the SIM space, S-I-M space, so on the security side prior to Sumo Logic. And, you know, it was tricky to be able to sort of adopt full automation based on those security rules, because those security rules themselves were fragile, right?

    Shimel: Yep.

    Kurtic: They weren’t necessarily overly deterministic, you could get false positives, you could block CEO’s e-mail, you know, inadvertently and prevent something important from happening. And so, it was a—in those days, it was much harder to sort of bet on that automation, right?

    As you fast forward to now, when you apply advanced analytics—this is why we call our platform an intelligence platform. When you apply advanced analytics, you know, more sophisticated technologies like machine learning and AI, when you start sort of looking across not at individual incidents and alerts, but you start looking across multiple incidents to really have a better understanding of what’s the actual impact of these events that I’m observing, then you can start, you know, making those automated actions.

    And of course, there’s always gonna be things you will not know how to act on, right, which then goes into a wholly different pipeline that, where you enable people to understand what’s actually happening and then decide, in the future, do I wanna make this an automated action or not. But basically, as we go through this cycle of, you know, capture a new unknown, learn what it is, route it to the right place—when it becomes unknown, it gets added to that sort of automation engine, and eventually, you keep sort of reducing the number of manual steps you need to perform to run a good business, to run a secure business or whatever it might be at the use cases.

    And so, we’re not done, right? There’s still plenty of situations where you’re not gonna wanna take an automated action. But I think at this point, we’ve achieved the level of intelligence to make that automation actually be useful without hurting you.

    Shimel: It does my heart good, man. [Laughter] I gotta be honest. So, I think I mentioned to you off mic that my last startup was a security company I started in 2001, and that’s when we were making the move from, like, IDS to IPS, right? Intrusion detection to prevention, which meant automated blocking of traffic.

    Kurtic: Mm-hmm.

    Shimel: And, you know, I always thought it was a no brainer, but it really wasn’t, because the state of the art at the time was, we didn’t have an intelligence platform.

    Kurtic: Mm-hmm.

    Shimel: Right?

    Kurtic: That’s right.

    Shimel: You know, we were constantly trying and striving, but, you know, it just wasn’t there. So, Bruno, what would you—and, you know, there’s a tough one—what would you point to that has really sort of moved the needle in this evolving intelligence platform that you could say, “Hey, man, you can trust this now, right, because 99 out of 100 is making the right choices, or 999 out of 1,000.”

    What is—you know, you alluded to it, but let’s get down into it. What’s providing, what do you think triggered it? What do you think was the breakthrough?

    Kurtic: Yeah, so, I would say that it’s definitely not one thing, right? It’s multiple things.

    Shimel: Yeah. It never is, right?

    Kurtic: Exactly. So, I’d say it’s sort of, you know, there’s a few sort of things that have occurred in the last decade at least that we have done internally to bridge this gap, right? At first, the old systems were siloed. They were not scalable enough to actually be able to ingest all of the telemetry required to make these decisions, right?

    So, you have to compromise. Like, if you’re sort of familiar, since you’re familiar with IDS and IPS, you might be familiar somewhat with the old SIM systems, right?

    Shimel: Sure.

    Kurtic: The SIM systems of the old age were, you know—you have to compromise. You couldn’t scale them sufficiently to accept all the telemetry, and so, you have to continue to reduce the amount of data that you were sending into them. And when you have limited visibility, it is much harder to be able to make a deterministic decision on what you can act on automatically, right?

    We’ve built a highly scalable, cloud based microservices multi-tenant back end that can basically accept literally almost an unlimited amount of data, right? And so, we get all the data and all the required telemetry to be able to make those decisions, which then creates a different problem, right? Now that you have all the data, how do you actually make sense of it all, right? And, you know, the data analytics techniques have dramatically improved over the last decade. You know, the old world used to be strictly rule based, and if you know this in sort of the IDS and IPS world, like, it’s basically signatures, right? In the SIM world, it was rules, right?

    And now we’ve moved away from that, right? We don’t even require our customers to tell us what the schema of their data is, because in the new world of high speed software development and DevOps, there is no schema, right? Developers put whatever they want into their logs of whatever metrics are coming from that infrastructure. And so, you need to be able to deal with the fact that this data has no schema and you’re gonna have to deal with the schema on demand and still need to be able to derive intelligence from that.

    So, we built a back end that then allows any data to be ingested, any data to be indexed and analyzed. And then, as you analyze that data, we realized very quickly that even if you have a very scalable back end and a very open ended sort of platform that can accept any data, giving a human a keyboard and a coding language is insufficient in empowering that human to actually construct what they actually want to derive out of this, right?

    So, we invested heavily into a couple of things. One is, you know, from the very beginning, we invested into automated techniques for analysis—advanced statistical analysis, machine learning, and things like that, that basically are special purpose built for these types of data systems where, you know, they detect anomalies, they detect outliers. They enable you to sort of remove 99.9% of stuff that is noise and sort of highlight and find all of those things that are real signals in that data.

    And the second part that we talked about last year, which was one of the big innovations we delivered, was something that we called global intelligence service, which basically leverages all this telemetry that we see across sort of the global infrastructure that we run. And it’s able to sort of derive what I would call best in class behavior. What are you expecting to see to happen on this type of infrastructure, right? If I see 1,000 pieces of infrastructure that is common across hundreds of our customers, and I know that this is what’s normal—well, that can tell me whether your stuff is normal as well, right?

    So, there are all these novel heuristics analysis techniques that can inform those decisions as you then run those automations on the back of them.

    Shimel: Yeah. So, you mentioned, Bruno, you were working—was that on ArcSight before, or a different SIM?

    Kurtic: No, actually, my other founding members were at ArcSight. I was at a company called SenSage, which was competing with ArcSight.

    Shimel: Okay. I—yeah, those were my days, those were my peeps.

    Kurtic: Yep.

    Shimel: But, you know, you’re 100% right. You know, they say you can’t make wine before it’s time. And as much money and effort and blood, sweat, and tears that we poured into SIMs back then, they were almost at some level doomed for failure, just because it was state of the art, right? It was—

    Kurtic: Yeah.

    Shimel: You were always trying to dumb down the amount of signal in there and reduce the signal to noise and what you can do and what people would trust with it. And, you know, in many ways, kinda that, that right there, the flip side of that is kind of the success story behind Sumo Logic—right platform at the right time.

    Kurtic: That’s right. That’s—and we’ve learned those lessons, right? All of the founding teams, Sumo has seen how it worked before, right? And when we started the company, we wanted to build something different, take this to the next level, and that has been the task for the last 10 years.

    Shimel: Yeah, 10 years in the making, another overnight success. [Laughter]

    Kurtic: Right, yeah.

    Shimel: Now, we’ve got this platform, we are—you know, we’re in the right place at the right time. Let’s assume we are. Where do we go from here? Where do we go from here?

    Kurtic: So, where do go from here? So, you know, where we go from here, I think, is—we, as a company, sort of, we deliver on this vision of the continuous intelligence category and platform for our customers. Where we are moving into is, we’re moving into sort of fine tuning and shipping multiple products that are optimizing the outcomes for specific user personas and use cases.

    So, I’ll give you some sort of examples of that. You know, on the DevOps side, right, we’ve spent a lot of time on the use cases around cloud, multi-cloud, packaging out of the box solutions for people running in AWS, GCP, in Azure. We recently introduced a, what we call a Kubernetes solution. So, as more and more of our customers move into solutions like—into platforms like Kubernetes and containers and serverless, they’re looking for out of the box insights that, as soon as you plug the data coming out of these platforms into a platform like Sumo Logic, they want to know what—how is my application, how is my platform doing, right?

