Chennai’s technology sector is rapidly evolving, demanding professionals who can design, deploy, and manage scalable cloud-native solutions. As Kubernetes becomes the standard for container orchestration, gaining deep, practical expertise is essential for staying competitive in the job market. This guide explores how the right training program can bridge the gap between theory and practice, equipping you with the skills needed to lead digital transformation initiatives and accelerate your career.

Why Kubernetes Expertise is Essential for Chennai Professionals

Chennai’s diverse tech landscape—from manufacturing and automotive to finance and healthcare—is increasingly adopting cloud-native technologies to drive innovation and efficiency. This shift has created a high demand for IT professionals skilled in Kubernetes, with roles in DevOps, Cloud Engineering, and Site Reliability Engineering (SRE) offering significant growth opportunities. Mastering Kubernetes enables you to build resilient, scalable systems, automate deployment processes, and optimize infrastructure performance—skills that are critical for advancing in today’s tech-driven economy.

What to Look for in a High-Impact Kubernetes Training Program

When choosing a Kubernetes course, prioritize programs that offer:

• Comprehensive Curriculum: Coverage of core concepts, advanced operations, security, networking, and CI/CD integration.
• Expert-Led Instruction: Learning from trainers with real-world experience in deploying and managing Kubernetes at scale.
• Hands-On, Practical Labs: Opportunities to apply knowledge in realistic scenarios, such as troubleshooting clusters and optimizing deployments.
• Career-Focused Outcomes: Training that aligns with industry demands and prepares you for certification and job advancement.

DevOpsSchool: Your Gateway to Practical Kubernetes Mastery

DevOpsSchool has established itself as a leading platform for technology training by focusing on practical, job-ready skills. Unlike traditional courses, DevOpsSchool’s programs are designed by industry practitioners to address real-world challenges. Their approach combines live instruction, hands-on labs, and continuous support to ensure learners gain the confidence and competence needed to excel in their careers.

Key features of DevOpsSchool’s training include:

• Industry-Aligned Curriculum: Courses updated regularly to reflect the latest trends and best practices in cloud-native technologies.
• Flexible Learning Options: Live online sessions, self-paced modules, and interactive workshops to suit diverse learning preferences.
• Community and Networking: Access to a global community of professionals, mentors, and industry experts.
• Proven Outcomes: A track record of helping learners achieve certifications, secure promotions, and transition into high-demand roles.

Learn from a Renowned Expert: Rajesh Kumar

The quality of training is deeply influenced by the instructor’s expertise. The Kubernetes training in Chennai offered by DevOpsSchool is led by Rajesh Kumar, a seasoned professional with over 20 years of experience in DevOps, SRE, Cloud, and Kubernetes. Rajesh’s practical insights, drawn from years of solving complex infrastructure challenges, enrich the learning experience and provide invaluable context for applying Kubernetes in real-world scenarios.

Under Rajesh’s mentorship, students gain not only technical knowledge but also strategic understanding of how to design, secure, and optimize Kubernetes environments for enterprise use. His guidance helps learners develop problem-solving skills and confidence—qualities that set them apart in the job market.

Curriculum Overview: Building Skills Step by Step

This program is structured to take learners from foundational concepts to advanced implementation:

Module 1: Kubernetes Fundamentals

• Introduction to containers, orchestration, and Kubernetes architecture.
• Core components: Pods, Deployments, Services, and Namespaces.
• Setting up and managing basic cluster operations.

Module 2: Configuration, Storage, and Networking

• Managing application configuration with ConfigMaps and Secrets.
• Implementing persistent storage solutions for stateful applications.
• Configuring networking, services, and ingress for scalable applications.

Module 3: Security and Advanced Operations

• Implementing security best practices, including RBAC and network policies.
• Monitoring, logging, and maintaining cluster health.
• Automating deployments and managing cluster updates.

Module 4: Advanced Topics and Ecosystem Tools

• Advanced deployment strategies: Blue-Green, Canary, and rolling updates.
• Package management with Helm and infrastructure-as-code practices.
• Integrating Kubernetes with CI/CD pipelines for DevOps workflows.

Module 5: Real-World Projects and Certification Prep

• Capstone projects simulating enterprise-scale Kubernetes deployments.
• Guided preparation for the Certified Kubernetes Administrator (CKA) exam.
• Best practices for managing production environments and troubleshooting common issues.

Training Comparison: Making the Right Choice

Turning Skills into Career Success

Completing this Kubernetes training in Chennai equips you with the tools to:

• Lead cloud-native projects and drive digital transformation in your organization.
• Design, deploy, and manage secure, scalable Kubernetes environments.
• Enhance your employability and command higher salaries in Chennai’s competitive tech market.
• Build a professional network with peers, mentors, and industry leaders.

Take the Next Step in Your Professional Journey

The demand for Kubernetes expertise is growing, and now is the time to position yourself at the forefront of this trend. By investing in high-quality training, you’re not just learning a technology—you’re building a foundation for long-term career success.

To explore how this program can help you achieve your goals, connect with DevOpsSchool today.

Contact DevOpsSchool:

• Email: contact@DevOpsSchool.com
• Phone & WhatsApp (India): +91 84094 92687
• Phone & WhatsApp (USA): +1 (469) 756-6329
• Website: https://www.devopsschool.com/

Table of Contents

1. Introduction
2. Why Container Security Matters in CI/CD
3. Common Security Risks in Containers and CI/CD
4. Key Principles for Securing CI/CD Pipelines
5. Automation Strategies for Container Security
6. Tools and Technologies to Automate Container Security
7. Best Practices for DevOps Teams
8. Real-World Use Case
9. Final Thoughts

1. Introduction

With the rise of DevOps, Continuous Integration/Continuous Delivery (CI/CD) pipelines have become the backbone of modern software development. At the heart of these pipelines are containers—lightweight, portable units that package software and its dependencies together.

However, as the speed of deployment increases, so does the attack surface. Containers, by design, are ephemeral and scalable, but they also introduce unique security challenges. Manual security measures can no longer keep up. This is where automated container security becomes essential.

This guide is a complete blueprint for DevOps teams looking to automate container security across their CI/CD pipelines.

2. Why Container Security Matters in CI/CD

Containers are used to build, test, and deploy applications at scale. While containers offer speed and portability, they also:

• Share OS kernels, increasing risk from kernel exploits.
• Often use images from public registries, which can be compromised.
• Are dynamic and short-lived, making manual security nearly impossible.
• Integrate deeply with CI/CD tools, risking widespread damage if compromised.

In a CI/CD environment, a single insecure container can lead to:

• Supply chain attacks (compromised base images)
• Credential leaks
• Unauthorized access to production
• Compliance violations

Therefore, securing containers—and automating this security—is no longer optional. It’s a necessity.

3. Common Security Risks in Containers and CI/CD

a. Insecure Images

Images pulled from public repositories may contain known vulnerabilities, malware, or misconfigurations.

b. Secrets in Containers

Hardcoded credentials, API keys, and tokens inside container images pose a significant risk if exposed.

c. Inadequate Isolation

Containers share the host kernel. If improperly configured, one container can escape and affect others.

d. Outdated Base Images

Using outdated images increases the chance of having unpatched CVEs in the container stack.

e. Unvalidated Inputs and Dependencies

Uncontrolled or unscanned libraries may introduce malicious code during build.

f. Weak CI/CD Pipeline Security

Unprotected Jenkins agents, GitHub Actions runners, or GitLab CI configurations are vulnerable to attacks.

4. Key Principles for Securing CI/CD Pipelines

1. Shift Left Security
   Integrate security early in the development lifecycle—from code commit to image build.
2. Zero Trust Architecture
   Assume no service or image is inherently trustworthy.
3. Policy-as-Code
   Define security policies programmatically using tools like OPA (Open Policy Agent).
4. Immutable Infrastructure
   Avoid mutable containers. Rebuild and redeploy instead of patching in place.
5. Security Observability
   Make security events visible to teams using logging and alerting tools.

5. Automation Strategies for Container Security

Here are key areas where DevOps teams should automate container security:

a. Automated Image Scanning

Use scanners like Trivy, Grype, or Anchore to:

• Detect known vulnerabilities (CVEs).
• Identify outdated packages.
• Check for embedded secrets.

