devopsy.kinsta.cloud

Tag: open source

  • Survey Sees Cloud Foundry Momentum Gains

    Survey Sees Cloud Foundry Momentum Gains

    At a time when many organizations are wondering to what degree they should rely on legacy application development and deployment platform versus emerging container-based platforms, the Cloud Foundry Foundation (CFF) today released the results of a survey that shows reliance on the organization’s namesake open source platform-as-a-service (PaaS) environment continues to grow.

    Announced at the European Cloud Foundry Summit, the annual survey of 306 IT professionals finds 45% of respondents describe their use of the PaaS as “broad,” compared to 30% a year ago. The same survey finds nearly 20% started using Cloud Foundry in just the last 12 months and 39% of developers are deploying applications now in less than one day. More than three-quarters (77%) report application development cycles of fewer than three weeks.

    Nearly half of survey respondents report they have at least 100 developers using the PaaS, a significant jump from just one-third last year, and the share of companies with more than 50 applications on Cloud Foundry grew to 43% in 2019.
    The future of the PaaS has been called into question ever since the rise of Docker containers and Kubernetes. The CFF has been slow to adopt Kubernetes as a more efficient foundation for deploying a PaaS environment. Most recently, the CFF has provided organizations that adopt the PaaS the option of replacing the Diego container orchestration engine developed by the CFF with Kubernetes. At the same time, the CFF is working toward replacing much of the foundation layer for Cloud Foundry with Kubernetes to provide a more efficient means of standing up a Cloud Foundry environment.

    The CFF has also made it possible to deploy applications built on Cloud Foundry on a Kubernetes runtime. CFF CTO Chip Childers says that no one should be surprised when the rise of Kubernetes leads to more adoption of Cloud Foundry. Most of the application development environment available for Kubernetes today are not as robust as the Cloud Foundry PaaS, with the notable exception of the Red Hat OpenShift PaaS. Following the acquisition of Red Hat, IBM is now promoting Red Hat OpenShift as the cornerstone of a hybrid cloud strategy that has Kubernetes at its core. Meanwhile, last month Pivotal Software, provider of a curated instance of a Cloud Foundry PaaS, told financial analysts it expected to see a $40 million to $50 million decline in revenue in fiscal 2020. Shortly after, VMware moved to acquire Pivotal, which, like VMware, is a unit of Dell Technologies.

    An update to a previous report published today by source{d} shows there are now 879 repositories in the Cloud Foundry GitHub organization, with the total number of commits reaching approximately 50,000 per month. The report finds the highest levels of activity are centered around the Stratos UI project, Istio integrations and the core Cloud Foundry Application Runtime Cloud Controller.

    The CFF and Kubernetes, under the auspices the Cloud Native Computing Foundation (CNCF), fall under two separate arms of The Linux Foundation. It’s unclear if the Linux Foundation might one day merge these two arms or continue to keep them separate as a means of navigating conflicting vendor strategies. Whatever the outcome, Cloud Foundry is likely to remain a vibrant part of the open source community for many years to come.

    — Mike Vizard

  • Eclipse Foundation Delivers on Jakarta EE Promise

    Eclipse Foundation Delivers on Jakarta EE Promise

    The Eclipse Foundation today announced the general availability of Jakarta Enterprise Edition (EE) 8 Full Platform and Web Profile specifications and associated technology compatibility kits (TCKs).

    Announced during the JakartaOne Livestream virtual conference, Jakarta EE 8 is the follow-on open source platform to JavaEE that provides a foundation for building cloud-native applications using a familiar Java construct.

    Mike Milinkovich, executive director of the Eclipse Foundation, said the availability of Jakarta EE 8 represents a milestone in that it is the first official release of a full Jakarta platform since Oracle agreed to give up control of Java EE to the Eclipse Foundation.

