CoreOS was founded with a mission: To secure the internet. This somewhat audacious goal drives everything we do. Since forming the company three years ago, we have been in the center of a transformative change in the industry, a movement towards a cloud-native world of dynamically scheduled, containerized applications. As organizations modernize their application infrastructure, there is a unique opportunity to implement and adopt new measures throughout the software stack to secure the services businesses and customers rely on.
It turns out machines can deploy software much better than humans can. Why? Because software deployment is a set of mechanical procedures that can be driven by a declarative language. It is a process primed for a systematic approach done right, and reproducibly. This is especially important as patches and security fixes are applied to software — a ritual that should be repeatable and seamless.
Automatic Updates = Self-Driving Infrastructure
A majority of security issues affecting software deployments could be mitigated simply by timely application of readily-available updates. Unfortunately, a generation of infrastructure constructed organically and under high pressure is regarded as so fragile that many operations teams have developed a mantra of “get it running and don’t touch it.” Not only is this bad for security, it’s also bad for business since it hinders the ability of companies to deliver their own software, not just their ability to apply security updates.
Here’s an example: as a critical illustration of the security implications of this status quo, we’ve seen two major vulnerabilities that required immediate attention: the “Dirty COW” Linux privilege escalation (CVE-2016-5195) and a Kubernetes remote access bug. Both of these security flaws were disclosed on the same day and are prime examples of a “fire” of critical vulnerabilities that operations teams had to drop whatever they were doing to update their software.
With self-driving infrastructure, on the other hand, the security updates were automatically applied to all of the running systems using Container Linux (formerly referred to as CoreOS Linux) and CoreOS Tectonic software. Within 24 hours of the so-called “Dirty COW” vulnerability, the majority of customers’ CoreOS Linux systems were updated without any user intervention. We provided this self-driving approach with CoreOS Container Linux since we started CoreOS, and now we’re bringing this critical capability to Kubernetes clusters. Updating software is the key to security, and the ability to easily and automatically update software is the most effective way to improve server security.
Self-driving infrastructure allows the ops team to shift their focus from chasing security updates and dousing fires, freeing engineers to innovate in areas of higher value. The same way self-driving systems in automobiles reduce the cognitive load for a human driver, self-driving infrastructure takes care of the seemingly constant fires and issues that plague ops teams managing servers today.
Open Components in Pursuit of a Platform
To make self-driving infrastructure a reality, we’ve spent the last three and a half years shepherding a new category of open source software built on software containers and distributed systems. Automating infrastructure software updates and management without downtime or impact on running services is a tremendously hard problem, and that’s why we spend so much effort on fundamental components to make it all work: software like CoreOS Container Linux, etcd, and Kubernetes. We see these pieces as requirements for building the reliable, self-driving infrastructure that makes us excited about the future.
Self-driving Infrastructure Available Today
This isn’t just a vision of the distant future. We currently provide automatic software and security updates via Container Linux by CoreOS to 1 million instances a month. At KubeCon in November, we introduced Operators, which are Kubernetes agents that encapsulate application domain expertise, and can already be used to help manage your monitoring system, or to automate deployment and recovery of the etcd distributed key-value store.
Operators are a major milestone in the development of the Kubernetes ecosystem. They paint a picture of CoreOS’s vision of the future of infrastructure and provide a mechanism for automating security measures that is key to our mission to secure the Internet.
Lastly this week from Tectonic Summit, the premier enterprise Kubernetes event, we announced that CoreOS Tectonic is the first self-driving Kubernetes platform, which takes our Container Linux philosophy and applies it to CoreOS Tectonic. Those using CoreOS Tectonic will have the latest release and security updates applied to Kubernetes. This is an exciting time as it is only the beginning of what we can do together to secure the Internet and make the backbone of our digital world a stronger and more secure place.
Intel’s Nick Weaver Discusses Orchestration
Listen to all TNS podcasts on Simplecast.
CoreOS and Intel are sponsors of InApps Technology.
