With Weaveworks’ Demise, What’s Next for GitOps and Flux?- Cloud Native Now Podcast EP 2

Hey everyone. Welcome back to the Cloud Native Now podcast. I am Sharon Florentine.

I am here again with Mike Vard, and this week, hello. We are gonna kick things off and, uh, with a sad little eulogy of sorts for Weaveworks. Earlier this week, Alexis Richardson in a LinkedIn post announced that the company was shutting its doors permanently.

And, uh, as many of us us know, Weaveworks, uh, was one of the foundations of the GI ops methodology movement, um, in the cloud native space. They were also the creators of the Flux Project. But, um, thoughts on, on Weaveworks demise, Mike?

Well, I think flux lives on because it's an open source project, and I think the CNCF folks are involved in that, but I think this is one of, uh, many of these unfortunate circumstances that we're about to see because, well, the venture capital community is pulling back funding for startups like WeWorks, and the issue is, um, interest rates are high, and so they can't really return a value proposition to their investors by, that's beats the current interest rate. So a lot of money that they were counting on is being held up and they're not inclined to invest, uh, further until they see some other activities in the financial sector change. Um, and I think WeWorks was probably looking around for somebody to acquire it.

And those talks are difficult. We've seen some of the valuations of companies in this space are, shall we say, shallow. Yeah.

And, um, so that wasn't much of a play for 'em either. And frankly, I think they just ran outta runway in terms of, or not enough time and didn't get enough altitude. And by that, I mean, the fundamental premise here with Git Ops is that I'm gonna manage the infrastructure as code in the same Git repository that I'm gonna manage, uh, the rest of my application code.

Well, do I need a separate platform to do that or can I do that in my existing repositories? The answer is yes, I can do GI UPS with my existing stuff. So a lot of folks were like, yeah, it's a good idea, but is it a movement?

I'm not entirely sure. It seems more like, uh, it's a feature. And they were also making the case for separating continuous integration and cd.

Now on paper, that's probably a good idea, but most people, let's be honest, they kind of stink in CD in the first place. So, um, you know, they, we get the continuous integration side of things and, uh, but we still haven't wrapped our arms around continuous delivery. And it really only works when there's a consistent set of APIs for something like Kubernetes to run it on.

Well, if I don't have enough Kubernetes clusters out there, I don't have enough people who are really gonna do CD anyway. So I think that's, the world is gonna go to this more loosely coupled CICD approach. But, um, as that old cowboy wisdom says, you know, never mistake a Clearview for a short distance and they just ran outta time.

Yeah. It, it sure sounds like it. So, you know, like you said, flux lives on, it's now a graduated project with the CNCF.

I mean, is that really that's, that's gonna be, uh, the legacy you think? Yeah, I think people will contribute to it. I'm not sure that, um, you know, will it have enough momentum to, uh, hold up?

There's a lot of things that people can contribute to and they will naturally drift, shall we say, to other things maybe. So it remains to be seen, but if you, you know, are using the Weaveworks platform and you have flux, you're not, um, you know, abandoned because Weaveworks isn't around. So you can decide to continue to use that and, you know, have to rip and replace everything overnight.

But, um, you know, you might be looking for somebody else for a little support from time to time, but these are the challenges we live in with all open source projects. Indeed, indeed. Well rest in peace Weave works.

Thank you for your contributions. And, uh, moving on though to some other bad news, I guess we could say this week. Yeah, I guess it's not so much bad news, but we were talking about, uh, security.

Yeah. Last episode and yeah, since then we've seen a couple of interesting attacks. One is, uh, involved, uh, I forgot what it's called again, and The, uh, commando catt Commando catt.

That's it. Start with that one. Yeah.

Now Commando Cat, I don't think it's a huge attack vector, but it's another example where somebody created a fake repository and developers wound up downloading some code that was infected and then, you know, somebody could gelb break out of their container and into the host environment, move laterally and chaos ensues. Um, I think, you know, it's just something developers need to be aware of. There's a tendency just to kinda fat finger your way into a repository, and the next thing you know is, Hey, I think I got all this stuff, I'm good to go.