    Its specifications are fully compatible with Java EE 8 specifications and include the same application programming interfaces (APIs) and an instance of Javadoc using the same javax namespace. Its TCKs are based on, and fully compatible with, all Java EE 8 TCKs. Jakarta EE 8 will not require any changes to Java EE 8 applications or their use of javax APIs. The specifications were developed under the Jakarta EE Specification Process, which replaces the Java Community Process (JCP) for Java EE.

    The Eclipse Foundation is announcing the certification of Eclipse GlassFish 5.1, an open source compatible implementation of the Jakarta EE 8 Platform. Eclipse GlassFish 5.1 is fully tested under the open source-licensed Jakarta EE 8 TCKs for the Full Platform and Web Profiles.

    IBM today also announced that Open Liberty, an open source implementation of the WebSphere Liberty application server, has been fully certified as being compatible with Jakarta EE 8 profiles. All vendors in the Jakarta EE Working Group, including Fujitsu, IBM, Oracle, Payara, Red Hat and Tomitribe, have committed to certifying their Java EE 8-compatible implementations.

    Milinkovich said Jakarta EE 8 should drive a wave of innovation as more than 10 million developers who already know Java employ the platform to build cloud-native microservices that can be deployed using containers on Kubernetes platforms. In fact, he said, the number of cloud-native applications based on microservices that will be built and deployed in the enterprise will soon accelerate. As that transition occurs, the number of organizations embracing best DevOps processes to manage those applications also should significantly increase because the rate at which Jakarta applications will be built will be faster than Java applications historically have been built.

    Collectively, Milinkovic also noted that despite the rise of rival programming languages, these and other forthcoming efforts will drive a resurgence in interest in Java programming languages that will ensure Java’s continued dominance of enterprise IT environments for many years to come.

    Of course, the primary reason IT vendors are excited is they no longer need to pay royalties to Oracle. It’s not clear how much of those savings might be passed on to IT organizations. What is apparent is that organizations that are required to employ open source technologies whenever possible are going to be a lot happier now that Jakarta EE 8 has finally arrived.

    — Mike Vizard

  • Why Modernizing Security is Like Visiting a Fast-Food Restaurant

    Why Modernizing Security is Like Visiting a Fast-Food Restaurant

    Fast casual restaurants are taking over the food industry. Today’s consumers want quality and speed, and the brick-and-mortar model offering immediate service paired with quality ingredients perfectly fits the bill. It’s the new, modernized dining experience. You can also argue that the same modernization taking the food industry by storm is happening in the security sector.

    Simply put, fast-food restaurants know what their customers want: food that’s served hot, fresh and quickly–all while being made to order. And while the needs of a fast-food customer may seem far from the security needs of an organization, it isn’t too far off. Just like a fast-food customer, DevOps teams are hungry for a streamlined process. However, in their case, this doesn’t come in the form of a fried chicken sandwich; rather, an app infrastructure that is low-latency, secure and brings visibility.

    According to the 2018 Verizon Data Breach Investigations Report, web application attacks are the leading source of data breaches. This suggests security procedures are not keeping up with modern systems and vice versa, which means they’re not keeping up with the modern customer, who has increased security needs due to demands for fast, interactive, web-based experiences with vendors. From food service to security, many industries are learning that, to succeed today, you’ve got to combine the old with the new.

    As technology evolves, systems must as well. When it comes to security, it does not make sense to continue using a legacy WAF built for a decades-old line of defense. Today’s technology and applications require next-gen WAF systems that can keep up with the changing infrastructures and the evolving threat landscape. The risk is too great to sit back and do nothing.

    Security teams today often find themselves either supporting new infrastructure initiatives or inheriting legacy applications and systems. Determining where an application is running can be a challenge. Rather than simply pointing to a rack of servers to locate an app, security professionals now must look to the cloud. However, this presents another obstacle: container orchestration. Kubernetes or otherwise, the options are not always clear-cut.

    A modern infrastructure mix is made up of many parts (much like a layered chicken sandwich): cloud, containers, hardware, platforms—and sometimes serverless. Flexibility and deployment options are essential to defending applications and APIs across multiple components and delivery stacks. Typically, security teams end up in a balancing act of supporting new infrastructure plans while taking over existing legacy systems and applications.

