staging-devopsy.kinsta.cloud

Category: Features

  • Sonatype Acquires MuseDev to Add Code Analysis

    Sonatype Acquires MuseDev to Add Code Analysis

    Sonatype today revealed it has acquired MuseDev, a provider of a code analysis tool, in addition to updating its Nexus platform for discovering vulnerabilities in software supply chains.

    Muse analyzes code each time a pull request is made, which makes it easier for developers to discover and address issues long before they commit code. Muse is integrated with 24 pre-configured code analyzers for GitHub, GitLab and Bitbucket repositories. It then analyzes each pull request to surface bugs, as part of automated code review, and includes analysis of interprocedural information flow and thread safety issue analysis, along with guidance to fix any bugs discovered.

    In addition to adding support for Muse, the latest edition of the Nexus platform integrates a container firewall from NueVector along with a set of tools for identifying and providing guidance on how to address misconfiguration issues that frequently arise when developers employ open source Terraform software to programmatically manage infrastructure as code.

    Finally, Sonatype added tools to provide better guidance on the implications of open source licensing terms attached to various projects, while at the same time starting its own community for organizations migrating from Bintray and JCenter, now that those tools have been sunsetted.

    Brian Fox, Sonatype CTO, said the expectation is Muse will create an opportunity to introduce the complete DevSecOps portfolio to developers as they analyze code. Most developers are keenly interested in both optimizing and securing their code. They would just prefer to achieve that goal on their own versus being informed of an issue after code has been committed to a repository managed by a larger DevOps team, noted Fox.

    An advanced development pack was added to the Nexus platform last year to make it easier to surface dependencies in code that are vulnerable to threats. It applies machine and deep learning algorithms to automatically identify and block software supply chain attacks based on typosquatting and malicious code injections. Collectively, these tools give developers control over third-party open source code, first-party source code, infrastructure as code and containerized code, Fox said.

    Sonatype claims it now counts 70% of the Fortune 100 as customers, and supports more than 2,000 commercial engineering teams. In 2020, it claimed it saw a 35% annual growth in Nexus repository installs, which now stands at more than 250,000 instances employed by nearly 15 million developers.

    Overall, it’s not clear how much progress is being made toward embracing DevSecOps best practices. Sonatype, however. is making a case for putting DevSecOps tools directly into the hands of developers to address software supply chain security. In the wake of some recent high-profile breaches involving software supply chains, that approach may soon gain additional traction. After all, for all the encouragement being provided by application development team leaders these days, there’s nothing quite as effective as providing developers with a set of tools that enables them to achieve that goal on their own terms versus requiring them to follow a set of procedures dictated by a DevOps management team.

  • With Explosive Revenue Growth, MediaOps Recognized in Inc. Magazine’s List of Florida’s Fastest-Growing Private Companies

    With Explosive Revenue Growth, MediaOps Recognized in Inc. Magazine’s List of Florida’s Fastest-Growing Private Companies

    Companies on the 2021 Inc. 5000 Regionals: Florida list employed more than 83,000 people in 2019.

    Boca Raton, FL , March 16, 2021 – MediaOps, the place to tell your story in the most powerful way, announced that Inc. Magazine has ranked MediaOps as No.146 on its second annual Inc. 5000 Regionals: Florida list, the most prestigious ranking of the fastest-growing Florida-based private companies. Born of the annual Inc. 5000 franchise, this regional list is a unique look at the most successful companies within the Florida economy’s most dynamic segment—its independent small businesses. 

    “This recognition of our place within the thriving Florida ecosystem is very gratifying for us at MediaOps. We are also pleased that even through 2020, we have been able to continue our growth trajectory,” said Alan Shimel, CEO of MediaOps. “This recognition and others like it are testaments to the great work by our team of professionals here at MediaOps, who are really the engine that drives our growth. We are honored to be recognized by Inc. 5000 Regionals.”