    So, we’re spending more and more delivering special purpose insights on top of these specific use cases and areas for specific personas. On the security side, we are sort of extending our product set into things like the cloud SIM, you know, tuning it for compliance, again, across specific domains. Like, if you are running on premise or in multi-cloud or in single cloud, we want to deliver more and more specialized packages that basically enable our customers to consume this without having to think too hard about it, right?

    Shimel: Yep.

    Kurtic: The old SIMs were difficult, because you had to write all this stuff yourself, right?

    Shimel: Agreed, agreed.

    Kurtic: Right?

    Shimel: And I think, you know, it’s almost continuous automated intelligence for DevSecOps.

    Kurtic: Mm-hmm.

    Shimel: Right? And I’m not saying that’s the end of the road or the end of history as we know it, right, because we’re in a constant cat and mouse game and as things change, but it really is such a different place than we were 10 years ago, or even five to seven years ago, for that matter, right?

    Kurtic: That’s right, yep.

    Shimel: Bruno, let me ask you personally, right? Ten years in here, you are, you know, the key person developing this, you’ve got this to where it is—what gets you juiced in the morning, man?

    I know I love doing what I do now, right? I got out of the software game, I’m a media person, I love building my company and doing it. What gets you excited in the morning about coming to Sumo and doing this?

    Kurtic: Thanks for the question. It’s actually, you know, if I kind of, when I look at what’s happening, what are the undercurrents here of this market that we’re in, right? We talked about use cases and all this, but the undercurrent here is that there is a massive transformation that’s happening in the technology landscape, right? And the transformation is driven by the business transformation occurring in all industries today, right? Everybody’s—every company is getting remade from inside to go from a traditional business model to a digital business model.

    And these digital business models are then meaning that every single company is becoming, essentially, a software company. And they’re competing not on manufacturing or whatever business they were in, they’re competing on delivering products and services—digital products and services to their customers.

    So, essentially, the entire GDP is gonna be based on software, right? And in order for all of these enterprises and government organizations, you name it, to do this effectively, they’re all going through basically modernizing of how they do their technology, how they build their applications, how they develop them, how they understand them, how they improve them, how they optimize them.

    And we are just at the very, very beginnings of what this market is going to need, right? And I think our goal from the very beginning has been that we kind of want to be that platform for the digital business that’s leveraging all this new stuff, and to enable those users to actually do this effectively. And the challenge that those users have today are sort of, they seem insurmountable today. There’s so much data, right? There’s so much digital exhaust that they have to contend with. The skill sets available to them to actually adopt these technologies are very, very scarce, right? But everybody is going there because there is no other way.

    And so, to me, this is really exciting. We are sort of at this crossroads, this sort of fork and every 18 months today there’s a massive paradigm shift in technology. And, you know, every 18 months, we have to think really hard about how do we now do this and help our customers do that? You know, it’s no longer like two decades ago when it was like, you know, your three tier applications and that trend is going on for 20 years, right? Now, we’ve gone from on-prem, three tier, to cloud, to microservices, to Kubernetes, to containers, to serverless, and God knows what’s gonna happen in six months, right?

    And that’s just really exciting, and having to build—building a company that can respond to that and support our customer base as they go there so they can compete better is extremely exciting for me. And so, that’s what keeps bringing me back and keeps me smiling when I wake up in the morning.

    Shimel: Great answer, man. You know what? It’s a great time to be alive and in this industry, it really is. There’s so much happening.

    Kurtic: It really is.

    Shimel: We’re on the precipice of so much more, though. Because it’s like—you know, the more we accomplish, the more we can accomplish. And that, I think it keeps a lot of us in this, right?

    Anyway, Bruno, I told you we were gonna do this for 15 minutes, and we’re closer to a half hour now, I apologize. [Laughter]

    Kurtic: No problem.

    Shimel: But it was a great conversation, I’m really happy we got caught up on Sumo, you know, and the continuous intelligence platform. You guys are gonna be at RSA, yeah?

    Kurtic: We will.

    Shimel: Yep. So, I’m gonna try my best to have this up for our audience listening to this, RSA is the week of February 24th in San Francisco, and if you’re attending RSA Conference, go check out the Sumo Logic booth.

    Also, we’re gonna be putting on a whole DevSecOps event conference within a conference at RSA on Monday, February 24th at Moscone—I think we’re in Moscone West this year. So, if you have an RSA bench and you want to talk DevSecOps, come join us there. We have a great lineup of speakers. We also can visit the Sumo booth at RSA Conference, which is, I think it starts Monday night the 24th, the expo floor opens and it runs through Friday. So, check that out—shout out to our friends at RSA.

    Bruno, thanks very much, man. Say hello to all of our Sumo Logic people. Keep up the great work.

    Kurtic: Will do. Thank you, Alan. Appreciate it.

    Shimel: Alright. This is Alan Shimel for devopsy.kinsta.cloud. You just listened to another DevOps Chat.

    — Alan Shimel

  • DevOps Chats: Kubernetes is the New Compute, with Rancher Labs’ Sheng Liang

    DevOps Chats: Kubernetes is the New Compute, with Rancher Labs’ Sheng Liang

    Rancher Labs is a great example of a startup that was smart enough to sense the way the market was moving and adopted a strategy to capitalize on it. And, if you know Rancher co-founder, CEO Sheng Liang, you should not be surprised. Sheng has been seeing the market and staying one step ahead for a long time.

    In this DevOps Chat, we sat down with Sheng and spoke about the recent momentum at Rancher. We also spoke a lot about Kubernetes becoming the industry standard for compute.

    It is always a good learning experience speaking with Sheng, and this conversation is no different. Have a listen.

    Transcript

    Alan Shimel: Hi everyone, this is Alan Shimel for devopsy.kinsta.cloud and you’re listening to another DevOps Chat. I’m really happy to be joined by a good friend of mine who I’ve known probably more years than we want to admit to, my friend Sheng Liang who is the CEO of Rancher Labs. Sheng, welcome.

    Sheng Liang: Thank you very much. I’m glad to be here.

    Shimel: I’m glad to have you here, my friend. So, Sheng, the news with Rancher, I guess we call it a momentum release, right, you recently put out.

    Liang: Yeah.

    Shimel: Why don’t you just share some of the highlights with the audience?

    Liang: Yeah. Every January, early February, we tend to look back the year before and see how we’ve done, how the whole industry has done, and it’s just been remarkable. I guess the top-level thing is our business, our recurring revenue grew 169%, so that’s like high three-digit growth. It’s way exceeded our expectation. That itself is good news for us, but it’s not really–I don’t think an average person in the industry needs to care about it as much.

    What I want to, Alan, spend some more time talking to you is some of the underlying technology changes and industry movement that’s kind of enabling us to thrive in this environment.

    Shimel: Absolutely. Let’s be fair, congratulations. A hundred and sixty nine percent year-over-year growth is nothing to sneeze at. You’re right, there is a little bit I think of a rising tide lifts all boats when we’re talking about the Kubernetes market. Nevertheless, 169% is still 169%. You and I both come from that startup world and congratulations.

    Liang: Thank you.

    Shimel: It’s something to be proud of.

    Liang: Yeah.

    Shimel: Also, for our audience out there who are not familiar with Rancher Labs and Rancher OS, it’s a great startup story. Sheng, your background, cloud.com, all the things you’ve been involved in, you’re the perfect person to have led this. But Rancher Labs came out there originally with the Container Revolution, right?

    Liang: Yes.

    Shimel: With an OS for running containers. You were agile, nimble, adaptable enough to see Kubernetes and say, “Hey, we’re not gonna–we’re shoveling sand against the tide, right, if we think we’re gonna beat Kubernetes. If you can’t beat them, join them.” You incorporated Kubernetes into the Rancher Lab system.