    To be adequately protected, security teams must evaluate defensive tools, open source or commercial, for use in:

    • Major cloud providers (e.g. AWS, Azure, IBM, GCE)
    • Container platforms (e.g. Kubernetes, Docker)
    • Hardware and web servers (e.g. load balancers, NGINX+)
    • Serverless options (e.g. API gateways)
    • Platform services (e.g. Heroku, language plugins)
    • Cloud-based deployment models (e.g. hosted cloud WAF)

    The modern world is ever-evolving and the definition of “modern” changes as new technology is introduced. Fast-food chains have evolved over the years and, in turn, moved the food industry forward with the introduction of fast, casual and reliable options. The companies continue to evolve to meet the customers’ demands by introducing delivery services, unique rewards programs and leading mobile apps.

    The security world can learn a thing or two from the fast-food chains’ commitment to continued business evolution. Much like the way fast-food customers are quick to jump ship if they don’t see the selection they want, legacy WAF customers are learning they can make a change to other security solutions if features and infrastructure aren’t evolving.

    The simple truth is legacy WAF solutions can’t accommodate today’s technology and applications, exactly how traditional fast-food can’t keep up with customers’ growing demand for tasty yet quick meal options. This leaves proprietary data exposed and vulnerable to attacks. It’s time for security leaders to take action and upgrade their systems while getting their teams up to speed without sacrificing security of their vital assets.

    — Jonathan DiVincenzo

  • GitHub Actions Advances Automation Strategy

    GitHub Actions Advances Automation Strategy

    GitHub Actions, a set of application programming interfaces (APIs) through which DevOps tools can automate workflows, is now available in beta.

    Previewed last year at the GitHub Universe event, GitHub Actions is intended to provide not only a way to automate responses to events occurring within a GitHub Repository but also share those workflows across multiple DevOps teams, said Max Schoening, senior director of product design for GitHub.

    Actions are based on YAML files, which makes it possible to write them in JavaScript or other programming languages or package them up as a set of containers. In either instance, they are designed to interact with the full GitHub API and any other public API.

    In addition, higher levels of automation enabled by GitHub Actions should make it more feasible for DevOps teams to test multiple versions of a project in parallel as workflows written in code replace manual processes, said Schoening.

    As more manual processes become automated, the number of IT teams who are intimidated by DevOps processes today should begin to decline. Organizations also should be able to apply best DevOps practices more consistently across multiple teams. Too often today the DevOps practices within the same organization tend to vary widely. Schoening also noted that given the open source history of GitHub, organizations will be able to see how workflows have been created for popular open source projects and then copy them.

    In addition, Schoening said the arm of Microsoft will continue to invest in analytics that will surface workflow recommendations that can be applied to any project regardless of the language employed or the platform on which it’s destined to be deployed.

    On one level, DevOps is all about a ruthless commitment to automation. But when automation goes wrong at scale, it can be extremely problematic. Rather than relying on “black box” approaches to automating processes, a truly open source approach to automation makes it possible for DevOps teams to see how a process is being automated and then extend it if they so choose, said Schoening. To help address the concern, GitHub Actions also provides access to live logs to provide real-time feedback as builds run, which Schoening said makes it easier for DevOps teams to debug automations created using GitHub Actions.

    It’s too early to say just how automated DevOps processes will get. There’s an emerging school of thought that contends the goal is to make it feasible for developers to spend 100% of their time writing business logic. It’s not clear whether that goal is achievable anytime soon, but progress is made with each update to continuous integration/continuous development (CD/CD) platforms. As complementary advances in machine learning algorithms and other forms of artificial intelligence (AI)—otherwise known as AIOps—occur, it’s apparent many manual DevOps processes will fall by the wayside.

