devopsy.kinsta.cloud

Tag: cloud management

HashiCorp Updates Terraform; Wider Cloud Infrastructure Developer Toolsets
As HashiCorp quietly slips into its new existence under the parent umbrella of IBM after this year’s $6.4 billion acquisition, the company held (one last?) HashiConf in Boston this week to set out its stall. That market stall is of course one populated by infrastructure lifecycle management and security lifecycle management products for hybrid multi-cloud environments.

Key among the announcements made by the company right now are updates to its Terraform Infrastructure-as-Code (IaC) cloud provisioning technology and its HCP Waypoint tool, which is designed to create internal developer platforms with templates and add-ons to manage application dependencies.

HashiCorp says that Terraform’s capabilities for infrastructure provisioning enable cloud-native developer teams to take a cloud-agnostic highly interoperable approach to multi-cloud management. It operates with a single workflow (i.e. a singular software code process within which all planning, testing, deployment and monitoring can happen) so that lifecycle management can be promoted as an essential function.

Terraform Stacks

Given the wider trend for compartmentalized containerized abstracted pre-configured convenience across all software application development toolsets and platforms, it is perhaps not a surprise to see HashiCorp put as much automation convenience as possible into Terraform. This now comes in the form of Terraform stacks.

Terraform stacks is a configuration layer update intended to simplify cloud provisioning and cloud resource management at scale by controlling “cross-configuration dependencies” between Terraform modules. Given that software application dependencies are fundamental, cross-configuration dependencies at the infrastructure provisioning level can also include configuration item hierarchies, where dependencies are an association between two configuration elements that would be rendered to an invalid state if both were not present and working correctly.

Stacks is essentially a way of grouping different Terraform cloud infrastructure modules (we could also call them components) together in order to centralize maintenance and interdependency tasks. While this function has been around in private beta for a while, HashiCorp is now moving this technology to public beta. Terraform stacks are controlled from a Terraform configuration (aka Terraform-config), which the company describes as a complete document in the Terraform language that tells Terraform how to manage a given collection of infrastructure. A configuration can consist of multiple files and directories.

Multiple Infrastructures, Multiple Environments

“With Terraform Stacks, we’re reimagining infrastructure as code, making it easier to build and deploy the same infrastructure multiple times, across multiple environments, regions, landing zones, or accounts within a cloud provider,” said Armon Dadgar, CTO and Co-Founder, HashiCorp. “With new features across Vault and Boundary, we’re bringing important management capabilities to our security portfolio, including auto-rotation, dynamic secrets and secret scanning to provide full lifecycle management for security.”

Also central to the product announcements brought forward right now is HashiCorp Cloud Platform (HCP) Waypoint. This is an internal developer portal with templates to codify golden patterns (proven, reusable and validated software patterns for infrastructure and security automation workflows) for day zero provisioning, add-ons for day one (24 hours after deployment to live production status) and updates to manage Day N (the decommissioning point at which any software system reaches end-of-life) operations.

Other updates include:
- HCP Vault Secrets adds new lifecycle management features, including auto-rotation (generally available), dynamic secrets (public beta), and dynamic cloud credentials for HCP Terraform (public beta) to support secrets lifecycle management for enterprises.
- Terraform migrate (public beta) automates the migration of common DIY workflows from Terraform Community Edition to HCP Terraform or Terraform Enterprise.
- Nomad GPU enhancements in 1.9 (generally available) adds advanced GPU scheduling to support demanding AI workloads. This includes support for multi-tenant workloads sharing GPUs to maximize utilization and resource quotas to efficiently broker access to shared resources.
Cloud Management, Management

What’s happening here is logical, inevitable, redolent of wider automation trends and (arguably) quite welcome. As cloud lifecycle management technologies now evolve at the infrastructure-first level, the gloomy specter of spiralling hyperscaler costs will naturally make firms more interested in operational streamlining technologies of this kind.

With distributed diverse divergent application types also coming to the fore (edge computing is getting so much smarter as we know – and that’s not the only zone where compute and analytics are in a vortex), organizations will want lifecycle management tools that enable them to be compliant with governance legislature and, in many cases, just to keep their heads above water.

It is, in other words, cloud management management.

Whether HashiCorp remains as independently branded and operated as Red Hat under IBM is more open to question. Only Big Blue knows.
October 18, 2024
A Manifesto for a More Sustainable Cloud Future

I’ve talked about cloud sustainability extensively in these pages previously, but until we start taking tangible steps to collectively reduce our cloud carbon footprint, things are not going to change. Achieving real change comes down to a smarter, more efficient use of resources and establishing a culture of sobriety—both financial and environmental—that flows through an organization. Below, I present the steps necessary for a more sustainable cloud future.

1. Shift the Mindset

First, and arguably most important, there needs to be a shift in mindset that sees IT managers, CIOs and other IT leaders become part of a much broader conversation about how to bake sustainability into the overall IT strategy from the start. In doing so, this offers a path to bring development, finance, ESR and business teams together to ensure greater financial and environmental accountability.

2. Right-Size to Optimize

Regular sustainability assessments can help to identify oversized resources and underused services, which paves the way for smarter allocation. Eliminating unnecessary services and right-sizing instances will help to identify recurring problem areas and serve to reduce carbon emissions. This will create a best practice of optimal resource usage and, consequently, contribute to ongoing savings made to an organization’s bottom line.

