devopsy.kinsta.cloud

Tag: VMware explore

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom today at the VMware World Explore conference a set of hardened artifacts for the open source Spring framework, including the 5,000 dependencies that are needed to run it.

TrueSource Trusted Artifacts by Broadcom provides access to artifacts built in a clean room, including instances of Apache Tomcat, Kotlin, PostgreSQL, RabbitMQ, MySQL, and Valkey databases and middleware. It also extends to the Bitnami Secure Images catalog, adding hardened, verifiably built container images for hundreds of commonly used open source packages.

Based on the enterprise edition of the Spring framework that Broadcom supports, TrueSource Trusted Artifacts by Broadcom includes curated artifacts written in Java, Python and Node.js. Every library and artifact is selected against a reference architecture, then built and verified by human Broadcom engineers. That aspect of the service is critical because patches generated by AI coding that have not been validated by software engineers are much more likely to break an application running in a production environment.

Broadcom, via this service, will also scan customer repositories, assess the potential blast radius of each release, and then open pull requests based on the lowest-risk remediation path determined. There is also a set of dashboards through which DevSecOps teams can track what has been fixed and what tasks remain to be completed.

DevSecOps teams will also have the option to bring not-yet-public vulnerabilities they discover for early access remediation. In addition, there is a special program for critical infrastructure organizations that provides them with dedicated access to patch insights and mitigation advice.

Finally, Broadcom is committing to contributing the fixes it creates back to the maintainers of the open source software that it has remediated.

Purnima Padmanabhan, general manager for the Tanzu Division of Broadcom, said TrueSource Trusted Artifacts by Broadcom brings a lot of our open source capabilities together under one umbrella in a way that remains true to open source. In fact, Broadcom claims that over the past five months, engineers have already spent more than 12 billion tokens against frontier models to secure open source projects to ensure that every supported release line is patched before a Spring-related vulnerability is ever published.

Those efforts are crucial because earlier this year Broadcom revealed there has been a more than 1,700% surge in monthly security advisories reported by the Spring community, resulting in the largest set of security patches in Spring’s 23-year history being created and delivered.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at The Futurum Group, said a curated pipeline inside the customer’s own build and deploy path addresses a key software supply chain requirement. Teams pull libraries, images, and data engines already built, signed, and pinned to the versions their release lines support, with automation that opens pull requests carrying the lowest-risk fix, he added.

That removes work enterprises absorb today: Triaging advisories, testing patches, and deciding what is safe to ship, noted Ashley.

It’s not clear to what degree exploits created using AI are starting to overwhelm DevSecOps teams, but the one thing that is clear is nearly all of them will require additional help to keep pace. After all, it’s not so much a question of whether there will now be more incidents so much as how much they can first be prevented and, just as importantly, rapidly contained.

August 31, 2026
IBM to Provide Hybrid Cloud Service Based on VMware Cloud

At the VMware Explore 2023 conference this week, IBM announced that it will soon provide a fully managed service based on a streamlined edition of VMware Cloud.

Brendan Kinkade, vice president for independent software vendors, technology and hybrid cloud partnerships for IBM Global Sales, said VMware is now making available editions of VMware Cloud that are both easier to deploy and manage and, just as importantly, migrate between cloud platforms and on-premises environments as IT teams see fit.

IBM is committed to using that platform to deliver a managed VMware Cloud service that will span hybrid cloud computing environments aligned to an NIST-validated framework, he added. That approach is critical because it will enable IT teams to apply VMware license credits to any instance of VMware Cloud no matter where it is deployed, noted Kinkade.

In addition, the streamlined edition of VMware Cloud doesn’t use proprietary application programming interfaces (APIs) to make it simpler to port IT environments to another cloud service or back to an on-premises IT environment whenever necessary, he added.

At the foundation of the hybrid cloud service will be an instance of a multi-tenant vCloud Director console residing on the IBM Cloud. Through the console, IT teams will be able to work with IBM to co-manage application environments.

In addition, IBM is providing a managed IBM Cloud Cyber Recovery (ICCR) Service to better secure cloud computing environments.

It’s not clear how much of IT is now being consumed as a managed service, but the COVID-19 pandemic has certainly increased that number. Many IT organizations are also finding it simpler to rely on a managed services provider (MSP) to manage infrastructure so they can focus more of their time and effort on application development, noted Kinkade.