And suddenly, you know, your entire project is compromised. So it's just the word to the wise and now, yeah. And then SNE had some stuff where, you know, it was more theoretical, but they were just showing how uh, a couple of combinations of attacks could lead to almost the same effect as essentially another jailbreak kind of mechanism, um, that requires an update to your, uh, docker, um, tools to mitigate.

And so the issue now with a lot of folks is like, Hey, now all the bad guys know how to do this. And if I didn't update my tool, then yeah, suddenly I could be a victim here. But, uh, hopefully people are staying current because if you wanna be secure, you gotta stay current.

That's how the world is. Right. And, and this is another, especially with the commando cat vulnerability that we were talking about last week, that involves initially at least crypto jacking that a lot of people still perceive as a, a nuisance crime that, well, you know, what's really the harm?

They're not, you know, doing anything super, super damaging. But again, like you said, the point is that it can escalate and, you know, the container escape to can lead to much more detrimental effects down the line. So yeah, There's, there's good news in this part of the world.

Um, we have, uh, you know, the guys at KSOC are putting together something that is a, mounts to a digital fingerprint for container images, which is, um, kinda the key because if the fingerprint is, um, altered in any way, well then it means somebody went into your image and tinkered with it or tampered with it in a way that you probably are not gonna like. And, uh, so, you know, ultimately it's still early days, but we could have a situation where we have monitoring tools and socks and everything could be looking for these fingerprints and any changes to the images, there'll be an alert and we can respond accordingly and maybe, uh, replace those images instantly. Or maybe we'll have some fancy AI thing that will, we go after the images to see where they all are because there's so many of them.

But, uh, they envision a world where there's a repository full of fingerprints that they provide for open source container images and companies that build their own images, we will be able to license a commercial version and apply fingerprints to those container images. So I would just say, Hey, there's hope. Yep.

Absolutely. So on that front, um, when I was looking at that article, is that kind of analogous to like a code signing technology? Yeah.

The, the fingerprinting, It's similar in concept. Absolutely. I don't think it requires developers to do much anything other than the fact that, um, you know, there's a, a, a set of images that are defined and, and, and, and have an id.

You could think about it as, um, almost, you know, zero trust for container images. Okay. And as opposed to code signing, which I'm not, I don't think it eliminates the need for code signing, but code signing is problematic just because, well, I gotta actually get somebody to sign the code and well, you know, that's hit miss all too often and some people don't want their names attached to coat for whatever reason.

But, um, you know, if coat signing was the silver bullet, we'd have solved all those issues by now. Very true. And, um, I think there's also been some interesting conversations around was too, and, uh, Yeah, there's a, a nice article up on, uh, cloud native now talking about the relationship between WAS and AI and wasm.

It's still early days, but the, one of the attributes of was that's interesting is it allows you to really work with smaller bits of code. If the code is smaller, it's more efficient, and if it's more efficient, it uses things like GPU resources better now. GPU resources are expensive, is all hecking, you can't find them anyway.

So, um, I guess what we're folks making a case for here is that AI might wind up being a killer app for was because of the fact that it's just fundamentally more efficient. And, uh, there's a lot of other reasons to use was, it's still a little difficult to work with, but, um, these days everybody's all about saving money. So I think folks will look into this a little more aggressively and we'll see what happens.

But, um, cloud native and ai, you know, eventually these things are gonna come together. Right. Let's hope so.

'cause it's, uh, it definitely seems like there's a lot of good synergies, as they say. Cool. All right.

And then, you know, there's one other thing I would call everybody's attention to. It's up on the tech strong tv, uh, website, but it interview with the folks at SIL Labs and, um, we're talking about, uh, an alternative container format that they created, uh, I think it was called Singularity back in the day. And it was designed for high performance computing environments, AKA, you know, things that run AI or a form of HPC, right?

When you think about it. Mm-Hmm. They're making a case for, look, they went out and they made this thing compatible with the, uh, container image standard format.

So if I build an app in using Docker or whatever it is, I can take that image and run it on their container in a production environment. And why would you wanna do that? Well, turns out that their containers are, uh, a lot more efficient and, um, are designed for high performance and are just easier to manage from a operational perspective to all those folks on the DevOps side of that house.