    Liang: Yes, and in a fairly unique way as well. I’d love to share the story a little bit if you don’t mind.

    Shimel: No, you’ll tell it better than I will.

    Liang: We’re just over five years old, over 200 people now. We operate in 14 countries and we’re open source business. It’s 100% open source. Every single product we ship is available free in source code form, Apache open source, and it really worked well for us. I know in the industry there’s actually been a lot of talks about “Is open source even a great business anymore in the context of cloud?” But we continue to believe so, at least especially in the industry we’re in, and we can talk a little bit more about that.

    But let’s talk about the business and market and Kubernetes. The great opportunity we see with Kubernetes is Kubernetes for once has become an industry standard for compute. Now, think about it. We all know compute these days is everywhere. Computing is on cars, in ATM machines, on your phone, certainly on the server, in the cloud, but really, before Kubernetes where the world was getting into was quite challenging for a lot of organizations.

    Because these clouds as good as they were, as good as they still are, they’re just different. If I’m a CIO, say if I wanna be efficient, I wanna maybe go all in on one cloud whether it’s Azure or Amazon or Google, but until the day comes, now I merge with another company and now bringing a whole different set of infrastructures, and I don’t really wanna worry about that because my whole point is develop the apps, transform the business, help the–all the stuff I’m doing to worry about infrastructure is just plumbing, and that’s the true power of Kubernetes.

    I don’t think enough people in our industry are promoting Kubernetes this way yet, so I’d like to make a strong point with you, that in my mind, Kubernetes is the TCPIP of compute. Now, think about it.

    Shimel: It’s the stack. It’s the [Crosstalk] as you say. It’s the protocol.

    Liang: It’s a stack and a protocol because before TCPIP if you and I could remember back in–

    Shimel: I do remember.

    Liang: There were a handful, almost a dozen different network protocols, and after TCPIP we had 3Com, we have Cisco, we have Yahoo!, we have Google. All that stuff happened, internet. Revolution happened because finally–

    Shimel: I remember when you had to add the TCPIP stack separately. It didn’t come with Windows, so you had to add that in. That was an add-on. Early open source stuff.

    Liang: That’s exactly what’s happening because–this is a great point you brought up. Someday people will say, “Oh, I remember there was a time I had to talk to vendors like Red Hat and Rancher just to implement Kubernetes, whereas today if I get infrastructure like from Amazon, Google, from VMWare, from Dell, wherever, it comes with Kubernetes.” That’s exactly the same thing that’s happening. You see that, right?

    Shimel: Yeah. History repeats itself. When you get old enough, Sheng, you realize that. Let’s talk something else. I wanted to talk a little bit about CNCF because that’s their mission to make sure that Kubernetes is part of the plumbing. Truthfully, it’s not just Kubernetes. When you look at CNCF’s mission, they truly are trying to develop a stack or at least help foster the development of a stack built on several open source projects.

    Beyond Kubernetes, for Rancher now, what are some of the other CNCF projects that you see making their way into Rancher either now or in the future?

    Liang: I would say pretty much the whole stack. We’re very deeply involved in CNCF. We’re very early member of CNCF, and my co-founder Shannon Williams is elected to the CNCF governing board. Just this week I was elected to the CNCF TLC.

    Shimel: Really? Congratulations.

    Liang: So, I have some power kind of deciding what projects are gonna go into CNCF. CNCF fundamentally is a governing body for projects, and really our goal is anything and everything that–we wanna provide basically the complete software stack that organizations need to complete their cloud native transformation. Kubernetes is really just the start. Beyond Kubernetes you see everything else that’s going on from monitoring to logging. I’m talking about projects like Prometheus and ____.

    Those are some very mature projects now. Some of the more recent projects, things around security and policy management like OPA. I think those are very, very–

    Shimel: Love OPA.

    Liang: Yeah, and service match Linkerd. That’s also part of our CNCF. We last year contributed to a project called Longhorn. It’s cloud native storage, Kubernetes storage into CNCF. It’s a CNCF sandbox project now. So, it’s pretty much really the whole stack. If you think I was saying Kubernetes is TCPIP, then the rest of the CNFC, it’s the rest of the software stack, from the platforms to some of the key applications to some of the tools and equipment that more people have used.

    They’re gonna build this cloud native ecosystem. So, I’m really excited about it. I’ll be serving this CNCF technical oversight committee for the next two years and play a role in really growing the scope, further grow the scope of CNCF.

    Shimel: I just wanna say one other thing about CNCF, and that is we did a virtual event here called Predict last month where we took a look at a year in the future, and one of the points I made is that to me, CNCF is sort of the poster child for this third generation of open source that we’re in. I call it the first stage, sort of the cathedral in the bazaar back in the day. I know you know about it, Sheng.

    And then we moved from the cathedral and the bazaar to what I call the big brother era where every open source project was really owned by one company, and everything that that project did was for the benefit of one company, and that discouraged others from joining in and helping do it. Now we’re in sort of the foundational era of open source where you have foundations managing these projects for the good of the whole community with multiple vendors involved, people like you on the board who are doing it.

    Yes, it’s good for Rancher, but it’s good for all of the community, and that’s a very different–as I said, it’s the third generation of open source and it’s a great thing. Let’s focus in on Rancher a little bit though, Sheng.

    Liang: Yeah, absolutely.

    Shimel: So, we’ve got all these great projects. You’re literally building the stack or at least distributing the stack, your distribution of the stack. Fantastic revenue growth. What are people doing with Rancher that this demand is in such high demand?

    Liang: Yeah, I know. It’s one thing that Rancher of course supports and distributes a lot of CNCF technologies including Kubernetes and Prometheus and Linkerd and Fluentd, and we’re gonna soon be doing OPA. That’s all valuable, but fundamentally, a company like us really only have a reason to exist if we innovate. We basically create things that people can uniquely get from us and not from anywhere else.

    There are two pieces of content or two technologies that we created that actually help put Rancher on the map. One is K3S. It’s one of the most–if not the most–popular open source project in the Kubernetes ecosystem today outside of Kubernetes itself, and it’s just got tons of momentum. What K3S achieved was it took Kubernetes that was already proven in data center and cloud, and we brought it out to Raspberry Pi’s and surveillance cameras and set top boxes.

    Shimel: This is K8 lite. I remember we spoke about this, the one in the KubeCons. I remember.

    Liang: We launched GA at KubeCon, so it’s very big. We’re very excited about it. You remember, again I keep using TCPIP as an example because in the 90s when TCPIP just came, it was obviously a computer networking standard, but nobody probably could’ve imagined like a phone would also be talking TCPIP, right?

    Shimel: They all do.

    Liang: They all do now. I can see in ten years every phone, every camera will be running Kubernetes as well. Every car will be running maybe multiple Kubernetes. So, we’re very excited about that. Then the other big piece of innovation that really Rancher helped to make it happen is this thing called multi-cluster management. We believed Kubernetes again is a protocol. It runs everywhere, so you kinda need something to tie them all together.

    It’s not really good enough to be able to operate individual clusters. You need to treat all the clusters as a resource pool. In fact, you actually kinda have to treat every single cluster as a cattle or as a pet. That’s where the Rancher analogy came in.

    Shimel: I remember talking to you about that three, four years ago.

    Liang: I know.

    Shimel: It’s cattle, not pets.

    Liang: Our namesake product Rancher, which is named after our company, is a Kubernetes management platform. It takes all of your Kubernetes clusters in the cloud. In the cloud, that could be GKE, EKS, AKS. Could be Kubernetes clusters on-premise. It could be RKE. It could be open shift. It could be Project Pacific, PKS. It could be K3S clusters on the edge in cameras.