Integrate scanners in:

• Pre-commit hooks
• CI build pipelines
• Container registries

b. CI/CD Pipeline Security Gates

Enforce security policies at each stage:

• Fail builds with critical CVEs.
• Block deployments from unauthorized registries.
• Allow only signed images.

c. Secrets Management

Use tools like HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets to:

• Inject secrets dynamically.
• Rotate credentials automatically.
• Avoid hardcoding sensitive data.

d. Runtime Threat Detection

Monitor containers post-deployment using tools like:

• Falco (open-source runtime security)
• Sysdig
• Aqua Security

These tools detect suspicious activities like file modifications, reverse shells, or process anomalies.

e. Compliance Automation

Use tools like OpenSCAP, Kube-bench, or Checkov to:

• Enforce CIS benchmarks.
• Validate compliance with GDPR, HIPAA, or PCI-DSS.
• Automate audit trails.

6. Tools and Technologies to Automate Container Security

7. Best Practices for DevOps Teams

✅ 1. Use Minimal Base Images

Prefer distroless or Alpine-based images to reduce the attack surface.

✅ 2. Implement Image Provenance

Sign images with tools like Cosign and verify them in CI/CD before deployment.

✅ 3. Restrict Network Access

Define strict network policies (via Calico, Cilium) to prevent lateral movement.

✅ 4. Enable Namespace Isolation

Separate build, test, and production environments using Kubernetes namespaces or separate clusters.

✅ 5. Limit Container Privileges

Avoid running containers as root. Use capabilities and securityContext settings in Kubernetes.

✅ 6. Audit Everything

Enable audit logging for container runtime, CI/CD actions, and registry access.

8. Real-World Use Case: Securing CI/CD for a FinTech Startup

Problem:
A FinTech startup built their app on Kubernetes using GitHub Actions. They used public base images and embedded secrets in CI scripts.

Risks Identified:

• Images contained critical CVEs.
• Credentials to payment gateways were exposed in logs.
• Production containers ran with elevated privileges.

Automated Solutions Implemented:

• Trivy scans integrated into GitHub Actions.
• Secrets managed using HashiCorp Vault and injected via environment variables.
• Cosign used for image signing and verification.
• Falco deployed for real-time runtime anomaly detection.
• OPA policies enforced no privileged containers.

Outcome:

• Reduced vulnerabilities by 80% in three months.
• Passed PCI-DSS compliance audit.
• Incident response time dropped from 3 hours to 15 minutes.

9. Final Thoughts

Containerization is revolutionizing software development—but without security, it’s a double-edged sword. Manual processes can’t keep up with the scale and speed of modern CI/CD. Automating container security is the only way to ensure continuous delivery doesn’t become continuous risk.

DevOps teams must embrace security as code, automate relentlessly, and adopt tools that make security part of the development culture—not a bottleneck.

💡 Security is not a phase. It’s a mindset baked into every layer of your CI/CD pipeline.

Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. In the context of DevOps, Kubernetes plays a crucial role in enabling continuous integration, continuous delivery, and infrastructure management. By managing containers across multiple environments, Kubernetes ensures that applications are scalable, resilient, and easily maintainable—key aspects of any DevOps workflow.

This post explores how to implement DevOps practices using Kubernetes, highlighting the major features that make Kubernetes an ideal platform for automating DevOps processes and streamlining the development lifecycle.

Setting Up Continuous Integration and Continuous Delivery (CI/CD) with Kubernetes

One of the primary goals of DevOps is to establish a smooth and automated flow for software delivery. Kubernetes facilitates this by integrating with CI/CD pipelines, allowing for automated deployment, testing, and scaling of applications in various environments.

How Kubernetes Facilitates CI/CD:

1. Automated Deployments: Kubernetes simplifies the deployment process by using declarative configurations (e.g., YAML files) to define the desired state of applications. Continuous integration tools like Jenkins, GitLab CI, or CircleCI can be integrated with Kubernetes to automate the deployment process.
2. Scaling Applications: Kubernetes automatically scales applications based on traffic, resource utilization, or custom metrics. This allows DevOps teams to implement auto-scaling policies in their CI/CD pipelines to optimize resource usage.
3. Rollbacks and Version Control: Kubernetes supports seamless rollbacks to previous versions of an application, which is essential for maintaining stability during continuous delivery. It helps teams quickly revert to a stable state in case of deployment failures.
4. Blue-Green and Canary Deployments: Kubernetes supports deployment strategies like blue-green and canary deployments, where new versions of applications are tested in production with minimal risk. This allows DevOps teams to reduce downtime and improve the reliability of software releases.
5. Integration with GitOps: Kubernetes works well with GitOps practices, where the desired state of the application is defined in Git repositories. Changes to the application are automatically deployed by Kubernetes, providing a seamless and automated flow from development to production.

Infrastructure as Code (IaC) with Kubernetes

Infrastructure as Code (IaC) is a key DevOps practice that enables teams to manage and provision infrastructure using code, ensuring consistency and scalability. Kubernetes plays a vital role in IaC by allowing DevOps teams to define infrastructure and application configurations in code, making it easy to automate deployments and manage environments.

Implementing IaC with Kubernetes:

1. Declarative Configuration: Kubernetes uses YAML or JSON files to define application resources like pods, services, and deployments. These files act as declarative configurations, specifying the desired state of the application, which Kubernetes automatically enforces.
2. Version Control for Infrastructure: By storing Kubernetes configuration files in Git repositories, DevOps teams can manage infrastructure changes in the same way as application code. This ensures traceability, versioning, and collaboration on infrastructure management.
3. Automating Provisioning: Tools like Helm, Kustomize, and Terraform can be used alongside Kubernetes to automate the provisioning of cloud resources, such as virtual machines, storage, and networking, in addition to managing Kubernetes clusters.
4. Consistent Environments: Kubernetes ensures that the application environment remains consistent across different stages of development, testing, and production. This eliminates the “works on my machine” problem, making it easier to move applications through the pipeline.
5. Immutable Infrastructure: Kubernetes promotes the use of immutable infrastructure, where changes are made by replacing entire containers or services rather than modifying existing ones. This enhances system stability and reduces configuration drift.

Automating Application Management with Kubernetes

Kubernetes simplifies the management of applications by automating key processes such as scaling, monitoring, and recovery. This automation reduces the operational burden on DevOps teams and ensures that applications are resilient and responsive to changing workloads.

Key Automation Features of Kubernetes:

1. Auto-Scaling: Kubernetes automatically adjusts the number of running instances of an application based on real-time metrics like CPU usage or traffic. This ensures that applications are always available and responsive to user demands.
2. Self-Healing: Kubernetes provides self-healing capabilities by automatically replacing failed containers or nodes. If an application pod crashes, Kubernetes will automatically restart it, ensuring high availability without manual intervention.
3. Rolling Updates: Kubernetes allows for rolling updates, where new versions of applications are deployed incrementally. This minimizes downtime and ensures that users are always served by a working version of the application.
4. Resource Management: Kubernetes helps optimize resource usage by assigning CPU and memory limits to application containers. It ensures that each application gets the necessary resources without over-consuming or under-utilizing the available infrastructure.
5. Service Discovery and Load Balancing: Kubernetes automatically manages service discovery and load balancing, ensuring that traffic is routed to healthy instances of an application. This eliminates the need for manual configuration and improves system reliability.

Monitoring and Observability with Kubernetes in DevOps

Monitoring is a critical aspect of any DevOps process, ensuring that teams can identify and address issues in real time. Kubernetes offers various features that integrate with monitoring and observability tools to provide deep insights into application health and performance.

Monitoring and Observability Features of Kubernetes:

1. Integrated Logging: Kubernetes integrates with logging tools like Fluentd, Elasticsearch, and Kibana (EFK stack) to collect and analyze logs from containers, pods, and nodes. This helps teams gain insights into application behavior and troubleshoot issues.
2. Prometheus and Grafana Integration: Kubernetes works seamlessly with Prometheus for monitoring system metrics, such as CPU usage, memory usage, and network traffic. These metrics can be visualized in Grafana dashboards, allowing DevOps teams to monitor application performance in real time.
3. Health Checks: Kubernetes provides built-in health checks, such as liveness and readiness probes, to monitor the health of containers and applications. If an application fails a health check, Kubernetes automatically restarts or replaces the container.
4. Centralized Monitoring: Kubernetes allows for centralized monitoring, where multiple clusters and services are monitored from a single platform. This enables DevOps teams to track the performance and health of the entire system from a unified dashboard.
5. Alerting and Notifications: Kubernetes integrates with alerting tools like Alertmanager to notify teams when certain thresholds are crossed, such as high memory usage or application downtime. This ensures that teams can respond quickly to critical incidents.

