devopsy.kinsta.cloud

Tag: containers

  • Better Apps and Better Security When You Shift Left

    Better Apps and Better Security When You Shift Left

    Tens of thousands of people and hundreds of cybersecurity vendors descended on San Francisco at the end of April. While the RSA Conference was the primary draw, there are a number of peripheral events that go on throughout the week as well, such as the Cloud Security Alliance Summit, the CIO/CISO Interchange, BSides San Francisco and the Qualys Security Conference.

    I was able to attend some of the Qualys Security Conference and I had the opportunity to see Alex Mandernack, security solution architect for product management at Qualys, presenting on the need to shift left when it comes to cybersecurity.

    Mandernack outlined some of the issues organizations face today when it comes to security. Migrating to the cloud and embracing DevOps culture means more ephemeral, elastic environments and compressed development time frames. He pointed out that these trends make security more challenging, but also described the opportunity they present to change our approach to streamline and improve security.

    The Traditional Pipeline is Broken

    The traditional model of application development is much more linear. Each app team builds their own image—often in a silo or vacuum disconnected from other teams. Penetration testing is conducted on a sporadic or infrequent basis, and eventually the app is deployed. Vulnerability scans are run on the app in production, and issues or deficiencies are reported back to the developers to address or incorporate into the next build.

    The process is slow and cumbersome. It also has the potential to introduce redundancies that waste resources and make the organization less efficient. As companies embrace DevOps and move to the cloud, the traditional development pipeline simply doesn’t work—especially not for security.

    DevOps, and Cloud, and Containers — Oh My!

    The cloud and DevOps fundamentally change the development lifecycle. Development time frames are compressed, and the process is a self-feeding, iterative circle rather than a repeating linear approach. The traditional approach of identifying and resolving security issues after an application is deployed won’t work in a DevOps environment because by the time issues are identified and fixed, the app itself may have already moved on to the next version.

    Cybersecurity and the development pipeline have enough challenges with the cloud and DevOps, but there is also a newer technology trend that exacerbates the problem—containers. Containers are designed to get code quickly and to operate fast. They are also built for scalability—spawning and spinning down hundreds or thousands of containers constantly to keep pace with demand.

    There is a diverse array of tools and platforms associated with cloud, DevOps and containers. Organizations often employ a complex collection comprised of some combination of AWS, Azure, Docker, Kubernetes, OpenShift and others. The result can quickly become a black hole when it comes to security—which is why it’s important to push security left into the CI/CD pipeline.

    Shift Left to Help Security Teams Do Better

    In a DevOps culture, developers and security teams need to think about security sooner. It’s important to get the security tools into the process earlier. Thankfully, with the DevOps lifecycle and the tools commonly used within a DevOps environment, it can be done.

    For starters, companies should build a golden image. Developers shouldn’t have to patch and update the base operating system before they even start developing. The golden image takes a baseline operating system such as Ubuntu or CentOS, and completely patches and configures it so everyone has a standard, consistent image to develop on.

    With the golden image in place, the next step in shifting security left is to implement testing and scanning in the CI/CD pipeline. Put vulnerability information at the fingertips of developers as they’re developing and implement vulnerability gates in the pipeline to ensure that applications that don’t comply with policies and meet minimum requirements are not allowed to be deployed.

    New Role of the Security Team

    Part of shifting security left includes providing tools that make security self-service for the DevOps team. Automating actions with scripting, APIs and CI plugins ensures that security is simplified and streamlined to provide value for developers.

    In this shift left scenario, the security team has to redefine its role in the process. The security team is still vital, but rather than being the police or a roadblock in the development process, the role of security focuses on verifying and auditing the process. The security framework should have dashboards and live data that enable the security team to monitor activity and identify trends that may need further attention.

    Better Security, Faster

    There is often conflict between developers and security teams, but there doesn’t need to be. Mandernack stressed that developers don’t want to create insecure apps either.

    Shifting security to the left into the CI/CD pipeline streamlines the whole process. Ultimately, the result is higher quality, more secure applications that are developed faster.

    — Tony Bradley

  • Instana Expands Scope of APM Ambitions

    Instana Expands Scope of APM Ambitions

    Instana has launched a series of additions to its application performance management (APM) platform that reach into the realm of IT infrastructure as well as mobile and Java applications.

    Chris Farrell, technical director and APM strategist for Instana, said the company is adding support for VMware vSphere because more customers are converging their management of applications and IT infrastructure, thanks in part to the rise of DevOps practices. Many IT organizations are also simultaneously embracing emerging platforms such as Kubernetes to run microservices-based applications on top of VMware vSphere, he noted.

    Instana also recently added support for the Container Runtime Interface based on the Open Container Initiative specification, otherwise known as CRI-O, alongside existing support for Docker containers.

    At the same time, usage of Instana, which was created to focus mainly on emerging microservices-based applications, is expanding to include monolithic applications. As a result, Instana has added a free AutoProfile feature for Java applications based on tools it gained by acquiring StackImpact.