    We present it to your DevOps teams and ITOps teams as a unified computing platform, so you can manage access, you can deploy apps, you can run CICB, and that’s what Rancher is. It really started to resonate last year, even though we’ve been building it for three, four years, and that’s ultimately what propelled our tremendous business growth last year.

    Shimel: Great. Sheng, we’re coming up on the end of our time. I’m gonna throw one more kind of topic question out at you we can discuss, and that is really what does the future hold for Rancher not necessarily from a product deployment point of view but you’ve started and had exits with multiple startups now in your career. Where do you see Rancher in two to three to five years? Do you go public with this? Is this something maybe some larger entity wants to acquire to kinda own the stack if you will? What do you think?

    Liang: I think these days I probably think a little less about ultimately how Rancher will exit, just making sure we build a great business. I think we’ve kind of grown past the point that sort of an early stage easy equal hire or a technology would be viable.

    Shimel: It’s not a tuck in.

    Liang: We’re big enough to be sustainable by ourselves, and honestly, I absolutely believe it’s a big enough market. We solve a big enough problem that there’s a potential for tremendous business. Think about people actually all talk about hybrid cloud and multi-cloud, edge computing, but I think a lot of these terminologies are very attractive from a market demand or business case perspective but always lack some technical meat to actually bring it to reality. That’s actually been the problem.

    Of course, we all know hybrid cloud is a real business need, but the problem is because there was no fundamental consistent experience that could actually implement that. So, as a result, no big businesses have been built. We kind of approach it a little bit differently. We’re very much centered around Kubernetes as a common protocol for compute.

    I think by building on that, I really believe there’s a tremendous business opportunity here because fundamentally, we’re gonna solve these multi-cloud, hybrid cloud and edge computing problems. Those are business problems with Kubernetes as the common compute protocol. So, I think that will keep us busy for the next five, ten years, and I think this business has lots and lots of room to grow.

    Shimel: Let the chips fall where they may. Sheng, we’re about out of time. I wanna thank you for taking time out of your busy day and joining and talking to our devopsy.kinsta.cloud and Container Journal audiences. Always a pleasure to speak with you and get an update on what’s happening at Rancher Labs. I will see you in about a month and a half in Amsterdam for KubeCon.

    Liang: Thank you. Thank you, Alan. It was great talking to you.

    Shimel: Always a pleasure. Sheng Ling, CEO, co-founder Rancher Labs. This is Alan Shimel for devopsy.kinsta.cloud and Container Journal, and you’ve just listened to another DevOps Chats.

    — Alan Shimel

  • DevOps Chat: Increasing Delivery Velocity, with Launchable

    DevOps Chat: Increasing Delivery Velocity, with Launchable

    Jenkins founder Kohsuke Kawaguchi (KK) and respected DevOps veteran Harpreet Singh have launched a new company called Launchable.

    Launchable aims to help you improve your delivery velocity by prioritizing and applying some ML and intelligence to testing. There is still much work to be done but with these two industry luminaries behind it, the expectations are high for something impactful.

    The VC community and a blue chip list of investors are already on board.

    Yes, this means KK is no longer at CloudBees (several CloudBees execs are investors in Launchable) and Jenkins, while he is still an advisory. But, with Jenkins now in the capable hands of the CDF and Linux Foundation, and CloudBees well established, he felt this was a good time to pursue an issue he thinks needs to be solved.

    Hear from KK and Harpreet themselves in this great podcast.

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel for devopsy.kinsta.cloud, and I am here, you’re listening to another DevOps Chat. We have some really great breaking news on this DevOps Chat. I’m really happy to have, snagged a dynamic duo of industry veterans in the DevOps space who have just started what promises to be perhaps a game changer in the DevOps industry. But they’re gonna tell us more about that, I don’t know.

    Let me introduce you to Harpreet Singh.

    Harpreet Singh: Hello.

    Shimel: Hi, Harpreet, how are you?

    Singh: Very well, thank you.

    Shimel: Thank you. And Harpreet is co-CEO of the new company, and his co-CEO is none other than my friend, Kohsuke, K.K., founder of Jenkins, CloudBees and all of that good stuff. K.K., welcome.

    Kohsuke Kawaguchi: Hello. Thanks.

    Shimel: Okay, so, let’s talk about the big news. We have a new company in the DevOps space called Launchable.

    Kawaguchi: Yeah.

    Shimel: Is that—and the both of you are co-CEOs?

    Singh: That’s right.

    Shimel: And, of course, with your track record, I’m sure, you know, it wasn’t as hard as it is for a first time entrepreneur, but Launchable’s already raised some venture capital to help it get off the ground, including some high profile angels.

    Kawaguchi: Yeah. We’ve been very lucky.

    Shimel: Talk a little bit about it—who’s involved, who’s put some money in?

    Kawaguchi: So, there are two big institutional investors. One is Barclays Ventures, and that comes from Harpreet’s long relationship with their partner, Gomesh. I think, in fact, your wives know each other. Like, it almost feels like an insider. [Laughter]

    And then another VC is the unusual ventures, and that’s started by Unusual Ventures, and that’s started by John Vrionis. And John actually has been also an investor at CloudBees, so his people have seen us in action and know us well enough so, you know, you get their validation and then you endeavor it. It’s been—I’ve been truly grateful.

    Shimel: Sure. Well, I’m familiar with Battery back in my day, it was a guy named Gerry Conlon out of Battery Ventures. I don’t know if either of you know Gerry, but he was instrumental early on in Battery. But yeah, they’re a great company. It sounds like two, you know, kind of blue blood venture capital firms in there.

    There’s also some high profile angels including Sacha—Sacha Labourey, CEO of CloudBees, right?

    Singh: Yeah, yeah. So, I think what was exciting for us as we were talking with people was just, you know, the phenomenal backing that we got from investors as well as—you know, these marquee investors as well as individual angels, right? So, we both have been at CloudBees.

    So, I don’t like to think of ourselves as first time entrepreneurs, because we built CloudBees from less than 10 people to whatever it is today.

    Shimel: Yep.

    Singh: I had a sojourn to Atlassian, where I spent about a year and a half really learning from that phenomenal company. So, we were very lucky when people from CloudBees like Sacha, Michel—Michel Goossens, who was the VP of sales there at some point came in and invested. Bob Bickel, who’s been an industry veteran invested in us. And on the Atlassian side where the CTO is Sri Viswanath and Noah, who’s the head of tech teams, which is Jira, Bitbucket, Opshimi and all these comfortable investing in our capabilities and our mission.

    Shimel: Absolutely. And make no mistake, you’re not first time entrepreneurs, because first time entrepreneurs don’t raise money that easily, guys.

    Singh: [Laughter]

    Kawaguchi: [Laughter]

    Shimel: I mean, I think there’ll be a lot of people who listen to this podcast who are first time entrepreneurs and say, “Man, if we only had their background and their resume and their experience, it wouldn’t be as hard as it is.” I think a lot of first time entrepreneurs struggle—struggle with doing that.

    But that’s great. It’s always good to have money in the bank when you start a venture, because it’s needed, but as we were talking about off camera a little bit, I’ve never met a successful startup entrepreneur who did not think what they were doing was in some way changing the world, making it better.

    And so, I wanted to ask each of you individually—what really got your juices flowing? What really got you excited about what you guys are doing at Launchable?

    Kawaguchi: Sure. Alright, so I’ll start. So, you know, one of the things I started—I created this sort of thinking and I felt like I put the state of the automation and the software development power to the next level in the world. And this automation, they produce a lot of data. And what I realized after a while was that, you know, in the rest of the world, in the rest of the business world, data is increasingly being used effectively to drive decisions and make people more efficient and so on.