Enhancing Security in DevOps with Kubernetes

Security is a critical concern in any DevOps process, and Kubernetes offers several features to help teams secure their applications, infrastructure, and workflows. Kubernetes integrates with security tools and practices to ensure that DevOps teams can build and deploy secure software.

Security Features of Kubernetes in DevOps:

1. Role-Based Access Control (RBAC): Kubernetes provides RBAC to manage access to cluster resources. By defining roles and permissions, teams can control who has access to specific parts of the infrastructure and limit the risk of unauthorized access.
2. Pod Security Policies: Kubernetes allows teams to define security policies that specify how containers should be configured. These policies help ensure that containers run in a secure environment with the right privileges and resources.
3. Secrets Management: Kubernetes integrates with tools like HashiCorp Vault to securely manage secrets, such as API keys, passwords, and certificates. Secrets are stored encrypted and can be accessed by applications without exposing sensitive information.
4. Network Policies: Kubernetes supports network policies that define how pods communicate with each other. These policies can restrict traffic between pods, reducing the attack surface and improving application security.
5. Image Scanning: Kubernetes can integrate with image scanning tools like Clair or Anchore to scan container images for vulnerabilities before they are deployed. This ensures that only secure images are used in production environments.

Kubernetes and DevOps Automation

Kubernetes plays a central role in automating many aspects of the DevOps lifecycle, from continuous integration and delivery to infrastructure management, monitoring, and security. By using Kubernetes to automate tasks, DevOps teams can streamline workflows, increase efficiency, and improve the overall quality and stability of applications.

With Kubernetes, teams can deploy and manage applications more consistently, scale them efficiently, and maintain high availability with minimal manual intervention. Whether you’re managing cloud-native applications, microservices, or hybrid environments, Kubernetes provides the automation and flexibility needed to support modern DevOps practices.

SAN FRANCISCO–(BUSINESS WIRE)– Zettaset a leading provider of data protection solutions, today announced that XCrypt Kubernetes Encryption is available on the VMware Marketplace.

VMware Marketplace enables customers to discover and deploy compatible, validated third-party solutions to VMware environments. Once validated, partners can easily publish their solutions for VMware customers across platforms. Customers will be able to access these third-party partner solutions directly from their cloud environments, while also being able to experience the convenience of features such as notifications, reporting, and analytics.

According to a recent study from the Cloud Native Computing Foundation (CNCF), 78% of organizations leverage Kubernetes within their environments. The rapid adoption of containerized environments has created new data protection challenges that security teams need to address. Zettaset’s XCrypt Kubernetes Encryption product is a first-of-its-kind, software-defined encryption solution that protects data-at-rest across Kubernetes environments. The solution provides a transparent, high performance layer of security that protects customers’ data no matter where it is stored, helping organizations efficiently transition from DevOps to DevSecOps.

“Leading organizations are finding that integrating security into the technologies and processes required to power DevOps cultures is a difficult and complex task to accomplish,” said Tim Reilly, CEO of Zettaset. “With our XCrypt Kubernetes Encryption solution, customers are able to expand their data protection efforts to containers with ease. This enables them to move at the speed required for innovation, without worrying about the security of their data within these new environments.”

“We are pleased to see Zettaset’s XCrypt Kubernetes Encryption on the VMware Marketplace,” said Ramya Sarangarajan, Director, Product Marketing and Strategy, VMware. “Validated technologies, such as XCrypt Kubernetes Encryption, enable our customers to build, run, manage and secure their applications effectively and efficiently. We’re excited to work with partners such as Zettaset to empower customers to derive the most value from their technology investments.”

Zettaset

Zettaset is a leading provider of data protection solutions. Its software-defined encryption solutions can be transparently deployed across all physical and virtual enterprise environments. Unlike traditional solutions that are appliance-based, Zettaset is a cost-effective, software-only solution that is easy to deploy, does not impact performance, and scales with your business from on premise to the cloud,

SAN MATEO, Calif.–(BUSINESS WIRE)–Armory, the open source continuous delivery software company, announced significant growth of its easy-to-use Spinnaker deployments, as the overall user community grew, evidenced in part by the 100% increase in attendees at the upcoming Spinnaker Summit. Spinnaker is the open source, multi-cloud continuous delivery (CD) platform for releasing software changes with high velocity and confidence.

Armory will participate at Spinnaker Summit June 22-24 with a number of sessions discussing the value of making Spinnaker more accessible and easier to use. Armory will take part in a keynote panel session moderated by Kelsey Hightower called A Deep Dive into the Benefits of CD. The Birds of a Feather session titled Continuous Delivery: Spinnaker at Scale includes speakers from Armory, Autodesk, AWS, Cox Automotive, Netflix, and Salesforce.

“Everything we do revolves around making Spinnaker more accessible and easier to use so that engineering teams are able to ship better code faster,” said Daniel R. Odio, co-founder and CEO, Armory. “And that’s achieved by working closely with partners like AWS and customers like Autodesk, who are leading the way by empowering developers and delivering code as efficiently as possible.”

Armory Frees Engineers to Focus on Delivering Value

One way Armory is making Spinnaker more accessible is through its Managed Services Offering, providing expert engineers to manage Spinnaker installations with 24/7 support and guaranteed 99.95% uptime—including break-fix, debugging and troubleshooting. Not only does this offering remove the management overhead of Spinnaker, customers typically see at least a three-times cost savings over hiring an internal team to install, configure, manage and provide 24/7 support of Spinnaker.

“Armory Managed Services eases our life with their expertise—from installation to service management—allowing us to focus on building CI/CD pipelines rather than troubleshooting Spinnaker,” said Leon Xiao, site reliability engineering manager, eHealth.

Scale Spinnaker Deployments to Kubernetes

Armory’s Agent for Kubernetes is a lightweight, scalable service that monitors each Kubernetes cluster and streams changes back to Spinnaker’s Clouddriver service, solving the following problems:

Latency issues that arise when caching large Kubernetes resources in Spinnaker;
Security and access issues that exist when Kubernetes clusters are managed by a central resource;
Bottleneck issues that surface when new Kubernetes clusters require onboarding by a central resource; and
Complexity issues stemming from supporting thousands of Kubernetes clusters that have tens of thousands of objects and multiple edge cases.
Armory and AWS Extend Use of Spinnaker

In collaboration with AWS, Armory recently added blue/green and canary support into Lambda deployments within Spinnaker. Learn more about the Lambda integration and Autodesk’s success with Armory and AWS here.

Armory will also soon be releasing an AWS Quick Start to make it simple to deploy a production-grade instance of Armory on AWS EKS. To learn more, AWS has a workshop scheduled on June 24 about continuous deployment for cloud-native applications that includes hands-on labs from Armory and others.

Simplified Spinnaker Installation

Armory Minnaker is a virtual machine leveraging K3s and the Armory Operator to enable software deployments in 10 minutes instead of 10 days. Armory Minnaker is a full Spinnaker installation packaged inside a virtual machine running the certified K3s Kubernetes distribution. Minnaker automatically handles authentication, security such as SSL/TLS, namespaces, custom resources in Kubernetes (CRD) and more.

Additionally, Armory has created pre-built DevOps pipelines, along with a self-guided tour of the platform to acquaint new users. All of this enables integration of Armory into DevOps toolchains, such as continuous integration (CI) systems, Git repositories, security tools, and targets for software distribution.

Spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence. Created at Netflix, it has been battle-tested in production by hundreds of teams over millions of deployments. It combines a powerful and flexible pipeline management system with integrations to the major cloud providers. Learn more at www.spinnaker.io.

Armory

Armory is the company driving modern digital transformation with its enterprise version of Spinnaker. Armory’s scalable, flexible, and secure platform automates software delivery, enabling software teams to ship better software, faster. The core of Armory’s platform is powered by Spinnaker, the continuous delivery platform developed and open-sourced by Netflix and Google to help companies quickly and safely deploy software into multiple clouds. Armory builds on open-source Spinnaker’s foundation, adding proprietary features for bolstered enterprise scale, along with 24×7 enterprise-grade support. Armory’s platform is trusted by dozens of Global 2000 customers in financial services, technology, retail, healthcare and entertainment. Armory is also a proud sponsor of, and contributor to, the Continuous Delivery Foundation (CDF), the vendor-neutral home of the fastest-growing projects for continuous delivery.