    Available in beta, AutoProfile attaches itself to the running process automatically with no restarts or reconfiguration required, to surface how specific pieces of code and associated bottleneck impact overall performance.

    Finally, Instana has also made available in beta an End User Monitoring of Mobile Applications module. That capability is also being made available at no additional charge. Troubleshooting mobile applications should become easier because Instana captures every single request made at the client by both the browser and the application.

    While adoption of APM platforms relative to the size of the IT market remains slight, Instana as a startup has been gaining traction at the expense of incumbent rivals. Instana claims it is now monitoring more than a half a million container and program run-time processes via its software-as-a-service (SaaS) platform, including hosts, containers, Java Virtual Machines, NodeJS runtimes and AWS Lambda functions written in PHP or Ruby. In total, Instana claims to also be gathering 1.5 billion metrics per minute, with more than a million application request traces being captured every second. New customers acquired in 2019 include Vivy, MacMillan Learning, TIpico, ExaVault and Avoris. Overall, Instana reports that its base of customers grew 150% in the last year.

    The Instana APM platform is designed from the ground up to automate application monitoring, including application discovery and mapping, monitoring sensor and agent deployment, and application infrastructure health monitoring. Instana is betting that the rise of microservices will not only require more organizations to rely on an APM platform to manage an increasingly complex application environment in real-time but also force many organizations that have APM platforms to reconsider their options when they discover how limited the visibility into containerized applications those platforms provide. At the same time, by adding support for VMware vSphere and making additional capabilities available for free, Instana is ratcheting up the pressure on rivals in 2020 further.

    Of course, it’s not clear there is anything approaching general dissatisfaction with existing APM platforms, so Instana may have its work cut out. Nevertheless, competition among providers of APM platforms has never been fiercer.

    — Mike Vizard

  • The Definition of Faster in the Age of App Capital

    The Definition of Faster in the Age of App Capital

    Businesses want speed. One of the impacts of digital transformation—and the associated pressure to succeed in an app economy—is the desire to move at speed. Nearly half (48%) of organizations are driven by digital transformation to deploy faster according to our State of Application Services 2019.

    But it’s not all about deployment. It’s also about development and responsiveness to threats and changes in demand.

    Organizations want to develop and deliver apps faster. They want to adapt to unpredictable changes in business conditions faster. They want to respond to attacks faster.

    So, how are they going to get it?

    Faster Development

    Deploying more frequently implies you’re first developing faster. That often means adoption of speed-oriented Agile methodologies. GitLab’s 2019 Global Developer Report: DevSecOps found that the majority (54%) are choosing Scrum, while 37% go for Kanban.

    Componentization

    Methodologies aren’t enough if application architectures aren’t well-suited to development styles. Smaller, focused teams sprinting toward frequent releases isn’t really a good fit for developing new features or fixes for traditional and monolithic applications. Componentization through the adoption of microservices and more distributed forms of architecture fit more naturally with modern architectural and operational principles. It’s no surprise that, on average, more than 80% of a modern application is made up of third-party components, heavily weighted toward open source.

    APIs

    Adoption of APIs, as well, is no surprise amongst those seeking faster development through componentized application architectures. APIs decouple implementation from interface and allow teams to make modifications to processing without impacting the use of APIs from other components or applications. This is a common pattern, with an impressive 64% of organizations creating APIs today for use in either internal or external use cases. Nearly 50% of those organizations rely on APIs to get ideas to market faster according to Jitterbit’s State of API Integration 2018.

    Automation (CI/CD)

    The build pipeline, too, has to keep up if frequently deployment goals are to be met. That means CI/CD tools that seamlessly move code from commit to test to release. The most popular CI and build tools in GitLab’s survey were, unsurprisingly, GitLab (61%) followed by Jenkins (36%) and Travis CI (12%). Notably, our own research finds Jenkins in use by 16% for network automation as well—a promising result if organizations are seeking to extend DevOps beyond delivery into deployment.

    Faster Deployment

    Developing faster doesn’t get ideas to market faster. That requires deployment. While born-in-the-cloud technology companies have mastered the delivery-deployment divide with ease, many established enterprises find this transition challenging. Existing organization structures as well as the continued need to support traditional and monolithic applications introduces conflicts that can be challenging to integrate with modern operational demands. But there is no doubt that organizations must overcome these challenges for those applications requiring faster and more frequent deployments.

    Continuous Deployment

    Don’t be fooled; established organizations are embracing automation and applying it to the deployment pipeline. The issue is often that traditional IT structures introduce inconsistent automation and self-service efforts. We see this play out in our own research, where strongly siloed team structures continue to impact automation efforts across IT.

    Team structures matter and organizations whose compass is pointed at automated pipelines will need to address the cultural aspects of continuous deployment if they want to consistently deploy faster.

    Public Cloud

    Traditionally, the inability to achieve continuous deployment has pushed developers and app owners to turn to the public cloud, because it eliminates the obstacles in the slower, enterprise deployment path. The disparity in opinion on frequency of deployments is, in part, a contributor to the issue. Our 2018 NetOps/DevOps survey found that while 55% of DevOps and 52% of cloud architects felt their organization did not deploy frequently enough, only 30% of NetOps and the same percentage of operations agreed. 