    In the meantime, the workflows that make up any DevOps process should become increasingly sophisticated as advances in automation span everything from hybrid cloud computing environment to internet of things (IoT) deployments. The issue soon may not be how cumbersome any DevOps workflow is, but rather the potential limits of the imagination applied to automating them.

    — Mike Vizard

  • DevOps World | Jenkins World 2019: Sacha Labourey Q&A

    DevOps World | Jenkins World 2019: Sacha Labourey Q&A

    CloudBees has been active on the acquisition front, picking up Electric Cloud and Rollout in recent months: Are we going to be talking about other deals by the time DevOps World Lisbon rolls around in December?

    “We’re always actively looking at deals that make sense. To be truthful, we’ve set the bar pretty high at the moment. Not only are we focusing hard on executing on those acquisitions, we’re delivering on a vision we’ve laid out for the future in a category we call Software Delivery Management.”

    What are you most looking forward to at DevOps World | Jenkins World 2019?

    “Always the same: Meeting with great people, hearing about the great innovations in the Jenkins and Jenkins X community, and really, checking out everything all these talented companies are doing. The amount of creativity and innovation we see year after year at DevOps World | Jenkins World is truly amazing.”

    How is CloudBees addressing gender and diversity at this year’s event?

    “We have supported diversity at DevOps World | Jenkins World for a very long time. We’ve tried to encourage diversity in our recruitment of speakers and in our acceptance of them. Specific to this year’s conference, on the Wednesday of the conference week (August 14), CloudBees is sponsoring a Women In Tech mixer, as part of the conference activities. On Thursday, August 15, we’re sponsoring a Diversity and Inclusion luncheon. At the luncheon, a panel of speakers tackle the topic Connecting Diversity and Inclusion with Business Outcomes.

    Outside of DevOps World | Jenkins World, here are some other ways we’ve been trying to be inclusive and supportive of diversity:

    • CloudBees encourages diversity in our hiring. Our industry is heavily white male, but we are committed to achieving more diversity within the company. We’ve been benchmarking ourselves against the industry to see how we rank, relative to our peers. We are not satisfied with the results. We employ highly capable transgender, minority and culturally diverse people. We will continue to make this a priority.
    • We are currently a customer of Power to Fly and are working with them to help attract more women into technical roles. We hosted a Women in Tech event in conjunction with Power to Fly in our Raleigh office on June 25.
    • We have actively supported women in DevOps (as evidenced by the blog series on our website about Women in DevOps). We have had specific breakouts at company meetings and at past DevOps World conferences for Women in Tech.
    • We have supported an internal team of women who applied to speak at the Grace Hopper conference. We are very proud that two have been accepted.
    • Our Customer Advisory Board has increased female representation from two to six (out of about 30 total members).

    As positive as this is, it’s not enough and we are not satisfied with our gains in diversity. We continue to focus on this important area.”

    How has the evolution of DevOps World mirrored CloudBees’ growth?

    “We’ve really witnessed it all since 2010 and before. We’ve been part of the first steps of CI, the move to the right and the quest for ever-increasing automation. We’ve seen the fantastic chain reaction where cloud has enabled organizations to do so much more in DevOps and DevOps has returned the favor, opening up so many opportunities for cloud. We are really witnessing the birth of a new tech era. It is a unique privilege for CloudBees to be part of that small group of change agents!”

    One of the sessions talks about how to become a “DevOps superhero.” What is your personal DevOps superpower? 

    “That’s easy: open source. After years in the JBoss community, at Red Hat and now at CloudBees, where we are the leads on the Jenkins and Jenkins X projects, I still love open source. It is part of our DNA here at CloudBees. There is so much innovation going on in the open source communities, and the developers who are involved are so passionate about what they do. I do think, for the most part, open source developers are among the best in the developer community. They are also inclusive and really have a desire to impact the world.”

    — Heidi Gilmore

  • The Challenge of Securing Open Source Applications

    The Challenge of Securing Open Source Applications

    As enterprises have increased their reliance on applications over the years, there has been a significant rise in the use of reusable software components such as third-party libraries and open source code. This makes perfect sense, as this development method makes it possible to add value to applications and other software offerings quickly and easily. After all, why reinvent the wheel when supposedly well-tested and proven software components are readily available?

