As of late, I find myself involved in interesting conversations around ‘Digital Disruption’. Eventually we will have to drop ‘disruption’ as change, constant learning and clear communication will be the new normal for businesses to survive.
We can change culture through using different tools. Enablers to instill a culture and mind set of fast change are concepts like DevOps and PaaS. Buzz word bingo aside, for me that means web-scale, cloud-native application architectures, development and deployment process readiness, multiple deliveries per day, CI/CD tooling, tool chains and executive sponsorship to ‘Make it Happen!‘ (which really means to shortcut the organisational change management bureaucracy, politics and internal stakeholder management efforts, which are ultimately roadblocks and threats to the survival of a company in the digital age). And that’s exactly what we see in our customer base who are successfully undertaking Digital Transformation.
From there on forward it becomes obvious that we want to be ‘no worries’ as much as possible about the layers underneath whatever makes up a customer consumable service/function/feature/application to be developed and operationalised (DevOps). Below an example of what I call an Enterprise Ready Container Reference Architecture.
The only reason you want PaaS is to make your life easier. Easier can mean making you faster, more scaleable, reliable and/or with higher levels of quality. Nowadays it’s not the big eating the small, it’s the fast eating the slow, for breakfast, lunch, dinner and dessert at your next all-inclusive holiday accomodation you booked through Air BnB (which made the agent you booked through last time go out of business). Therefore what you do not want is to invest in proprietary technology (increases risk of lock-in and technical debt) or having to deal with technical issues you didn’t have to think about before you went down the DIY PaaS path (for example container security, orchestration, scalability algorithms, sourcing secure container images or container networking).
A PaaS conversation has many different angles to it, hence it’s absolutely vital to see through empty Marketing promises, get a comprehensive picture and focus on what’s important to your organisation. A PaaS should be fit for purpose for your business model. Your architecture should not be driven by product features nor vendors (search also for opinionated, structured and unstructured PaaS) but by your business needs.
Because there are many offerings out there that call themselves ‘enterprise ready’ even when they are not, I compiled a list of questions to ask when choosing your PaaS.
Feedback is always welcome.
Enjoy,
Andreas
PS. The best way to move forward I believe is to define a Minimum Viable Product from front end/API to backend integration and see the entire SDLC in action around your PaaS. Marketing slides, thick strategy papers and multi-month planning cycles are not a focus area within the successful Digital Transformation programmes I have witnessed.
| Market Research | Have I got a good overview of the market, e.g. through Forrester, Gartner, blogs and forums? |
| Peer review in other organisations | How do Digital Transformation agents in other organisations address this topic? |
| Hybrid Infrastructure Cloud / Hosting | Can the run-time be easily moved between on-prem, public infrastructure and support both deployments (hybrid) at the same time across Dev/Test/UAT/PROD? How can the number of platform infrastructure nodes be extended or decreased? |
| Licensing / subscriptions | What is the cost structure regarding users / nodes / applications. How does on-boarding of new applications and/or users or the need for more compute / memory / storage affect pricing? |
| Software/solution Development Lifecycle (SDLC) | How do web-scale/cloud native applications move through the SDLC? Is it code or binary based? Do I have a choice? Can I implement emergency deploy scenarios? Can I use web-hooks to trigger builds? Can I do a Source to Image build? |
| CI / CD | Does the platform support my CI / CD processes and pipeline? How will it integrate? |
| API | How powerful is the API? What does it support in terms of build/design and run-time (DevOps)? What DevOps, CI/CD processes does the platform support – is there a restriction? How powerful is the API? |
| Application – Target Platforms | What target platforms does it support natively? How are web applications scaled on port 80/443? |
| Frameworks | What application development frameworks are supported? Is there a restriction on what can/cannot be supported. |
| Cloud Management & Monitoring across PaaS, Containers and IaaS | How do you manage your heterogenous IaaS providers (AWS, onPrem, OpenStack, Google, VMWare) and containers through a single pane of glass? Do you have/need a consolidating monitoring solution? |
| Distribution | How are the applications exposed to the public? Across different geos? |
| Governance | Is it compatible with our internal project/release processes and the associated project governance and delivery model? |
| Project Level Isolation | How are users, teams, backend services, repositories, code and applications isolated or shared on a per project basis and across applications? How can people & teams collaborate? |
