Emre Baran, Cerbos | KubeCon + CloudNativeCon Europe 2023

This is texturing TV. Hey everyone. We are still here in mid to chaos of kubecon in Amsterdam 2023 10,000 people now starting to converge back onto the floor here because we have our opening night reception.

I guess. Yeah, they'll be serving drinks all around everybody. Everybody's bringing drinks in.

It looks like it's gonna be a party. It's a long night. It's supposed to go to nine o'clock.

Yeah, I don't know if I'll be here till 9. But yes it is. I'm getting too old for that man.

You have to man the boots. I I well God bless you. Let me introduce you to Emery Barron Emory is with the company called Certo servos and he's gonna tell us all about that.

But first, I want to hear his story a little bit everybody. Tell us about you man. So my background is All right.

It's it's I started studying economics and very quickly realized that banking isn't for me even in my bank internship job. I find myself writing Excel macros, and I'm like, I got to go get back to school and do computer science. So after that I graduated I was a software engineer.

I worked all in Telecom products in the US Federal governments city government financial systems. And then after that I built a social network, which became turkey's largest social network, really and this was back in 2003 2007. And then after we exited that I joined Google as a product manager, I was a product manager on AdWords at that sense at some point.

All of I worked on all the AdSense backend products. And after leaving Google I moved to the UK. com with my co-founders a large Enterprise retailer marketing technology, A/B Testing product recognitions.

And then after that we started service and the story is actually in every single one of these previous roles. I had to go build roles and permissions and authorization into software products. And every time we built it like why are we still building?

This this is not adding any extra value, but it's a crucial thing to have. And with service, we're trying to address that challenge of never having to build permissions again so that we can provide that is off the shop open source core for developers so they can focus on their core business rather than infrastructure. Absolutely.

I love that. You know before we go further Servo Studios server's not dead that Dev. Yes.

That's our first one. We also own service iOS service Co and a lot of domains but our primary audiences developers because we don't want them to reinvent the wheel. I love it.

So one of the things that we're like a trend that I'm seeing here is the Yeah, when devops first came out it was it was in some ways it made life harder for death. Because they gave them like more responsibilities. They had to worry about then just coding.

Yes. Security Ops testing, you know all of these things. but now what we're seeing is You know platform engineer SRE.

These kinds of function specializations. Yeah, but they're they're pulling back. For saying hey Dev, let me make this easier for you.

Let me serve this to you on a platter. So you don't have to worry about it. So you do your thing.

That's absolutely the same Trend. We're on and the way that's what I see we call this a decapitalization, right if you wrote software in back in 1960s, you had to write your own database layer you had to write your infrastructure you have to write everything but you know at 20 years at a time when we look at this the databases that got decoupled and then okay ldap was a very first thing in security the directory got decoupled. So nobody's building their own ldap.

Then authentication got decoupled log processing and security got the couple but authorization is still the way that we look at this is like developers doing it themselves because there's a very fine line between your business logic and authorization logic and not many people are thinking about what that API should be. So going back to what you were saying a lot of Developers. Find it much easier to do it in code than separating it out and actually making it thing on its own.

And but however by doing it a thing on its own but you're enabling is like you're you enabling all the bells and whistles to be added to that authorization thing. If you leave it to a developer, it's a very simple if then else statement like if manager he can do this if you read on the user they can only look at it, but they can't edit. However all those requirements over time get very complex.

They get much more complicated all of a sudden the developer is facing that same burden you mentioned because hey, it was easy. Now it got complex. Oh, I wish there was a special special software specialization that took this off my plate.

Yeah. And and I mean, here's the good news though. There is and there are right and we're starting to see that.

Impressions here at the show what we're kind of feedback. Are you getting from people? We're getting a great feedback.

Of course. This is a developer event, but it's very much kubernetes a lot of infrastructure. However, that being said as you mentioned earlier, there are a lot of developers who are in between infrastructure and software.

So we get a great feedback, you know, 90% of the conversations. We've had are always around. Oh we had to build it ourselves.

Oh, we have to revamp that. Oh we have to do it. We need to go Enterprise ready.

So we're getting a lot of positive feedback into something that makes their life easier, especially when it's open source, and it's free to put into your products. Absolutely. Let's talk about that.

You know, how do you how do you move people not move people? That's the wrong word? Excuse me.

But how do you how did like how do people know what I can get? I can use the open source product. It's fine for me.

What's the defining life for the commercial? So the commercial product we just launched we announced it last week. So and it's a very fine line right?

Well, how do you make an unpaid user into a paid user? However, our principle is if you're a developer Your default go to is oh, I can code that and write three lines of code. You want to make sure that you never resorted to that because you're getting into a big, you know, Big Mess.

You're in the beginning. You're probably you're not seeing what's coming your way. We want to make sure our product is as simple and as developer friendly as possible to implement so they can get their job done.

However, when as a developer Unity implementer roles and permissions, but at some point Your Role now starts extending into a devops role rather than just implementing roles and permissions. Now if you have to do your ci/cd pipeline for your policies, if you have to build a deployment pipeline, we offer that as a premium product so you don't have to actually handle that similarly as a developer. It's free and open source to write your own permission policies in yamil.

You can talk to your product manager and convert those but if you want to have product management empowered project managers managing their own policies now, we have a busy week interface for them that's premium for them to actually point in Click and change. Similarly for security teams for seesaws. I see csos icios if they want to if a developer says don't worry.

I got my I have a great relationship with my see so I can listen to what they need and I can run a report on the logs and give them the output great that's free. However if you want to give the sea so a tool so they can do it an audit they can run a blast radius impact analysis of a change they can do an analysis of who's over permission under permission on their own without having to rely on developers. Then that's a premium product.

So at the end of the day core developers software developer things are part of Open Source and the moment it starts jumping into other roles and empowering other roles. That's where we draw the line or premium commercial. It makes a lot of sense and it certainly, you know, look, I think the dominant model we're seeing today is oh, yeah, you can take the open source model or we'll give you the hosted version.

but quite frankly the hosted version oftentimes doesn't have a lot of more bells and whistles. It's just hosted. So with us, the core product is actually self-hosted because authorization unlike many other cloud services needs to happen in sub-milliseconds because you're in the blocking path of every API request every interaction with the product.

Our Cloud control panel is actually to manage all of those your excuse me your hosted instances. Love it. I think we covered a bunch here everything we left out.

dev and we have our service cloud in private data. Fee. dev.

They can check out our open source core product there. They can also check out our new Cloud offering cloudflare Channel Emery. Thank you.

Thank you very much for your time. Thank you. Go check out servos dot Dev great open source and and Commercial product there.

We're gonna take a break. We've got a friend of ours waiting in the wings next.