ISSUE 194: KubeCon+CloudNativeCon North America 2019

“It’s not about where you rank on the contribution list, how big your sponsorship is. Do not run yourself into the ground, you will burn out. It’s OK to step aside for a moment and make room for the next person to push the thing forward.”

Many IT teams begin moving their applications to containers and Kubernetes after their managers mandate the switch. Then in the rush to deploy they may forget, or simply delay, some fundamentals. Only six to 12 months later does integrating security into their CI/CD pipeline becomes a priority.

This gradual evolution toward cloud native security best practices is worrisome, but it’s the norm among organizations adopting Kubernetes today. This is what we learned from a panel of cloud native security experts at The New Stack’s pancake and podcast from KubeCon+CloudNativeCon North America this week sponsored by Prisma by Palo Alto Networks. 

There are, however, several ways that open source projects, vendors and IT teams themselves can improve security practices in the software development life cycle so that teams no longer need to compromise between going fast and being secure.

KubeCon+CloudNativeCon North America 2019

My, how KubeCon (now “KubeCon+CloudNativeCon”) has grown! We remember three years ago, when the conference was held in the second floor of a Seattle hotel, you could take a tour of all the booths within a few minutes. This year, more than 12,000 attendees packed the San Diego Convention Center, dozens of vendor booths span three gigantic rooms. You needed a map just to find one you were looking for. A good number of the companies we met with back in 2016 have grown into full-fledged businesses. Thanks to a sponsorship of Portworx, we were able to dispatch a team of crack reporters (B. Cameron Gain, Emily Omier, Jennifer Riggins, Joab Jackson, Mary Branscombe, Mike Melanson and Susan Hall) to capture many of the product updates that debuted at the show. Here are a few:

These were a plethora of commercial Kubernetes distributions on display this year, as companies polish up the container orchestrator for commercial usage. Diamanti showed off Spektrum, a Kubernetes appliance that combines the simplicity of a full, turnkey Kubernetes stack with significant performance advantages from hardware acceleration. Rancher Labs has released two new packages for creating an end-to-end Kubernetes solution for all compute environments: It has unveiled a beta of Rio for DevOps automation, as well as the general availability of K3s, a distribution of Kubernetes for small footprint workloads. 

At the show, Nirmata debuted the next major release of its own K8s distro, which enables advanced multi-cluster workflows as well as the ability to support multiple developer experiences. You’ll need a place to store all these containers: JFrog has launched a free edition of its JFrog Container Registry, touting the release as “the most comprehensive and advanced Docker container registry available in the market.” This free container registry boasts many of the same features of the company’s premium product Artifactory, but with some limitations for capacity. 

A step along the development chain, Codefresh, which offers a Kubernetes-based continuous deployment and continuous integration (CI/CD) platform, has released what it calls the first live pipeline debugger for CI/CD systems. It is set to reduce time to find and fix issues in complicated CI/CD pipelines by sixfold. 

Security continues to grow as a concern for cloud native computing. Octarine has launched Guardrails and Runtime, a pair of technologies designed to keep Kubernetes workloads secure during the development, testing and deployment phase as well as in runtime. 

Within the realm of security, identity management were major topics of concern: The Cloud Native Computing Foundation’s SPIFFE and SPIRE projects showcased their expanded capabilities to offer OpenID Connect (OIDC) federated identity, enabling microservices to employ this security not only between themselves on a single SPIRE instance, but also between shared services, such as databases, service meshes, and public cloud providers, without necessarily using secrets and/or network security controls. Also in the realm of ID management Portshift demonstrated its identity-based workload protection platform for containers and microservices. The system, Portshift says, offers more complete mesh-enabled security for Istio thanks to its container workload-identity and other features.

Speaking of service mesh, we are seeing some second-generation service mesh technology development here as well. A new project from service mesh provider Solo.io demonstrated the possibilities of automating service mesh operations, using the telemetry created by the service mesh itself. The project, Autopilot is a framework creating an automated series of operations that can be triggered by conditions set by the administrator.

And, finally, data streaming continues to be a growing concern for cloud native operations. Lightbend, the company that created the Scala programming language and Akka middleware, has launched Cloudflow, an open source framework to make it easier to develop and deploy streaming data pipelines on Kubernetes. Oracle is expanding its users’ abilities to develop cloud native software on Oracle Cloud by filling out the pieces of its software development and management stack, launching Kafka Compatibility for Oracle Streaming, Oracle API Gateway and Oracle Logging.

And this is only the first batch of releases. Continue to check back into thenewstack.io in the days to come for more technologies we saw at KubeCon+CloudNativeCon North America 2019. 

Portworx Backup: Tuneable Backups for Kubernetes Applications

Container-native storage company Portworx launched PX-Backup, software that allow companies to back up — and relaunch if necessary — Kubernetes applications’ data and configuration in a couple clicks. Users have control over how often individual applications should be backed up.

Snyk Releases a Kubernetes-focused Container Security Platform

Cloud native security company Snyk has launched a container- and Kubernetes-focused security platform Snyk Container to find and fix vulnerabilities in third-party application dependencies across the whole software development lifecycle. The company’s recent open source security report highlights the need for container scanning services, in general. The research suggests that “containers often introduce hundreds of vulnerabilities from open source dependencies, and there is no native safeguard in place to find and fix them.”

Why Kubernetes Has Emerged as a Key Ingredient in Edge Computing

Kubernetes has rapidly become a key ingredient in edge computing. With Kubernetes, companies can run containers at the edge in a way that maximizes resources, makes testing easier and allows DevOps teams to move faster and more effectively as these organizations consume and analyze more data in the field.