    But it’s not the only driver. Digital transformation is certainly a factor; 33% of respondents in our State of Application Services indicated they are intentionally moving to deliver apps from the public cloud as a result of embracing digital transformation initiatives. The ability to easily integrate application services and subsequently automate operation is a huge boon to organizations seeking a faster route to frequent deployment.

    Containers

    In the cloud—but also on-premises—continuous deployment often requires the ability to adopt per-app pipelines and application services that support the model. Increasingly, organizations are turning to containers because of their ability to support rapid updates and operate seamlessly in highly volatile environments. We see containers in demand not only to support modern application architectures such as cloud native—the top container use-case at 33% of respondents to Diamanti’s 2019 Container Adoption Benchmark—but also for infrastructure. The demand for on-premises application services in containers has consistently grown year over year in our own research, rising from just 4% in 2017 to 15% in 2019.

    Faster Responses

    Not everything is about delivery and deployment. Organizations also need speed when it comes to security and operations. In today’s world, where more than half of all app interactions are conducted by bots, it’s important for organizations to respond quickly with a reject message to avoid falling prey to exploits or infection. 

    Real-Time Threat Analytics

    One of the ways organizations are seeking to speed up their ability to respond to attacks is through the adoption of real-time threat analytics. With security continuing to be a top priority and consistent challenge, it was no surprise to see this category ascend into the top five strategy trends and technology in 2019 with 41% of respondents tagging it.

    The availability of intelligent security application services will accelerate as machine learning and automation continue to apply their considerable capabilities to the problem of identifying troublesome traffic faster.

    Orchestration Included

    Machine learning isn’t the only way in which infrastructure and application services are getting smarter. As the need for faster responses to capacity and processing grow along with users, infrastructure and application services are evolving to include orchestration as a core capability rather than an add-on. Application service platforms with integrated orchestration layers will mean services that scale along with demand—on-demand. While such capabilities exist today—indeed, they are part and parcel of cloud and containers—the capabilities to automatically scale up and down based on application and user defined requirements is not native to most systems today. But they will be.

    Faster Identification of Bad Actors

    Finally, organizations need to combat bots for both business and security purposes. Whether organizations need to stop scraping—a real threat to business—or prevent bots from probing for vulnerabilities, identifying bad bot actors faster is critical today. Checking a box (I’m not a robot) isn’t enough today as bots are growing more intelligent and are able to foil such primitive techniques.

    Organizations are turning to Bot Defense services capable of applying more modern, successful techniques to quickly identify and block bad actor bots. We’ve seen the use of bot defense services grow quarter over quarter in response to this need, and expect this trend to continue.

    Faster Development, Faster Deployment, Faster Responses

    When it comes to business’ need for speed today, we wind up looking at processes. Development processes are automated to gain speed with CI/CD. Deployment processes are automated to gain speed with continuous deployment and cloud. Scaling and security processes are being automated by systems and the introduction of orchestration as native to application service platforms.

    Faster, it turns out, relies on an organization’s ability to automate processes across development, deployment and security. 

    — Lori MacVittie

  • The Acceleration of Data and Data Storage Trends

    The Acceleration of Data and Data Storage Trends

    There’s never been a more exciting time for data. Increasing demands for size, speed, performance and reliance have propelled the data market forward at a faster rate than could have ever been anticipated, and new technologies are making some dreams for data a reality.

    From open source adoption in place of legacy databases to cloud-native app stacks and more, here are seven trends driving the acceleration of data and data storage. 

    Oracle’s Slow Fade Drives Cloud-Native Adoption

    Organizations of all sizes continue to eschew Oracle for cloud-native databases, shrinking the user base of the monolithic legacy provider. Two major trends driving this activity are the ongoing move to microservices-based redesign of applications and the rise of cloud-native deployments running in public clouds or Kubernetes. Overall, Oracle has lost market share every year since 2013, and legacy relational database players have dropped about five percentage points per year. Major organizations, such as Amazon and Salesforce, have already figured out that it’s to their benefit to use less, not more, Oracle.

    Open Source DB Usage Increases

    Open source databases that claimed 0% of the market 10 years ago, now make up more than 7%. It’s clear that the market is shifting and an increase in open source database adoption is on the rise. This goes against the recent trend of database and data infrastructure companies abandoning open source licenses for some, or all, of their core projects. However, as technology rapidly advances it will be in the best interest of database providers to switch to a 100% open source model, since freemium models take a significantly longer period of time for the software to mature to the same level as a true open source offering.

    Furthermore, Gartner predicts that, by 2022, more than 70% of new in-house applications will be developed on an OSDBMS or OSDBMS-based dbPaaS. It’s clear that open source has proven to be the most successful approach to developing and distributing business-critical infrastructure software, driven by the benefits of reduced total cost of ownership, access to community support and innovation and compatibility with commercial databases, making it easy to migrate towards an open source solution. 