     The companies on this list show stunning rates of growth across all industries in Florida. Between 2017 and 2019, these 250 private companies had an average growth rate of 202% and, in 2019 alone, they employed more than 83,000 people and added nearly $11 billion to the Florida economy. Companies based in major metro areas—Miami, Fort Lauderdale, Jacksonville, Tampa and Orlando—brought in the highest revenue overall.

    Complete results of the Inc. 5000 Regionals: Florida, including company profiles and an interactive database that can be sorted by industry, metro area and other criteria, can be found at https://www.inc.com/inc5000/regionals/florida starting March 16, 2021.

    “This list proves the power of companies in Florida no matter the industry,” said Inc. Editor-in-Chief Scott Omelianuk. “The impressive revenues and growth rates prove the insight and diligence of CEOs and that these businesses are here to stay.”

     ABOUT MEDIAOPS

    MediaOps, the place to tell your story in the most powerful way, is an omniversal media company covering IT industries and practices that are re-shaping the world of technology, including DevOps, Cloud-Native, Cybersecurity and Digital Transformation. Through a convergence of new media distribution platforms, we deliver the experiential stories IT professionals need to gain fresh insights and learn new skills. For marketing partners, MediaOps delivers unparalleled access to inform and engage with a highly involved IT community, for thought leadership, demand generation and specialized campaigns. MediaOps is not only the most trusted name in technology media, but the most loved as well. For more information, visit https://mediaops.com.

    ABOUT INC. AND THE INC. 5000 REGIONALS

    Methodology

    The 2021 Inc. 5000 Regionals are ranked according to percentage revenue growth when comparing 2017 and 2019. To qualify, companies must have been founded and generating revenue by March 31, 2017. They had to be U.S.-based, privately held, for profit, and independent—not subsidiaries or divisions of other companies—as of December 31, 2019. (Since then, a number of companies on the list have gone public or been acquired.) The minimum revenue required for 2017 is $100,000; the minimum for 2019 is $1 million. As always, Inc. reserves the right to decline applicants for subjective reasons. 

    About Inc. Media

    The world’s most trusted business-media brand, Inc. offers entrepreneurs the knowledge, tools, connections, and community to build great companies. Its award-winning multiplatform content reaches more than 50 million people each month across a variety of channels including websites, newsletters, social media, podcasts, and print. Its prestigious Inc. 5000 list, produced every year since 1982, analyzes company data to recognize the fastest-growing privately held businesses in the United States. The global recognition that comes with inclusion in the 5000 gives the founders of the best businesses an opportunity to engage with an exclusive community of their peers, and the credibility that helps them drive sales and recruit talent. The associated Inc. 5000 Conference is part of a highly acclaimed portfolio of bespoke events produced by Inc. For more information, visit www.inc.com.

    ###

    Rebecca Auguste

    rebecca@devops.com

    (561) 430-3347

  • VMware Enhances Management Portfolio

    VMware Enhances Management Portfolio

    VMware today rolled out a series of updates to its automation and monitoring portfolio as part of an ongoing effort to simplify management of highly distributed IT environments.

    Updates to the VMware vRealize Cloud automation portfolio include VMware vRealize Automation 8.4’s tighter integration with the open source Salt automation framework the company gained by acquiring SaltStack last year, in addition to a range of tools for provisioning and governing instances of VMware software running on Google Cloud, Microsoft Azure and VMware Cloud on Amazon Web Services (AWS).

    There is also a set of tools to enable organizations running NSX network virtualization software for vSphere to migrate to NSX-T, an instance of network virtualization software that can be deployed anywhere.

    VMware vRealize Operations, meanwhile, is being updated to support a total of 57 AWS services along with the ability to predict the cost of deploying VMware Cloud on AWS. The latter capability includes tracking potential savings generated by powering off idle or unused virtual machines as well as snapshots, orphaned disks and oversized virtual machines. There are also now ten additional dashboards for tracking various costs, including return on investment, total cost of ownership and potential cost savings. IT teams can also more easily track capacity utilization trends on AWS.

