Continuous Cloud-Native Progress – Cloud Native Now Podcast EP5

All right folks. Welcome back to the Cloud Native Now podcast. I am Sharon Florentine.

I am here again with Mike Ard, and this week we have a great show for you. We're gonna span all kinds of different cloud native topics, but the first, first thing we want to kick off with is an announcement that Octopus Deploy made that they have acquired Code Fresh. And their intention in doing so they say is to modernize DevOps in Kubernetes environments.

And I'm wondering a couple things. What does that look like? What does it mean to modernize DevOps Op?

This is, uh, the operative conversation of the day. In fact, we were just discussing that very thing on the text drawing gang. Um, let's just dive into that for a minute because if you listen to the announcement, first se, and it makes sense in the, in the, in this regard, they're saying that our pipelines are a little bit outta control.

Codefresh provides a way to, um, organize them and reduce the number of pipelines that you need, uh, which is probably a good thing as software development gets more complex. Um, but they're also saying that, um, in the, with the rise of Cloud native, we are seeing more DevOps teams embrace continuous development or delivery, whichever phrase you prefer. And the issue has always been that with legacy CICD platforms, everybody did CI and hardly anybody did CD because it was just too hard.

The platforms are all snowflakes and the monolithic side in the cloud native era, with the rise of Kubernetes, you get a consistent set of APIs that makes it easier to do continuous delivery. And so, um, uh, octopus Deploy is betting that more organizations will, um, embrace cd and as such, they will look for a CI front end that is more closely aligned, or at least, um, loosely coupled to the CD platform in a way that gives people the flexibility they require. And it's an interesting argument on the Converse side.

A lot of the providers of existing CICD platforms would argue that, well a organizations are continuing to build monolithic applications, so they need to be able to build and deploy monoliths alongside microservices based applications. And they're not gonna throw out what they currently have in place. And many of them are already using those platforms to build cloud native applications that get deployed on Kubernetes clusters.

So there may not be as compelling a need to rip and replace. That said, um, CloudBees has a proprietary offering that they are positioning as a modern DevOps platform. And that is interesting in the sense that they're moving away from that open source model that made Jenkins go Mm-Hmm.

Um, we also have Harness, which is embraced open source, and then there's this Argo CD platform that Intuit built that is being advanced under the CNCF that is gaining traction in, um, cloud native environments. And one of the reasons that Octopus Deploy bought codefresh is they have a lot of expertise working with Argo. And in fact, there's an interview over on, uh, Textron TV with, uh, Jeremy RA from Credit Karma talking about how they are using Argo and why they're using it.

Of course, uh, credit Karma is a subsidiary of Intuit, so you might have to come up with a heck of a good reason not to use it. But the point being is that there's a transition happening here and DevOps teams are starting to choose upsides. And it's not clear to me how they're gonna, uh, navigate this in, in cloud BE'S case.

They're saying that, uh, the existing Jenkins platform can be extended to be integrated with the new platform. So there is a transition path there. Um, other folks though might be looking at ripping and replacing things.

And of course some organizations have multiple, um, CICD platforms as it is by different teams. And, um, they're having discussions right now about whether or not to standardize on one platform in this, um, age of, so-called platform engineering, which is a, throws another thorny issue into the whole discussion. But, um, it seems to me at least that we haven't had this level of, um, uncertainty about where to go forward in terms of our CI ICD platforms than I've seen in recent memory.

Right. And what's also interesting to me is that at the same time, and, and maybe this isn't an issue, but at the same time that organizations are really starting to focus on controlling costs across the board, not just cloud costs, but everywhere. The fact that, you know, you might need to rip and replace what you have, that seems like it might be an argument not in favor of ripping and replacing, right?

Like you may as well just stick with what you have. It seems like it'd be a lot more expensive to, to have to transition. But then also, you know, my, my other question would be about just consolidation in general.

Do you think there's gonna be a larger wave of these kind of acquisitions coming? Um, a lot of of startups and venture backed organizations have not been able to get the kind of funding that they had even a year ago. So how does that tie into it?

It's a thorny issue indeed. Yeah. I mean, it's a very serious issue and it's particularly problematic in this cloud native space because a lot of the companies are startups and they were depending on getting their next round of funding.

But, um, that funding is harder to come by when interest rates are so high. And investors are basically beaten up on venture capitalists and saying, why should I give you money to get a 5% return when the bank is guaranteeing me a four to 5% return? So, and that's safer.

Um, so that's kind of where the core of the cash crunch is at. Um, that may change as interest rates gradually come down, but we'll see how that plays out in the meantime. Um, some companies are just running outta money and funding and, uh, in the absence of that funding, they ain't gotta look to be acquired.

And venture capitalists are trying to cash out and see what they can get for some organizations. And sometimes they may decide to grin and bear it and hold out for the long term, but other times they're gonna be like, Nope, we gotta go. We're gonna flip the proverbial hamburger now and, um, move on to the next thing.

Um, and there's a lot of next things out there for them to invest in. Right? It's not just client server.