    Kubernetes For Stateful DBs

    There has been continued growth in the adoption of both microservices and containerization. With the combination of massive adoption and the support of a large and thriving open-source community, it is clear that the dynamic nature of containerization and microservices deployments will have huge implications on fundamental application architecture. To put it simply, this is the future of how applications will be built. This is also why the adoption of Kubernetes has continued to grow.

    Multi-Cloud Goes Mainstream

    Multi-cloud deployments are becoming the norm in today’s enterprise. A multi-cloud approach is critically important for organizations that run on-premise, since they need to stay in a hybrid mode when moving microservices to the cloud. As a result, enterprises are widely embracing distributed SQL databases to ensure agility without the availability constraints of traditional monolithic databases, such as Oracle. 

    Rise of Edge Data Centers

    While the rise of edge data centers is assuredly a trend, Gartner predicts that three quarters of all databases will either be deployed or migrated to a cloud platform by 2022. There will also be an increase in multi-cloud adoption as a result of the geo-distribution of data. Edge data centers are already starting to offer data services with geo-distribution, a clear sign that demand is creating supply.

    Cloud-Native App Stacks Gaining in Popularity

    Modern microservices-oriented architectures are becoming increasingly popular. Over time, this leads to environments with lots of microservices that should be able to notify one another of changes and store these changes in a system of record. The application stack that is getting very popular for such use-cases is a combination of:

    • Spring framework to build the applications.
    • Kafka as the message bus to send notification between the microservices.
    • A Distributed SQL database to store the data in a scalable manner and query it efficiently.

    Other application stacks that are rising in popularity are the JAMstack ( Javascript, APIs and Markup) where there is no dependency on any particular web server. Javascript frameworks such as ReactJS and VueJS have become very popular for building the frontend portion of the app. GraphQL frameworks such as Apollo and Hasura are getting increasingly adopted as efficient ways to build the API portion of the app.

    Advances in innovation for data and data storage will undoubtedly continue, driven by major trends across all areas of business, as long as organizations are prepared to embrace change and hit the accelerator on their data strategies.

    — Karthik Ranganathan

  • Trends and Benefits of Serverless Computing

    Trends and Benefits of Serverless Computing

    Gartner estimated that by 2020, 20% of the world’s organizations will have gone serverless. Serverless computing initiates a mind shift in the way businesses are run and improves the accuracy and impact of technology services. Leading to higher functionality, reduced AWS bills, increased delivery speed and multi-cloud support, serverless computing paves the way into the future. 

    The scope of serverless is yet unexplored. With new and high-potential developments (such as FaaS and GitOps) still in their nascent stages, organizations can expect massive benefits leveraging the power of serverless computing going forward. 

    Servers have been a very important part of the computing architecture for decades. But, with the introduction of cloud, we’ve moved to predominantly web-based server infrastructure, and the migration to serverless architecture has begun.

    Serverless computing–abstract and virtual server support–has made the computing landscape more dynamic, robust, intuitive and powerful. But advancement in serverless technology is still in its nascent stage. The next few years are expected to bring in numerous developments and transformations.

    First, let’s take a look at some serverless trends you should keep an eye out for.

    Kubernetes Will Become the Go-to Serverless System

    Kubernetes has become synonymous with open-source containerization. But in the next few years, we will see Kubernetes become the base for serverless infrastructure. Features such as networking, service discovery, agile scaling and multi-cloud environment support make Kubernetes the perfect choice for serverless. 

    Additionally, with Knative already released, the process of standardization and interoperability of serverless platforms may soon become a reality. 

    Stateful Applications Will Also See the Usage of Serverless

    Restriction of serverless for stateless apps is a thing of the past. The next few years will see stateful apps benefiting from the immense power of serverless. Developers will be able to use database connections, BaaS and event payloads to run their applications.

    FaaS Industry Size Will Grow 

    The FaaS market is expected to grow to $7.72 billion by 2021. Large-scale adoption of serverless will be seen across the world, and there will be a 32.7% CGAR. 

    GitOps Will Be the Next Big Thing 

    The version-controlled system of DevOps, GitOps, will see more takers in the future, especially in FaaS. GitOps is expected to improve operational workflows, especially in fast-moving projects, and enable implementation of technologies such as Kubernetes and other cloud solutions. 

    Additionally, this will enable cloud vendors to provide greater ecosystem support and tooling capabilities to users.

    Containers Versus Serverless

    Containers by nature are segmented, isolated and contained spaces of application-specific servers. While they offer high degrees of specialized (and often customized) tools, resources and support, they suffer from numerous challenges:

    • They are very resource-inefficient compared to serverless. 
    • Their ecosystem is fractured as opposed to the wholesome environment offered by serverless. 
    • Data storage and retention are complicated, necessitating frequent data migration across containers. 
    • Graphics support is limited, resulting in poor-quality deployments. 

    The challenges that come with containers prompt organizations to choose serverless. Already, many companies have implemented serverless.

    Here is how the move to serverless will benefit you, too.