    VMware is adding support for the open source Telegraf Agent to enable IT teams to collect metrics from any platform, in addition to providing an update to VMware vRealize Log Insight 8.4 and vRealize Log Insight Cloud that enables these monitoring tools to store data collected from multiple cloud services more efficiently. IT teams will also be able to collect logs from both Microsoft Azure and AWS.

    Finally, VMware is expanding its network monitoring tools to provide greater visibility across multiple clouds.

    Fidelma Russo, senior vice president and general manager for cloud services at VMware, said the rate at which IT teams are consuming the software-as-a-service (SaaS) editions of VMware management and observability tools or full-blown managed services has increased sharply since the start of the COVID-19 pandemic, as IT teams managed on-premises and cloud instances of VMware software from home.

    It’s not clear what percentage of VMware’s installed base are now consuming the company’s automation and monitoring tools, but as the number of VMware instances deployed on public clouds increases alongside on-premises IT environments, so, too, do the management challenges. The choice IT teams generally have to make is deciding between automation and observability tools that are optimized for a specific platform versus adopting frameworks that work more broadly. With the acquisition of Salt and support for Telgraf, it is apparent VMware is moving to expand the reach of its management portfolio beyond its own software.

    In the meantime, IT teams are not only being asked to manage more complex IT environments, but the expectation that, through automation, they will be able to more effectively implement cost controls. This is happening at a time when many organizations have not been quite so sensitive to the total cost of IT. The challenge, of course, is those organizations are being asked to spend money on automation today in the hopes of spending less because of it tomorrow.

  • IBM Deepens DevOps Insights on Mainframes

    IBM Deepens DevOps Insights on Mainframes

    IBM today extended its effort to enable IT organizations that have mainframes to embrace DevOps best practices by updating the analytics tools it provides.

    Tom McPherson, vice president for IBM Z Software, said a version 6.0 update to the suite of IBM application discovery and delivery intelligence (ADDI) for IBM Z tools surfaces more granular insights by leveraging a new version of Wazi Analyze that now analyzes code immediately after a change is made. That capability is critical, because most of the workloads running on a mainframe are highly tuned. Any issue that is likely to occur can usually be traced directly back to the latest software update made to the environment, McPherson said.

     

    Wazi Analyze also can now be deployed as a set of containers, which McPherson said means IT teams can opt to run the analytics application on a platform other than the mainframe.

    ADDI also has been updated to improve Assembler support by making it easier to analyze multi-level dynamic assembler macro calls. A set of application programming interfaces (APIs) for feeding that data back to a continuous integration/continuous delivery (CI/CD) pipeline has also been added.

    Finally, IBM revealed it signed a licensing agreement with ITP Software Systeme GmbH, Munich (ITP) to enhance application analytics capabilities. That capability will be added to a future release of DevOps for IBM Z Hybrid Cloud, which includes ADDI and IBM Wazi Developer, to enable organizations to determine how best to modernize legacy monolithic applications as they transition to a microservices-based, cloud-native computing environment.

    Naturally, not every monolithic application is going to be converted into a series of microservices. However, McPherson said, it’s clear there is a need for analytics tools that will enable IT teams to more easily determine which elements of an application are better suited to being reconfigured as microservices that could be deployed on, for example, a Red Hat OpenShift cluster.

    For the last several years, IBM has been encouraging IT organizations that have mainframes to embrace DevOps best practices as part of a larger effort to position mainframes as another type of distributed computing platform. The overall goal is to lower the total cost of mainframe ownership by reducing the need to rely on specialists to manage mainframe application environments. Each year, more of those specialists retire. IBM wants to make it more feasible for organizations to replace those specialists with IT generalists, like those that typically manage distributed computing environments. At the same time, management of distributed computing environments is becoming more automated, thanks to the rise of DevOps.

    Of course, mainframe processes have been highly automated for decades. IT teams managing mainframes may still rely primarily on waterfall-based processes to deploy applications, but the underling infrastructure is designed to scale up and down on demand as application workloads require. Convincing IT teams that, for decades, have employed the same processes to manage mainframes often requires a significant amount of cultural change.

    Regardless of motivation, however, the winds of DevOps change are now blowing through mainframe environments just as fiercely as they have through the rest of IT.

