0

Calico Egress Gateway: Universal Firewall Integration for Kubernetes

New applications and workloads are constantly being added to Kubernetes clusters. Those same apps need to securely communicate with resources outside the cluster behind a firewall or other control point. Firewalls require a consistent IP, but routable IPs are a limited resource that can be quickly depleted if applied to every service.

With the Calico Egress Gateway, a new feature in Calico Enterprise 3.0, existing firewalls and control points can now be used to securely manage access to infrastructure and services outside of the cluster. In addition, IT teams are now able to identify an application/workload in a Kubernetes namespace via the source IP.

As organizations progress on their Kubernetes journey from pilot to production, they begin migrating existing applications into the cluster, which has merged with the greater IT environment. For the platform teams involved, this creates challenges because these apps will need to communicate to services outside of the cluster.

1. The Platform team will need to enable Kubernetes connectivity to infrastructure and services behind a firewall (or other third-party enforcement point such as a proxy, a DLP solution, or a monitoring solution like a SIEM.)
2. The firewall will require a consistent IP to enable Continue reading

0

Daily Roundup: Cisco Licks Wounds

Wound-licking Cisco targeted the next cloud computing wave; Nokia cried foul on rivals' 800G...

Read More »

0

Public Cloud connectivity done wrong

If your idea for interconnection and migration to the private cloud involves using NSX and L2VPN so that you can “stretch the vlan” between your NSX private farm and the one into the Cloud you are doing it wrong.

No matter if you are using VXLAN as a transport or any other technology, if your plan involves layer 2 extension you are doing it wrong.

Not every application should be migrated to the public cloud, and most definitely you should not migrate something that relies on a layer 2 adjacency to work.

If layer 2 extension is a way to allow ip mobility, then again, it’s just a lazy design. There are better ways to provide same-subnet IP mobility that doesn’t require layer 2 (see LISP or BGP-EVPN Type 5 routing for example).

Even if it works on Power Point or on a small demo, you really should NOT.

0

Automation Services Catalog: A Deep Dive into What’s New in Red Hat Ansible Automation Platform

Red Hat Ansible Automation Platform introduces automation services catalog, a new hosted service for Red Hat Ansible customers to extend their automation in a controlled way to the various end users who need it. This is a deep dive into the capabilities and features of the offering.

 

Users

The automation services catalog is designed to be a familiar experience, providing an easy and intuitive user interface for ordering products (automation resources). 

Products to Order

The idea is that those using the automation services catalog may not know that what they are ordering is actually Ansible Automation. For example, a product could be a business function, like ordering a new OpenShift project or onboarding a user to a new platform.

Ordering a product will present the user with options to facilitate the order. This could be provisioning the datacenter or applying permissions for a Kubernetes project. Upon submitting the order, the user can see the progress in their order queue. Users can search for past orders and see those currently in progress indicated by statuses including: Order, Failed, Approval Pending and Completed. Orders that are pending approval can be compared with ordering a product from a website and seeing Continue reading

0

The Hedge Podcast 037: Stephane Bortzmeyer and DNS Privacy

In this episode of the Hedge, Stephane Bortzmeyer joins Alvaro Retana and Russ White to discuss draft-ietf-dprive-rfc7626-bis, which “describes the privacy issues associated with the use of the DNS by Internet users.” Not many network engineers think about the privacy implications of DNS, a important part of the infrastructure we all rely on to make the Internet work.

download

0

Red Hat Beams Quarkus Into Its Runtimes Middleware

Quarkus is a Kubernetes native Java framework that allows the programming language to be more...

Read More »

0

Cisco Licks Wounds, Targets Next Cloud Computing Wave

“It’s not a secret that we did not do as well as we wanted to in the first phase of the web...

Read More »

0

Fortinet Fortifies Hyrdo One’s SD-WAN Offering

The Toronto-based telecom claims the service will provide customers with tools to support both...

Read More »

0

Net One Systems Taps Juniper’s Contrail Enterprise Multicloud

The network integrator needed a services management platform that would allow it to configure...