3. Embrace Dynamic Scaling

Most cloud providers now offer dynamic scaling capabilities that allow resources to be adjusted according to demand. By embracing these sorts of features, organizations can ensure that resources are used more efficiently while minimizing emissions. This sort of real-time optimization can strike an important balance between performance and environmental responsibility.

4. Fewer Servers Means Less Power Needed

Server virtualization—essentially the process of dividing a physical server into multiple unique virtual servers—offers a clear way of contributing to carbon reduction efforts. By optimizing resources and reducing the physical server count, the consumption of energy can be minimized. Fewer servers mean less power consumption, which directly translates into lower carbon emissions.

5. Only Energy-Efficient Architecture

Platforms such as serverless computing architectures have emerged as a greener alternative to traditional infrastructure, allocating resources only when needed. This creates greater energy efficiency and reduces total carbon emissions. Leveraging these sorts of energy-efficient instance types and hardware, such as ARM-based processors that consume less power than x86-based alternatives, provides a clear way to minimize power consumption and environmental impact.

6. Localization Matters

While the steps above are effective, their impact will be amplified by choosing cloud regions that are based on low-carbon energy sources. For example, regions that are reliant on coal or other high-carbon energy sources should be avoided or used sparingly to minimize environmental impact, but this is not as straightforward as it sounds due to seasonal variations, which might mean that renewable energy sources are subject to fluctuations; the costs associated with storing excess energy from intermittent sources which are both challenging and expensive and the cost of energy trading between regions which can impact carbon footprint.

The truth is that there is no one-size-fits-all solution when it comes to evaluating localization. Assess the energy mix, consider the availability and reliability of renewable energy sources and factor in any seasonal variations or dependencies on fossil fuel-based backup systems. This way, you can make a more informed decision that aligns with your sustainability goals and minimizes the environmental impact of your cloud infrastructure.

7. Align FinOps and GreenOps Strategies

Closely linked to more established terms like FinOps—another framework for managing operational expenditure across an organization, often in conjunction with the cloud and cloud computing—GreenOps is an emerging term that essentially means providing greater cost transparency while promoting a culture of environmental responsibility. The challenge is that making an entire IT ecosystem sustainable requires a step back and all areas of IT to consider their impact on the environment.

This requires collaboration right the way across an organization and with other lines of business which includes areas like HR, marketing, procurement and the accounting departments, all of whom must set business requirements, determine software development and DevOps processes, and adhere to operational principles. Aligning GreenOps and FinOps strategies will allow organizations to start monitoring cloud computing emissions by connecting emissions data directly to their cloud expenses so they can see both the costs to budget and the cost to the environment in the same place.

8. Remember to Turn Off the Tap

Finally, think of efficiency as being the cornerstone of any sustainable initiative, and cloud computing is no different. Optimize cloud instances and you will, in turn, reduce carbon emissions. By evaluating running service instances continuously and strategically and turning off those that are not needed during periods of low demand, organizations can significantly cut down on unnecessary energy consumption. This will not only reduce carbon footprint but also optimize operational costs.

By addressing these complexities head-on, I believe we, collectively, as an industry, have a once-in-a-lifetime opportunity to reduce our carbon footprint and pave the way for a greener, more efficient cloud computing landscape.

October 27, 2023
How to Keep Your IT Infrastructure Invisible

IT infrastructure is critical. IT infrastructure enables businesses to run—from day-to-day operational execution to visionary strategic innovation and everything in between. What’s interesting, though, is that people are only aware of it when there’s a problem: HR can’t access the payroll application, customers are complaining about how slow the transactional system is or this month’s cloud bill was double what you expected it to be.

No one should notice a well-orchestrated environment, but once application performance slows or an outage occurs, people start to grumble. The same is true for IT infrastructure.

The Top Four Ways Your IT Infrastructure Can Become Undesirably Visible

Given the complexity of modern hybrid/multi-cloud environments and the applications they support, it’s no surprise that countless things can go wrong—and when they do, your IT team takes the flack.

If your infrastructure is humming along nicely, that’s a testament to the IT infrastructure team’s hard work and expertise. Sadly, they don’t get the recognition because it’s all invisible to the rest of the organization. It’s only when *BAM!* something happens that the team is scrutinized.

While there are many ways this can manifest, it usually falls under one of the following four categories:

• Availability — This may be the most catastrophic because when systems are unavailable, people can’t do whatever it is they need to do.
• Performance — A system might be available, but that doesn’t mean it’s performing to SLA or user expectations. The result can range from minor annoyance to lost revenue and customer churn.
• Cost — Runaway expenditures don’t necessarily affect users, but you do not want to be called to account by the finance team or, worse, executive leadership.
• Compliance — This is another area that may not have a broad impact on user experience, but the repercussions of non-compliance can be financially and reputationally significant.

Common Infrastructure Culprits and How to Address Them

To ensure the necessary availability, performance, cost control and compliance to keep your IT infrastructure under the radar, you must understand what can cause problems in these areas. Here are eight common culprits, along with ways you can address them, so your IT team stays invisible.

Broken or Misunderstood Dependencies
Your infrastructure is a complex web of interdependent applications and services. Every time you make a change, it could have a rippling effect on the categories mentioned above. Automated discovery and service mapping capabilities enable you to easily trace dependencies throughout your infrastructure to avoid unintended consequences.

Cloud Waste
Chances are very high that you’ve got cloud waste. This means that you could be getting billed for a storage block that’s attached to a stopped instance, for compute instances that are not being used, or for unattached load balancers. Finding idle and abandoned resources can keep your monthly cloud bill under control and on budget.

