Pivotal Platform - December Release A First Look

Confidential │ ©2020 VMware, Inc.
Pivotal Platform
January Update
Jared Ruckle | @jaredruckle
Dan Baskette | @dbbaskette
January 2020

The Pivotal Platform Value Proposition
Developer
Productivity
Hit the Tab key to access
the secondary text style
Operational
Efficiency
Comprehensive
Security
Multi-Cloud
Success

4Confidential │ ©2020 VMware, Inc.
Developer Productivity

Pivotal Application Service

App developers can deploy a sidecar with a buildpack
• Continues support for user-provided sidecars, as in prior releases
• Previously, developers had to roll the sidecar process into the main app then
deploy it with an app manifest.
• Sidecars feature remains in beta
Plus, cli support for sidecars
PAS 2.8
Speed

• The new metric is relative to the application CPU entitlement.
• A value of 100% always means "you are using all the CPU you're entitled to and should probably scale up your
application," regardless of the size of the cell.
• Developers can now make more informed decisions about scaling their apps.
• Current CPU stats are relative to the cell's CPU capacity; they don't include data about how much CPU
the application is entitled to use vs how much CPU it's actually using.
• Learn more: https://github.com/cloudfoundry/cpu-entitlement-plugin
PAS 2.8
PAS emits CPU usage metrics that take entitlement into account

Apps Manager 2.8: Config Server Integrations
View the configuration of Spring
Cloud Config Server instances on
the service instance detail page
View the online status of the SCS
instance, and perform a mirror
sync with one click
Closer integrations with Spring
Cloud mean devs can work and
troubleshoot faster
Speed

Speed
Apps Manager 2.8: View Quota Information
Quota information for the org is
displayed in the org header, helping
devs and admins understand
resource usage

PAS for Windows

• .NET Devs can use the Web Config Transform Extension Buildpack to externalize .NET Framework
configs
• An extension buildpack that offers a zero code change / zero touch function to externalize the configurations
in the web.config to environment variables. [aha]
• If config server binding is detected, it will replace any matching token in web.config with config server value.
• https://network.pivotal.io/products/buildpack-extensions/
• One of the first tasks in replatforming efforts for .NET applications is externalizing configurations.
Today, customers manually externalize their configurations to get to a state where they can push their
application to the platform.
Speed
Web Config Transform Extension Helps .NET Devs Go Faster

Cloud Cache

Breakthrough Performance Improvements
• Recent Cloud Cache releases have delivered perf improvements (2x on
server side, 10% improvement in client/server topology). Version 1.10
continues this theme:
• “Get” is now 4x times faster
• “Put” is now 2x times faster
• Devs can connect to Cloud Cache with a Node.js client
• We now have a client to ease interactions with Cloud Cache for the three most
popular enterprise frameworks! [aha]
• Developers have a self paced Getting Started guide
• https://docs.pivotal.io/cloud-cache-dev/
Cloud Cache 1.10
Speed

Steeltoe

https://steeltoe.io/initializr
Use this tool, and your starting
codeset can include common
dependencies like internal single
sign-on libraries and helper utilities.
https://steeltoe.io/get-started
• Be more productive in your first
few minutes!
• Take 5 minutes and deploy a
“hello world” app using a given
feature. Get a working project
with clearly defined code on
how to implement that feature.
• Support for .NET Core 3.0.
• Middleware consolidation
because of .NET core 3.0.
Steeltoe: More Speed, Stability for .NET Developers
Recent Highlights
Initializr site gets you going
faster
Getting Started Guides Steeltoe 2.4

Steeltoe CLI brings dev/prod parity one step closer to reality
https://github.com/SteeltoeOSS/Tooling
The cli aims to help you write better code by
improving parity across your environments.
Say your app is using a cache. Why should you
have to mock up a store locally, only to find a
whole host of challenges when it’s bound to a
cache on your chosen runtime?
The CLI provides a manifest-driven experience
where you can do a “push” locally. This mimics
what would be done to the platform, bringing
your desktop closer in-line with prod.

Spring Cloud Services

Pivotal Spring Cloud Gateway - Now GA
Routing
Resiliency
Monolith Strangling
Single Sign-On
Security
Monitoring
Canarying
Flexibility
A developer-friendly way to route, secure and monitor API requests to services

Operator Efficiency

• Operators can more easily break up their PAS upgrades into multiple independently upgradeable
chunks of Diego cells.
• This mechanism can also decouple the upgrades from the PAS control plane.
• Enabled by “placement-tagless” with Isolation Segments.
• PAS for Windows also supports this approach.
• Similar to the “cell-block” upgrade mechanisms in Pivotal Web Services
Speed, Stability
More manageable upgrades of large PAS installations

Extract Ops Manager VM config (GCP and AWS only) [v4.2]
FOUR new tasks [v4.1]
• collect-telemetry and send-telemetry: Enable use of Pivotal Telemetry tool by adding the tasks to the
pipeline.
• expiring-certificates: See which certs are about to expire within a specified time range.
• stage-configure-apply: Selectively apply changes to a single product. (Note: this is an advanced task;
see docs.).
• check-pending-changes: Check on Ops Manager and fail if there are pending changes. This is useful as
a “gut check” before applying changes to your foundation.
Recent Highlights
Platform Automation