  • ServiceNow Adds Low-Code Tool to Platform

    ServiceNow Adds Low-Code Tool to Platform

    ServiceNow today made available an update, dubbed Quebec, to its Now platform that adds a set of low-code application development tools.

    Marcus Torres, general manager for IntegrationHub and vice president of platform product management at ServiceNow, said the Creator Workflows tool leverages existing App Engine and IntegrationHub capabilities in the platform to make it possible for both end users and professional developers to build custom applications faster using a visual development tool dubbed App Engine Studio. A set of templates that provide a set of pre-built workflows is also included.

    The goal is to make it easier to develop applications that would otherwise not be built because professional developers, using existing tools, would simply not have the time, Torres said.

    The Quebec release of the software-as-a-service (SaaS) platform is also used for IT operations management (ITOM), adding artificial intelligence (AI) capabilities in the form of ITOM Predictive AIOps that surfaces potential issues before they become a major issue. It is now also easier to set up the virtual agents that ServiceNow makes available to enable conversational AI, and there is now an AI search capability built into the ServiceNow portal. ServiceNow gained these capabilities via its recent acquisitions of Loom Systems and Attivio.

    Finally, ServiceNow has added process optimization and workforce optimization modules, along with an engagement messenger module that extends the self-service capabilities it provides to third-party portals, and a universal request tool that enables agents to collaborate and transfer tickets across departments while keeping employees informed of the status of their ticket.

    Thanks to the general enthusiasm for digital business transformation initiatives being accelerated in the wake of the COVID-19 pandemic, reliance on low-code tools to build applications has significantly increased. The challenge organizations encounter, however, is that a low-code tool can build a relatively simple application. However, development means may need to drop down to a lower level of abstraction to address more complex issues as an application continues to evolve. The Creator Workflows tool from ServiceNow is designed to provide development teams with that option.

    In general, ServiceNow is making a case for building applications on the same platform that many IT organizations already employ to manage IT. Many organizations already take advantage of workflows that ServiceNow has built to extend its core platform to address a wide range of uses cases involving, for example, human resources applications. The addition of the low-code tool will make it easier for IT teams to create applications that address use cases unique to their organization.

    Of course, there is no shortage of options when it comes to low-code and no-code tools these days. IT teams will need to decide to what degree platform-specific low-code tools make sense versus adopting low-code tools that enable them to build applications that can be deployed anywhere. Regardless of the path forward, however, it’s clear the number of applications that need to be deployed is dramatically increasing with each passing day.

  • The Importance of Incorporating DesignOps Into DevOps

    The Importance of Incorporating DesignOps Into DevOps

    Design is a critical software project element that often goes unnoticed by those writing code. After all, coders and implementers tend to take the design process for granted and leave the look and feel of applications to the designers. In the days of waterfall based development, design was one of the first steps in the development sequence of creating a new application. However, with Agile and DevOps development practices, design became disconnected from the overall process.

    “If you look at the full spectrum of AppDev, it becomes obvious that there are many elements that should be part of DevOps. Take, for example, cyber – today, there is a movement to integrate cyber into the DevOps pipeline, which the industry has started to call DevSecOps,” said Mark Troester, VP of strategy at Progress, a software company offering tools for developers and IT. “To make design a part of the iterative process of DevOps, teams need to think about including designers during the complete development process, something along the lines of how cyber has become part of the iterative process. In other words, teams should be embracing the concept of DesignOps,” Troester said.

    To understand the challenges this creates for those looking to include design as part of the DevOps process, one only needs to look at how design, specifically user experience/customer experience (UX/CX) design, was done in the past. Designers would use tools such as InVision Studio, Axure, Proto.IO, Adobe XD, or one of the many other tools available, to prototype the look and feel of an application, or, more specifically, the end-user experience. The term DesignOps was coined to encapsulate the processes around design. However, DesignOps solely focused on the process of design, such as design workflows, design tools, design governance, team management, budgets and so on. 