Un-Breakdownable Cloud Costs
Cloud bills are notoriously complex, and while cloud providers do offer tools to help you analyze your cloud spend, those tools often don’t answer all the questions your business might have. In addition to adding clarity to such opaque expenses, you need to be able to parse your cloud spend based on what makes business sense to your organization, not what makes technical sense to your cloud provider.

Poor Capacity Planning
Your infrastructure needs to meet your business needs, which are continuously evolving. As changes happen, whether it’s increased utilization of existing resources or modified/added resources to support new requirements, workloads could push current capacity and impact performance and stability. You need to be able to forecast infrastructure demands against business objectives to minimize potential issues before they happen.

Poor Workload Placement Decisions
Your infrastructure consists of various environments each with its own characteristics. If you migrate a workload without understanding the implications of that particular environment, you could risk performance problems or spiking costs. To prevent this, you need any-to-any migration insights to make better decisions about workload priorities, groups and deployments.

Poor Reservation Planning
Reservations (i.e., reserved instances or programmatic discounts) offer discounts for committing to a particular plan. If you plan well, the savings can be significant. But if you don’t use the capacity you’ve bought, the savings might not materialize. To improve cloud resource planning, you need to be able to evaluate your potential savings in varied scenarios.

Workload Drift
Over time, your workloads evolve due to changing demand, data volumes, etc. As a result, they can outgrow their current configurations, leading to performance issues or rising costs. This is a natural result of business growth, so the goal isn’t to prevent that drift. Instead, you want to optimize capacity and cost on an ongoing basis to keep your workloads right-sized.

Slow Problem Troubleshooting and Remediation
No matter how many precautions you take, something somewhere will inevitably go wrong. And once you become aware of the situation, the clock starts ticking to find the cause and fix it, all of which takes time. The longer the entire process takes, the longer your infrastructure will be visibly and painfully not working as expected. For those cases, you need full-stack visibility with application-centric, AI-based analytics to minimize impact duration as much as possible.

Keeping the engine running behind the curtain can be a daunting task, but with proper planning and management, your IT team will remain visible to those responsible for managing it and invisible to those in the rest of the organization. Of course, the complexity of today’s cloud infrastructure makes that challenging, and there will be IT fire drills that take place, but it’s about how IT leaders react to the situation and resolve it in the quickest way possible, allowing themselves to return to their preferred place in the shadows.

July 7, 2023
Quali Adds Governance and Cloud Cost Control Tools to Automation Platform

Quali today revealed it added governance and cloud cost management tools to its Torque platform for automating IT infrastructure management.

David Williams, senior vice president for market strategy at Quali, said the added governance tools will make it possible to enforce security, compliance and consumption policies as IT environments are launched using the automation blueprints that Torque enables IT teams to create.

At the same time, IT teams can now also define consumption policies based on cloud runtime or regions employed within a cloud computing environment. In addition to taking advantage of dashboards to visualize consumption of cloud resources, IT teams can also use Torque to identify cloud waste including detached, inactive and overprovisioned instances. They can pause, right-size or tear down environments to reduce costs and eliminate the possibility of a billing surprise at the end of the month, noted Williams.

Torque also enables IT teams to detect drift and then update live cloud environments to remediate any that fall out of scope, he added.

Quali has been making a case for an environment-as-a-service approach to managing IT. That approach is based on a set of triggers for controlling infrastructure via a software-as-a-service (SaaS) platform that can be invoked either via an application programming interface (API) or a graphical user interface (GUI).

In addition to providing a set of infrastructure provisioning guardrails that prevent mistakes from being made, Torque makes it possible to automatically deploy complete application environments on top of infrastructure provisioned as code using blueprints rather than relying on low-level Terraform scripts. The goal is to increase developer productivity by enabling IT teams to create self-service portals that developers can use to spin up environments.

That approach is becoming more appealing as many organizations begin to adopt platform engineering as a method to centralize the management of DevOps workflows, noted Williams. In fact, as part of that effort, many organizations are starting to unify the management of cloud and on-premises IT environments, he added.

While many developers routinely provision IT infrastructure using tools such as Terraform, many of them lack the cybersecurity expertise required to ensure cloud computing environments are configured properly. Developers also tend not to remember to de-provision cloud resources when no longer needed; over time, those factors contribute to unnecessarily increased cloud costs.

Ultimately, the goal is to find ways to centrally manage IT environments to reduce costs and improve cybersecurity without inhibiting the pace at which developers are building innovative applications, said Williams.

At the same time, as application environments become more complex, it is becoming even more challenging to provision and manage IT environments at a time when many organizations are reluctant to hire additional IT staff, he noted.

One way or another, IT environments will become more automated. The issue is determining how best to organize the IT teams managing those environments as tasks that once required a lot of manual effort are increasingly automated.

June 20, 2023
FinOps Foundation’s FOCUS Aims to Standardize Cloud Billing

Cloud spending is on the rise. As organizations shift more applications to the cloud, there is a growing need to optimize workloads and reduce spending when possible. But a lack of visibility into complex cloud bills often impedes these goals. This is compounded by a lack of data standardization across the multi-cloud landscape, with cloud vendors producing lengthy billing reports in various formats. With things so decentralized, FinOps practitioners often struggle to make sense of it all.

FinOps Open Cost & Usage Specification (FOCUS) is set to change this status quo. FOCUS, an initiative sponsored by the FinOps Foundation, a Linux Foundation technical project, aims to create a standard, vendor-neutral specification for cloud cost, usage and billing data. A common schema for cloud billing should help unify cost data across cloud vendors and greatly aid FinOps objectives in areas like allocation, chargeback, budgeting and forecasting.