    Serverless Computing Eliminates the Need for the Set-Up of Complex Application Stacks

    Developing even the most basic server-bound application is a challenging task. It requires the set-up of high-powered and complex application stacks that can be both difficult to build and difficult to manage. By going serverless, organizations can eliminate all these heartaches. 

    Serverless stacks, such as Lambda and Azure, create a robust and intuitive environment for the development of agile applications, by providing organizations with a large set of capabilities and allowing them to run at scale, at the lowest costs.

    It Reduces the Organization’s Capital Expenditure

    Unfortunately, IT infrastructure is considered a capital expenditure by many organizations. So, building your own servers can lead to a high CapEx.

    Consider this. Physical servers are vulnerable to breakdown and depreciation, which add to CapEx. If you report this value as expenses in your income statement, it may ultimately negatively affect your P&L and your company valuation. Going serverless allows organizations to avoid such a challenge and maintain their profitability and high valuation.

    Plus, serverless infrastructure reduces the need for human resource deployment as focus on batch processing decreases. Additionally, serverless allows organizations to convert workflows into step functions, which reduces the number of EC2 and SWF issues. Together, these reduce company expenses tremendously. 

    It Shortens the Standard Release Cycle Significantly Due to Microservices and Nano-Services

    Serverless computing allows organizations to benefit from the magnificent power and scope of microservices. From making minute application-specific developments to isolating and rectifying issues, to managing and deploying individual applications, organizations can do a lot of things using serverless computing. 

    In fact, a survey shows that utilizing serverless microservices can bring down the standard release cycle from 65 days to a mere 16 days.

    It Allows Easy Completion of ELT Tasks and Cron-Type Jobs 

    Again, serverless computing microservices gives organizations the flexibility, technical support and clarity needed to process data. ELT tasks become more consistent and allow the creation of structured data warehouses.

    Similarly, since isolated components and applications can be created, deployed and fixed in serverless, it’s easier to implement cron-type jobs as well. 

    It Allows Organizations to Escape Traditional Workflows Through Event-Based Computing 

    Adoption of serverless computing allows organizations to shift from the restrictive, time-consuming and draining traditional workflows and engage in event-based computing. Now, coders can just write the algorithms and allow the serverless provider to take care of the data storage and computing needs. Not only will this reduce the time of transaction processing and the cost of DevOps, but it will also free up the time and space for coders to take on other business logic tasks. 

    It Enables Green Computing 

    With climate change becoming such an imminent threat to the world, it’s important for organizations to become mindful about the way they operate. One way to become sustainable is to go serverless.

    For one, serverless computing ensures organizations don’t over-utilize electricity. Additionally, with no physical servers and data centers that emit toxic radiation as they cool down, there will be lesser concerns about health and climate change. 

    Another aspect is scalability. Serverless is highly-scalable, meaning you don’t need to set-up more servers at your office. Given that 30% of the world’s servers are unused at any point in time and most servers only utilize 5%-15% of their total capacity, serverless may be the best way to go green.

    It Promotes Deployer Autonomy and Encourages the Adoption of New Mindsets

    Serverless computing gives organizations the freedom to focus on their core business offerings and deal with only low-level OS issues. This time, money and opportunity can be used by deployers, coders and top management to develop competitive offerings, which can help the organization overtake competitors. 

    With physical servers, it’s more likely than not for organizations to focus on technical server issues than the business process.

    Conclusion

    Serverless computing could be one of the most exciting developments of the 21st century. It is breaking down old barriers and allowing organizations to expand and explore new frontiers. Its high deliverability, coupled with the immense opportunities it promises, makes it a must-adopt in any organization.

    — Subramonian

  • Service Meshes: Improving Security, Delivery and Availability

    Service Meshes: Improving Security, Delivery and Availability

    Containerized microservices are taking over the software world. These services provide developers a way to quickly create and deploy cloud-native applications. However, containers aren’t perfect. Orchestrating and managing container deployments can be a serious challenge. 

    To help ease this challenge, service meshes were developed. In this article, you’ll learn about service meshes components and architecture options. You’ll also learn how services meshes can improve your container deployments.

    What Is a Service Mesh?

    A service mesh is a dedicated communication layer that sits on top of your request/response layer. It works similarly to a Container Networking Interface (CNI), which controls the connection of your services to your network. A service mesh sits on top of your CNI, adding additional functionality, such as service discovery or security. A service mesh is not a replacement for a CNI or a service orchestration platform.

    Services meshes are designed for use with containerized microservices. You can use this technology with any container or container orchestration tools. However, the most active projects seem to favor developing service meshes for Kubernetes.

    Service Mesh Architectures

    When deploying a service mesh, there are three architectures you can choose from.

    Library 

    The library architecture employs a library that is imported in an application’s code and runs from inside the application. Using a library eliminates the need to call out to a remote service, making it more secure.

    Libraries make it easier to allocate resources since all work is contained in the microservice running the library. A library architecture works well for in-house applications that are written in one language. Third-party applications are difficult or impossible to add the library to.