Weaveworks has added observability tools to its GitOps platform for Kubernetes environments with no additional configuration effort required.

Company COO Steve George says the addition of an observability portal to the Weave Kubernetes Platform (WKP) to monitor the health of clusters and overall system performance is a natural extension, given the scope of the technology.

In addition, with the release of version 2.5 of WKP, Weaveworks is enabling IT teams to troubleshoot entire fleets of clusters on which the company’s GitOps platform is deployed across. Support for standard metrics and logs along with aggregation of alerts are all included, says George.

IT teams can also leverage open source Prometheus monitoring software to collect endpoint data from other platforms running on Kubernetes in addition to the alerts and cluster events generated by Prometheus.

Finally, Weaveworks has added support for single sign-on capabilities and deepened the level of integration it provides with the Amazon Elastic Kubernetes Service (EKS).

Weaveworks is making the case for a GitOps platform based on Flux, an open source tool that automatically ensures the state of a cluster matches the configuration stored in a Git repository. It uses an operator in the cluster dubbed Flagger to trigger application deployments to Kubernetes without requiring IT teams to acquire and deploy a dedicated continuous delivery platform. Flux monitors all image repositories, detects new images, triggers deployments and updates configurations accordingly.

WKP adds on top of that core platform Team Workspaces, a workflow application for tracking changes to Git-based deployments that can be used by multiple DevOps teams. Each workspace can span multiple Kubernetes clusters to simplify the rollout of applications across a fleet of Kubernetes clusters.

That approach provides the added benefit of improving security and auditing because each pull request made from the repository needs to be authorized and logged, notes George. That audit trail also accelerates troubleshooting, he adds, by making it easier to discover the root cause of an issue across the full stack of a Kubernetes environment that otherwise would be challenging to diagnose.

It’s not clear at what rate organizations are adopting GitOps as a more opinionated instance of a DevOps workflow. However, it’s apparent there is a high correlation between the adoption of GitOps and the transitions organizations are making to Kubernetes. Given the rapid pace of change to microservices-based applications, organizations are attempting to leverage the standard set of application programming interfaces (APIs) that Kubernetes clusters present to automate continuous delivery especially.

IT teams will require observability tools that provide more context than traditional IT monitoring tools to achieve that goal. Each IT team will need to decide for themselves to what degree they want to employ observability tools for a specific application deployment environment versus relying on platforms that observe both legacy IT and more modern Kubernetes environments. Regardless of the path chosen, one way or another observability as a core tenet of a best DevOps workflow is finally becoming a lot easier to achieve.

A reverse engineer has discovered what is claimed to be “the first known malware targeting Windows containers to compromise cloud environments,” a sentence to put any system administrator on edge.

Building on work published in December of last year on reverse-engineering Windows containers, security researcher Daniel Prizmant’s latest discovery – made during his day job at Palo Alto Networks’ Unit 42 security arm – looks to punch holes in Kubernetes clusters, and has apparently succeeded in doing so across at least 23 known targets.

“Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers,” Prizmant wrote of the malware, which he first discovered in the wild in March. “Its main purpose is to open a backdoor into poorly configured Kubernetes clusters in order to run malicious containers.”

A hidden danger
Siloscape does its best to stay hidden, Prizmant discovered, using the Tor Project network and an anonymous .onion domain to connect to a command-and-control server. During his analysis, Prizmant found 313 individual systems connecting to this server – though could verify only 23 active Siloscape victims, suggesting the malware represents only part of a broader attack.

“Compromising an entire cluster is much more severe than compromising an individual container,” Prizmant explained in his report, “as a cluster could run multiple cloud applications whereas an individual container usually runs a single cloud application. For example, the attacker might be able to steal critical information such as usernames and passwords, an organization’s confidential and internal files or even entire databases hosted in the cluster.

“Such an attack could even be leveraged as a ransomware attack by taking the organization’s files hostage. Even worse, with organizations moving to the cloud, many use Kubernetes clusters as their development and testing environments, and a breach of such an environment can lead to devastating software supply chain attacks.”

“This particular malware is extremely impressive,” ESET UK cybersecurity specialist Jake Moore told The Register, “and something even infosec professionals were not expecting. However, this is exactly what we should be doing and expecting the unexpected in all walks of cyber crime. This type of attack can be leveraged into multi-layered attacks causing all levels of disruption and grief to any targeted organisation.”

“While it may seem surprising that we now have malware targeting containers, in reality it shouldn’t come as much of a surprise,” added security specialist Sean Wright. “The way organisations run their services has changed, with more and more organisations deploying their services and applications into containers, most notably Kubernetes. Criminals will adapt as well, and time and time again they have shown if anything they are incredibly resourceful and adaptive when it comes to trying to stay a step ahead.

“Additionally,” said Wright, “since organisations will likely run multiple services within a single Kubernetes cluster, gaining access to this could effectively give attackers an enormous level of access and control. It’s no wonder that attackers have their eyes on this. Combine this with the fact the Kubernetes is still a relatively new technology, many companies likely don’t have the sufficient knowledge to ensure that their instances are configured entirely correctly and most importantly securely.”

Microsoft caught napping
Prizmant had previously reported the ability to break out of Windows container boundaries in July 2020, but to his surprise Microsoft was initially unconcerned. “Microsoft originally didn’t consider this issue a vulnerability, based on the reasoning that Windows Server containers are not a security boundary, and therefore each application that is being run inside a container should be treated as if it is executed directly on the host,” Prizmant recalled.

“A few weeks after that discussion, I reported the issue to Google because Kubernetes is vulnerable to those issues. Google contacted Microsoft, and after some back and forth, it was determined by Microsoft that an escape from a Windows container to the host, when executed without administrator permissions inside the container, will in fact be considered a vulnerability.”

It was shortly after this reclassification that Prizmant discovered Siloscape, which he believes has been actively exploiting zero-day vulnerabilities in containerised applications, and using Windows-specific container escape techniques to gain access to the underlying node and from there the cluster for over a year.

“Users should follow Microsoft’s guidance recommending not to use Windows containers as a security feature,” Prizmant concluded. “Furthermore, administrators should make sure their Kubernetes cluster is securely configured. In particular, a secured Kubernetes cluster won’t be as vulnerable to this specific malware as the nodes’ privileges won’t suffice to create new deployments. In this case, Siloscape will exit.”

Shipa Corp., a Kubernetes application development and management platform, today announced the launch of Shipa Cloud that will assist developers, DevOps teams and platform engineers with the management and support of cloud-native applications.

Shipa Cloud provides a secure developer-centric platform for managing operating applications on Kubernetes. This includes the automatic creation and deployment of all objects.

It operates within the application layer and ensures that developers can observe the app’s entire context without interacting with infrastructure or tinkering with Kubernetes under the hood. As a result, the developers and engineers involved in the process do not need Kubernetes expertise.

“Kubernetes is a powerful and requisite tool for modern application development, but for too many enterprises now leveraging it, it remains frustratingly complex to manage,” said Bruno Andrade, chief executive of Shipa. “We launched Shipa in 2020 to take many of those infrastructure tasks off developers’ plates.”

Shipa Cloud features and benefits include the elimination of existing YAML and Helm charting, post-deployment observability, easy setup and governance and out-of-the-box integration with many cloud-native tools.

Upon installing Shipa Cloud, DevOps teams no longer need to update YAML files constantly and maintain policies for automated governance. The company says it will do that itself to deploy applications, so teams can stay in touch with Kubernetes environments through the interface.

Once deployed, Ship Cloud provides in-depth observability across all applications for statuses, objects, dependencies and network policies. It also connects with numerous pre-built connections into existing management tools for application lifecycle history and version management.

Shipa Cloud also allows DevOps teams to set policies for governance easily– for example, policies can be applied across the entire application stack. Once deployed, it can apply to network security, user roles, resource consumption and much more.

“We enable developers to focus on application deployment and management, while also empowering DevOps to set up the control and compliance policies they require,” said Andrade.

The platform also integrates with numerous cloud-native tools popular on the market such as Vault by HashiCorp Inc., Datadog Inc., JFrog Ltd., Circle Internet Services Inc., Traefik Labs and Istio.

Shipa Corp., a Kubernetes application development and management platform, today announced the launch of Shipa Cloud that will assist developers, DevOps teams and platform engineers with the management and support of cloud-native applications.

Shipa Cloud provides a secure developer-centric platform for managing operating applications on Kubernetes. This includes the automatic creation and deployment of all objects.