• Operators can now obtain IaaS VM metrics (compute, network, storage) via the Firehose for ALL VMs
via the System Metrics Agent
• Previously, these metrics were only available for PAS VMs
• This is an improvement on the current bosh-system-metrics-forwarder (this component will eventually be
deprecated)
• App, Org and Space GUID/Name are now available...
• ...as annotations on all PAS Metrics
• ...as annotations on all PAS Logs
• Operators can send logs for all applications to a single syslog destination, such as Splunk, using an
aggregate drain
• Saves the setup of an individual drain for every single application
PAS 2.8
Metrics & Logs Improvements

• A tile does not need a hard dependency on another tile (eg: Healthwatch can be optionally dependent
on PAS and PKS).
• Operators do not have to care about the “right order” to deploy tiles.
Ops Manager 2.8
Tile authors can declare optional dependencies

Tile authors can use a new Install Time Verifier to check for service instances that may be slow to update.
If it is not safe, the upgrade will quit, and the operator will see a warning message.
Ops Manager 2.8
Operators are protected from service instance upgrade lag

System metrics report the usage and status of VM memory, disk, CPU, network, load and swap space.
Other platform tools such as Healthwatch can consume these metrics.
Ops Manager 2.8
Ops Manager installs system metrics agent on all VMs by default

[speed, stability] Tiles can be auto-imported on Ops Manager
[stability, security] Ops Manager supports certificate authentication to vSphere NSX Manager
[stability] Operators can use the API to revert pending changes
[security] Operators can configure multiple hardware security module (HSM) hosts in CredHub
[security] BOSH VMs can use signed URLs to communicate with Blobstore
Other Highlights
Ops Manager 2.8

v2.8 http://docs.pivotal.io/platform/2-8/opsman-api/
Ops Manager API Docs Now Online

VMware Enterprise PKS

VMware Enterprise PKS 1.6
Production-ready Kubernetes on any cloud
Enterprise Security & Networking
Ingress scale out using the LoadBalancer CRD
HTTP-> HTTPS redirect
HTTP proxy on AWS
Kubernetes 1.15
Management
New role “pks.clusters.admin.read”
Configure a single K8s cluster with a specific Docker
Registry CA certificate
Upgrade multiple K8s clusters simultaneously, with
support for canaries
Observability
Additional Log Sink types
Increased uptime for Log Sinks

PAS for Windows

PAS for Windows 2.8
• Platform engineers can ‘bosh ssh’ into Windows compilation VMs on Azure,
AWS, GCP, and vSphere.
• Useful for debugging the initialization of a windows Diego cell
• Platform engineers can use a test suite to validate Windows stemcell
creation and isolate stemcell creation failures.
Highlights for Platform Teams
Speed, Stability

RabbitMQ

• Service Gateway: on-demand instances can be given an externally accessible address. This enables use
cases such as connecting IoT, legacy apps, and DR’ing between sites
• Improved availability of SIs when updating underlying RabbitMQ and Erlang versions (rolling upgrade)
• We ship with RabbitMQ 3.8.1 which brings quorum queues, improved monitoring, OAuth 2.0, and
Single Active Consumer https://www.rabbitmq.com/blog/2019/11/11/rabbitmq-3-8-release-overview/
• ICYMI: RabbitMQ Summit 2019 talks are on YouTube
Release Highlights
RabbitMQ for Pivotal Platform 1.18

Comprehensive Security

PAS will not deploy if the CredHub instance count is set to 0, so we include CredHub by default.
In addition, this inclusion has other benefits:
• Service teams can count on the PAS CredHub being there, and don't have to plan for unexpected behaviors
PAS 2.8
Operators are required to deploy at least 1 instance of PAS CredHub.

Many customers have an identity provider with users that they assign to “groups”
For every app that they are associating with the IdP, they want only users in a certain group to get access.
UAA to perform user group authorization enforcement, a more elegant solution compared to the present
state (i.e. client servers inspecting scopes in the token that UAA issues).
App Developers no longer have to embed user group permissions into the app code
Single Sign-On 1.11
User Group Permissions from the IdP to Govern App Access

The Space Auditor CAPI role now has access to SSO Dashboard. Space Auditors can view the same areas as
the Space Developer, but cannot edit the space.
Developers gain visibility to restricted PROD environments.
Auditors can inspect SSO App configurations.
Single Sign-On 1.11
Role: Space Auditor

Compliance Scanner
• v1.2.16 is CIS certified.
• Now bundles the official CIS Ubuntu Xenial benchmark, with addendum for Stemcell specific
exceptions.
• Scheduled scanning, Azure blob store support.
File Integrity Monitoring for Windows
• Windows support (Beta) in FIM v1.4.8.
• Container scanning not supported at the moment.
Recent Highlights
Compliance Updates

SMB volume service is enabled by default. Use this over NFS where possible.
Other Security Highlights

Kubernetes-Native Services

A full-featured Kubernetes Operator for RabbitMQ to provision and manage clusters at scale.
• More efficient resource consumption
• Consistency
• Modular administration
• Latency
Interested? Contact us: https://pivotal.io/pivotal-rabbitmq-on-kubernetes (or reach out to
mkuratczyk@pivotal.io)
Beta testers wanted!
Pivotal RabbitMQ for Kubernetes

Partner Ecosystem

ISV Ecosystem Momentum Drives Platform Advantage

Next Steps
Software published to http://network.pivotal.io/.
Docs available on http://docs.pivotal.io.

Pivotal Platform - December Release A First Look

More Related Content

What's hot

Similar to Pivotal Platform - December Release A First Look

More from VMware Tanzu

Recently uploaded

Pivotal Platform - December Release A First Look