MSPs are also in a better position to aggregate all the telemetry data needed to train artificial intelligence (AI) models that will be used to automate workflows, he added.

Exactly how DevOps workflows will evolve as organizations rely more on external service providers to manage IT infrastructure is, naturally, a work in progress within many organizations. The main challenge is aligning a unique set of continuous delivery (CD) practices for deploying and updating applications with a provider that has already defined its own workflows.

Nevertheless, given the complexity of those environments, many organizations are not able to hire and retain the IT expertise required to manage it, so the only option may be to rely on an MSP.

Each IT organization will need to decide whether to rely on an MSP, given the total cost of a service. Many organizations often wind up having a mix of workloads managed by internal IT teams and external service providers. The one thing that is certain is that as the pace at which workloads are being deployed in the cloud increases, many internal IT teams are overwhelmed by a level of complexity that will only increase.

August 23, 2023
VMware Preps Generative AI Assistants to Automate IT Workflows

At its VMware Explore 2023 conference today, VMware previewed what will become a suite of intelligent assistants that use generative artificial intelligence (AI) to automate the management of a wide range of IT tasks.

Krish Prasad, senior vice president and general manager for cloud infrastructure at VMware, said VMware will eventually build out assistants for managing individual platforms such as VMware vSphere and the integrated VMware Cloud Foundation (VCF) platform through which the company aggregates those offerings into a single platform.

VMware is creating those assistants, also known as co-pilots, using multiple large language models (LLMs) that the company uses to train AI models using code written by site reliability engineers (SREs), said Prasad. That approach ensures that the recommendations being made along with the code generated are of the highest quality, he added.

That approach will enable IT teams to identify configuration drift that might be adversely impacting performance or that could create a cybersecurity risk, for example, noted Prasad. The first of those assistants is being made available in beta for VMware Tanzu, a platform based on Kubernetes. VMware is also building an assistant for its NSX virtual networking software that analyzes security events to generate policies and rules that can be applied to firewalls in real-time as threats are identified.

It will then be up to each IT team to decide whether to implement those recommendations. Over time, it’s clear that the management of IT infrastructure is going to become increasingly automated as confidence in those recommendations increases, he added. In fact, the ultimate goal is to fulfill the promise of ‘lights-out’ IT management, said Prasad.

In effect, advances such as these will lead to the democratization of DevOps workflows as it becomes simpler to manage IT infrastructure at scale. IT organizations will be able to invest more resources in building and deploying applications rather than hiring specialists to manage IT infrastructure, noted Prasad.

In fact, the pace at which applications are built and deployed should dramatically increase in the months ahead, Prasad predicted.

The rise of generative AI creates a unique opportunity for IT teams to become more relevant than ever to their organizations. It will soon be possible to build and deploy a wide range of distributed applications capable of processing and analyzing data at the point where it is created and consumed.

While generative artificial intelligence (AI) has captured the popular imagination, it’s becoming apparent that multiple forms of AI will soon be used together to automate DevOps workflows at levels of unprecedented scale.

Machine learning algorithms, of course, are already used by many organizations to automate everything from analyzing log data to identifying security issues to surfacing patterns in tests made using multiple regression, function and unit testing tools. With the rise of generative AI, it is now possible to automatically generate code and create summaries of reports that multiple stakeholders can more easily understand. Generative AI doesn’t replace the need for previous use cases involving machine learning algorithms. Instead, generative AI makes use of a form of deep learning algorithms to create different types of AI models.

As a result, DevOps workflows will soon be invoking multiple classes of AI models to automate workflows in ways that should enable IT teams to automate processes at unprecedented levels of scale.

August 22, 2023
VMware Looks to GitOps to Drive Edge Computing

At its VMware Explore 2023 event, VMware today unveiled an orchestration tool, dubbed VMware Edge, that promises to simplify the management of edge computing services at scale.

At the same time, VMware has launched a Project Keswick initiative through which it will work with customers to define additional use cases for VMware Edge based on zero-trust principles and GitOps workflows for deploying applications. The company also unveiled a VMware Retail Edge platform based on VMware Edge and is planning to add additional offerings aimed at specific vertical industry segments.

Finally, VMware is making available a managed connectivity service through which it will provide private 4G/5G wireless services.

VMware Edge Cloud Orchestrator is based on a tool that VMware created to orchestrate the management of its secure access service edge (SASE) platform. That has now been extended to support a wider range of software running on edge computing platforms.

