DevSecOps environments are touted as the best methodology for effectively delivering secure applications. But some of the same tools that have opened the door to the efficient, rapid delivery and deployment of new applications that is the hallmark of DevSecOps could also be opening the door to new organizational problems and security vulnerabilities.
Tools like containerization and platforms like Kubernetes bring so much to the development table that it’s easy to overlook some of the challenges that come with these advancements. But one such challenge – a concept called, “Cluster Sprawl” – is very much a reality for Kubernetes users. One that is taxing personnel, leaving organizations vulnerable, and creating some important issues that need to be resolved if development teams are to fully realize the benefits of Kubernetes.
D2iQ’s recent study, “Kubernetes in the Enterprise: Uncovering Challenges & Opportunities,” takes a deep dive into the impact of Kubernetes on organizations and asks difficult questions. What is the experience like for developers? How are deployments taxing organizational resources? What challenges are created by development at lightning speed? And, has COVID-19 created any additional issues for development? This timely study tackles these questions, and more. And the results indicate that Kubernetes deployments can deliver incredible benefits but at a potentially steep cost.
Not exactly too good to be true
It’s common. A new method or technology comes along promising to revolutionize or disrupt how we work, or dramatically increase operational efficiency. But it frequently does not deliver exactly as anticipated, or without other negative ramifications that are discovered far later.
This was the case with cloud technologies and solutions. While the cloud revolutionized IT and opened the door to many of the advanced technologies we’re seeing today, it created a new set of organizational, management, and security challenges. Individuals began spinning up their own cloud resources thanks to the low initial costs – often without oversight or approval from IT and security personnel. This created problems like “Shadow IT” and “Cloud Sprawl,” which resulted in organizations having unknown security vulnerabilities and incurring costs from cloud services that they didn’t know they had or had forgotten about.
The same problems that we saw with the cloud could, in fact, plague Kubernetes users.
Kubernetes, with origins that can be traced back to Google, is a platform that uses an open-source methodology to manage the development and deployment of applications. It serves as a system of management and organization for workloads in containerized development environments.
Kubernetes has taken the development and deployment world by storm – especially with digital transformation initiatives nearly ubiquitous. In fact, according to the D2iQ study, 99 percent of all organizations are executing digital transformation initiatives. Digital transformation is the adoption of new technologies and solutions and the replacement of legacy IT systems that are opening the door for organizations to improve workflows, increase efficiency, and optimize their workforce. And 75 percent of organizations undergoing digital transformation initiatives are utilizing Kubernetes as a central component of their development operations.
Kubernetes is helping organizations take advantage of the hundreds of technology services that the cloud-native landscape provides to improve their bottom line. This reality is pushing more and more teams to adopt the platform. When money is on the table, decisions are often made quickly. And the decision to embrace Kubernetes is no exception. The coupling of Kubernetes with cloud-native storage is proving effective and economical, resulting in 64 percent of organizations choosing this pairing. This has allowed a greater number of Kubernetes clusters and an increase in the quantity of IT initiatives – simply stated, many new services and applications are now possible.
But is it too much of a good thing? Organizations are creating an expanse of capabilities in new clusters. It allows them to address many key issues, quickly, and effectively. With new applications and services coming online rapidly, governance, project management, resource tracking, and oversight of permissions and functions becomes difficult. And this is leading to the rise of what organizations like D2iQ have called, “Cluster Sprawl.”
Cluster sprawl happens when the number of clusters and workloads grow and are managed with little consistency. Cluster management becomes unwieldy, redundant work and wasted resources are likely, and eventually, the environment becomes extremely difficult to support. It’s possible for many developers to create services independently, and at speed, potentially without oversight. The benefits of the Kubernetes platform can frequently be mitigated by this added complexity.
Cluster sprawl is a real possibility within Kubernetes. Often clusters are created and managed independently with very little care for uniformity or proper management. Organizations are needing to turn to increased, centralized governance and management platforms to gain a grasp on sprawl.
In our next article, we’ll look at the impact of cluster sprawl on our government agencies and organizations. We’ll discuss the costs, the risks, and look at ways to overcome or prevent, cluster sprawl.