Read More »

0

Shortening the developer commute with Docker and Microsoft Azure

Do you remember the first time you used Docker? I do. It was about six years ago and like many folks at the time it looked like this:

docker run -it redis

I was not using Redis at the time but it seemed like a complicated enough piece of software to put this new technology through its paces. A quick Docker image pull and it was up and running. It seemed like magic. Shortly after that first Docker command I found my way to Docker Compose. At this point I knew how to run Redis and the docs had an example Python Flask application. How hard could it be to put the two together?

version: '3'
services:
  web:
    build: .
    ports:
      - "5000:5000"
  redis:
    image: “redis”

I understood immediately how Docker could help me shorten my developer “commute.” All the time I spent doing something else just to get to the work I wanted to be doing. It was awesome! 

As time passed, unfortunately my commute started to get longer again. Maybe I needed to collaborate with a colleague or get more resources then I had locally. Ok, I can run Docker in the cloud, let me see how Continue reading

0

There’s No Duty of Care without Strong Encryption

On 15 May, the Telegraph reported that The Five Eyes intelligence alliance planned to meet to explore legal options to block plans to implement end-to-end encryption on Facebook Messenger. According to the UK-based newspaper, the discussions between the governments of the United States, the United Kingdom, Australia, Canada, and New Zealand would focus on how the “duty of care,” a basic concept found in tort law, could be stretched to force online platforms to remove or refrain from implementing end-to-end encryption. (A duty of care is the legal responsibility of a person or organization to avoid any behaviors or omissions that could reasonably be foreseen to cause harm to others.)

If this is true, this is an attempt to justify their calls for encryption backdoors.

It’s easy to predict what such a strategy might look like – the playbook is familiar. In this case, if duty of care becomes the rationale for banning end-to-end encryption, it could be used as a framework to ban future deployments. Additionally, similar to other legislation, including the Online Harms, there will be an argument that social media companies have a special duty of care to protect vulnerable groups. This is nothing more Continue reading

0

Day Two Cloud 050: Nerding Out On GitHub Actions With Chris Wahl

Today's Day Two Cloud podcast gets into the nerdy details of how an infrastructure professional can use GitHub Actions. Actions lets you chain together steps or instructions and trigger them to run as a workflow. Our guest and guide to GitHub Actions is Chris Wahl.

0

Day Two Cloud 050: Nerding Out On GitHub Actions With Chris Wahl

Today's Day Two Cloud podcast gets into the nerdy details of how an infrastructure professional can use GitHub Actions. Actions lets you chain together steps or instructions and trigger them to run as a workflow. Our guest and guide to GitHub Actions is Chris Wahl.

The post Day Two Cloud 050: Nerding Out On GitHub Actions With Chris Wahl appeared first on Packet Pushers.

0

How to Use Migration Coordinator’s Automated Maintenance Mode

Migrate from VMware NSX for vSphere to NSX-T with Minimal Downtime

In order to help easily migrate from NSX for vSphere to NSX-T, with minimal downtime, the latest release of VMware NSX-T 3.0 introduces Maintenance Mode to NSX-T Migration Coordinator (a tool that has been built into NSX-T since the 2.4 release).  The Migration Coordinator tool is designed to run in-place on the same hardware that is running NSX for vSphere, and swap out NSX for vSphere bits with NSX-T.

This blog post is a follow up to the previous blog, Migration from VMware NSX for vSphere to NSX-T,  which covers Migration Coordinator. For more details on the Migration Process, please check out the previous blog.  This blog focuses on the Maintenance Mode feature which is part of the NSX-T 3.0 release.

What is Migration Coordinator?

Migration Coordinator is a tool that runs on NSX-T Manager. Its disabled by default since migrating from NSX for vSphere to NSX should only be a one-time task.

How to Enable Migration Coordinator

To enable Migration Coordinator, simply log in to NSX Manager via SSH and run the command “start service migration-coordinator”.

 

Note: This command is also Continue reading

0

Top Tech Businesses for Sale for Young Entrepreneurs

If you are a young entrepreneur and have a bit of money that you want to invest in some tech businesses for sale, then here are the top 5 types of tech businesses that you may want to consider buying.

5 Types of Tech Businesses for Sale

Blog Consulting

With so many people these days looking for ways to work online, becoming a blogging expert is an advantage. That’s why buying a blog consulting business may be a great business for you. Blog consulting is one of the tech businesses for sale, and it is much easier to buy an existing business then to start a blog consulting business from scratch.

As a blog consultant, you may help different people set up and run their blogs. As your business grows, you can also farm out blog related projects to others and take a percentage of the proceeds for each job.