They've got AI funds and all kinds of things that are, um, perhaps a little more compelling at the moment. So for IT teams it creates a, a little bit of a quandary 'cause you're not sure who's gonna be where once you buy something. And that level of uncertainty tends to make people cautious.

Yes, indeed it does. Um, so we were talking about Argo and your conversation with Jeremy Un Roth from Credit Karma, and it was, it was interesting to hear him talk about the CD issue, the CICD issue, and how, you know, how they made the decision to, to go the Argo route. And Argo seems to be everywhere.

This, this really seems to be becoming a standard for cloud native CICD here. Is that what you're seeing as well? I think there's a whole set of folks who are embracing, um, DevOps principles for cloud native in greenfield environments, right?

They get a Kubernetes environments going and it has very little to do with their legacy environment. And they're the ones that are driving adoption, especially of Argo. There are some organizations like Intuit that have, you know, made a switch to Kubernetes whole hog Mm-Hmm.

And, you know, they're, uh, at, at the front end of Argo clearly. So, yeah. Uh, it's not clear to me how many organizations made that commitment, but most of those greenfield environments for Kubernetes, of which there are an increasingly larger number, 'cause there's more startup companies than ever that are building applications that are native to Kubernetes and they don't have any legacy platforms to worry about.

And so the, they look around and Argo pops up pretty quickly. It does, it does. Um, so to kind of further that a little bit, um, and segue into our next topic, the, the number of Kubernetes clusters that are running now in production just keeps growing and growing and growing exponentially.

And we had a great article this week about a cast ai report that was talking about just the massive scale of cloud infrastructure waste that is generated from all of these clusters running. Um, yeah, go ahead. I think it, It's basically an open secret that we're wasting massive amounts of cloud infrastructure.

Um, and that part, it is just human nature at the end of the day and the way we operate, right? Developers are provisioning these environments, and especially in the case of Kubernetes, as noted in this report. Yeah.

They'll over-provision because from their perspective, the worst thing in the world is for them, they get a call at three o'clock in the morning that their application crashed. So 'cause they don't have the resources. Yeah.

Right. And historically that was the way you always did things back in the on-premise day. You just spec as much as you could possibly get or afford to get.

Theoretically, Kubernetes is supposed to make it easier to scale up and scale down, but not a lot of people invoke those capabilities just yet. And, um, the other side of this question too is there's so many clusters now and, and they're so complex that the average person who's running it isn't able to keep up with that anyway. So even if they are aware of the issue, their ability to do something about it is limited.

Yeah. Cast AI is making a case for using AI and machine learning algorithms to automate that process, but you know, there's a lot of people who are still on the front end of that curve, and I think they're right. I believe that we will use AI to bring more of that under control.

It's not clear to me what that might do to the revenue implications for cloud service providers as we all get more efficient. But there's another factor here and it's all those, uh, advocates for Green IT who were basically noting that, uh, we need to find ways to generate less carbon. And if we keep running and over provisioning, uh, resources in the cloud, that's not helping.

So I think there's, besides the cost factor and the finance team coming around the finops club, there's a whole other green IT side of this equation that hasn't been factored in. But I think the pressure to be more efficient is, is there and, but it takes a little while to do something about it. Right.

And my, my other question, you know, that hypothetically is all of that ai using AI to right size, do you not also need backend resources, many of which are running in the cloud to be able to drive the AI solution to right size? Or am I not understanding? So how does that balance out?

Like are you just shifting cloud resources from one to the other? I, Yeah, I mean, in the sum total of things, yeah, it's gonna be more efficient, but yeah, you are spending some level of compute to make the rest of the compute efficient, but I don't think it's a huge percentage yet. We talk about AI and there's two flavors of it, right?

There's the generative AI models that a, um, open AI will build that, you know, those things are massive, but then there's AI models for predictive and those things are not massive. They're measured in, uh, maybe terabytes and, um, so, you know, they don't consume as much as generative AI model. Not all AI models are equally piggish, if that makes any sense.

Right. Okay, that makes sense. And um, you know, we're talking about not just over provisioning, but also over permissioning.

Um, and that came up as well in an article from KS o, the Kubernetes Security Operations Center, talking about their addition of tools to improve Kubernetes security. And one of the big issues that they mentioned was over permissioning. So in addition to over provisioning, a lot of DevOps folks tend to just, you know, give access to anyone who might possibly need it.

And that's a big problem. A lot of this comes back to the standard security issues that we've seen that are, you know, comes down to credentials, right? Mm-Hmm.

The bad guys steal the credentials, then they get into that system, they learn the system, and then they start to escalate their privileges, and then they use that to start distributing malware everywhere. And before you know it, you've got this kinda catastrophic event. Um, in the case of Kubernetes, that is, um, more problematic because the role-based access controls that the, that come with Kubernetes are, shall we say, uh, complicated, um, and maybe cumbersome to deal with.

