Building A Niche Cloud: A Pragmatic Approach




Before getting started you might want to read about the birth of the niche cloud in the first part of this two part series.

We have all heard the saying, you cannot teach an old dog new tricks. Yes that is true, but we aren’t thankfully dogs. Learning to do something new of course, requires an open mind-set and a desire for change. Many organizations are getting left out of digital disruption these days because they keep falling back on old outdated ideas, behaviors and habits. Our minds are so full, so occupied and so tired we simply cannot grasp or don’t have the energy for anything new. We spend our time applying what is new to what we know, which is old.

In this article lets reset our minds and look at an approach to build a niche cloud from the ground up. Instead of pealing back the onion we will apply layer after layer until we have the onion itself. Of course I realize there is a lot more and this article is just scratching at the surface, nevertheless it is an approach, a basic rule-set and guideline for getting started.

Continue reading

Security and Vulnerability Scanning of Container Images

security concept  with a lock


In this article we will focus on security and vulnerability strategies for scanning container images. I know, in the past security was always viewed upon as an impedance to the speed of production but hopefully these days are behind us. Having a security breach, as you probably know, is one of the most costly things an organization can endure. It takes years to build up a reputation and only seconds to tear it down completely.

I still see today, many organizations ignoring container images completely because it is often misunderstood. Exactly what is inside a container image? Who should be responsible for it? How does it map to what we have done on servers? Security teams often don’t understand containers or even know what questions to ask. We need to help them and it is our duty to do so. Unfortunately there are not very many tools that can help in broad sense. Containers are new and evolving at breakneck speed. That coupled with the fact that security can negatively impact the speed of a DevOps team (if not done right), it is no wonder we are at square one, in many cases.

Before we dive into more detail, let us review important security aspects of containers.

  • Containers can have various packaging formats, Docker is the most popular today
  • Containers are immutable and as such are image based
  • Container are never updated, any change always results in a new container
  • Container images consist of layers (base, runtime, application)
  • Container images require shared responsibility between dev and ops
  • Containers don’t contain, they are in fact, just processes

For more information I recommend reading about the 10 layers of container security.

Continue reading

OpenShift Showback Reporting using CloudForms

openshift_logo plus_sign  cf_logo


One of the most important capabilities of any platform in today’s service driven, pay-as-you-go economy is metering and showback. Without a solid understanding of costs, organizations are in fact unable to provide services. With containers, metering and showback becomes more challenging. If we think about containers simply being processes, then we are basically needing to meter and perform showback at that level of granularity. In addition since OpenShift uses Kubernetes for container orchestration, there are additional concepts that are new. For example, one more more containers run together in what Kubernetes refers to as a Pod. Next Pods are extremely dynamic and their lifetime very short. All of this make metering and showback anything but straight-forward. Thankfully OpenShift and CloudForms have the solution.

Continue reading

CloudForms Installation and Configuration Guide for Red Hat Virtualization



In this article we will deploy CloudForms 4.2 on Red Hat Enterprise Virtualization (RHV). We will also show how to configure CloudForms in order to properly manage a RHV cluster and it’s hosts as well as virtual machines.

Before you begin a RHV cluster is needed. If you haven’t set one up, here is a guide on how to build a basic two node RHV cluster.

Continue reading

Deploying CloudForms in the Azure Cloud



In this article we will deploy the CloudForms appliance in the Azure cloud. CloudForms is a cloud management platform based on the opensource project manageiq. Red Hat bought manageiq a few years back and opensourced the software. Originally it was designed to manage VMware but over the years has expanded to many additional traditional as well as cloud platforms. You can use this article as reference for both CloudForms and ManageIQ.

CloudForms can connect to many cloud providers such as RHEV (Red Hat Enterprise Virtualization), VMware, Hyper-V, OpenStack, Amazon Web Services (AWS), Google Cloud Engine (GCE) and Azure. Large organizations don’t have one cloud but many and in addition typically have on-premise, off-premise as well as public. All of these various platforms creates a lot of complexity if not managed right. CloudForms can create a bridge between traditional (mode 1) and cloud native (mode 2) workloads, offering applications a path to switch between these modes. In addition, CloudForms allows an IT organization to act as a cloud broker between the various public platforms. Finally CloudForms can be used to automatically deploy and manage applications across the various cloud platforms. Businesses have choice in platform, flexibility and speed while IT can manage it all centrally applying common policies or rule-sets regardless of where workloads are running.

Continue reading

OpenShift Enterprise 3.2: all-in-one Lab Environment

Screenshot from 2016-08-04 14:40:07


In this article we will setup a OpenShift Enterprise 3.2 all-in-one configuration. We will also setup the integration with CloudForms that allows additional management of OpenShift environments.

OpenShift has several different roles: masters, nodes, etcd and load balancers. An all-in-one setup means running all service on a single system. Since we are only using a single system a load balancer or ha-proxy won’t be configured. If you would like to read more about OpenShift I can recommend the following:

Continue reading

Detecting Security Vulnerabilities in Docker Container Images



Containers, especially Docker container images have been on fire of late and it is simple to understand why? Docker container images give your development and operations organizations a major shot of adrenaline. The results are quite impressive. Applications are developed at never before seen speeds and as such organizations are able to deliver innovation to customers much faster. It’s all so easy, just get on Docker Hub, download a container and run it. So why isn’t everyone already doing this? Unfortunately it is not quite that simple. Enterprises have many other requirements such as security. Once IT operations gets involved they typically start asking a lot of questions. Who built this container? How is the container maintained? Who provides support for the software within the container? Does the software running within the container adhere to our security guidelines? How can we run security compliance checks within containers? How do we update software within containers?
Continue reading

Governing the Cloud with CloudForms


In a previous article it was stated that cloud in not a technology but rather an architectural methodology of resource governance that utilizes underlying virtualization technologies. Since cloud is more about the methodology, the technology platforms such as VMware vCenter, Red Hat Virtualization Management (RHEVM), Microsoft System Center, Amazon EC2 and OpenStack can change as application requirements or life cycles change. An application may start on a virtualization platform like VMware but over time move to a cloud platform such as OpenStack. It could even have components serviced by both. This is the exact concept behind what Gartner talks about when they refer to Bi-Modal IT. Gartner also says 50% of companies will screw this up. A bridge is definitely needed for managing applications between these various platforms. Red Hat CloudForms is exactly that bridge. It allows us to create an abstraction above the virtualization platforms so that governance and business process can remain consistent across the cloud.
Continue reading