    The ultimate goal of DesignOps was design creation; that design was then passed on to those who would write the code and develop the logic to bring that design to fruition in the form of an application. DesignOps worked rather well when an organization was adhering to waterfall development methodologies, where each step was clearly defined and the goal was to deliver a complete, finalized application to those requesting it.

    “Larger organizations were able to field large design teams and could afford to implement a complete design system. When you have 50 or more designers, a complete design system becomes critical to manage design,” said Troester. “However, as AppDev has evolved into a more agile process, especially under DevOps, the disconnect between design and development became a significant problem.”

    What Troester is alluding to is the reiterative development cycle used by DevOps teams, where applications are delivered in pieces and then further modified based on user feedback or business operational changes. Businesses today are embracing agile concepts, so they can react much faster to changing market conditions. This, in turn, means modifying applications as quickly as possible to maintain a competitive advantage. Currently, design remains somewhat siloed, and can become a bottleneck for implementing changes if the UX/CX must be modified to address those needed changes. 

    “With the rise of DevOps, teams need to start thinking of reiterative processes, where DesignOps integrates with the DevOps team, so there is collaboration between the designers and the developers, allowing design changes to happen quickly,” Troester said. “Yet, there are still remaining challenges – some created by the COVID-19 crisis – where designers and developers may not even be in the same building, much less the same time zone,” he said.

    To Troester’s point, the COVID-19 crisis has forced businesses to evolve in ways that were once thought impossible. Developers, designers and even operations teams and individuals may no longer be sharing office space, and might be distributed across multiple locations. That complication will drive the need for better collaboration tools that bring design into the DevOps cycle.

    “DevOps teams, as well as DesignOps teams, should be looking into technologies that can bridge the designer/developer divide. It will be critical in the near future to facilitate collaboration between design and development,” Troester said. “Perhaps, the answer lies with building some type of bi-directional API into design systems, which can play a key role in the implementation and support of design-first experiences,” he added.

    Existing solutions to the current divide seem to be few and far between. But, that does not mean DesignOps and DevOps teams should not be currently looking for a solution to what will become a major problem as DevOps accelerates in the enterprise.                  

  • LinearB Raises $16M for Software Delivery Intelligence

    LinearB Raises $16M for Software Delivery Intelligence

    LinearB announced today it has raised an additional $16 million in funding to advance adoption of a software delivery intelligence platform.

    Ori Keren, LinearB CEO, said rather than relying on antiquated processes that require software development teams to track progress by reentering data into a project management application, it’s now possible to automatically collect all the relevant data required from the tools and platforms being employed to build software.

    The LinearB platform correlates DevOps pipeline data gathered from code, Git, projects and releases to provide visibility and context to every member of the development team. LinearB employs machine learning algorithms to construct and correlate that data, in real-time, to provide accurate insights into project status. That’s critical, because it empowers every individual on that team to make informed decisions about which tasks to prioritize without waiting for an explicit directive, Keren said.

    LinearB will, in part, use the funding to build integrations with a wider range of DevOps platforms and tools, Keren added.

    Software delivery intelligence differs from value stream management (VSM) platforms; though they provide similar insights, those surfaced by LinearB are aimed at developers rather than C-level executives trying to optimize deployment of limited resources across multiple teams, said Keren. In many ways, the data collected by LinearB could be employed to better inform a VSM platform, Keren added.

    LinearB, in contrast, makes it easier to identify which teams and projects need additional help in near-real-time using metrics surfaced in a dashboard that track, for example, cycle times. The goal is to provide insights that make it easier to predict and eliminate project delays, remediate high-risk code before it is included in a production environment, eliminate bottlenecks and make certain the focus of the DevOps team remains on tasks of the highest priority.

    More than 1,500 software development teams are already using LinearB as an alternative to traditional project management applications. Most of those customers are building commercial applications, so the goal now is to extend the reach of LinearB into the enterprise, said Keren.

    LinearB, of course, doesn’t eliminate the need for project managers. However, it does eliminate the need for project managers to nag developers to update a project management application. Given the rate at which application development projects are now updated, much of the data in a project management application is outdated shortly after it is entered.