    Node Agent 

    A node agent architecture uses a node agent or daemon that serves all containers on a particular node. A node agent architecture is language-agnostic since it doesn’t run from inside your microservice. It can be used with in-house and third-party applications. However, node agents must be coordinated with infrastructure processes, making this architecture more complex to deploy.

    Node agents require less memory than sidecars since information can be shared across a node. This architecture employs work resource sharing, with dynamically shared resources, making it easier to scale. The downside of sharing, however, is that it can be abused, with one service hogging all available memory.

    Sidecar Proxy 

    A sidecar proxy architecture uses sidecars that run alongside your containers. The sidecar handles all traffic into and out of the container it is attached to. Sidecars do not require coordination with your infrastructure since one proxy is assigned to each container. This lack of coordination makes sidecars easier to set up than node agents.

    Sidecars only serve one pod and are not influenced by other pods. This isolation makes this architecture better for zero-trust deployments as each container is accountable for its own actions. Sidecars can be added to containers at any time, enabling you to easily scale processes.

    Use Cases For Service Meshes

    Service meshes are an emerging technology, with new use cases being actively developed. The three use cases introduced here are just the ones that are currently most common.

    Improving Security

    Containers are isolated environments and generally considered to be more secure than traditional applications. However, containers still contain vulnerabilities, such as possible abuse of root access. 

    Service meshes can help address security concerns by providing:

    • Zero-trust security—any communication, either from inside or outside requires verification. Verification prevents compromised containers from interfering with other microservices or your broader system. It restricts a container’s actions and communications to that container alone.
    • Communication tracing—enables you to collect communications information and isolate errors or issues. If a container is communicating in an unexpected way or against protocol, you can identify it. Once identified, you can easily replace the container with an uncorrupted image or remedy the issue. Tracing enables you to pinpoint possible attacks, including where attackers came from and what they’re trying to accomplish.

    Improving Delivery

    Containers already improve on application and service delivery by making it easier to release and patch services. Service meshes expand upon these capabilities by improving application and performance monitoring functions. 

    Service meshes can also help improve service delivery by enabling:

    • A/B testing—provides advanced routing, enabling you to divide traffic between A and B versions. This routing makes it simpler to set up A/B testing. Additionally, tracing features enable you to gather and analyze user traffic and interactions.
    • Rapid versioning—new versions can be released with zero downtime and reduced risk. Containers can be started and verified healthy before traffic is gradually shifted between versions. If issues arise, changes can be rolled back without system-wide consequences. Easier corrections enable you to relax delivery requirements with minimal risk.

    Improving Availability

    Containers can provide improved availability, depending on your hosting configuration and resources. Service meshes can expand upon these abilities by improving load balancing, traffic management and health monitoring functionalities.

    Service meshes can also help improve availability by enabling:

    • Resilience testing—enables you to test how services respond with fault injections. Service meshes enable you to test your services’ fault tolerance. Increased understanding of how faults affect resilience helps you identify and correct vulnerabilities. Greater service resilience leads to greater availability.
    • Deployment and request shadowing—enables you to simulate anticipated traffic flow and see how services respond. Shadowing enables you to test the traffic and workload capacities of your services. With this information, you can determine whether you need to scale resources and connections. Proper scaling ensures that your traffic needs are met and prevents traffic bottlenecking and decreased availability.

    Conclusion

    As microservices become standard, teams are placing an increased focus on improving container performance and security. The development of service meshes is a result of this increased focus.

    Hopefully, this article helped you understand what service meshes are and how this technology can help improve your container deployments. If you’re interested in seeing how a service mesh might help you, check out this tutorial explaining how to build a service mesh.

    — Gilad David Maayan

  • Moving Things Around: The Acquisition of Protego

    Moving Things Around: The Acquisition of Protego

    I received a note from Protego Labs’ vice president of marketing about Check Point Software acquiring Protego. We see a fair number of acquisition announcements, and usually don’t write about them–though we read them and stay abreast of industry happenings.

    I used to follow Check Point, and haven’t looked into what they’re doing in a while, so I followed through links to both organizations and looked at their products.

    I found myself becoming the wizard that some call Tim. But instead of “What is your name? What is your quest? What is your favorite color?” I was looking into “Where is your site? What are your products? What value do you add?” My beard is kept trimmed, more along the lines of a knight’s, so it makes sense I would ask different questions. As long as I’m not spouting “It’s just a flesh wound,” I figure I’m doing okay.

    First off, this merger makes sense. Protego does it for serverless and Check Point is doing their best to be where your code is running. Indeed, Protego probably needed a merger of some kind because all they do is serverless. Check Point’s Cloud Guard Dome 9, by contrast, will protect access rights and data for serverless, but doesn’t do what Protego does–keep an eye on the code. So this is a good fit.

    But it once again brings to light an interesting issue as you move things from DC to cloud A to cloud B to serverless. Where are your support functions? Networking, security, storage…These things need to be where the code is, but architectural options are more than they’ve been for decades. And the architectures are largely incompatible. Consider network functions for a physical-server based DC versus a VM DC, versus a Container DC, versus Cloud…You get the idea. The array of functionality and where it runs is different. Different in implementation and different in maintenance.