It operates within the application layer and ensures that developers can observe the app’s entire context without interacting with infrastructure or tinkering with Kubernetes under the hood. As a result, the developers and engineers involved in the process do not need Kubernetes expertise.

“Kubernetes is a powerful and requisite tool for modern application development, but for too many enterprises now leveraging it, it remains frustratingly complex to manage,” said Bruno Andrade, chief executive of Shipa. “We launched Shipa in 2020 to take many of those infrastructure tasks off developers’ plates.”

Shipa Cloud features and benefits include the elimination of existing YAML and Helm charting, post-deployment observability, easy setup and governance and out-of-the-box integration with many cloud-native tools.

Upon installing Shipa Cloud, DevOps teams no longer need to update YAML files constantly and maintain policies for automated governance. The company says it will do that itself to deploy applications, so teams can stay in touch with Kubernetes environments through the interface.

Once deployed, Ship Cloud provides in-depth observability across all applications for statuses, objects, dependencies and network policies. It also connects with numerous pre-built connections into existing management tools for application lifecycle history and version management.

Shipa Cloud also allows DevOps teams to set policies for governance easily– for example, policies can be applied across the entire application stack. Once deployed, it can apply to network security, user roles, resource consumption and much more.

“We enable developers to focus on application deployment and management, while also empowering DevOps to set up the control and compliance policies they require,” said Andrade.

The platform also integrates with numerous cloud-native tools popular on the market such as Vault by HashiCorp Inc., Datadog Inc., JFrog Ltd., Circle Internet Services Inc., Traefik Labs and Istio.

Observability is a staple of high-performing software and DevOps teams. Research shows that a comprehensive observability solution, along with a number of other technical practices, positively contributes to continuous delivery and service uptime.

Observability is sometimes confused with monitoring, but there is a clear difference between the two; it’s important to understand the distinction. Observability refers to a technical solution that enables teams to actively debug a system. It is based on exploring activities, properties and patterns that are not defined in advance. Monitoring, on the other hand, is a technical solution that enables teams to watch and understand the state of their systems, and is based on gathering predefined sets of metrics or logs.

What Makes Kubernetes Observability Different?
Conventional observability and monitoring tools were designed for monolithic systems; observing the health and behavior of a single application instance. Complex distributed microservices architectures, like Kubernetes, are constantly changing, with hundreds and even thousands of pods being created and destroyed within minutes. Because this environment is so dynamic, pre-defined metrics and logs aren’t effective for troubleshooting issues. Conventional observability approaches, which work well in traditional, monolithic environments, are inadequate for Kubernetes. So, an observability solution that is purpose-built for a distributed microservices architecture is needed to match the unpredictable nature of Kubernetes cluster behavior, and to capture the data required for teams to identify and troubleshoot issues in real time.

Kubernetes Observability Challenges
Kubernetes provides abstraction and simplicity with a declarative model to program complex deployments. However, when it comes to debugging microservices, this abstraction and simplicity actually creates complexity. There are several reasons why.

Kubernetes microservices architecture itself is complex, involving tens to hundreds of microservices that are communicating. Debugging this architecture requires specialized tools.
Kubernetes clusters run on a distributed infrastructure that is spread across on-premises, hybrid and cloud environments.
Kubernetes infrastructure is dynamic. The platform spins up required resources and provides ephemeral infrastructure to scale the application based on demand.
Kubernetes deployments need fine-grained security and an observability model that complements a defense-in-depth approach. Some DNS issues, for example, can indicate a compromised resource in the cluster.
Given the complex nature of Kubernetes microservices deployments and the overwhelming amount of data generated, it’s not humanly possible to diagnose and troubleshoot this kind of environment. This becomes even more problematic when mission-critical applications are involved. Given the density of applications and the dynamic nature of the computing environment, the problem is worsening each day.

Enabling Kubernetes Observability with Artificial Intelligence
Existing tools are inadequate. It’s time to reimagine a solution for this critical observability problem. We can start by applying machine learning and artificial intelligence (AI) to observability; in effect, deploying machines to debug machines. By automating dynamic monitoring processes, for example, we can create intelligent observability that converts telemetry data into actionable insights. We can use AI to analyze this data and identify problem patterns, and create unique observability “snapshots” which can be used to build reference templates that can be catalogued and accessed by troubleshooting teams when issues arise.

Kubernetes introduces dynamism to distributed infrastructure, and a high level of complexity for troubleshooting teams. By applying machine learning and AI to observability, we can open exciting new avenues to make Kubernetes more consistently reliable and secure, speed time to root cause analysis and resolution, and make it easier for new SREs, DevOps engineers and service owners to effectively debug dynamic, distributed Kubernetes environments.

Software services architected as microservices, packaged in containers, and orchestrated with Kubernetes changes the game for continuous testing because of the excellent alignment with the five tenets of continuous testing.

The DevOps Institute describes continuous testing as an essential tenet of DevOps. Continuous testing allows for continuous assessment of incremental changes as part of establishing a culture and environment where building, testing and releasing software can happen rapidly, frequently, reliably and safely. In my book, Engineering DevOps, I explained that there are five tenets which are guiding principles for continuous testing as follows:

Shift Left: Conduct each test as early in the pipeline as possible.
Fail Early: Arrange the tests so the most likely problems are found at the earliest possible stage in the DevOps pipeline.
Fail Often: Run tests frequently and with many different conditions.
Test Fast: Arrange tests to run in quick cycles.
Be Relevant: Focus on the most important tests and results.
The microservices approach aims to produce well bounded, networked, service-oriented modules. This is attractive to software application architectures because the individual microservices can be built and deployed as independent units. The smaller modules align well with the five tenets, which makes it easier and quicker to test compared to large monolithic applications.

Shift Left
Applications engineered as microservices have contracts that define how a containerized service behaves with other services that use it. This attribute of microservices reduces the dependence between microservices, which reduces the potential risk of unexpected interactions. This means that a substantial amount of high-quality testing of standalone microservices can be conducted early in the pipeline. Tests can be conducted, not just at the unit level, but at the integration level, as well. Specialty tests—such as user interface visual validation or security scans—can be performed with confidence that the application is being testing in the same way it will be used when deployed to production.

System-level testing applications, including regression, performance and reliability testing, in the later stages of pipelines can be a source of bottlenecks, because more complex configurations involving multiple services are needed. This testing can be accelerated when the dependencies between containerized microservices are well-understood, because only the configurations that are known to be affected by a change need to be deployed and tested in the staging environment.

Advanced deployment and testing patterns, such as feature-flag rollouts, canary rollouts and blue-green deployment methods, take advantage of the flexibility of containerized applications and further accelerate testing. Instead of waiting for sufficient testing to be performed before deployment to production, these patterns allow changes to be gradually and safely deployed without any downtime or interruptions for users. A subset of running application instances can be deployed and tested with a subset of users instead of updating all the application instances at one time. Progressively more of the running application instances can be deployed as the application changes are proven with more users and deployment variations, until they are all updated. With the blue-green pattern, a parallel set of production instances can be used to verify each new version of your application, and then switched with the existing production instances when the new version has been verified ready-to-deploy.

Fail Early
The structure of built container images can be tested very early in the pipeline to ensure commands run as expected, that files are in the correct location and have the correct content. Structure tests ensure commands run properly in the target image, make sure all expected files exist within the image, verify file contents are correct, verify metadata configuration data is correct, and verify license permissions on copyrighted files.

A well-configured and maintained test environment, one that closely mimics production and contains up-to-date code deployments, can provide a safe and sane way for testers to validate a scenario before it gets into the hands of a customer.

In my article 9Pillars of Containers Best Practices, I explained how containers allow the job of orchestrating many test configuration variations to be migrated from infrastructure teams to developers. Developers specify what their application needs in a container during the testing phase, and their continuous deployment tool builds and runs the container. Some of the container practices that help find problems early include the following:

Place everything a service or application needs for testing in a container. Containers offer the opportunity to package test resources in special test containers so they can be conveniently and immutably invoked, on-demand, for testing changes with elastic scaling benefits.
Test using the same container definition that is deployed.
Test the container before pushing it to a shared environment.
Fail Often
Packaging a microservice into its own container is attractive because the service can be deployed immutably across any number of operating systems and infrastructures, scale easily and also can be reverted easily in the case of test failures.

Test environment management (TEM) systems can optimize the orchestration of test resources better with container test topologies that can be predefined and managed with Kubernetes across variations of operating systems and infrastructures.