I recently met with Udam Dewaraja, FOCUS lead at FinOps Foundation, to understand the context that led to creating the specification. Below, we’ll dive a little deeper into FOCUS, examining the details of the proposed specification and considering what benefits it will bring to cloud consumers and cloud service providers (CSPs).

Why the Cloud Needs a Common Billing Schema

The complexities of today’s cloud services can often create headaches around cloud billing. For instance, AWS alone has hundreds of services and potentially thousands of SKUs. Cloud service providers each have their own data formats and terminologies, which are reflected differently in detailed bills. And with the granularity of cloud metering, enterprises could be staring at hundreds of millions of rows of cost data. Now, extrapolate that across multiple cloud service providers, SaaS and APIs, and you can see the dilemma that the modern CFO faces.

“There are many nuances that FinOps practitioners need to understand,” said Dewaraja. “And a lack of a common definition can be a scalability challenge as you add more things.”

It’s relatively easy to spend money on more and more cloud-based consumption models. As Dewaraja said, “Everyone has the company credit card.” Of course, you can use tools like AWS Cost Explorer, Cloudability or Datadog to garner some insights to reduce spending. But to really get the fuller picture, you need to rationalize cost metrics across many areas. Plus, in 2023, The State of FinOps report found the widest variety of cloud cost management tools in use in the history of the report, indicating tooling sprawl.

Overview of FinOps Foundation

First, for those unfamiliar, the FinOps Foundation is a Linux Foundation-supported group that aims to help practitioners understand the discipline of FinOps. Representing a community of over ten thousand FinOps practitioners, the FinOps Foundation routinely shares best practices and oversees a FinOps framework. “FinOps is more of a cultural practice that should be adopted,” explained Dewaraja. As such, the initiative aims to oversee training, meetups and events and encourage executive buy-in around the FinOps concept.

Understanding the FOCUS Specification

So, what exactly does FOCUS entail? Well, FOCUS is an open source royalty-free specification for cloud billing data. It will provide standard dimensions, attributes, and terminologies for cloud billing data sets. To formalize the specification, the project contributors are actively considering the essential FinOps capabilities and what requirements these cloud bill data sets have in common.

The specification itself has yet to be officially released and is still being formalized at the time of writing. Microsoft and Google have joined the initiative, as well as numerous cloud finance and cost analysis vendors. And while the group waits for additional CSPs to join, the community is building out open source validators and converters, said Dewaraja.

Benefits of a Standard Cloud Billing Spec

Cost management solutions are already available, but what’s not readily available is a method to make business decisions based on broader richer datasets, explained Dewaraja. This is where standardized cloud billing can greatly aid efforts by creating a more holistic picture.

Specifically, this can aid objectives like allocation, chargeback, budgeting, and forecasting. Doing so is often an incremental process, explained Dewaraja—as you gather insights into data, you iteratively use this visibility to make improvements over time.

Some other benefits of adopting FOCUS will likely be:

Putting finance in engineering terms. In the cloud, finance is quite dynamic. And interestingly, the FinOps discipline is becoming engineering’s responsibility as part of the shift left approach, said Dewaraja. Engineers now need to understand this problem and how to architect their solutions cost-effectively. As such, bringing specifications into the mix will help put financial responsibility squarely on the shoulders of engineering terms.

Bringing accountability to cloud consumption. A standard specification should empower essential FinOps capabilities that rely on usage segmentation like internal cost reporting, showback and chargeback. Because if invoices are just one big pie, there is no accountability for individual departments, and you can’t drive the behaviors you need, said Dewaraja.

Win-win for practitioners and cloud vendors. With FOCUS, cloud providers will drive more trust in cost data, providing more visibility. And corporations using the cloud can make their adoption more efficient, likely influencing them to bring on more workloads. “Driving trust and understanding of this cloud data is mutually beneficial,” Dewaraja said.

FOCUS Set to Improve FinOps

Dewaraja, who previously spearheaded FinOps practices at Citigroup, knows all too well the strains of managing disparate cloud billing data. He oversaw a broad, dynamic cloud-native platform of distributed cloud and SaaS and sought to embrace platform engineering principles. In this environment, you need a holistic cost picture that associates various expenses to make the right calls, he said. “You really see success if you can plug this into the workflows of those developers and into business processes themselves,” he said.

Theoretically, FOCUS could deliver on these goals. But although the project is gathering momentum, it’s still in an early stage. For the standard to gain a foothold, it will require greater awareness and more contribution from other CSPs. The specification is community-driven but is being led from the practitioner down, adopting corporate contribution licenses instead of individual developer contributions. Thus, cloud vendors and cost management vendors will likely lead the initial charge.

FOCUS looks great in the long run but will require a little bit of work upfront to get folks on board. That said, it should be on the radar for 2024 roadmaps, said Dewaraja. To learn more about FOCUS and how to contribute, software providers should check out the FinOps Foundation materials.

May 25, 2023
Cloud Management Issues Are Coming to a Head

A survey of 1,300 technology and data executives found that more than a decade after the initial rise of cloud computing, organizations are still struggling to manage these environments.

Conducted by Wakefield Research on behalf of NetApp, the survey found 98% of respondents reported their business has been impacted by everything from the increasing complexity of data and heightened cybersecurity risk to lack of visibility into business operations and staff burnout.