    This was a problem I (and others) pointed out when cloud started taking off: more work for ops, even if some of it is automated. Turns out ops, storage management and security all have more work, because all of those items are handled differently in the different architectures. And Protego had to focus on one to get it right, meaning they needed some kind of merger in the long run.

    So do you. Adding more and more work to ops–be it DevOps or traditional ops–is not the answer. A plan for standardizing is necessary.

    That is one of the big promises of containers, in my opinion. Not only are they more agile and easier to use in a DevOps environment, they are relatively standardized. Ops will still have more work if you’ve got apps in several of those architectures, but containers obfuscate some of the differences and allow standardized networking within the pod/node/group, for example.

    Some functionality just doesn’t fit into containers–you still need a physical network in the DC, or to configure the virtual network in a VPC to get traffic to/from your containers–but much of it does fit. Once at the pod/group, networking is virtual and the same regardless of where the containers are running. Which reduces overhead while making changes easier. The same is true for security, and increasingly for storage.

    There are great companies out there tackling these issues, and I’ll look at them on occasion. Right now, I know my former employer F5 Networks is working to solve the networking services/performance/security issues, and taking advantage of NGINX to handle some parts the core org traditionally hasn’t addressed. There are other companies, I just hear about that one more because I am still very close to some F5ers.

    It is worth planning for and certainly worth looking into more portable options, anything that lightens the load and keeps your great apps running. Keep kicking rear and spinning up apps.

    And don’t call me Tim.

    — Don Macvittie

  • The Top Six Cloud Computing Trends of 2019

    The Top Six Cloud Computing Trends of 2019

    Cloud computing was one of the hottest topics in the technology and business media throughout 2019. This is no surprise as the cloud sector has been growing rapidly for the last few years. Synergy Research Group recently reported a 37% overall growth year-over-year in public cloud. They also note that it has taken just two years for the public IaaS and PaaS markets to double in size and their forecast shows them doubling again within the next three years.

    While steady growth was expected this year, a few trends of note stand out. When the experts look back at 2019, they will likely stress the following cloud computing trends shaped the year.

    Rise of the Enterprise Cloud Manager

    We recently did a study on ParkMyCloud users which showed that a growing proportion of company technical leads have cloud or the name of their cloud provider–such as AWS–in their job title. This indicates a growing degree of specialization for individuals who manage and architect cloud infrastructure. Whether called enterprise cloud manager, cloud architect or something similar, 2019 saw the rise of a specialized role to oversee and direct cloud operations.

    Consolidated Multi-Cloud Views

    As enterprises large and small continue to adopt and use more than one public cloud, we have seen a rapidly growing need for a consolidated multi-cloud view and ability to take actions across multiple clouds in 2019. Third-party tools that do this provide enterprises the ability to pick a single tool to orchestrate, manage, govern and optimize their hybrid and multi-cloud environments. Many customers also sight the need to simplify operations—native cloud provider tools are not always easy to use.

    Multi-Cloud Arrives

    Multi-cloud truly arrived in 2019 and will only grow in 2020. The majority of organizations now use multiple clouds. In fact, most studies suggest that more than 80% of enterprises have a multi-cloud strategy. Reasons cited include the need to avoid vendor lock-in, the ability to leverage the best in class cloud services from each cloud provider and application efficiency choices.

    More Automation

    One of the biggest tech benefits to a DevOps approach is automating away the manual tasks that bog down operations and critical projects. Thus, the trend toward automation continued to expand in 2019.

    More Abstraction

    IT became more and more abstracted in 2019. This means container usage grew, along with models that allow developers to worry less and less about infrastructure (such as serverless and PaaS).

    Containers Became Mainstream

    Application containerization is more than just a new buzzword in cloud computing; it is changing the way in which resources are deployed into the cloud. More and more companies utilize container services such as Kubernetes and cloud native services such as EKS, AKS and GKS in 2019, 

    Business continued to move to the cloud in 2019 and the six trends described above showed that the sector is growing–sometimes in unpredictable ways. Next year will, no doubt, also contain some surprises. But the trend for expansion of the cloud and related services is unmistakable for the foreseeable future.

    — Jay Chapel

  • DevOps Deeper Dive: SUSE Sets DevOps Course

    DevOps Deeper Dive: SUSE Sets DevOps Course

    There was a time when SUSE was considered to be the second-biggest force driving the adoption of Linux in the enterprise, after Red Hat. Then came an odyssey to rival any epic written by Homer. A few short years after moving its corporate headquarters from Germany to Oakland, California, the company was sold to Novell, which was then later acquired by Attachmate. Three years later, Attachmate was acquired by Micro Focus. Three years after that, SUSE (as an arm of Micro Focus) acquired distributions of OpenStack and the Cloud Foundry platform-as-a-service (PaaS) from Hewlett-Packard Enterprise (HPE).