    As a result, open source code has become a vital part of software development for most organizations. Today, nearly 70% of every application is comprised of reusable software components, including open source software. At one time, open source software was considered too risky for commercial use. That is not the case today, however, as even major corporations are making use of open source components to innovate and deliver applications to market rapidly.

    While enterprises have gotten very good at using open source to speed the application development process, they have not yet figured out how to do so without inadvertently introducing vulnerabilities into their code. This is due in part to the fact that as more enterprises increase reliance on applications, they fail to implement application security into the software development life cycle. Consequently, as the adoption of open source software continues to grow, the likelihood of applications inheriting vulnerabilities is higher than ever before.

    This is evidenced by the fact that, according to my company’s research, unpatched library vulnerabilities make up 21% of all application vulnerabilities, by far the most of any type. In fact, nearly 20% of the inquiries we answer are related to unpatched libraries, which is almost on par with injection vulnerabilities.

    That is why it is imperative for development teams to stay up-to-date with open source library maintenance and updates.

    Software Composition Analysis

    The right way for organizations to track their open source components is through a set of technologies known collectively as software composition analysis (SCA). These technologies, which arose out of a need to automate the open source management process, provide organizations with visibility into their open source inventory. This allows them to identify third-party and open source components integrated into their applications.

    Using SCA, organizations can determine easily if any of their applications are relying on a vulnerable library, if any libraries are out of date and whether licensing is legal/proper. SCA helps them identify multiple types of risk introduced by third-party and open source components. These can include known vulnerabilities, intellectual property risk and technical debt related to component age.

    It’s important to remember the use of open source software code is not a problem in and of itself. On the contrary, it has been an essential part of the recent innovations in software development, and, in fact, it is no riskier than proprietary or commercial off-the-shelf offerings.

    Problems arise only when organizations fail to be proactive in identifying and managing security and license risks associated with open source code. This may occur in part because it is assumed that, as with commercial software, updates, patches and information are pushed to the user. But that’s not the case in the open source world, where the onus is on the user to keep track of these things.

    It takes diligence, but in the end, the only way to mitigate both the security and legal risks associated with your open source code—and to fully realize its benefits—is to track every piece of it. Today, SCA is the proven way to help you do that. By incorporating SCA into the development process, developers can capture inherited vulnerabilities early enough to prevent them from being introduced. Of course, it should go without saying, but it’s not enough to just find vulnerabilities; you also must fix them. The most typical remediation is replacing vulnerable components with the non-vulnerable ones.

    Considering most application code is now open source, and attackers are going after vulnerabilities in open source more than ever before, SCA should not be an afterthought. It needs to be an integral part of any organization’s application security and secure DevOps processes.

    — Joseph Feiman

  • Blockchains Done Right Are the Next Evolution in Open Source

    Blockchains Done Right Are the Next Evolution in Open Source

    Open source code is more than just a way to create new technology. It’s a disruptive force that changed the way software is built, from taking individual developers and turning them into thriving communities to changing how enterprises do business–building open ecosystems versus restricted walled-gardens.

    The next evolution of this movement is blockchain technology. Decentralized groups of developers across the globe are contributing to greater data integrity for businesses, better guarantees to ecosystem partners and can work together on live instances including their data. And that was the missing piece–live instances. Up until now, we could only collaborate on writing the code for a system together. Today, with blockchain technology, we can also collaborate on running this system together.

    Open Source is Decentralized

    From its ideological beginnings in the 1980s, open source code changed how we do business around the world, all stemming from developers’ work in software creation. Developers have seen open source disrupting almost every field of infrastructure, from operating systems (Linux in the cloud) to databases (MySQL, MongoDB, Redis) to programming languages (JavaScript, Python, Java, C, PHP).