Top challenges include cybersecurity risk (45%), staff not taking full advantage of business applications (44%), increased skepticism about the cloud from leadership (44%), lack of visibility into business operations (42%), going over budget (37%) and burning out staff (31%).

A full 88% continue to encounter technical challenges, including data mobility between clouds (33%), security risks (33%) and interoperability between cloud services (30%).

The top drivers of cloud investments are scaling artificial intelligence (AI) and automation (39%), followed by driving business innovation (35%) and creating digital experiences (34%).

Organizational challenges encountered include having a clear vision for cloud strategy (32%), establishing the right level of governance (31%) and managing costs (30%). A full 84% are under pressure to show short-term return on investments (ROI) in cloud computing platforms, with 76% noting CFOs and other business leaders are skeptical of savings. Nearly half of the tech executive respondents (49%) reported that when cloud strategy discussions occur, cost concerns come up often or all the time. As a result, nearly three-fourths of executives (74%) said tiered workloads are either very or extremely important, the survey found.

Other factors impacting multi-cloud strategy include environmental, social and governance (ESG) concerns (79%) and data sovereignty (74%), the survey found.

Ronen Schwartz, senior vice president and general manager for cloud volumes at NetApp, said as more organizations employ multiple clouds, total costs tend to rise. Each cloud platform requires mastering another control plane, which means someone in the IT organization must have the right skills to manage, he noted. IT leaders are attempting to exercise more control over cloud deployments, but developers, for a variety of reasons, have already deployed workloads across multiple cloud computing environments, added Schwartz. One approach to achieving that goal is to make sure data is stored on the least expensive tiered service possible for any given specific use case, he noted.

Less clear is whether an uncertain economy might push organizations to consolidate workloads on fewer cloud computing platforms. Even then, the cost of moving a workload is not trivial given the proprietary application programming interfaces (APIs) that many developers have likely invoked as DevOps built and deployed cloud applications.

Of course, there is no going back; the issue now becomes how to define a set of best practices for managing cloud computing environments in a way that minimizes costs. It turns out that cloud computing can be more costly than an on-premises IT environment simply because the infrastructure resources made available to developers are almost infinite. In the final analysis, however, that can turn out to be too much of a good thing—especially if organizations wind up spending more on IT to support these environments. Many of those environments are not rigorously managed because, for example, developers may not be inclined to spin down a development environment on a Friday because it takes too long to spin it back up the following Monday.

One way or another, however, a level of long overdue scrutiny of cloud computing costs may be on the horizon.

March 29, 2023
Cisco Streamlines Licensing Options for IT Operations Platform

Cisco has reduced the number of licensing options for its Intersight operations platform to two as part of an effort to make the software-as-a-service (SaaS) platform for managing on-premises and cloud computing environments more accessible.

In addition, Cisco has added a Cisco UCS X-series Modular System to its portfolio based on a two-socket server configured with 4th Gen Intel Xeon Scalable processors and an instance of Intersight that has been extended to make it possible to apply policies that limit energy consumption.

Mahesh Natarajan, senior director of product management of cloud and compute for Cisco, said Intersight is a complement to the management platform the company already bundles with its Unified Compute Systems (UCS) platforms for on-premises IT environments.

Essentials enables management of server profiles/policies, managing firmware updates and proactive health monitoring and security advisories along with many other capabilities. The Advantage option adds low-code/no-code orchestration, more advanced server operations, multi-domain visibility and third-party integration with, for example, third-party IT service management (ITSM) platforms.

In the wake of the COVID-19 pandemic, there’s been a shift toward cloud-based platforms that make it simpler for IT teams to centrally manage multiple IT environments from anywhere. Cisco Intersight, in addition to supporting Cisco servers, has been integrated with cloud services from Amazon Web Services (AWS), Google and Microsoft to achieve that goal.

In fact, as the management of IT continues to converge across multiple platforms, the concept of a data center has become something of a misnomer, said Natarajan. Integrated application workloads are now routinely distributed across on-premises and cloud computing platforms that are simpler to manage using a consistent set of policies, he added.

A SaaS platform also provides the added benefit of reducing the total cost of IT because the need to deploy management platforms for each environment is sharply reduced, noted Natarajan.

Very few organizations are running all their application workloads in one environment, so the need to reduce costs by finding more efficient ways to manage IT operations is becoming a more pressing issue. Most IT teams are trying to limit the number of full-time employees they might otherwise hire by trying to improve the overall productivity of the teams they do have.

Of course, centralizing the management of IT is as much a cultural challenge as it is technical. Each IT team that deploys a workload on a platform has a natural bias toward using the management framework made available by the platform provider. Each of those platform providers is now extending its reach as part of an effort to become the one control plane that rules them all. Cloud service providers, for example, are extending the reach of their management frameworks into both local data centers and edge computing environments.

Regardless of preferences, the cost of licensing multiple management platforms can quickly become prohibitive, especially if they provide redundant capabilities. Organizations looking to reduce the total cost of IT would much rather reduce licensing costs than lay off the IT staff that drive a wide range of digital processes. The challenge, as always, is getting everyone in the IT organization to agree on what that one management platform should be.

March 10, 2023
Introduction to Cloud Custodian
Organizations continue to increase their footprint in the cloud. Yet, applying governance and enforcing policies across multiple cloud environments at scale is a challenging endeavor. Organizations typically have governance policies written in English, but translating them into enforceable code has historically required some custom workarounds. In the same vein as infrastructure-as-code (IaC), DevOps engineers now seek a similar GitOps approach to implement shared policies across cloud-based workloads.