    But whereas in the software development, I feel like that actually hasn’t really happened. And I felt like this was a great shame, one as somebody who, you know, helps people produce a lot of data with these automation systems, but also, you know, we are the number people, we are the data people, right? We are the pride of ____, at least I think of it that way.

    Shimel: Mm-hmm.

    Kawaguchi: Yet, everywhere I look, I feel like we are making decisions, engineering decisions based on gut and instincts, and this can’t continue. And so, that’s what I kind of started thinking about after a while, and then this idea kind of grew and grew on me. So, yeah—so, that’s probably where my, how my juices got flowing.

    Shimel: Excellent.

    Singh: Yeah, very similar. I think Kohsuke and me used to sit next to each other in the same office room at CloudBees and we used to talk about this all the time. We got the opportunity to see sales and marketing really be completely numbers driven, and we would come back and say, “Oh, if we could only do this on our engineering product side of the house, it would be so much better.” And the answer always was, “Well, it’s a craft.” And we think bringing data in there is important.

    Shimel: Right.

    Singh: And so, that’s sort of what got us both going. My personal anecdote was, after I left and moved to Atlassian, I was talking to somebody out in my customer base there who had this challenge where their delivery velocity was slow and, you know, their aim was to put a few engineers to go in and look at it and how to improve it. And having the DevOps background and you understand CI/CD, I felt like—there has to be a better way to do this than just, “let’s allocate a few engineers and see what comes out of it.”

    Shimel: Right.

    Singh: So, that’s sort of the problem space, and that’s what excited us.

    Shimel: Excellent. And it is, it’s almost ironic or oxymoronic, even, when  you think about it, right?

    Singh: Right.

    Shimel: Because—so, my background’s in information security, right? And one of the things we have seen in security is information overload, like data overload.

    Singh: Right.

    Shimel: The noise to signal ratio. But there have been—there have been a lot of security startups over the last, let’s say five years, seven years, who have really tried to fine tune that dial to get more signal to noise, to be able to automate going through the mounds and mounds of log data, for instance, right?

    Singh: Mm-hmm.

    Shimel: So, you get a company like a Splunk that can just suck a lot of data in from everywhere. And then try to figure out, in an automated way—because there’s just too much to go through by hand—

    Kawaguchi: Exactly.

    Shimel: What’s important from a security point of view or maybe even from a network operations point of view. But as you guys said it, I’m thinking—we don’t really do that with our software development, do we?

    Kawaguchi: Yeah. And I mean, when you describe it like, it might sound a little abstract program, but idealized, it’s actually connected in so many ways to frustrations that I have every day as a developer, right?

    Let me give you an example. You know, I was working on this Jenkins project, and it’s a sizable project with lots of test cases, which is great, but what that means is that every time when anybody wants to make, like, a ____ change, the first thing that happens is, the CI system comes in and they run the whole one hour test cycle before the code review happens, and then somebody makes some observations or a suggestion that, “Oh, you should change this part to something else.” And then you follow that and then another whole hour of testing. And then that’s basically, like—two hours is a long time to wait if you get some change in, actually. And that happens all day in that area.

    Shimel: No, no—I mean, so, let me be a half glass full kind of guy. It’s better than—the one hour is better than the one day it used to be before we automated some of this stuff, right?

    Kawaguchi: That’s true.

    Shimel: I remember back in my StillSecure days and we would—we didn’t even have a big enough infrastructure to do the testing, we would have to outsource, like, unit testing and all this stuff.

    Kawaguchi: Yeah, so, let’s talk about that one big thing, right? Because that’s actually probably an even bigger program. And you said that that’s before automation, but I’ve seen teams every single day that actually have tests that run for more than a day, you know, [Cross talk].

    Shimel: With automation?

    Kawaguchi: Yeah, like an auto maker company putting a car together, a lot of big software. If you test them all, it’s in that cycle for weeks. So, there are a lot of pieces of software getting assembled together into something big, and that test gets even bigger.

    So, what I started doing is, like—okay, so, every time you do this, it’s not like everything is changing all at the same time, right? There’s only small parts of the system it’s changing, and then when we re-run the whole test cycle. So, what if we could ____ the right subset for that test to run? They’re most likely detached programs, so they’ll not only finish quickly, but they also run cheap, and then you still get, like, a pretty sizable, meaningful feedback. You know, you’re not gonna get 100% coverage, but you might get 95%, and that’s plenty good, and that cuts the execution down in, let’s say, half.

    And so, these are the kind of things I thought the data would actually enable, and I’ve seen some prior work, I’ve talked with teams who seem to be on the cusp of doing these things, and I felt like—yeah, this clearly makes sense. More and more people need it, and I need it. And so, that sort of became the founding idea behind Launchable.

    Shimel: So, that was the itch you were looking to scratch here, as I say, right?

    Kawaguchi: Yeah, right.

    Singh: And you asked, like [Cross talk]—

    Shimel: I’m sorry, go ahead.

    Singh: Yeah, and as we were sort of thinking about this, right, we identified this problem and we’re thinking about, like—so, what’s the company’s mission, right? And we realized that every sort of software teams in the future or even today will drive every significant human achievement there. It’s really hard to think about anything that’s not being software delivered.

    And our mission now is to take this artisan teams and actually make them data driven scientists to drive their velocity, you know, and deliver software confidently. So, that’s sort of our big itch and our big mission.

    Shimel: Absolutely, got it. So, let me play devil’s advocate a little bit. You know, one of the things we always used to hear—I heard it in security, I heard it in QA—was, “Look, we don’t have enough time to do a full test, full testing. Let’s just test 80%, 70%, 90%”—take your pick, I don’t care what number you pick.

    You know, Murphy’s Law says whatever you don’t test, that’ll be the thing, somehow, that breaks, right, or that causes a problem. And when we say, “Oh, my God, because we didn’t test that”—why didn’t we test that?

    Kawaguchi: Right. So—

    Shimel: “Why shouldn’t it get done?” Right.

    Kawaguchi: Yeah. So, if you think of testing in isolation, then yes, that’s naturally a concern, because, you know, we need every help and every confidence we can get out of the test. So, like, why would you skip that? That doesn’t make sense.

    But I think where it does make sense is actually, if you think about it, the software development life cycle is composed of a lot of different tests at a lot of different points. So, collectively, they should be seen as a whole system, right? I mean, this is things like—so, the code review, right? If that’s the only point in which you are getting tests run, then you want to run them all. But what happened is, after the cold gets reviewed and merged, then another set of the same tests will come in. So, it is really important that you run all the tests before the code review and spend one hour, or are you okay with 80% of the confidence that happens in, like, five minutes, right? Then knowing that the rest of the 20% get code immediately after.

    I think there is an argument to be made that, overall, you’d be better off, even if some program slips down into the ____, so long as it gets eventually caught before the customer sees everything, so.

    Shimel: So, I guess then that that begs the question is—can that be accomplished? And, to accomplish that, what’s it going to take?

    Kawaguchi: Mm-hmm, yeah, and that’s what we are working on. I think, you know, the—so, I have some preliminary numbers, and they look good. Because if you think about it, the baseline that we are competing against is basically people running all the tests in a random order, and so, literally, you cannot do any worse than that. So, and instinctively as a developer, I know that certain tests are designed to catch certain programs in some specific things.

    So, really, the only question is how well a machine learning model can learn these things over what amount of data. And that, over time, I think I’m sure is gonna get better and whatnot. And I don’t know exactly what kind of impact we can create or what product, but overall, I’m feeling pretty confident. You know, it just needs to be good enough to start making an impact, and it’s only gonna go up from there.

    Shimel: Harpreet, what does success look like for you?

    Singh: Well, this has been a question that’s been asked to us while we were raising funds. I like to think in terms of—so, we’ve done this before. We’ve helped companies get successful. What’s in it for me is actually solving a problem for customers.