| Tooling | How can the platform support existing development, test, deployment tools and tool chains? Do I know what the existing or target build/deploy process looks like? |
| Source Code | How is source code managed (SCM) around the platform? What existing SCM components are currently being used within my organisation? |
| Backend System Access and Integration | How are Enterprise services accessed on a per application, project or user bases? How does the platform support existent architectural concepts such as Microservices, SOA, BASE, API Management and Enterprise Service Bus? |
| Bandwidth / Throttling | How does the platform manage bandwidth constraints? |
| Re-usability | What is the level of re-usability across applications, code, patterns, reference architectures, runtime images, libraries, corporate repositories and services? |
| Data backend / Storage | What data backends are supported out of the box? How are non-out of the box data backends supported or integrated? What storage options do I have? Is my choice of storage supported? Is storage replication supported? Is storage assigned per application, project, container or platform wide? |
| Business Case | What is my business case timeframe? How is my ROI calculated? What is the TCO across entire lifetime? Do I need to capitalise the cost or can I run a OPEX model – do I have a choice? |
| Support | Which part of the build/run-time stack is supported by the vendor, i.e. Cloud infrastructure certification, Operating System, container run time, orchestration engine, application platform, application run-time? Is the vendor support enterprise ready and 24/7? What are the vendors response/fix time SLAs? |
| Vendor Stability | Is the vendor financially stable? Is it self (profit) or VC funded? What’s the revenue/profit per year? How do the financial analysts rate the vendor? How long has the vendor been around? How does the vendor go about R&D and select the next new PaaS features? Is the vendor Enterprise and/or consumer/developer focussed? |
| References | How many existing customers are there? How many success stories and references are there? |
| Application Deployment – different version and version upgrades | How does the platform support different versions of an application connecting to different end points depending on functionality? Are blue/green deployments supported? How can I roll back a failed deployment?
What programming languages are supported and how can you add additional languages to the platform? |
| Architecture – support and constraints | How does the platform support your reference architectures (eg backend service integration, APIs, business logic and front end, BASE, SOA) while observing loose coupling and high cohesion? Is my desired deployment architecture (onPrem, multi-AZ, multi region) supported? How is automatic data replication supported across multiple nodes in different geographies? What storage options do I have? |
| Security | What data security (in transit / at rest) is supported and how? What run-time stack security is available from Operating System, platform, to container? Who is patching security issues? |
| Authentication / Authorisation | What protocols are supported? Is MFA supported? |
| Compliance | How does the platform support the necessary compliance requirements such as SOX, ISO27001, Common Criteria? |
| Existing skills and change management | How can the platform support re-use of existing skills sets and help minimise the organisational change management component? Does the vendor provide trainings (on-site, online, class room) and certifications? Will I create a proprietary skill set or is there an Open Source community available to me? |
| Implementation support | Does the vendor offer implementation services? Does the vendor have a strong partner eco system? How expensive and available are those resources in the market place? |
| Quality of Service – Scalability & Clustering | How does the platform allow to scale in high-demand and off-peak scenarios? What work load density is realistic and supported?
What elements are looking after QoS concerns and how mature and supported are those? |
| Technology | Are there any specific, non-standard technologies mandatory I need to train on to use the platform? |
| Platform run time | How many compute nodes, memory, CPU, storage does the platform need to run on? What is the level of workload consolidation? |
| Platform Architecture | What are the architectural components of the platform? Are there any proprietary components that lock you in? |
| Networking | Is the networking architecture flexible, e.g. is Software-Defined-Networking utilised, if so is the implementation proprietary or supported by a large and active community? |
| Orchestration | How is container/microservices orchestration implemented? Proprietary or standards based? |
| Applications | Are there vendor supported and certified container image registries available? What does the update/notification mechanism look like if new images with bug/security fixed become available? Which components of my application stack is supported (Business rules, data grid, Data Virtualisation, application server, API management, Mobility) and maintained (security fixes, upgrades, patches) by the vendor? |