    There’s a lot of pressure on application development teams these days. Many projects have been accelerated as part of an effort to more rapidly embrace digital business transformation in the wake of the economic downturn brought on by the COVID-19 pandemic. The challenge for many developers is they, too, are working from home to help combat the spread of the virus. That often results in interactions with managers over video conferencing calls that lack context. Having access to a software development intelligence platform should enable everyone with a vested interest in application deployment speed to make more informed decisions faster.

  • Linux Foundation Project Secures Software Supply Chains

    Linux Foundation Project Secures Software Supply Chains

    The Linux Foundation today embraced a sigstore project founded by Red Hat, Google and Purdue University to make it simpler for developers to employ cryptographic software, enabled by transparency log technologies, to secure software supply chains.

    Luke Hinds, security engineering lead in the office of the CTO at Red Hat, said he and Dan Lorenc, a staff software engineer for Google, led a small team creating a lightweight mechanism for signing software artifacts, such as release files, container images and binaries, in way that creates an immutable, tamper-proof log.

    Now, the goal is to take that project to the next level by contributing it to the Linux Foundation, at a time when the focus on software supply chain security has increased in the wake of a spate of high-profile breaches. As part of that effort, a free service, based on sigstore, will also be made available by the Linux Foundation to make the cryptographic software easily accessible to a wide range of developers.

    Hinds said one of the reasons that artifacts are not signed by developers is that the current processes employed are too cumbersome. The cryptographic software is designed to be integrated as an extension of existing workflows, Hinds noted.

    Because the log created is immutable, everyone participating in the software development process, including auditors, can now transparently track chain of custody for any software artifact, Hinds said. At its core, sigstore creates a set of short-lived ephemeral keys with a trust root based on an auditable public log.

    Existing approaches rely on digests stored on insecure systems that are susceptible to tampering. Cybercriminals can, for example, swap out digests if they can gain access to compromised credentials. Those types of targeted attacks can be thwarted using sigstore, because the log management system that underpins it is immutable, said Hinds.

    Of course, no system for securing software supply chains is going to be useful if developers won’t employ it. Key management, key compromise/revocation and the distribution of public keys and artifact digests are challenging to manage. Developers, then, need to determine which keys to trust in addition to learning how to sign them when different platforms are employed. Digests and public keys are also often distributed across vulnerable websites susceptible to hacks, or stored as a README file on a public git repository.

    As organizations embrace DevSecOps best practices, it’s only a matter of time before the entire software supply chain comes under greater scrutiny. Ultimately, the issue will come down to finding a way to secure those supply chains, either from the top down by deploying and maintaining a platform, or simply making it easier for developers to better secure artifacts from the bottom up.

    Regardless of approach, the signing of software artifacts should, one way or another, become more routine in the weeks and months ahead. The biggest challenge will be overcoming the simple inertia that currently exists among developers who routinely ignore the whole process.

  • GitGuardian Reports Careless Handling of Application Secrets

    GitGuardian Reports Careless Handling of Application Secrets

    A new report, the 2021 State of Secrets Sprawl on GitHub, published today by GitGuardian, a provider of a tool for monitoring usage of application secrets, suggests developers are not especially good at keeping those secrets safe.

    Based on an analysis of every single commit made to GitHub, the report finds there has been a 20% year-over-year increase in the number of secrets – such as application programming interface (API) keys, private keys, certificates, usernames and passwords –  discovered on a public repository.

    Developers, as they build an application, make secrets easily accessible as plain text for the sake of convenience. However, when those applications are deployed in a production environment, developers often forget to delete the secrets they stored in GitHub.

    GitGuardian CEO Jeremey Thomas noted that cybercriminals are now actively scanning repositories looking for secrets that would enable them to compromise applications.

    As the number of application development projects being launched increased, so too did the number of application secrets being stored in repositories like GitHub. The GitGuardian report notes 60 million repositories were created in the last year, representing a 35% increase over the previous year. GitGuardian claims it detected more than 5,000 application secrets per day. Most of those secrets have been detected in repositories that belong to developers (85%), while the other 15% belonged to organizations. The top four countries where secrets were disclosed were India, Brazil, the United States and Nigeria.