    So, if you are able to get and solve a software team’s problems everywhere, to get their products in the hands of customers first—that’s success for me. I know it’s not sort of putting the typical Silicon Valley 100 million to 200 million ARRs. That’s not where we are. That’s not where my head is at. It’s really helping people who are struggling with delivering software.

    Shimel: Got it. K.K.?

    Kawaguchi: So, you know—

    Shimel: What about you?

    Kawaguchi: One time I was working in San Francisco Airport, and then somebody was, you know, working behind me and she said, “Oh, you got a Jenkins thing. That’s nice. Where can I get it?” Right? And that, to me, is like a success. So, it’s gonna be a difficult one to beat once more, but you know, I feel like it’s worth giving it a shot.

    I mean, that’s the kind of—I guess I sort of think that the sign that you made a big enough impact in the world, and some people, and touched some people in pretty deep ways. And that, to me, is success. That’s what I’m itching for, yeah.

    Shimel: Okay. Let’s—let me hold both of your feet to the fire a little bit. So, you’re now launched, this is—you know, it’s out there, the website’s out at Launchable Inc, that’s L-A-U-N-C-H-A-B-L-E-I-N-C dot com, right? When can people hope, maybe, to see a beta? When do you think you’ll be out with something people can actually start using?

    Singh: You’re really holding our feet to the fire, right?

    Kawaguchi: [Laughter]

    Singh: You have a product manager and an engineer, here. I would like my engineering head to give me the dates on deliverables. [Laughter]

    Shimel: You know what? Classic. You’ll make a [Cross talk].

    Singh: Boy, you and me on the same side, here.

    Shimel: That was a great CEO move right there.

    Singh: [Laughter]

    Shimel: Alright, Mr. co-CEO, he threw you under the bus. What do you think?

    Singh: Jokes apart, I think one of the things that we are actually doing at the moment are, we are actively talking to prospects and customers. A lesson that we’ve learned over the years is not build a product in a vacuum and then hope that we’ve solved the problem.

    So, we are actually—there is actually a beta invite list button on our website. What we are looking for is actually partners who can come with us and tell us if we are solving the right problem and work with us to solve the right problem, right? So, that’s sort of where we are today. I’ll leave it at that and I’ll put the dates to you.

    Kawaguchi: Yeah, so, you know, we have preliminary numbers, like I mentioned. We made some models that made some impact, and now what I’m really hoping to find is event partners where we can apply the same technique on their system, their projects, and their source code to see what kind of impact does it produce. And then, so that’s—you know, that may be fundamental in these teams who are willing to work closely with us, and—

    Singh: Is that some number that you can share on preliminary numbers?

    Kawaguchi: Yeah. So, I mean, there is no guarantee that it’s gonna apply to your system. But, for example, while I was able to do this, select 10% of the subset for the best case use and it’s gonna catch like 40% of ____ right off the bat. So, I guess, you know, that’s—yeah, that, to me, is a pretty promising number, and you can only go up from here, so.

    Shimel: Excellent. So, look, both of you have garnered a ton of good will, not only among your peers as evidenced by the angel, you know, the investors’ list here, but also in the community at large, and K.K.—I mean, it goes without saying within the Jenkins community how well respected and, I don’t wanna use the term worshiped, that’ll go to your head, [Laughter] but you know, how honored you are in the community.

    What, people maybe from the community listening, what can they do to help, here?

    Kawaguchi: Yeah, I think giving us their feedback probably is the most. You know, we are working on something that we think is pretty exciting, and then we wanna hear that, or if that’s not the case, then that’s also great to hear. So, so far, the conversations we’ve had with people who are interested in this space who are thinking about this space have been incredibly valuable.

    So, if—you know, if you feel like some of what we discussed here is you and your challenges, we’d love to hear from you. And also, we are hiring—wink, wink. So, you know. [Laughter]

    Shimel: Everyone’s hiring.

    Kawaguchi: Yeah, so if you—

    Shimel: Alright. Is it on the website?

    Kawaguchi: It is. You know, one thing I got a lot more passionate at, you know, CloudBees and Jenkins is sort of passing back onto the next people, right? I felt like I got a lot more joy out of talking to the junior engineers and folks, we steer and mentor them. So, I feel like what we can offer—and I know it’s true with Harpreet, too, so I feel like what we have right here is an incredible opportunity to work, you know, sit side by side with these people, you know, people like us who, I think ____ creativity. We’re also passionate about mentoring other people. So, you know, I think if it sounds like your cup of tea, then…

    Singh: I’ll jump on that. So, I think, CloudBees was a fantastic company. You know Sacha, Alan—he’s just a great leader. He built a fantastic company. So, we learned a lot of good lessons on what it means to be a good company.

    Then I ended up at Atlassian where, you know, I learned the same things from Scott Farquhar and the other folks, and we’ve tried to bring in all the great points from these two companies into this company, right? We are sort of values driven. We’ve really thought hard about the kind of company we want to build, the kind of impact we want to have in the world, and we are looking for people who share that sense of mission, right, to come on our team, right? And if you find some of those guys on our team, that’s fantastic.

    On the former side of the house, again, we are looking to solve problems for customers. We are not looking to do this in a vacuum. So, there’s a general profile of people who are like, “Yeah, I hear this. I wish I could partner with someone and help you define what—go solve this problem for me.” If you’re that person, we would love to talk to you and we’d love to partner with you through those things.

    Shimel: Fantastic. Guys, we’re way over time. I promised you 15 minutes. We might be coming up on a half hour; I apologize.

    But let me close off by saying—you know what? Congratulations. Someone once told me new companies are like boats—the best days are the first day you get ‘em and the day you sell ‘em. [Laughter] But that being said, it’s also a lot of fun sailing ‘em. So, enjoy the sail, guys—change the world. If there’s anything, of course, we can do here at MediaOps, you know you can count on it. I couldn’t think of two nicer people for this new adventure and to take on this challenge.

    Harpreet Singh, K.K.—co-founders, co-CEO of Launchable, you can find out more at Launchable Inc. This is Alan Shimel for devopsy.kinsta.cloud. You’ve just listened to another DevOps Chat.

    — Alan Shimel

  • DevOps Chats: Simplifying Digital Adoption, With WalkMe

    DevOps Chats: Simplifying Digital Adoption, With WalkMe

    WalkMe recently announced a funding round of $90 million, bringing its total raised to over $300 million. But according to President and Co-founder of WalkMe Raphael Sweary, the real measure of WalkMe’s success is its annual recurring revenue being more than $100 million (which it is) and whether the company is helping its customers.

    WalkMe’s customers are comprised of businesses undergoing digital transformations and looking to accelerate their digital platform adoption.

    In this DevOps Chat, Raphael and I discuss WalkMe’s plans for its latest funding, including plans for its SaaS-based digital platform. As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud and you’re listening to another DevOps Chat. You know what, we’re recording this—oh, December 23rd, here, getting near the end of the year. This is probably the last DevOps Chat of the year. So, what a great way to end our year of fantastic DevOps Chat with Rafael Sweary, president and co-founder of WalkMe. Rafael, welcome to DevOps Chats.

    Rafael Sweary: Thank you, Alan. I’m super excited being here. It’s one of the last days of selling in Q4, and you know how it is when you’re a B2B business. It’s a big quarter for us, so I’m actually feeling privileged that I can spend some time with you.

    Shimel: I appreciate you taking it, I know how crazy it is. You know, Rafael, just on the subject, that’s something I’ve noticed the last two, three years. Years and years ago, kinda the consensus was that especially here in the U.S., after Thanksgiving, things kind of shut down, people got in that holiday mode and business slowed up. But I don’t know whether it’s because we live in a more global economy now or just, things are that different. The last couple years, the last couple weeks of the year have been absolutely frenetic with people doing things and deals coming in and sales being done, right up to the last second, it seems.