Cloud Custodian is one such toolset that can manage and enforce cloud policies in a standardized format. Using Cloud Custodian, a Cloud Center of Excellence has the building blocks to create policies for security governance, development guardrails and cloud cost optimizations. The free, open source project, which has been steadily evolving for years, recently gained its incubation status with the Cloud Native Computing Foundation (CNCF) and to date boasts over 350 contributors on GitHub.

I met with Kapil Thangavelu, Cloud Custodian creator and maintainer and CTO at Stacklet, to learn more about Cloud Custodian and what features we should anticipate from the project in the near future. Below, we’ll provide a comprehensive introduction to Cloud Custodian, exploring its history, how to use it and its core benefits. We’ll also analyze a few sample policies to showcase how Cloud Custodian functions in practice.

What is Cloud Custodian?

Cloud Custodian got its start as an internal tool developed within Capitol One toward the end of 2015, explains Thangavelu. At the time, engineers were grappling with the newfound realities of managing the cloud at scale and realized that having one-off ad-hoc policies across teams was causing friction. “It’s really hard to manage and enforce policies at scale,” says Thangavelu. So, engineers toyed with creating a more GitOps approach to policies around governance and security that could be run as an internal SaaS solution.

Thus, Cloud Custodian was born. The YAML DSL tool allows you to easily define rules to manage cloud infrastructure. It can offer real-time enforcement and produce event-based responses. For example, you can create policies that require tags on resources or one that turns off instances during off-hours. Or, a policy could prevent a developer without the proper privileges from accidentally making an open load balancer. Cloud Custodian supports AWS, Azure, and GCP and policies are specified to a resource type, whether it’s EC2, ASG, Redshift, CosmosDB or a PubSub Topic.

Thangavelu describes Cloud Custodian as a bunch of Lego bricks that developers can pick up to build guardrails in arbitrary ways. Instead of shipping with canned rulesets, “Cloud Custodian makes customization itself a first-class citizen,” he says. Capital One open sourced the project and contributed Cloud Custodian to CNCF in August 2020.

Example Policies

Cloud Custodian comes with a library of actions and filters. Let’s take a look at a few example policies across the three main cloud providers. But first, to install Cloud Custodian from PyPI, you can initiate the following command:
```
$ python3 -m venv custodian
$ source custodian/bin/activate
(custodian) $ pip install c7n
```
Let’s consider an example policy that would improve security hygiene on AWS. Below is one such policy that creates a CloudWatch Event to be triggered anytime a user logs in from an invalid IP address. This could be used to ping a security administrator to investigate. With this rule, it’s also possible to turn on an auto-remediation function.
```
policies:

  - name: invalid-ip-address-login-detected
    resource: account
    description: |
      Notifies on invalid external IP console logins
    mode:
       type: cloudtrail
       events:
          - ConsoleLogin
    filters:
      - not:
          - type: event
            key: 'detail.sourceIPAddress'
            value: |
               '^((158\.103\.|142\.179\.|187\.39\.)([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])
               \.([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5]))|(12\.([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])
               \.([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])\.([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5]))$'
            op: regex
    actions:
      - type: notify
        template: default.html
        priority_header: 1
        subject: "Login From Invalid IP Detected - [custodian {{ account }} - {{ region }}]"
        violation_desc: "A User Has Logged In Externally From A Invalid IP Address Outside The Company's Range:"
        action_desc: |
            "Please investigate and revoke the invalid session along
            with any other restrictive actions if appropriate"
        to:
          - CloudAdmins@Company.com
          - SecurityTeam@Company.com
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/12345678900/cloud-custodian-mailer
          region: us-east-1
```
Next, let’s consider a policy that would add some degree of governance for developers working on Azure. One simple yet popular policy involves tagging the ownership details to individual resources. This policy, therefore, will tag all resource groups with the creator’s email address:
```
policies:
  - name: azure-auto-tag-creator-resource-groups
    resource: azure.resourcegroup
    description: |
      Tag all existing resource groups with the 'CreatorEmail' tag; looking up to 10 days prior.
    actions:
     - type: auto-tag-user
       tag: CreatorEmail
       days: 10
```
Finally, let’s consider a policy that could aid in cost optimization on GCP. Below is a sample policy to enforce minimal CPU utilization for autoscalers on GCP. Implementing such a policy could help avoid underutilization to combat rising cloud costs.
```
vars:
  min-utilization-target: &min-utilization-target 0.8
policies:
  - name: gcp-autoscalers-enforced
    resource: gcp.autoscaler
    mode:
      type: gcp-audit
      methods:
        - v1.compute.autoscalers.insert
    filters:
      - type: value
        key: autoscalingPolicy.cpuUtilization.utilizationTarget
        op: less-than
        value: *min-utilization-target
    actions:
      - type: set
        cpuUtilization:
          utilizationTarget: 0.8
```
Benefits of Cloud Custodian

By automating a lot of the tedious policy management away, Cloud Custodian could reduce risk and accidents through more streamlined cloud governance. “It solves the natural problems when infrastructure is in everyone’s head,” says Thangavelu. By aggregating ad-hoc scripts and unifying policies across an organization, you could immediately instigate new rules without manually reminding all members of an organization, which could take years.