    Over time, open source connected thousands of developers and established a corporate precedent. In parallel, the largest corporations in the world are also the biggest contributors to open source. It is with these two transformations open source is now over 50% of all code relied upon in the average proprietary system in enterprise.

    Now, blockchain is disrupting existing business models by extending the implementations and possibilities of open software. It does so by providing a transparent and immutable record keeping method, auditability of algorithms, forking of live instances with the data and possibility facilitate governance participation, all derived from an open source, decentralized community.

    Amazon recently added support for open source blockchain frameworks such as Hyperledger and Ethereum on AWS. This is a great first step toward making this technology widely available. As more AWS blockchain customers build on the open source frameworks to build for enterprise business, the powerful capabilities of open source will become a part of the blockchain movement. Transparency, auditability and forkability in code, all present enormous opportunities for developers while also demonstrating a precedent.

    It should be noted where these instances run, whether on private permissioned networks or public permissionless ones, is material to their ability to provide external guarantees to their users. The highest standard of trust is permissionless–where any member of the public can participate in their operation and audit.

    Decentralization Rewards Both Developers and Enterprise Business

    Businesses have gained major advantages through the use of open source software. In the same way, decentralized blockchain infrastructure offers businesses increased security, robustness and most importantly, guaranteed transparency with its customers.

    Prior to the open source software movement, traditional methods of programming were expensive, slow to develop and lacked insight into user experience until long after each new release came to market. Today, developer communities download, interact and actively contribute to blockchain projects in the same way as open source. Decentralized developers give businesses rapid ability to replace arbitrary features with intentional decision-making by a large, merit-based community. Decentralized blockchains are Open Source 2.0.

    Today, most standard apps run with centralized back ends. The server hosts the back end and dictates how the database evolves, given users’ requests and transactions. End users interact through the front end and never see what’s going on behind their static experience. What if we gave users a way to shift the power structure inherent in this state? Apps could become better for their users and much more competitive.

    Not All Blockchains Fit the Open Source Credo

    There’s a wide spectrum in the industry with blockchain technologies ranging from fully public to completely private. There’s a lively debate whether the value given by these fundamentally different solutions is comparable. I argue that distributed ledger technologies or private blockchains have little technological innovation. Their validators are permissioned, which means they cannot provide unbiased external guarantees to their partners and users.

    That said, there are some benefits to using private blockchains in certain use-cases such as coordination between a small number of competitors or WalMart onboarding all its external supply-chain services onto one coordinated platform, but they are limited in giving any guarantees to anyone not participating in the consensus (i.e. not running a node).

    Public blockchains offer a business greater transparency, because there are neutral and external parties operating the blockchain outside of the company and its customers with an independent incentive system. This removes anyone’s opportunity inside the company to falsify records, as they could potentially do on a private blockchain, or have data integrity relying on business relationships and dependency. Public blockchains also live up to the ultimate test of trust–from the comfort of your home you can verify by yourself every guarantee provided by the network.

    Where Hybrid Blockchain Comes In

    Most public blockchains were designed for absolute decentralization, which makes them impractical for mainstream businesses. Private blockchains are highly practical but don’t offer the transparency and trust possible with public blockchains.

    Hybrid blockchains, such as the one developed by Orbs, offer the best of both worlds. They’re perfectly designed to address fundamental issues with performance and interoperability while allowing for applications in highly distributed environments. They provide strong guarantees, verifiable by anyone, yet leave businesses in control of their business models, governance and security.

    — Tal Kol

  • The Linux Foundation Breathes New Life into Osquery

    The Linux Foundation Breathes New Life into Osquery

    Facebook’s useful but neglected DevOps tool Osquery has gotten a new lease on life, thanks to The Linux Foundation.  

    Anyone who has been tasked with monitoring the security of server instances in a data center or cloud knows how laborious and time-consuming it can be. Osquery, a project started by Facebook, aims to lessen this burden by reframing how developers engage with their infrastructures. DevOps professionals can use Osquery to expose an operating system as a high-performance relational database, making it possible to use SQL commands to access data about a system, just as they would for a database. 