So, um, KOC is making it easier to implement and maintain those controls with a policy engine that they're putting into their platform, which, um, you know, and you gotta give these guys props that, I mean, I think they came outta nowhere in the last couple of years to really kinda take a leadership position around Kubernetes security in terms of not just, yeah, not just their platform, but, you know, they put out a lot of good content about, you know, what threats to look for and those things. So I would say that they're a, a positive contributor to the community as a whole. So, Um, I agree.

Yeah. But at the end of the day, um, I, Kubernetes security's going to get easier. I mean, to be honest, it's been an afterthought.

I mean, you would think every time we come out with a new platform that security would not be an afterthought after all these years, but it continues to be an afterthought after all these years. And, um, there's been a lot of progress made in the last year, but, um, I feel could be wrong. And, you know, this might be a conspiracy theory, but I think we did not look hard enough at the security issues when Kubernetes was being rolled out.

'cause we already knew it was complex as it was. And if we wanted to address the security issues, we would've scared even more people off. So I, I think the, we deliberately left too much, um, to the, to be dealt with later by others mantra.

Or sometimes you hear the Kubernetes community say, well, it's a platform for other platforms to be built on. Yep. Well, that's not much comfort when you're the IT person going, what the heck am I doing with this thing again?

Right. I think it's, uh, it was yet another project that they figured they could just throw over the wall to the security people without realizing that fairly soon they would also need to be some of those security people. Yeah.

I mean, there is a sig for security for the, uh, special interest group for those who don't know what to say. Mm-Hmm. Um, in the kubernetes com community.

So, and they're doing a, a fine job, but you know, it's, it's trying to fix something after the fact. And that's not as always these easy to do, so you gotta wait for updates. But I, I think progress is being made.

I just don't think it's coming fast enough because these Kubernetes clusters are now after better part of half a decade actually showing up in production environments. And the bad guys are like, Ooh, what's this? Yep.

Yep. Um, you know, speaking of, of security and open source and uh, and that kind of thing, uh, it seems the CNCF announced that it graduated Falco to improve Linux security. So that's kind of, you know, another, another layer of progress on the open source tooling project.

Well, not really tooling open source security front, I'm not entirely sure that, you know, the notion of graduating means a lot to folks. I think it gives some level of comfort to A CIO or a senior IT leader that something has been, shall we say vetted. Yeah.

But people have been using Falco for a while now, right. Including cystic that created it. And, um, what's interesting to me about this though is the security game is changing.

And for those of you who don't know, what Falco is, is it basically enables you to apply policies in the Linux operating system that, um, if thresholds are exceeded, you'll generate some kind of alert to tell you that there is a cybersecurity event. Mm-Hmm. Um, And what's important about that is it happens in real time.

And the reason it happens in real time is partially because Falco was one of the first platforms to make use of this extended Berkeley packet filtering technology inside the Linux subsystem that enables security software or storage or networking software or observability software to run in a, in a safe, isolated fashion that allows it to drive performance at a higher level of scale than could ever be achieved when that same software is running in user space. So we're gonna see a lot more of this, uh, use case involving different classes of software being run out of the EBPF subsystem that, uh, Microsoft plans to use also in Windows. And, and I think they're making some progress along that route already.

Yeah, this is gonna change the way we use all this software. Um, it's just that, you know, Falco was one of the first to kind of take advantage of that, and it, I don't, I think they've been at this now for several years, so it took a while to graduate and, you know, I guess congratulations there in order. Yeah.

Um, you know, I'm hoping we'll see more usage of this because, you know, the hangup is you, it's only the last three or four revs of Linux that have had support for EBPF. So, you know, it's, it's a work in progress as they say. Yeah.

But progress, however slow is still progress, I think. There you go. I think the part of the issue though is, and you know this well, I mean, how many people are cybersecurity experts that know Kubernetes?

I mean, you know, kind of looking for the Yeah. Really narrow funnel there. And, and do you think that, you know, that lack of expertise tends to hold back adoption of Kubernetes?

Same thing we see with developers. I don't have enough developers who know how to write apps for Kubernetes. And so, uh, as great as this platform is, it seems like, you know, there are these things that either overlooked or are just natural hangups that are, you know, that slow down the pace of adoption.

Right. No, I agree. And I think that's, that's part of the, the push to develop these levels of abstraction that, you know, sit on top of Kubernetes to get rid of that complexity.

Um, and I think, I can't think of examples off the top of my head of course, but you know, as we see more and more of those levels, they seem to track with the level of adoption, right. Just making it easier so you're not down, don't have to be down there in the guts every day, you know, fighting, fighting for your life. Yeah.

I prefer to fight for my right to party, but, um, Well, that too, but then we're aging ourselves I guess, on that front, I suppose. So. Yeah.

Well, that's all we got for this week, folks. I don't know if you wanna add anything, Sharon, thoughts closing? Uh, no.

Thanks for, uh, thanks for joining us as always. And, uh, we're gonna put all of the links to the articles and, uh, videos and interviews that we talked about in the show notes. If you have a topic that you want us to cover or if you wanna come on the show and talk to us yourself, we would love to have you and we wanna hear from you.

We'll put our contact information in there too as well. And until next week, thanks so much. Have a great day.

Bye-Bye.