    Sweary: Yeah. So, I’ve never felt the Thanksgiving effect. For us, it’s always, the last quarter of the year was strong. I think it’s because of budgets that companies have and they want to use it. And sometimes people have something on their desk that they want to come to closure with by the end of the year. So, next year, they can start building and start implementing the new software that they bought. So, I’ve never felt it, but I’ve definitely heard people talking about this phenomenon.

    Shimel: Yeah.

    Sweary: So, it might be, as you say, the globalization and everybody’s connected all the time. And so, we’re kind of hooked. We’re kind of—

    Shimel: Yeah. I agree, I agree. But Rafael, the big news is—well, the big news for WalkMe is, you guys have recently announced, what was it, a $90 million round?

    Sweary: Yeah, it’s a $90 million round. It brings the total that we raised to $307 million.

    Shimel: Wow.

    Sweary: We went into this funding, this funding we didn’t really thought about raising money, and we started entertaining with the idea—because we were very, very well-funded before and we’re selling a lot, so we are, we didn’t really, we’re not a startup that is in a dire need of cash. We weren’t in such a situation. We were very lucky there. And we were planning—we’re planning, we had, our hope is to go cash flow positive and start thinking about going public, et cetera.

    Now, what is happening is that, on one hand, we saw a huge opportunity to grow much faster than what we planned, because things were going really, really well with our larger accounts. And, on the other hand, there is a lot of uncertainty crippling into the market. So, you see some instability in the financial markets. Overall, it’s not—it’s not sustainable, but you keep seeing people are, you start seeing those articles about being, writing about the evaluations being too high, et cetera.

    And the second thing, you’re going into an election year. Now, uncertainty is not good for business, and those two things brought us into the option of possibly raising capital. We didn’t plan to raise so much money, but when you are dealing in such evaluations and when you’re raising money from later stage funds, they have a minimum that, below that minimum, they’re not interested in the deal, even if the deal is great. Just because they can’t, from a portfolio management, they gotta deploy a lot of money to every company. The minimum for Vitruvian, which is the fund we selected to work with, was 70 million, and then, you know, we have preempt rights, which was exercised by our existing investors, which made the round into 90 million.

    Shimel: Right. That’s crazy. So, you know, Rafael, as we were talking off mic, you know, we live in a bit of a crazy time—I don’t know if it’s crazy or if it’s just the new normal—but we live in a time where large numbers like this are not as unusual as it was when I was doing startups, you know, even 10, 20 years ago. And so, first of all, congratulations, alright, because I don’t care what anyone says. It’s hard raising money and it’s hard raising that kind of money, so obviously, you’re doing good stuff there.

    But I think the question for our audience is—okay, so now, we have another well financed startup here, raised 307 million, unicorn valuations. But what does it mean to them? How is this gonna change and affect their life, right? When we look at WalkMe, right, the digital adoption technology to help bridge the digital skills divide—

    Sweary: Yeah.

    Shimel: How are you helping people with that?

    Sweary: So, I want to first start with the unicorn. It’s a nickname I don’t like, I gotta say.

    Shimel: Fair enough.

    Sweary: And it’s overly inflated. So, when I get up in the morning, I’m not worried whether we’re a unicorn or not, right? [Laughter] What I’m concerned about is our stakeholders. Our stakeholders is our, first of all, our employees and our customers are in the number one place. And I wanna make sure that we’re providing a business for them and we’re working in such an environment where we make everything better for everyone, okay? So, this is my concern. My concern is not whether we’re a unicorn or not.

    By the way, speaking about that, I think that TechCrunch, I think it was TechCrunch, suggested to stop looking at whether you’re a unicorn or not, but over you over 100 million in ARR or not?

    Shimel: Right.

    Sweary: I’m glad to say that we are—

    Shimel: Good for you.

    Sweary: Well over 100 million in ARR. So, it’s not—now, let’s talk about, a little bit about digital adoption. So, for us as users, there is a lot of technology available, and we can use technology everywhere. The problem is that the technology is changing very, very fast, and for us as humans, we don’t change that fast. The common saying is that when practice makes perfect—but actually, practice makes a habit, and changing a habit is something that is very hard to do. You’re accustomed to do something in one way and to change how you adapt to these changes is something that takes very long.

    So, I don’t know if you ever moved from a Windows to a Mac machine or from—

    Shimel: Oh, I have. [Laughter]

    Sweary: You’ve been?

    Shimel: Oh, yeah.

    Sweary: So, you know that the first few days were painful, right?

    Shimel: Mm-hmm.

    Sweary: They were painful. They weren’t fun.

    Shimel: I know.

    Sweary: Right? It takes some time until you—so, Mac, I don’t know what the move you’ve done, but Mac might be much better than what you had before or Windows much better than what you had before. But when you make the change, those first few days, weeks are very tiring, you gotta focus very hard.

    Now, but this is a change you wanted to do. Nobody forced you to do this change, you wanted to do it. Now, when you go into an enterprise environment, what is happening is that you’re forced to make—you are forced by the company to make many, many changes to the way you work. Because the company implements a new software, because the company is, has a new process on an existing software, et cetera, et cetera.

    And what happens is that you find yourself overwhelmed with all those changes. You go to do your performance appraisal and the process changed or the application changed, and you find yourself learning it again and again and again.

    Now, this is where WalkMe comes in. WalkMe reverses the relationship between the user and technology. If today when a user uses technology, he has to focus and he has to think and understand what he needs to do in the software—we do the opposite. The software tries to understand the user and help him achieve what he came to do.

    Now, usually what he came to do is to do something specific. So, this is how we help on the user level. But the way we—so, when you are in a company and you’re an employee of a company, today you have many software packages and it’s very hard to track them and we help you to do that. But also important is what we do for the company itself.

    So, the general idea when you implement new software is to improve your business. Usually, companies don’t buy products for spite. Like, I might buy a jacket because I feel like it. But no company buys anything because they feel like it. They buy in order to do something.

    Now, usually the things that they’re looking to do is to sell more or to spend less or to reduce risk. Like, any expense that a business will do will fall into one, at least one of those buckets. Now, what companies buy most is technology. It’s the biggest expense after human resources. So, companies invest massive amounts of money in technology, but a lot of the times, they’re not gaining the benefits.

    So, let me dive a bit deeper, there. When a company buys or implements a CRM, what is their goal? Is their goal to replace the Excel file or the notebook that the salesperson was using? No. That’s not their goal.

    Shimel: [Laughter]

    Sweary: Their goal is to cell better, right?

    Shimel: Yeah.

    Sweary: Their idea is that if the salesperson will use the CRM correctly, they will be able to use AI to recommend which pipeline to focus on, on one hand. On the other hand, they would have better predictability so they can report to the market, and also the HR team will be able to look at it and understand if they need more employees or less, and the purchasing department will understand what supplies they need. So, the hope is that, with putting digital, the company will operate better.

    Now, what happens? What happens is that the salesperson, when he comes to the CRM, it’s not helping him. He’s struggling. And what happens is that he’s forced to use the CRM. So, what he does is documenting in the CRM. He actually continues to work on his Excel file, and he works on his notebook, okay? So, you’re not gaining all those benefits because it’s not predictable, it’s done retroactively, okay? It happened—once the action happened, okay, it’s a lagging indicator.