    Osquery works on Mac, Linux and Windows systems and is provided as an open source download via GitHub. Although Osquery was developed by Facebook to monitor and safeguard the security of its own platform, the social media giant quickly realized the utility of the platform would extend to other enterprises that depend upon insight into the low-level behavior of operating systems. 

    Facebook publicly released the project’s code and documentation in 2014, in response to feedback from a small number of other companies that tested Osquery. The public availability of Osquery resulted in a number of major companies including Airbnb, Dropbox, Netflix, Etsy and Uber to bring Osquery into their software development environments. Nevertheless, users have voiced frustrations with Facebook’s handling of Osquery, and have accused the internet giant of neglecting the project.

    To address those complaints, The Linux Foundation has taken over the mantel of Osquery and recently announced the formation of a new foundation to support the Osquery community. 

    The new Osquery Foundation brings together engineers and developers from Dactiv, Facebook, Kolide, Trail of Bits, Uptycs and many others committed to supporting the project with technical contributions and long-term stewardship. A Technical Advisory Board will be created to handle the shift in management from Facebook to the Osquery Foundation and will oversee the priorities initiated by the foundation’s members.

    This restructuring of management promises to extend the usability of the project as a number of developers contribute to the codebase.

    “Osquery has drastically simplified the process of operating system monitoring, which has unlocked new methods for securing infrastructure, detecting anomalies and more. We look forward to working with the Osquery community to develop the foundation in a manner that will continue to foster the growth and adoption of Osquery while supporting the community’s diverse needs,” said Jim Zemlin, executive director at the Linux Foundation.

    Developers working to maintain the security of their systems believe it would be wise to incorporate Osquery into their workflow. “Although Osquery will never do everything that a security team needs, it gets about 80% of what you need for endpoint insight in one package,” said Doug Wilson, director of security for Uptycs.

    Although the platform requires some configuration, developers familiar with SQL will feel accustomed to using Osquery to retrieve information about their systems. Furthermore, Osquery’s cross-platform support and customizability make it especially attractive to businesses with newer types of infrastructures and ones that work at scale. 

    The move away from Facebook toward a more community-friendly foundation is sure to breathe new life into the project, and as development on Osquery expands, it is likely to become a more valuable resource for security teams moving forward.

    This article was co-authored by Tyler Ohlhorst, research analyst and freelance copy editor and copywriter at Magnum Consulting.

    — Frank Ohlhorst

  • IBM Closes $34B Red Hat Acquisition

    IBM Closes $34B Red Hat Acquisition

    Following the official closing of IBM’s $34 billion acquisition of Red Hat today, leaders from both companies reiterated Red Hat will continue to operate independently of IBM but will leverage IBM resources to advance the hybrid cloud computing ambitions of the newly combined entity.

    Arvind Krishna, senior vice president for cloud and cognitive software at IBM, said IBM and Red Hat together will be in a better position to address what he described as Chapter Two of a continuing cloud journey. With 80% of applications still running in on-premises IT environments some 10 years after the arrival of public clouds, it’s apparent hybrid cloud computing will become the dominant form of IT, he said.

    Red Hat will play a critical role in helping customers achieve that goal using a common operating model based on distributions of Linux and Kubernetes container orchestration software, Krishna said. However, he added, IBM sees no need to rationalize its current middleware software portfolio, which often addresses use cases that Red Hat doesn’t.

    Paul Cormier, executive vice president and president for products and technologies for Red Hat, said Red Hat will continue to invest in products and projects independently of IBM. As such, Red Hat does not expect its relationship with its partners that compete directly with IBM to change substantially, he said. At the same time, he stressed that working more closely with IBM will accelerate a 100% open source approach to hybrid cloud computing that otherwise would have taken Red Hat “many years” to execute on its own. That hybrid cloud computing strategy, in contrast to rivals, will span virtual machines, bare-metal servers and public clouds, Cormier said.