Test Fast
The time between when a developer makes a code change and when you have a running version of the application should be as short as possible. In my prior article, 9 Pillars of Engineering DevOps With Kubernetes, I explained how, with Kubernetes, developers and testers can work better together to solve defects quickly and accurately, because developers can use the tester’s Kubernetes instance for debugging. This eliminates long delays associated with developers and testers trying to replicate each other’s test environments. Kubernetes also helps testers and developers quickly exchange precise information for application configurations.

Be Relevant
By packaging each application in its own container, it makes it easy to know what is being tested. Engineers can create precisely the test environment that is needed—locally, on-demand and with precisely the same OS version and dependencies as it would have in production.

Ideally, pre-production clusters used for testing are identical to production clusters, but for cost purposes, pre-production clusters can be scaled-down replicas. Keeping the clusters similar ensures that any testing is done using the same or similar conditions to production. This reduces the probability of unexpected failures due to environmental differences when you deploy to production.

One of the most difficult tasks in maintaining a test environment is keeping the data for each instance of the test environment current. Containerization encourages managing test data as a part of the test suite. The database is also a part of the container stack, which allows the test team to populate the database more easily with relevant data as a part of initializing a test run.

What This Means
Containerizing services, together with Kubernetes orchestration, is a game changer for continuous testing. The five tenets of continuous testing – Shift left, fail early, fail often, test fast and be relevant – are all supported by containers and Kubernetes, which make it much easier to implement continuous testing.

In my article, 9 Pillars of Engineering DevOps With Kubernetes, I explain that collaborative culture is a core pillar of well-engineered DevOps. DevOps favors cultures that are highly collaborative, continuous learning environments with most work arranged within small cross-functional teams that have short communication paths and shared accountabilities.

No technology, not even one as popular as Kubernetes, will achieve success with DevOps without the right culture. I said in my book, “Engineering DevOps,” that culture is a door to engineering DevOps, because if leaders and people do not accept DevOps, then no tool or engineering process will be successful. However, without an underlying engineering basis, culture is not sufficient to realize success with DevOps.

Fortunately, Kubernetes is truly a win/win situation for developers, because the K8s technology truly complements exemplary DevOps culture, and vice versa. There are numerous examples to illustrate the positive relationship between Kubernetes and DevOps culture.

• DevOps cultures encourage cross-functional collaboration, shared responsibilities, and elimination of silos between Dev, Ops and QA, security and product management team members. The flexibility and transparency that Kubernetes enables makes it easier for IT teams to work together more closely, and respond to business needs more rapidly.
• Operations teams are more satisfied, overall, because they appreciate how Kubernetes increases resource utilization and helps overcome many of the limitations of ticket-based management.
• The combination of automation capabilities, speed of operation and detailed, reliable information supported by Kubernetes enables teams to rapidly learn from failures, facilitates cooperation between departments and experimentation and improvement.
• Kubernetes supports DevOps continuous learning culture because communication of deployment information flows fluidly through end-to-end cross-functional teams.
• DevOps systems should be designed and created by an expert team and reviewed by a coalition of stakeholders including Dev, Ops, QA, and security. The inherent resilience, repeatability, flexibility and visibility enabled by Kubernetes suits a wide range of DevOps applications.
• Change management, often a source of conflict, is made more productive with Kubernetes because deployment configurations are version-managed together with the application code. This simplifies the ability of Dev, Ops and QA and security team members to collaboratively design end-to-end DevOps workflows.
• Kubernetes enables standardized and centralized organization workflows because it reduces the frustrations associated with scattered, decentralized information and disparate approaches to formatting and storing technical data.
  With Kubernetes, the work to stand up on-premises and cloud-based test environments is dramatically reduced, because containerized application software and associated testing software can be deployed in containers for testing as soon as application code is committed.
  Kubernetes supports integrated DevSecOps shift-left security practices with capabilities to improve access control to container clusters, manage updates to container code and environment variables, limit resource usage on pods, control the privileges that container-based workloads run with and restrict network access across containers. This reduces the fear of security risks, giving developers, operators and security teams more confidence that security risks are reduced.
• DevOps cultures favor key performance indicators (KPIs) that are set and monitored by the entire team to validate the performance of the end-to-end DevOps system. With Kubernetes, anyone can readily view and understand the state of all resources. Kubernetes breaks down traditional siloed visibility barriers between operations, QA, security and development teams. This improves transparency and open communication between team members.
• Team members are more confident in the quality of their application changes, because Kubernetes facilitates an enhanced DevOps culture of end-to-end testing that more closely resembles the experience of your users in production.
• Kubernetes reinforces exemplary DevOps culture practices, because it delivers clear benefits for technical and business stakeholders across the value stream. Kubernetes results in less costly, more productive, collaborative, engaged team members with fewer impediments, improved communication flow, dramatically faster time to deploy and quicker feedback and restore services times. Kubernetes and culture are truly a win/win for DevOps.

Puppet has launched a DevOps consulting service that promises to help organizations implement best practices that will ultimately make their IT organizations more efficient.

Nigel Kersten, field CTO, Puppet, said the Scaling DevOps Service is especially focused on improving workflows among organizations that have already started down the DevOps path.

Most IT organizations that embrace DevOps eventually encounter bottlenecks that conspire to limit the rate at which they can build and deploy applications. Puppet will make available DevOps experts capable of assessing DevOps workflows as part of an effort to reduce operational friction, said Kersten.

Those consultants can also identify integration opportunities that might further streamline workflows, in addition to providing an overall assessment of an organization’s DevOps maturity based on a model Puppet developed.

Kersten said in many cases, enterprise IT organizations, especially, are trying to adapt DevOps principles that were originally created for small startup companies, with mixed success. Puppet consultants, using observations gleaned from their own engagements with customers that have embraced its tools for automating the management of IT, are often in a better position to identify ways to optimize DevOps workflows across larger IT organizations, Kersten said.

It’s also easy for large enterprise IT organizations to misinterpret how one DevOps principle or another should actually be implemented, Kersten said.

DevOps consulting, of course, has become a cottage industry within the IT services sector over the last decade. Now, almost every systems integrator has a DevOps practice. Most of those practices are focused on enabling organizations to embrace DevOps, versus helping organizations optimize workflows after they have already begun the transition, said Kersten.

It’s not clear to what degree organizations that have not embraced Puppet’s automation framework will embrace consulting services based on a DevOps model created by observing Puppet’s customers. However, it’s apparent many IT organizations have inconsistently implemented DevOps practices across various departments. In many cases, bottlenecks that result in various departments within a larger IT organization are being addressed using a set of manual processes that have been created as a workaround to a specific problem.

Of course, optimizing DevSecOps best processes is only going to become more challenging as emergent technologies such as containers, Kubernetes clusters and serverless computing frameworks are added to the IT mix. More challenging still, many organizations are now trying to shift responsibility for security further left as part of a DevSecOps workflow.

Many IT teams are, naturally, resistant to paying for advice, while others routinely hire small armies of consultants in the hope that ideas and concepts that have worked well elsewhere can make their IT teams more efficient. Regardless of the approach pursued, IT leaders need to remember that DevOps is a continuous journey. Every time a new platform is added to an IT environment, a DevOps workflow will need to evolve. The real issue IT leaders need to come to terms with is how long it will take for their internal teams to adapt, whether it’s via the school of hard knocks or relying on external expertise that has handled most of the issues an internal IT team is likely to encounter.

CBA has provided its first detailed look at a container-as-a-service platform it stood up for development teams, and the guardrails wrapped around it to meet regulatory and security requirements.

Lead engineer Dário Nascimento told AWS re:Invent 2020 that the bank built the platform on an AWS stack and is using infrastructure-as-code practices and tools to manage configurations and compliance.

The bank – an AWS customer since 2012 – was cited in a recent blog by AWS chief evangelist Jeff Barr, though it had been unclear for some time where its focus with the cloud lay.

It is now clear that much effort of late has gone into the container-as-a-service platform and into containerising applications across more than one internal business unit or “department”.

In notes promoting the session, AWS said CBA had “built a platform to run containerised applications in a regulated environment and then replicated it across multiple departments using Amazon EKS, AWS CDK, and GitOps.”

EKS is Amazon’s managed Kubernetes service, while CDK – cloud development kit – offers a framework for companies to manage cloud infrastructure as code.

GitOps, meanwhile, is “an operating model for the delivery and management of cloud native applications on Kubernetes.”