That's something that's interesting to them because, well, there's a lot of containers out there. They're getting bigger by the minute and the original docker, eh, maybe not designed for that size of containers, and maybe we need another way of thinking about this in a production environment, but I think we're looking at more diversity among containers and there's not gonna be, you know, back in the day it was, you said containers, it was synonymous with Docker and maybe not so much anymore. So we'll see how all this plays out, but I think, um, we're gonna see some interesting times.

Ed Docker's only the beginning of the story, not the end. Yeah, indeed. I wonder how the, um, how that ties into our earlier discussion about security.

Did, um, in, in your conversation with Keith Cunningham, what was the security angle? Or was it mostly focused on opt on the optimization piece? It was mostly focused on the optimization piece, but I think, um, you know, the, we're gonna have some significant security conversations on the, on the backend.

There's this whole thing called SecOps, right? Mm-Hmm. Historically, this is how, um, and it's been an ongoing debate as to who's in charge of this?

Is it the security people or is that whole function moving over to the IT people because well, there aren't enough security people and security is core, so it ops people should be running that. Um, I think that that melds into this whole DevSecOps conversation we're trying to have where, um, folks need to take more control of the environment anyway, and, um, you might as well do that, optimize the environment and secure it at the same time. I just think that too much of what we've been trying to do is like, let's have, you know, three different teams meet at the quarterback and hope it all works out.

I think, you know, it's really just one function and, you know, next generation platforms maybe make it easier for mere mortals to master them all. But, um, I think right now our issue is we got too many engineers stepping on each other's toes and the tools are too complicated. So maybe it's time to get outta everybody's way.

Maybe it is. So what's on your mind, what are you seeing out there that kind of leaps out at you in this cloud native space? I mean, talked about a bunch of things, but, uh, you know, you see this content every day.

What kind of issues are top of mind? Well, I mean, definitely the, the AI conversation is huge. And using that, using generative AI to help cut through a lot of the complexity as far as both development, deployment.

Um, and you know, that's one reason why we bring up the, the was AI connection. Um, and service mesh is still a very, very hot topic. Um, gosh, obviously GI Ops has been on people's minds this week, which is why I wanted to kick off with that conversation.

And, um, you know, security, security, security especially, I mean, this week, seeing those major vulnerabilities all kind of cascading one after another, um, it's, you cannot afford to ignore the security implications really. Here. Here's what I think is gonna be the most interesting thing about AI, at least this year as it relates to containers and whatnot.

So the average container runs for a couple of minutes, and the challenges that there are hundreds if not thousands of these things coming and going on at all times. I don't think any human has any idea what containers are running when and where and what's actually happening in those systems. So you can imagine a time where somebody's using gen AI to track all this stuff and then kick out a summarization of what happened when in these container environments that I could actually maybe show somebody for, I don't know, an auditing purposes or whatever.

But I think, you know, we're gonna get more visibility and insights into these container environments, which today, you know, are highly dynamic. And yeah, theoretically we have all these observability tools, but I gotta be a rocket scientist to implement the observability tools. I think we're looking at a great simplification coming, which will, might even democratize this stuff for the average mirror mortal.

And, you know, who knows what, we'll see what happens, but kind of excited about the intersection of gen AI and observability and containers, because I think that's some sort of primordial soup that'll lead to something even better. No, and that's, that's a great point. The, the trouble with applying observability in, in cloud native environments when there are, so, when there's so much data coming in from all the different microservices and, you know, trying to dig down into that and figure out how that relates to a problem that you're seeing on the actual, you know, production side.

So that's, that's definitely a key area that that AI's gonna help for sure. All right folks, well, that's what's on our mind this week. Yeah, we hope you enjoyed this episode, and maybe you could write in a little bit and suggest some additional topics, but Sharon, take us home.

All right, that sounds great, folks. Thank you so much and we hope to see you back here next week. Again, we are gonna put all the links to the articles and things that we talked about in the show notes.

And yeah, like Mike said, send us a note, let us know what you want us to talk about. If you wanna come on and talk to us, we would welcome that too. All right, thank you.

See you next week. Bye.