Welcome to the InfoQ Software Architects' Newsletter! Each month, we bring you essential news and experience from industry peers on emerging patterns and technologies.

This month, we focus on the topic of "Cloud Computing: From Edge to PaaS and IaaS". The core topics of cloud computing currently span across the entire "diffusion of innovation" graph in last year's Architecture and Design InfoQ Trends Report. The latest DevOps and Cloud InfoQ Trends Report (July 2021) provides additional insight for architects working in this space. Key challenges remain, including designing scalable systems, the build vs. buy decision, and how to plan for multi-cloud adoption.

News

CNCF Publishes State of Cloud Native Development Report

The Cloud Native Computing Foundation (CNCF) has published the latest edition of the State of Cloud Native Development Report. An important finding from the report indicates that, as defined by the CNCF, the cloud native developer population has grown by 0.3 million to 6.8 million during the period from Q1 2020 to Q1 2021. Edge computing has the highest usage rates of containers and Kubernetes, with 63% of edge developers adopting Kubernetes and 76% adopting containers.

SlashData, a research firm commissioned by CNCF, has already published two versions of this report, the first one in May 2020 and the second in August 2020. A comparison study indicates that while cloud native is growing steadily at a rate of 300,000 developers, it is at a slower rate than the previous report, which reported a 1.8 million increase. Of the 6.8 million cloud native developers, 4.6 million use container orchestration tools, 4 million use serverless platforms and 1.8 million use both.

Fast-Track Application Refactoring with the AWS Migration Hub Refactor Spaces

AWS first introduced the preview of AWS Migration Hub Refactor Spaces, a new capability of AWS Migration Hub, last November at re:Invent 2021. Now, the public cloud provider announced the general availability of the Migration Hub capability.

AWS Migration Hub Refactor Spaces is the starting point for incremental application refactoring to microservices in AWS. It aims to reduce the undifferentiated heavy lifting of building and operating AWS infrastructure for incremental refactoring.

ValidKube Aims to Help Enforce Kubernetes YAML Best Practices

ValidKube is a new open-source tool that combines several tools to make it easier to validate, clean, and secure Kubernetes YAML configuration files. In its initial release, ValidKube integrates three popular tools used with Kubernetes: Kubeval, able to validate Kubernetes configuration files; kubectl-neat, which can remove clutter for Kubernetes manifests; and Trivy, a scanner for vulnerabilities in container images, file systems, and Git repositories. The three tools were developed in Israel by Aqua Security and Snyk.

Google Updates its Eventarc Service with New UI, Event Destination, and Storage Trigger

Recently, Google announced several new features for its cloud-based eventing platform Eventarc. The new features are a new UI, Cloud Run for Anthos services as an event destination, and a generally available (GA) Storage Cloud trigger.

In 2021 the company released Eventarc into general availability, enabling customers to send events to Cloud Run from more than 60 Google Cloud sources. And now, a year later, the Eventarc team delivers a new UI in preview to view, edit, and delete EventArc triggers. The UI enables the creation and deletion of triggers and also the listing of existing triggers showing various characteristics such as name, region, event provider, destination, and event type.

Liz Rice on Programming the Linux Kernel with eBPF, Cilium, and Service Meshes

In a recent edition of the InfoQ Podcast, Liz Rice discusses eBPF, a way of making the Linux kernel programmable, with Charles Humble. They talk about why this technology was created, how it works under the hood, and what you can and can’t do with it. They also talk about Cilium, an open-source library for observing network connectivity between container and cloud workloads, and the new Cilium-based service mesh currently in beta.

Case Study

Report Finds 75% of Cloud Runtimes Contain High or Critical Vulnerabilities

Sysdig's latest cloud-native and security-usage report finds that shipping containers with vulnerabilities have become standard practice - with the report finding that 75% of containers have high severity vulnerabilities which could have been patched.

The report stresses that many organizations find this to be an acceptable risk, with many organizations prepared to take these risks in order to move and release quickly. Key takeaways from the report show that many organizations have a long way to go in terms of ensuring that they have appropriate cloud-native and container security.

The report defines several key indicators to determine success in cloud native and security and analyses the responses from a broad array of organizations to show the current trends in the industry. Sysdig offers widely used software that helps users with cloud-native and container security. The anonymous reporting functionality in Sysdig’s popular software allows the company to gather valuable insights and adoption stats from its users.

Amazon Web Services’ S3 (Simple Storage Service) provides an ideal mechanism for storing and serving files but locking this down so that public access isn’t possible takes some effort. The report found that 36% of AWS S3 buckets are open to public access, and 73% of accounts have at least one public bucket.

While this isn't in itself necessarily a security problem, it’s indicative of organizations taking a security-by-obscurity approach to lock down buckets, perhaps as a zero-trust approach is not considered warranted. This could lead to private information being available publicly across the Internet.

This content is an excerpt from a recent InfoQ article written by Matt Saunders, "Report Finds 75% of Cloud Runtimes Contain High or Critical Vulnerabilities".

To get notifications when InfoQ publishes content on these topics, follow "cloud computing", "cloud architecture", and "cloud-native" on InfoQ.

Missed a newsletter? You can find all of the previous issues on InfoQ.

Upcoming events

QCon: For practitioners by practitioners

QCon London Software Development Conference (April 4-6): Learn from practitioners driving innovation and change in software.

QCon London (April 4-6) Software Development Conference is the place where senior software engineers, tech leads and architects come together to learn, share, and push each other to drive innovation in the software industry. Join over 800 of your peers and deep dive across 15 essential topics to inspire what’s next for your team and roadmap. Save £65 if you register before March 7th!

QCon Plus Online Software Development Conference (May 10-20): Level-up your skills with real-world implementation of emerging trends and practices.

At QCon Plus (May 10-20, 2022) Online Software Development Conference access a curated learning experience covering the topics that matter right now in software development and technical leadership. Connect with like-minded professionals from leading brands including AWS, Nordea, Bloomberg LP, BBC, Microsoft, Audi and more. Save £100 if you register before March 7th!

QCon San Francisco is back (Oct 24-28): Registrations are now open with Early Bird prices!

At QCon San Francisco brings together the world's most innovative senior software engineers, architects and team leads across multiple domains to share their real-world implementation of emerging trends and practices. Attend in-person on October 24-28 and uncover emerging software trends and practices. Save $1,140 if you register before March 7th!

Senior software developers rely on the InfoQ community to keep ahead of the adoption curve. One of the main reasons software architects and engineers tell us they keep coming back to InfoQ is because they trust the information provided and selected by their peers.

We’ve been helping software development teams adopt new technologies and practices for over 15 years through InfoQ articles, news items, podcasts, tech talks, trends reports, and QCon software development conferences.

We hope you find this newsletter useful. If not, you can unsubscribe using the link below.

Forwarded email? Subscribe and get your own copy.