Sanjay Uppal, senior vice president and general manager of service provider and edge for VMware, said the goal is to streamline the management of software-defined edge computing platforms via a single console. Achieving that goal requires the ability to identify and programmatically manage workloads distributed across a mix of networks, he added.

VMware is betting that as more workloads are distributed to edge computing platforms, there will be a greater need to centralize the management of workloads running on platforms that are not always easy to physically access. Less clear, however, is to what degree those edge computing platforms will be managed by IT teams versus operational technology (OT) teams that are usually embedded within a department that manages a specific business process.

However, regardless of who manages those platforms, they will be relying more on GitOps workflows to programmatically provision infrastructure and deploy applications that will need to be regularly updated. In fact, because these platforms are often dispersed across hundreds of physical locations, the need for a pull-based orchestration tool that works asynchronously is critical, said Uppal.

In the longer term, IT teams should also expect artificial intelligence (AI) capabilities to be applied in a way that makes edge computing self-healing, he added.

No one can say exactly how many organizations have adopted GitOps to manage the provisioning of both infrastructure and the delivery of applications, but it’s conceivable that edge computing will force the issue. The tricky part will be finding a way to manage those GitOps workflows at the necessary level of scale. Most DevOps teams already struggle with implementing DevOps workflows at scale, so if more workloads are to be distributed across hundreds of edge computing platforms, there will be a much more acute need for automation to consistently deploy, secure and update applications.

Regardless of approach, however, there may come a day when the number of workloads deployed at the edge far outnumbers the number of workloads deployed in the cloud or in a data center. The challenge and the opportunity now is to get ahead of edge computing issues before they inevitably create a set of management issues that will be more difficult to address after applications have already been deployed.

August 22, 2023
VMware Looks to Streamline Multi-Cloud Computing Management

VMware today integrated its console for managing cloud instances with its VMware Cloud Foundation to streamline the deployment of its software in on-premises IT environments.

Announced at the VMware Explore 2023 conference, the latest edition of VMware Cloud will make it simpler to manage multi-cloud computing environments by combining VMware Cloud Foundation Software and VMware Cloud Services into a single platform.

VMware also announced early access to an ESXi life cycle management cloud service for VMware vSphere+ that enables IT teams to centrally manage upgrades across a distributed vCenter environment. Additional updates to vSphere in the upcoming release include doubling GPU capacity per virtual machine.

Krish Prasad, senior vice president and general manager for cloud infrastructure at VMware, said the goal is to improve the overall pace of innovation; in addition to deploying workloads in on-premises IT environments, organizations are also deploying workloads on multiple cloud computing services.

VMware Cloud is being made available in five editions that can either be managed by an internal IT team, an external services provider or by VMware. In addition, a VMware Ransomware Recovery service based on VMware Cloud is also generally available. Following a breach of an on-premises IT environment, VMware Ransomware Recovery will enable organizations to run production workloads in the cloud until forensics are completed. The company also unveiled a technology preview of cybersecure storage that will integrate recovery workflows with native vSAN snapshots and add support for Google Cloud VMware Engine.

In addition, VMware is adding a managed NSX service delivered via the cloud, dubbed NSX+, that manages instances of the virtual networking software that runs on top of its virtual machine software. There is also now an NSX+ virtual private clouds (VPCs) option that isolates instances of the virtual networking platform.

Finally, VMware is adding a VMware Cloud with VMware vSAN Max, which will make 8.6 petabytes of disaggregated capacity and 3.6 million IOPS per cluster available on demand later this year.

VMware appears to be streamlining the number of platforms IT teams need to acquire to support and manage IT infrastructure at a time when more organizations are trying to navigate increasing economic headwinds.

One way or another, IT teams will need to reduce the cost of IT at a time when IT environments are becoming more complex. VMware is betting that, given its dominance in on-premises IT environments, there will be a natural inclination to deploy more of its software in the cloud to create a more homogenous IT environment that is less complex.

However, it’s not clear whether organizations are willing to pay extra for the privilege. Many organizations are now supporting multiple classes of virtual machines and associated software despite the fact that each additional platform raises the total cost of IT.

In the meantime, many IT organizations are also awaiting the outcome of Broadcom’s effort to acquire VMware before deciding how to centralize the management of multi-cloud computing environments.

August 22, 2023