“The core idea of GitOps is having a Git repository that always contains declarative descriptions of the infrastructure currently desired in the production environment and an automated process to make the production environment match the described state in the repository,” Walmart Japan cloud solution architect Bhargav Shah writes in an explainer.

“If you want to deploy a new application or update an existing one, you only need to update the repository – the automated process handles everything else.

“It’s like having cruise control for managing your applications in production.”

CBA’s Nascimento said that the bank’s use of GitOps – and the architecture of the container-as-a-service platform generally – was optimised for service security and resiliency, and to give auditors and financial regulators confidence in the cloud-hosted infrastructure.

In that way, CBA is treading a similar path to that of other banks with cloud ambitions: NAB, for example, has its CAST framework which it used to get the Australian Prudential Regulation Authority’s (APRA’s) blessing.

“We kind of use GitOps and infrastructure-as-code as an immutability firewall,” Nascimento said.

“One of the core principles is that our applications must be declared in code in Git, defining the state we want the system to be, [the] drivers and the operations that we want it to execute, and then Gitops operators such as Kubernetes and [AWS] CloudFormation systems will ensure the services reflects the state you defined that in code.

“That means humans only need read-only access for observability purposes.”

The container-as-a-service platform is also intended in part to make the job of auditors easier by implementing many security and compliance controls automatically, with development teams adding only a few controls of their own for their particular service or application.

“Financial institutions are regulated environments and must perform risk management to be compliant with the expectations of security and regulators,” Nascimento said.

“I consider [security and regulators] like ‘bar raisers’ for processes and mechanisms.

“Risk management is a constant process that assesses what risks exist and then find controls to mitigate those risks. Controls are like requirements, defined by security, by risk, by engineering teams, usually based on standards such as ISO, PCI or industry regulations. These requirements aim to detect, prevent and mitigate something that might happen.

“Auditors will demand evidence proving that controls have been implemented to ensure that the system is actually compliant.”

Nascimento noted that if each internal team composed its own Kubernetes platform, each would then “have to repeat this auditing process and provide evidence that their version of the platform is also secure and compliant.”

“This approach will definitely not scale,” he said.

“So we built a container-as-a-service platform with the … risk assessment to ensure the platform is secure and reliable, and just like with the ‘AWS shared responsibility model’, we implemented controls on behalf of the users to reduce the length of the architecting process.

“Users will only need to implement the few controls where they have to create a new service, and the auditors will absolutely have a more expansive trust base so the auditing process can be much quicker.”

Nascimento said the container-as-a-service platform also helped CBA “scale software development in an innovative, sustainable, reliable and secure manner.”

Aside from aiding auditors, GitOps was also intended to “empower developers to follow best practices so that services are well configured and reliable.”

“Service continuity and reliability is a must in the financial industry so when we designed this container platform, we optimised for service security and resiliency; in other words, for minimising the access permissions and the blast radius,” Nascimento said.

“We converged on running one cluster per AWS account and two accounts per system, a non-prod account and production account.

“A system itself is composed by multiple services within a single business unit.”

The multi-account strategy enabled CBA to effectively segregate systems, such that if one failed, it did so within “a well-defined blast radius” and did not impact other systems.

Nascimento did not talk about which business units run workloads on the container-as-a-service platform, nor the types or numbers of workloads, instead focusing purely on the architecture and guardrails the bank had laid down for the platform.

Red Hat, Inc., the world’s leading provider of open source solutions, and GitHub, the software collaboration platform home to more than 50 million developers, today announced extended collaboration between the two companies, emphasizing Red Hat OpenShift through GitHub Actions and more. Red Hat is adding Red Hat GitHub Actions to the GitHub Marketplace, bringing GitHub’s DevOps, continuous integration/continuous development (CI/CD) and developer workflow automation tools to Red Hat OpenShift. This further refines the application development capabilities of the world’s leading enterprise Kubernetes platform with GitHub Actions, adding greater freedom to how developers can build and deploy applications on Red Hat OpenShift across the open hybrid cloud.

GitHub has become nearly synonymous with developer tools and serves as the home for many popular software projects, including open source communities like the Linux kernel and Kubernetes. Using GitHub’s built-in powerful, flexible CI/CD solution, GitHub Actions puts automation directly in the developer path, making it possible for nearly any event in a GitHub repository, like a pull-request or issue comment, to trigger workflows that can build and deploy applications across an IT environment and automate nearly any process in the software lifecycle. Organizations often want to bring the familiar, collaborative experience of GitHub to their developers, as well as provide a more secure, common platform for working with open source communities. This makes the availability of tooling like Actions on enterprise Kubernetes platforms a crucial component for the future of IT.

Red Hat OpenShift now supports GitHub Actions, enabling organizations to standardize and scale their use of open, standardized developer toolchain components like Quay, Buildah, or Source-to-Image (s2i). This helps to meet developers where they are and provides greater choice and flexibility to OpenShift customers in how they build and deploy applications. The new GitHub Actions for Red Hat OpenShift, along with existing actions on GitHub Marketplace and action workflows, make it possible to achieve simple as well as complex application workflows on Red Hat’s enterprise Kubernetes platform using an extensive array of standards-based tools.

As part of the collaboration, GitHub has also joined OpenShift Commons, a community that helps drive connections and collaboration across the OpenShift ecosystem. Beyond Actions and GitHub Marketplace, Red Hat and GitHub are also exploring self-hosted GitHub runners for OpenShift. A runner is the combined application and server that hosts a job and carries out the steps for an Action workflow. Self-hosting runners gives IT teams more control and flexibility over the hardware and software included as part of their environment. This means that end users can increase memory size, enable GPUs, or install software that may only be available locally as part of a tailored application development experience.

The addition of GitHub Actions builds on Red Hat OpenShift’s robust developer experience, which includes OpenShift GitOps (based on ArgoCD) and OpenShift Pipelines (based on Tekton). OpenShift is now able to provide a complete solution for DevOps and GitOps practitioners as they seek to build, deploy, and maintain cloud-native applications.

Availability

GitHub Actions on Red Hat OpenShift are available now via GitHub Marketplace.

Supporting Quotes

Joe Fernandes, vice president, Products, Cloud Platforms, Red Hat

“Red Hat OpenShift is more than a Kubernetes platform for deploying cloud-native applications; it’s a powerful, flexible foundation for developers to build the latest and greatest applications. By adding GitHub Actions to our existing set of DevOps and GitOps capabilities and by working with GitHub to further refine and expand the developer experience, we aim to make Red Hat OpenShift the most complete cloud-native development platform available, one built on the open standards of Kubernetes and Linux containers and backed by the vast expertise of Red Hat.”

Jeremy Epling, vice president of Product Management, GitHub

“GitHub is the home for all developers, and we’re excited to expand our collaboration with Red Hat to accelerate software development within the enterprise. Combining Red Hat OpenShift with GitHub Actions will help our customers more securely automate nearly all their cloud-native development and DevOps workflows, providing a unified experience across the hybrid cloud that is exceptionally friendly to developers, security and operations teams. We’re looking forward to working more closely with Red Hat, and helping our customers deliver better and faster with open source software and standards.”

Microsoft launched a more complete Kubernetes tool to manage clusters on its Azure infrastructure-as-a-service (IaaS) that its open source team recommends as a replacement for the existing AKS Engine offering. The Cluster API Provider for Azure (CAPZ) also takes a step back from what has been a more abstracted view for managing container clusters on public cloud infrastructure.

Craig Peters, principal program manager for Azure container compute at Microsoft, explained in an email to SDxCentral that CAPZ is a tool that can be used specifically on and is complementary to infrastructure like Azure Kubernetes Service (AKS), Azure, and Azure Arc.

It’s built on the open source Cluster API (CAPI) Kubernetes sub-project, which is designed to provide declarative APIs and tooling to simplify provisioning, upgrading, and operating of multiple Kubernetes clusters. CAPZ takes that base and works through the Azure Resource Manager (ARM) to provide greater control for self-managed Kubernetes clusters on Azure and Azure-managed Kubernetes clusters.

“CAPZ enables users to use CAPI to create and manage either self-managed clusters where the user owns the control plane, uptime, and maintenance entirely themselves,” Peters wrote. He added that CAPZ is a tool that can be used specifically on Azure infrastructure through ARM to manage Kubernetes clusters through the Cluster API.

Basically, CAPZ provides for a greater level of management over Kubernetes clusters that are running in one of these managed environments. This allows it to bridge the gap between a user relying exclusively on their managed host for that control or attempting to manage Kubernetes on their own.