    GitGuardian also notes it sent out 937,539 pro bono alerts to 558,086 developers last year that informed developers that application secrets were exposed. The mean time for GitGuardian’s algorithm to detect a leak is four seconds. The average mean time to response of a developer when informed of the issues is about 25 minutes, the report noted.

    As a best practice, GitGuardian recommends not storing unencrypted secrets in git repositories, and that unencrypted secrets should never be shared via messaging systems like Slack. DevOps teams should also restrict API access and permissions.

    As more attention is paid to how software supply chains are managed in the wake of some recent, high-profile breaches, there is no doubt the number of audits conducted will increase. Many of those auditors will specifically be trying to ascertain how application secrets are being managed. Developers may have to get used to a new, higher level of scrutiny, especially as DevSecOps practices become more widely adopted.

    In the meantime, DevOps teams may want to review their dependency on public repositories. There are plenty of private repository options that provide most of the same source code sharing capabilities as a public repository. That may mean someone on the DevOps team is required to manage the private repository, but, given the fact that many regulatory bodies will soon be looking to make an example of organizations that don’t secure application secrets, chances are good those costs will be trivial compared to a fine that would be levied.

  • Kong Integrates Service Mesh with OPA

    Kong Integrates Service Mesh with OPA

    Kong, Inc. today announced an update to Kong Mesh, built on top of open source Kuma service mesh, that adds support for Open Policy Agent (OPA) software that enables DevOps teams to manage compliance as code.

    Kuma and OPA are both being developed under the auspices of the Cloud Native Computing Foundation (CNCF). Kuma, unlike other service mesh offerings, provides connectivity across both microservices-based applications running on Kubernetes platform and monolithic applications deployed on virtual machines.

    In addition to adding support for OPA, the 1.2 release of Kong Mesh adds authentication mechanisms between the global and remote control planes operating across multiple zones. That functionality extends the Kuma Discovery Service (KDS) to support multiple authentication mechanisms.

    Finally, Kong has added support for the federal information processing standard (FIPS).

    Like the Istio service mesh, advanced by Google and IBM for Kubernetes environments, Kuma is based on open source Envoy proxy software. In contrast, however, Kuma is both lighter-weight and designed to span both cloud-native and legacy application environments.

    Marco Palladino, CTO at Kong, said OPA support will be a significant advance for both classes of workloads as organizations start to employ Kuma within the context of zero-trust computing environments. As DevSecOps processes are extended to include managing compliance as code, OPA will provide a programmable mechanism for ensuring that policies are not only properly implemented, but can also be easily audited, Palladino said.

    In general, an effort led by Kong, VMware and others to elevate the service mesh conversations to more broadly address application connectivity is underway. A service mesh, at its core, provides the means for integrating hundreds of application programming interfaces (APIs) at scale. It also provides a level of abstraction above the network layer that makes it easier to connect applications across a heterogeneous networking environment.

    Kong is making a case for a lighter-weight approach that spans multiple platforms and is highly extensible. As such, third-party vendors and IT teams can add extensions to Kuma as they see fit.

    Ultimately, Palladino said, the time has come to take cloud computing to the next level. If all organizations wind up doing is lifting and shifting monolithic applications to public clouds, an opportunity to advance the state of IT will have been lost.

    Of course, it’s still early days as far as adoption of service meshes are concerned. Most organizations today are relying on API gateways, proxy software or ingress controllers to manage APIs. It’s not clear to what degree a service mesh may remove the need for some of that existing application connectivity middleware.

    Regardless of which approach is ultimately favored, it’s apparent that, as microservices-based applications become more widely deployed, a different approach to application connectivity will be required. Monolithic applications, however, are not going away. In some cases, a monolithic application might be carved up into a smaller set of microservices, but it’s unlikely that every existing monolithic application will lend itself to that architecture any time soon.