    And a lot of companies, a lot of time I talked to them and they say, “I have a great usage for my CRM.” And I said, “Look, if you wanna know if you have adoption for your CRM, go to a salesperson and ask him what he’s gonna close this quarter. If he opens the CRM, you have adoption. If he’s going into his notebook or his Excel file, he’s documenting, and you’re not gaining all the benefits.” And then it’s very easy to see that a lot of, for example, the pipe moves from stage two to stage eight, right? Because you’re not really keeping current.

    This is, of course, one example. The same thing is true about any type of professional applications that companies use, and even more on everything that is a digital workforce application. If it’s interesting, I can give you some more examples of what we see at our customers.

    Shimel: Agreed, agreed. You know, I’m sitting here listening to you talk, Rafael, and you know, you can’t help but put your own, how it fits in your—we went through this right here at MediaOps, right? We have a CRM tool, and I’m trying to break the people of using whiteboards and spreadsheets, you know? [Laughter].

    Sweary: Mm-hmm.

    Shimel: It’s just as you describe, right? All the reasons, all the motivations. But it’s also a process.

    Sweary: Yeah. How do you handle this process?

    Shimel: So, I’ve gotten older. I think I’ve become a better parent and a better supervisor. I used to try to force people and say, “You can’t use the spreadsheet, wipe the whiteboard, I want it all in the”—in our case, it’s HubSpot—“I want it all in HubSpot.”

    Sweary: Yeah.

    Shimel: And what I found is, you know, they would pay lip service to me and they would just move the wipe board out of the way or they’d have a spreadsheet that they didn’t show me, and then it would be like double work, Rafael. So, they would do it in a spreadsheet and then, to make me happy, they would kinda transfer that stuff into the CRM [Cross talk].

    Sweary: Right.

    Shimel: But a funny thing happened—as they transferred more and more into the CRM, the CRM became more and more valuable, right? So, you wanted, having things in there that you couldn’t put in there, just as you’re talking about.

    Sweary: Yeah.

    Shimel: You couldn’t put these things in a spreadsheet any more, right? Because there was more intelligence, if you will, built in there. And so, eventually, we started using it more. But—

    Sweary: Yeah. Now, think about this, about, with an enterprise that is global and has multi-branches and has a diverse workforce with different digital IQ. And no parents is there to tell them, “Put it into the Excel sheets and then—uh, put it into the CRM,” and then you start understanding the problem. Now, I assume that your CRM was stabilized.

    What is happening a lot of the times, it’s not stabilized, it keeps on changing because companies have new processes and then the process changes. So, for example, you keep learning from your business and you’re like, “Well, if it’s 30% discount, you need this approval process versus 15.” And now you add another complexity, and the salesperson is not able to work, right?

    So—and I think there is a solution. There is a solution. I think that what is stopping us from using technology to its fullest is the gap that happens between what the technology can do, what we can do as users, and how much, how long does it take until it gets better, right? So, anyone who’s ever used the GPS would never wanna go back to a map, right?

    Shimel: Right.

    Sweary: As soon as you experience it, it’s much better than anything you did in the past, do you agree?

    Shimel: I agree.

    Sweary: So, you don’t need to work—yeah.

    Shimel: I agree, I agree.

    Sweary: You don’t need to work—exactly. You don’t need to work on adoption. But when you’re talking about an enterprise application, there is a very big gap between the perceived value to the organization, and until you see the value and until it trickles down to the employees.

    So, let me take you through another example. So, a lot of companies are implementing HRMs, and they idea behind the HRMs is that the employee can self-task, right? You want vacation, you can take vacation. Now, in the past, let’s assume, let’s go back 20 years ago. An employee wanted vacation, he would fill out a form, it would go to his manager. His manager will scribble something, put it in his outbox, it will go into the HR department and then into the finance department and then back to the manager and then back to the employee.

    Now, all those people worked on something that didn’t add any value to the company. It’s just an employee taking vacation. So, the company has this great idea—we’ll put a ____ and when an employee wants to take vacation, he would see whether he has a balance or not. Once he asks for the vacation, if there is an issue and other people in his positions are already on vacation, he’s gonna get an alert, and if he doesn’t have the balance, he will get an alert, et cetera, et cetera. And you say, “Let’s automate this process.”

    Now, it comes down to the employee. The employee wants vacation. He doesn’t care about the process and how much time is spent, he wants vacation. He comes into this software, he doesn’t remember the log-in, because the last time he took vacation was a few months ago. And he goes in and he’s not sure how to ask for vacation and he gets stuck a few times and what does he do? He sends an e-mail to his boss. What does his boss do? Sends an e-mail to HR, that sends an e-mail to finance, that sends—and then you’re not gaining the benefits, right? Because you don’t see the value.

    Now, for the company, it’s super important that people use this application, because it makes sure that all the vacation days are deducted on time, and it really closes the loop, and less people are working on it. But you’re not gaining the benefits. Make sense?

    Shimel: Yeah, makes perfect sense to me.

    Sweary: Mm-hmm.

    Shimel: Perfect sense. Rafael, I wanna take a moment, because we’re running low on time—you know, we spoke about how much money and all of that and it’s all great. I wanted to give people a sense, though, of how many organizations you’re helping with WalkMe, right? And the amount, and how many applications you guys have done integrations.

    Sweary: Okay. So, customers, we have close to 2,000 customer logos, which means that when I say a logo, if—let’s say a company of ours, let’s say just as an example, Coca-Cola. So, we have, let’s say, Coca-Cola Greece and Coca-Cola U.S., it would be one logo, although there are two separate companies and that might be completely unrelated. So, we look at the logo level, and we have close to 2,000, including 30 percent of the Fortune 500.

    Regarding applications, WalkMe is platform agnostic. We really don’t care what application you use WalkMe on. We have some enhancements that are specific for the big and popular applications such as Salesforce, Dynamics, Workday, SuccessFactors, and those enhancements—again, they’re not about integration, it’s about, we already have a lot of data about what’s working in those systems and what is not, because we did hundreds of deployments over them. So, there is a lot of things you learn between customers.

    When we come to a new Workday implementation today, because we did a few hundred of them, we already know what the employees are gonna struggle with. We already know what the managers are gonna struggle with, and we built it into our system so it’s easier for our customers to create content, specific content. Make sense?

    Shimel: Mm-hmm. Got it—got it, got it, got it. Excellent. Rafael, I feel like you and I could talk about this stuff all day and lessons for people out there to learn to hopefully make their businesses better, but we’re out of time. I try to keep these, as I mentioned to you, to 15, 20 minutes. We might have gone over.

    Sweary: Sure.

    Shimel: But first of all—hey, congratulations on all of the success with WalkMe. And more than just the raising money—2,000 organizations using your product and really making a difference in trying to bridge the digital skills gap. It’s a great, great thing you’re doing, and keep it up. Secondly—love to have you back on again soon, maybe in the new year, and we’ll keep—

    Sweary: Sure. I would love to join and talk to you a little bit about what we do specifically for companies, how we help, and try to give some tips to some organizations that we see and what we learn from there, because we’re always humbled by what we learn from our customers. And it’s some of the best businesses in the world, and it’s really fascinating to see, when technology works, the competitive advantages that you’re able to gain.

    Shimel: Yeah. Agreed. You know what? You’ve got an open invitation, my friend, so when you’re ready, you’ll reach out to me and we’ll continue this.

    Sweary: Awesome. I hope Marissa hears that as well. So, Alan, thank you so much.

    Shimel: Thank you.

    Sweary: And I look forward to talking to you again.

    Shimel: Okay. Rafael Sweary, president and co-founder of WalkMe. This is Alan Shimel for devopsy.kinsta.cloud, and you’ve just listened to another DevOps Chat. Have a happy new year, a happy season’s greetings, merry Christmas, holidays, Hanukkah—whatever you’re celebrating, enjoy, folks.

    — Alan Shimel