    Other than introducing Red Hat to a potentially larger customer base, it’s not quite clear how being a unit of IBM accelerates the Red Hat strategy. Red Hat and IBM sales teams, for example, will have no incentives to cross-sell offerings and Red Hat will continue to promote its brand independently of IBM, in much the same way VMware operates independently of the rest of Dell Technologies. Both Red Hat and IBM also stressed there is no plan to impose an IBM culture on Red Hat or lay off any personnel. There is a consensus that open source software will play a role in enabling hybrid cloud computing that should generate opportunities for IBM to generate more professional services revenue.

    Longer-term, there’s clearly an opportunity for both Red Hat and IBM to promote the adoption of a common set of best DevOps practices across a hybrid cloud computing environment. Many organizations, however, are already moving to extend those best practices across all the platforms that make up very diverse IT environments.

    For now at least, organizations that have already committed to Red Hat appear to be lending their continued support. Red Hat’s fiscal year 2019 revenue was $3.4 billion, up 15% year over year. Fiscal first-quarter 2020 revenue was $934 million, up 15% year over year. Services revenue for Red Hat also grew 17%. Precisely how IBM and Red Hat intend to unlock the value of this merger beyond the momentum Red Hat already enjoys, however, remains a bit of a mystery.

    — Mike Vizard

  • Pivotal Embraces Spinnaker for Continous Delivery

    Pivotal Embraces Spinnaker for Continous Delivery

    Pivotal Software has added support for the Spinnaker continuous delivery platform to its platform-as-a-service (PaaS) environment for the open source Cloud Foundry PaaS.

    Richard Seroter, vice president of product marketing at Pivotal, said version 2.6 of Pivotal Cloud Foundry (PCF) extends the reach of the Spinnaker CD platform developed by Netflix to its PaaS environment and Enterprise PKS, an instance of Kubernetes curated by Pivotal and its sister company, VMware.

    At the same time, the latest version of PAS adds support for a beta instance of custom sidecar processes, which enable developers to embed additional functions running in an isolated container directly within their applications. That capability makes it possible to deploy, for example, a service mesh within the application, said Seroter.

    Finally, Pivotal plans to add multicenter replication capabilities for MySQL databases and a permissions model to Concourse for PCF, a continuous integration tool for building application pipelines with a Pivotal CF environment. That latter capability provides a mechanism through which DevOps teams can automate application updates, including patches, end to end, Seroter noted. As more patches are released to address the growing number of critical flaws involving microprocessors that make use of hyperthreading, the ability to automate their deployment is now more critical than ever, he said.

    Pivotal is seeing the deployment of both traditional 12-factor applications and more modern containerized applications on its PaaS environment. At the same time, the Cloud Foundry Foundation, which oversees the development of the Cloud Foundry PaaS, has,  via Project Eirini, made it possible to deploy containers that rely on Kubernetes rather than the Diego orchestration platform developed for Cloud Foundry. However, Eirini is still an alpha project and Pivotal has not yet fully committed to a specific level of support for Kubernetes with its overall PaaS strategy.

    In the meantime, Seroter said PCF continues to gain momentum in organizations looking to build and deploy software much like a technology company. As more organizations realize how dependent they are on software to drive revenue, they want to rely on a platform that makes it easier for them to manage software development and deployment platforms at scale, he noted.

    As part of that effort, Pivotal Software is aggressively incorporating tools that will enable organizations using its PaaS to implement best DevOps process. Many have adopted various modern development platforms in isolation but continue to rely on the Cloud Foundry PaaS to automate the building and deployment of mission-critical applications. Now, two classes of development platforms are merging into a single entity that makes it easier to embrace agile development methodologies using a lightweight development platform.

    Whatever the outcome, PaaS environments are not going away anytime soon. However, what organizations perceive as the role a PaaS environment plays in any enterprise soon might expand considerably as more container technologies are infused into the platform.

    — Mike Vizard