In an accompanying blog post, Peters explained that while AKS remains a “mature, scalable, secure” and fully Microsoft-based platform, it does not have the depth of control that some developers require.

“Some need functionality that is not available in AKS yet or might never be because they require user access to the control plane,” he wrote, noting that this need could be tied to regulatory or compliance issues, or even just a developer needing more control over Kubernetes features.

CAPZ Caps AKS Engine
That greater flexibility is also behind Microsoft’s move toward recommending CAPZ over its legacy AKS Engine product. AKS Engine is designed as a templating tool for turning cluster models into ARM templates to manage Kubernetes clusters but lacks flexibility as it can only create one cluster at a time, which limits scalability, and only on Azure.

“AKS Engine has been the workhorse for teams who need to operate their own clusters on Azure,” Peters explained. “The ARM template workflow is natural for some Azure-focused teams but doesn’t provide the power and flexibility of CAPI.”

However, Peters’ in the blog post noted that the “design falls short of empowering ongoing operational needs such as scaling, in-place upgrading, and extension management. And it isn’t useful for users who are focused on multi-cloud scenarios like managing fleets of Kubernetes clusters across cloud infrastructures that do not support ARM.”

As such, his team is suggesting that AKS Engine users look at CAPZ as it provides stronger support for managing the cluster lifecycle and that it will be the focus for all new investments from that team.

New Relic has announced its intent to acquire Pixie Labs, a startup that has developed an observability platform that runs natively on Kubernetes.

Pixie Labs CEO Zain Asgar, who is also adjunct professor of computer science at Stanford University, says the acquisition will result in the melding of an observability platform designed primarily for developers who need to debug applications with New Relic’s observability platform, which is employed primarily by IT operations teams.

Observability, a core tenet of any set of best DevOps practices, has become a larger issue as IT organizations begin to deploy microservices-based applications based on containers on Kubernetes clusters that have lots of dependencies. The only way to manage those applications effectively is to find a way to gather metrics in real time.

Pixie Labs employs the extended Berkeley Packet Filter (eBPF) at the Linux kernel level to automatically collect baseline data such as metrics, traces, logs and events. That approach eliminates the need to individually instrument every application deployed on a Kubernetes cluster using agent software that needs to be maintained, updated and secured.

The company addresses that challenge using a distributed machine data system it developed that creates streaming telemetry pipelines. The data from those pipelines can be employed to create artificial intelligence (AI) models to optimize Kubernetes environments or, alternatively, consumed via scripts and debugging interfaces fed into existing monitoring tools.

Asgar says the New Relic approach to unifying the monitoring of applications and infrastructure aligns with the Pixie Labs approach because the data it collects tends to focus more on what’s occurred in a Kubernetes environment in the last 24 hours to help developers debug applications. The New Relic platform will use that data to augment the platform, which is widely employed to optimize both microservices-based applications and monolithic applications.

While observability as a concept has been around since the dawn of DevOps, it’s only recently that many of the providers of what historically have been known as application performance management (APM) tools have begun to recast their offerings as observability platforms.

Part of that shift can be attributed to the rise of microservices, which require deep levels of instrumentation to effectively manage given all the dependencies that exist between them. Previously. Most IT organizations limited their use of APM platforms to their most critical monolithic applications because of the costs and the challenges associated with injecting and updating agent software embedded within those applications. Pixie Labs solves that latter issue by eliminating the need for agent software altogether.

It’s unclear to what degree agent software may be required to instrument IT environments going forward, especially as eBPF becomes more widely employed. The one thing that is certain is there’s no shortage of observability platforms, as competition among the providers of these platforms becomes increasingly fierce.

Each IT organization naturally will need to decide to what degree it wants to continue using its existing observability platform that will evolve over time versus adopting a new platform. Regardless of the path chosen, IT teams have never had better visibility into their IT environments.

Mirantis this week rolled out Mirantis OpenStack for Kubernetes, an instance of the open source cloud management framework in which all the components have been encapsulated in containers.

Shaun O’Meara, global field CTO at Mirantis, says that approach makes it possible to then employ Kubernetes to orchestrate those containers.

Mirantis OpenStack for Kubernetes is the first in a planned series of enhancements to the Mirantis Cloud Native Platform, a family of offerings based on Kubernetes that includes Mirantis Container Cloud, the container platform formerly known as Docker Enterprise that Mirantis acquired last year.

O’Meara says the goal is to make it easier to deploy, manage and update a widely employed cloud management framework that continues to be advanced under the auspices of the Open Infrastructure Foundation, formerly known as The OpenStack Foundation.

That approach also makes it possible to deploy OpenStack on either a virtual machine or on a bare-metal server, notes O’Meara. Even the kernel-based virtual machine (KVM) foundation on which OpenStack is most frequently deployed has been encapsulated in a container, he says.

Bare-metal instances of Kubernetes are gaining traction among financial service firms, organizations that are building artificial intelligence (AI) applications based on machine learning algorithms and telecommunications carriers—all of which trying to minimize the overhead a virtual machine adds to an IT environment, notes O’Meara.

OpenStack is most widely employed by telecommunications carriers and other IT service providers as an open source alternative to a commercial stack of virtual machine software from VMware. That approach enables organizations to deploy a cloud framework at scale without incurring massive software licensing costs.

The OpenStack framework has seen less adoption among enterprise IT organizations, but O’Meara notes that since the transition to cloud-native computing began, adoption of OpenStack has increased as organizations look to deploy containerized applications at scale. Mirantis OpenStack for Kubernetes will enable both service providers and enterprise IT organizations to expand their reliance on OpenStack using the same Kubernetes orchestration engine they already employ to manage containers in what are now highly distributed computing environments, he says.

That approach ultimately serves to reduce the total cost of managing IT environments that need to be able to run both cloud-native applications and legacy monolithic applications, he adds.

Longer-term, the convergence of Kubernetes and OpenStack should reduce the level of tension that surrounds both platforms. As Kubernetes continues to evolve, there are those that advocate the platform will one day replace OpenStack with a set of cloud-native extensions. The Mirantis approach effectively turns all the components that make up OpenStack today into a set of containers that run natively on Kubernetes. Previously, organizations could deploy OpenStack on Kubernetes, but each component was not a set of containers that could be individually orchestrated.

Of course, Kubernetes today is more commonly deployed on OpenStack and VMware because it provides a method for provisioning a complex platform using a familiar set of IT management tools. However, as cloud-native computing environments continue to expand, the relationship between the components that make us a management framework and Kubernetes are clearly still evolving.

Continuous software delivery startup Harness Inc. said today it’s integrating its platform with Amazon Web Services Inc.’s Elastic Container Service in a move that will enable users to run applications in Docker containers with less scripting and redundancy.

Amazon ECS is a fully managed container orchestration service that rivals the better known open-source Kubernetes service. They’re both used to manage software containers that host the components of modern apps distributed across many computer servers.

Harness sells a “continuous delivery-as-a-service” platform that uses machine learning algorithms to monitor new software updates for any problems. The service allows users to understand what’s happening with an application’s baseline environment and initiate automatic rollbacks to a previous version if any irregular activity is detected.

Harness said that by integrating its service with Amazon ECS, it enables numerous features that were previously exclusive to Kubernetes users.

That’s important, Harness says, because its 2020 State of Continuous Delivery Insights Report from earlier this year found that 31% of companies use Amazon ECS exclusively for container orchestration, while 67% use Kubernetes.

“Naturally, a vast majority of CI/CD vendors have built their applications for organizations using Kubernetes, but in doing so, they have alienated more than a quarter of the market,” Harness says, referring the providers of continuous integration and continuous deployment of applications.

So today’s integration is all about filling that gap, Harness said. By combining its platform with Amazon ECS, users will be able to automate app deployments without needing to manage scripts and handle various failure conditions during deployment.

Moreover, there will be less redundancy, Harness said. Finally, Amazon ECS users will be able to take advantage of several “out-of-the-box deployment strategies” that Harness provides, such as Canary, Blue-Green and Basic Deployments, as well as its failure strategy and automated rollback capabilities.

“With their single minded focus on Kubernetes, most DevOps SaaS solutions have forgotten Amazon ECS customers,” said Harness co-founder and Chief Executive Jyoti Bansal (pictured). “We understand that many of our customers are happy with their ECS environments and don’t plan to switch, which is why we offer the same level of functionality for ECS and Kubernetes.”