    That brings us to 2018, when SUSE was spun out of Micro Focus to become an independent company once again, headquartered in Germany once again. A year later Melissa Di Donato, formerly chief operating officer (COO) of SAP, was named CEO of SUSE. A few months after that, SUSE announced it would withdraw its distribution of OpenStack from the market to focus its efforts on emerging cloud-native opportunities stemming from the rise of Kubernetes.

    For SUSE, those opportunities arise from a distribution of Kubernetes deployed on its Linux operating system, which also serves as the foundation for its container-as-a-service (CaaS) environment, along with a version of Cloud Foundry deployed on top of Kubernetes.

    Brent Schroeder, global CTO for SUSE, said his company’s strategy is being driven by an acute need for increased flexibility. IT environments are inherently becoming hybrid as more workloads move to the public cloud, and many organizations will want to leverage a common substrate based on Kubernetes for building and deploying applications. In some instances, Kubernetes will be deployed on top of virtual machines, while in other use cases Kubernetes will be deployed on bare-metal servers. IT organizations will then decide to deploy a CaaS or PaaS depending on their requirements, said Schroeder, noting that regardless of the path chosen, IT modernization initiatives will create a significant opportunity for SUSE.

    “Virtual machines, bare-metal and the cloud will be a huge catalyst,” said Schroeder.

    DevOps, of course, is playing a major role in driving those transitions, which Schroeder said has become a major focus for SUSE as organizations think through how to not just build and deploy applications faster, but also secure and govern those processes. That latest version of SUSE CaaS Platform 4, for example, added support for Cilium open source project for securing network connectivity between containerized application services.

    Of course, SUSE is not the only IT vendor making this journey. Red Hat was the first to deploy a PaaS environment on top of Kubernetes and since then has been on a mission to obliterate the distinction between a CaaS and a PaaS environment. As an arm of IBM, Red Hat has also significantly expanded its market research as IBM builds out a hybrid cloud computing strategy based on the Red Hat OpenShift platform.

    Of course, Red Hat’s acquisition by IBM might create new opportunities for SUSE. After all, more than a few of the IT organizations that opted to embrace Red Hat OpenShift had plenty of opportunities to consider alternatives from IBM. Now that the acquisition has been finalized, some of them may be reconsidering their options.

    It’s too early to say when SUSE might arrive at its ultimate destination. When venture capitalists buy a company such as SUSE the goal is to either take the company public or recoup the investment by selling it to another entity. Whatever the outcome, it’s clear SUSE intends to leave its mark in the brave new world of containerized applications.

    — Mike Vizard

  • IBM Advances DevOps on the Mainframe

    IBM Advances DevOps on the Mainframe

    IBM has expanded its efforts to bring DevOps best practices to the mainframe by adding automated unit testing capabilities for CICS COBOL programs using Db2 to IBM Developer for z/OS (IDz) V14.2.1. The company is also making an instance of z/OS available within a Docker container that can be deployed on an x86 platform.

    Sanjay Chandru, director for IBM Z DevOps, said both capabilities will play a critical role in enabling IT organizations that have invested in mainframe to be much more agile. The Docker x86 capability will enable developers to build and test applications without requiring access to a mainframe, while IBM’s automated unit testing tools provide a much lighter-weight alternative to previous generations of tools, he said.

    In addition to automating assertions and pass/fail checks, the automated unit testing capability for IDz makes it possible to invoke the tests from within either the tool itself or as part of a continuous integration/continuous delivery (CI/CD) pipeline, Chandru said. DevOps teams also can now store tests in a modern source code management application alongside the code being developed, he added.

    The IBM unit testing tool can now intercept EXEC CICS and EXEC SQL application calls under CICS to allow data capture during a live run. This recorded data can then be used to create additional tests, including negative tests, in a virtual environment without having CICS because tests are now run as a batch job, Chandru said.

    Finally, IBM is also making it possible to export test results in PDF or XML in addition to JUnit and SonarQube formats.

    Chandru said interest in applying best DevOps practices in mainframe environments has increased dramatically as organizations embrace digital business transformation initiatives. Almost invariably, projects access applications that run on mainframe environments but still process most of the data within enterprise IT environments, he noted. Many organizations are now developing microservices-based applications that rely on mainframes at their back end, he added.

    However, given the rate at which those applications are being developed, legacy approaches to building and deploying mainframe applications are not able to keep pace with the rate of innovation now expected, said Chandru. As a result, IBM is encouraging organizations that have mainframes to shift responsibility for building and deploying applications much further to the left, he said.

    Long term, IBM wants to make developing applications for the mainframe “unremarkable” in the sense that tools for building and deploying applications for any platform should work equally well on mainframes, Chandru said, noting that approach will significantly expand the pool of developers that can build applications for the mainframe.

    It may be a while before DevOps best practices are employed pervasively across mainframe environments, many of which are steeped in legacy waterfall approaches to application development. However, there are pockets of IT teams within mainframe environments that are starting to appreciate the need to be able to respond to changing requirements more rapidly. The only issue that remains now is to determine just how deeply best DevOps practices on the mainframe will be embraced.

    — Mike Vizard