For those familiar with Open Policy Agent (OPA), you may notice some overlap in the objectives, as both are engines for enacting cloud-native policies. Compared to OPA, Cloud Custodian has some developer experience perks. For one, you don’t have to use Rego, as the policies are written in YAML, which is a familiar configuration language for DevOps engineers. Cloud Custodian uses abstractions on event runtimes for each cloud provider. Furthermore, compared to OPA, you don’t need to bind the engine for a particular problem domain, says Thangavelu, as Cloud Custodian is specifically bounded to cloud governance and management.

Cloud Custodian is also battle-tested. Many big names are using it in production, including Capital One, HBO Max, Intuit Inc, JP Morgan Chase & Co, Siemens and Zapier. Across its adoption, the tool tends to either be utilized by a Center of Cloud Excellence, security teams to conduct reporting or reveal real-time incidents or the CFO to direct cost optimizations.

Future of Cloud Custodian

Cloud Custodian maintainers describe the project as a consistent firehouse. Since the project tracks changes in all cloud provider resources in real-time, it’s quite a dynamic toolset. In addition to monthly updates, users can expect many additional updates on the horizon, including support for Tencent Cloud as well as additional Kubernetes support. Additional work is being done around shift-left capabilities to meet the developer where they are, says Thangavelu.

For more information, check out the Quickstart Guide to Cloud Custodian, or view the project roadmap here.
October 24, 2022
More Choices, More Problems: The Double-Edged Sword of Multi-Cloud

Multi-cloud environments can be a double-edged sword. On the one hand, there are clear benefits to using whatever cloud or tool is best for your particular needs, regardless of vendor – in theory. In practice, however, the more choices you have, the more complex and expensive your environment becomes. In fact, Andreessen Horowitz postulates that multi-cloud architectures are oftentimes costing enterprises more than if they had stayed with on-premises systems.

Enterprises need a multi-cloud environment to compete in such a rapidly expanding digital economy. For the majority of companies, completely repatriating to on-prem isn’t an option–the train has already left that station for most. But what do you do when the costs of staying competitive become more and more prohibitive, ironically making you less competitive?

Hybrid Clouds Became Multi-Cloud

When hybrid cloud–a mix of public cloud services and on-prem systems–became table stakes for enterprises, companies only needed one public cloud service provider. Most put all of their eggs in the AWS basket, splitting their workloads between AWS public cloud services and on-premises systems.

This setup provided more agility and flexibility to enterprises and lowered costs by reducing dependence on expensive, cumbersome on-prem hardware. A lot of capex was replaced by opex; with cloud services, you only pay for what you use as you use it without the physical infrastructure and maintenance costs.

Inevitably, the cost and efficiency benefits of the cloud drove companies to migrate more and larger workloads from their on-premises systems, increasing cloud costs over time. And the more workloads you had with a single vendor, the more beholden to that vendor you became. If AWS raised their prices, you had no alternative but to pay more.

Soon, hybrid clouds grew into multi-clouds, with other public cloud providers such as Azure and GPC in the mix. Sometimes this was by choice–why be locked into one vendor and suite of tools when you could choose from multiple vendors that might offer better pricing or have some products that are better suited for your needs?

More often, though, it was involuntary–developers spinning up their own clouds and resources for their own purposes without consulting IT, creating shadow IT. Or companies acquiring other organizations whose cloud choices varied. Either way, the enterprise is using multiple clouds whether they planned to or not.

Regardless of how it happened, once more clouds were introduced, complexity multiplied.

The Multi-Cloud Hydra

Too many organizations underestimate the complexity they’re introducing with each additional cloud. Operating systems, networking, cost monitoring and tracking, workload methodologies and data aggregation are all different for each vendor. How many people in your organization know what all these differences are and how to navigate between them? How do you effectively manage, govern and monitor usage, costs and security and compliance issues when each public cloud does it differently? You have to manually collect data from each cloud and aggregate it in spreadsheets for analysis. How accurate can that be, how long does it take and at what cost in terms of people and time?

Furthermore, how will you be able to accurately pinpoint waste and inefficiency? If you’re chasing down engineers to turn off resources or having to choose between one manual cost-efficiency action versus another, the waste will add up and your budget will be inaccurate.

As if that’s not chaotic and complicated enough, development teams spread out across the enterprise adopt different tools and use them for their own purposes, without any alignment or coordination. The same tool is purchased multiple times. Best practices between teams aren’t shared. Everything needs to be custom-coded, creating layers of “spaghetti code” that blur visibility and are ripe for misconfigurations, which results in security vulnerabilities. And let’s not forget shadow IT, which IT departments don’t even know about, let alone monitor.

You started your journey with a unified cloud strategy, but now you’re struggling with an ever-growing number of different clouds and strategies for different groups. Each group prefers different tools, clouds, methods and processes, and this has left you stuck with siloed teams, unending tool sprawl, infinite lines of custom code, worsening security risks and no clear visibility. And the meter keeps spinning, costing you millions.

So, what do you do now?

Taming the Chaos

To survive and thrive in the new cloud order, enterprises can’t just write off exploding cloud costs as “the cost of innovation,” or otherwise justify their cloud chaos as par for the course. Too many are doing that now, and it won’t end well, as we’re likely headed into recession and growing uncertainty and turbulence in markets.

First and foremost, taming cloud chaos and getting multi-cloud costs under control requires visibility and interoperability. You must be able to view, monitor, manage and analyze all clouds from one place; manually collecting that data with spreadsheets won’t do anymore.