Social Media Consulting

A social media consulting business may be a great business to buy, especially if the business is already up and running and has several great consultants on staff. Social media consulting is big business these days and can cover everything from social media marketing to advising people Continue reading

0

Tanium’s endpoint security meets Cloudflare for Teams

When Cloudflare first launched in 2010, network security still relied heavily on physical security. To connect to a private network, most users simply needed to be inside the walls of the office. Once on that network, users could connect to corporate applications and infrastructure.

When users left the office, a Virtual Private Network (VPN) became a bandaid to let users connect back into that office network. Administrators poked holes in their firewall that allowed traffic to route back through headquarters. The backhaul degraded user experience and organizations had no visibility into patterns and events that occurred once users were on the network.

Cloudflare Access launched two years ago to replace that model with an identity-based solution built on Cloudflare’s global network. Instead of a private network, teams secure applications with Cloudflare’s network. Cloudflare checks every request to those applications for identity, rather than IP ranges, and accelerates those connections using the same network that powers some of the world’s largest web properties.

In this zero-trust model, Cloudflare Access checks identity on every request - not just the initial login to a VPN client. Administrators build rules that Cloudflare’s network continuously enforces. Each request is evaluated for permission and logged for Continue reading

0

The latest in Red Hat Ansible Automation Platform – Using automation to effectively change your day to day

Last year, we made some significant changes to Red Hat Ansible Automation, including what is offered with it and alongside it, to bring you the first version of Red Hat Ansible Automation Platform. That change allowed users to harness the power of Ansible automation under one roof, one subscription - one platform.

Today, we are pleased to announce updates to Red Hat Ansible Automation Platform, the latest version of our enterprise-grade solution for building and operating automation at scale. The next time you log in to cloud.redhat.com, you can start utilizing the powerful new tools at your disposal. We’ve put in place the automation services catalog, a venue for developers and business users to manage, provision and retire resources. Customers told us this was a necessity and we agreed, with the automation services catalog now giving you a much deeper insight into how automation is improving efficiencies.  It also gives you visibility into redundant processes that may be costing you time and resources that you may want to sunset. Accentuate what is working and eliminate what is not. More information about automation services catalog can be found here.

Another enhancement we rolled out with the Continue reading

0

Automation Analytics – ROI Calculator and Notifications enhancements

The Red Hat Ansible Automation Platform is continually offering enhancements through its hosted services on cloud.redhat.com. At Red Hat Summit 2020 the new automation services catalog took the spotlight, which provides lifecycle management, provisioning, retirement and cataloging of automation resources to your business. However I wanted to also talk about the additional new  enhancements coming to Automation Analytics! Specifically I have two big things I want to talk about:

• Automations Calculator - a ROI (return on investment) calculator using aggregate data
• Notification improvements and a dedicated panel

If you are unfamiliar with Automation Analytics it is included as part of a Red Hat Ansible Automation Platform subscription and allows customers to analyze, aggregate, and report on data for their Red Hat Ansible Automation Platform deployments. Check out the previous blog I wrote about Getting Started with Automation Analytics, or if you have concerns around what type of data is being shared with Red Hat check out my blog Automation Analytics: Part 2 - Looking at Data Collection.

 

Automation Calculator

I am super excited about this new feature of Automation Analytics. A lot of customers I get to meet with are trying to figure out how to Continue reading

0

What’s New in Ansible Tower 3.7

We’re excited to announce the release of Ansible Tower 3.7, part of the Red Hat Ansible Automation Platform. Ansible Tower is the scalable execution framework of the Ansible Automation Platform, providing a REST API and UI framework that allows users to scale automation across their enterprise and integrate it into their processes and tools. 

The focus of the Ansible Tower 3.7 release is on scalability of automation and improving the experience of our users. 

 

Automate more without bottlenecks

These days automation often needs to work at large scales - both in terms of infrastructure, but also in terms of how many jobs are executed in parallel. With Ansible Tower 3.7 we have put in extra effort to handle job dependencies in a way that helps ensure your jobs aren’t blocked. By allowing project updates and inventory updates to happen while other jobs are running, we’ve eliminated many of the bottlenecks in job processing. This enables jobs to proceed faster and without the need to wait for each other.

 

Expand access to the Ansible Automation Platform without worries

Scale is not only about the IT technology itself, but also about users. As our customers Continue reading

0

How NDR protects your network from cyberthreats

Three steps to finding a network detection and response product that prevents, detects, investigates, identifies, responds and mitigates cyberattacks.