Development teams can no longer be siloed off from each other. There should be a single repository where all teams can access and utilize all tools, scripts, and previously coded integrations. When everything is viewable and available in a single place, no one has to buy the same tool twice or reinvent the wheel when using it. Once a tool has been integrated, any other team that wants to use that tool can simply re-use the integration, configuration, and policies that have already been created and vetted. If multiple groups are doing the same thing, an approved automation process can be created and shared.

True cost optimization also requires organizational awareness and shared responsibility. If people don’t know they’re wasting resources, how will they be able to stop? Enterprises need a system that detects waste and cost overruns and notifies stakeholders accordingly.

For example, a development environment may be up and running even though it’s no longer being used. An automatic alert could be sent to the appropriate team leader, reminding them to shut it down. A developer provisioning cloud resources might not choose the most cost-effective option, but the alert system would flag their activity and notify them of a cheaper alternative. Cloud resources that are left on overnight or on weekends would also be detected and shut down. Commitments would be conducted automatically every day and no longer require individuals to remember to do them manually.

There’s just no going back to the traditional whack-a-mole style of cloud management and cost control. Enterprises that understand this and create a holistic framework for cloud management capabilities based on simplicity, visibility, unity and awareness will be in a much better position to navigate the choppy economic waters to come.

October 19, 2022
Aligning Cloud Spend Management With Cloud Transformation

The cloud transformation movement is well underway, with more than half of enterprise organizations moving to a cloud-native approach this year, according to Forrester Research. Spending on cloud infrastructure is rising accordingly – more than $21 billion in Q4 2021, up 13.5% from Q4 2020, according to IDC. The cloud offers economies of scale and connectivity that companies can leverage to optimize operations, make better use of their data and identify opportunities. However, if a company’s cloud infrastructure investment isn’t well planned, they can end up spending more than expected due to unplanned access costs, applications consuming more resources than expected and underperformance caused by inefficient architecture or lack of maintenance.

Spending governance–creating and managing a budget that supports the company’s cloud goals–also helps to maintain cloud security by ensuring that there are adequate solutions in place to prevent phishing, ransomware and other attacks that can disrupt or disable an organization’s cloud operations. Financial monitoring allows organizations to accurately evaluate the cost-efficiency of the apps in their cloud ecosystem. This can help control costs and avoid situations where different groups add their own apps without first leveraging what’s already available or correctly gauging associated cloud spend. Unchecked app proliferation in the cloud can create a cycle that includes overconsumption of resources and security issues.

Cloud governance can address sustainability concerns, too, as executives increasingly focus on reducing their organizations’ carbon footprint. It’s important to benchmark the organization’s on-premises servers’ carbon impact, so you can quantify how moving workloads from on-premises to the cloud impacts sustainability progress. As with spending, cloud sustainability measurement requires adequate planning, execution, organization-wide visibility, effective monitoring, and efficient use of cloud resources.

Planning for Effective Cloud Spend Governance

Spending management processes have always been crucial for business, but governance of cloud initiatives is playing catch-up to technology advances and an accelerated digital transformation. We see many organizations that are relying more heavily on cloud infrastructure because of the speed it offers to deliver new products and experiences through innovation. But without financial controls, there can be an element of inefficiency that affects cloud spending decisions—something that we’ve seen as an increasing issue for companies over the past decade.

Whether an organization is preparing for the transition to the cloud or seeking to make existing cloud spending more visible and accountable, the financial governance aspect requires readiness. Assessing this readiness starts with cataloging the tools and expertise available in the organization to build a cloud budget, put monitoring tools in place, setting threshold levels that trigger notifications when spending exceeds certain levels and providing organizational controls to remedy any spending excesses.

It’s also helpful to define the goals and potential benefits of implementing better spending controls. First, no one wants to deal with unplanned costs that create budgetary problems and have a negative impact on the business. Second, spending accountability allows you to identify the internal groups that are knowledgeable enough about both cloud operations and spending management to take ownership of their role in the move to the cloud. At the same time, you can also identify the groups that need more training, guidance, and resources to get the most value and beset employee experience from their cloud transformation. Third, proper cloud governance can help companies avoid scenarios where cloud-related issues such as security, budget or over-proliferation of apps in the cloud ecosystem lead to customer experience problems.

All these planning requirements are more complex for organizations with an existing or planned multi-cloud environment. Because each cloud provider has its own processes and features, the organization will need to understand–and financially manage–a diverse set of tools and resources to analyze what happens across their cloud network. For example, it’s relatively simple to pull two similar reports from a single-cloud environment and synthesize them to create a summary report. When the reports are coming from two different cloud platforms, there can be format differences that make synthesis more challenging, time-consuming and costly to aggregate that data and present it in a dashboard for leaders.

Platform differences also mean that simply comparing previous on-premises spending to proposed cloud spending may not be a good model for accurate cost planning for multi-cloud environments. For all of these reasons as well as technical ones, multi-cloud governance often requires creating a team or task force to collaborate and share knowledge for effective technology and budgetary decision-making.

Cloud Spend Governance in Practice

Like cloud technology and applications, cloud spend governance is a continually evolving practice, not a one-and-done task. That’s because proper financial visibility and management require monitoring to identify any emerging issues in terms of capacity, cost and security. For example, a manufacturer might analyze their cloud usage data and find they’re underutilizing some resources, which enables them to turn those resources off to save costs.

Financial governance also allows companies to find opportunities for optimization–something that can be as simple as identifying potential configuration changes that make cloud operations more efficient and secure. In the end, the promise and potential of the cloud for companies depend on smart, properly planned use of cloud resources and spending governance is a critical part of that smart planning.

September 23, 2022