什么是云原生应用程序？

Cloud-native applications are applications designed and developed with the advantages of cloud technologies in mind, rather than being built with traditional approaches that were the standard before the Cloud was established. These applications use cloud capabilities to enable rapid development, optimization, and interconnectivity. This means that companies can bring products to market faster, discover insights easily, solicit feedback from users, and then roll out improvements rapidly.

To aid this flexible development process, cloud-native apps tend to be built in small pieces, utilizing microservices to complete tasks while remaining lightweight themselves. Cloud-native apps are different from cloud-based apps in that they are built specifically to fully use cloud features rather than just a few cloud services or resources.

Comparatively, legacy applications built with traditional software development methods tend to be monolithic and opaque and run on a single system. Often these systems are “snowflakes,” with hardware infrastructure growing in tandem with the enterprise application into a unique and uncoupled configuration. These legacy apps further run into the challenge of obsolescence, at which point organizations can reflect on the need to migrate their on-premises apps to the cloud.

Cloud-native applications rely on leveraging DevOps, microservices, containers, and continuous integration/continuous delivery (CI/CD) methods, to redefine how developers achieve business goals by changing the use of traditional on-premises infrastructures to the use of cloud environments. For many reasons, costs, security, flexibility, innovation, cloud-native apps are the future for business-critical applications.

Cloud-native application architecture encompasses several technologies that have shifted how engineers address the development process, application architecture, deployment & packaging, and application infrastructure. It is the coordination of these technologies and how apps use their services that define the cloud-native architecture category. Several of those enabling technologies include:

• Containers — Containers are akin to virtual machines, but are much smaller, and intended to be created and destroyed frequently as needed. Contrastingly, VMs must contain the underlying operating system, while containers, which silo applications, need only the application components. They consume fewer resources and cloud storage and are useful mechanisms that feature isolation, portability, and easy deployment.
• Microservices — Rather than include every code feature within a software package, the microservices approach minimizes services into several smaller services that can be coupled together to complete larger tasks. Microservices are independent and can be deployed, upgraded, and scaled on their own as needed. Microservice thinking intends to deliver just the core functionality to developers that they need and keep the overall application light.
• APIs — Microservices cannot be talked about without Application Programming Interfaces. APIs standardize the communication between microservices with protocols like Representational State Transfer (REST). APIs are essential communications between apps in the cloud paradigm of today which calls for isolating services and apps.
• Automation — Automating mundane tasks, or even critical tasks that are time-sensitive is another game-changing feature of cloud-native architectures. While automation has private uses, it has undeniably made cloud scaling possible. For example, without automation, servers could not automatically increase bandwidth or add compute resources to deal with an overflow of traffic.

Security in the cloud is an important concern, especially when many continue to allude to the fact that the growth of cloud and IoT has significantly expanded the Internet, and so the threat surface for cyber-attacks and network invasions. Because of the nature of the cloud, security concerns and responsibilities have shifted. The “Fortress” model was the traditional standard security model for many enterprises—enterprise assets were protected inside the fortress behind company firewalls. Today, because enterprise traffic traverses the public Internet, security has been reconfigured, and new technologies have slowly augmented fortress strategies or replaced them altogether.

• Identity and Access Management — IAM is a collection of policies and technologies that provide businesses the tools to manage identification and access controls for users and devices that access their resources. Closely associated with IAM practices is the Zero Trust principle, which states that all devices attempting access should by default not be trusted, and every attempt should be verified. Sometimes referred to as perimeterless security as the opposite of fortress strategy, a Zero Trust approach dislocates access and demands verification from all devices and users from anywhere even when accessing from the company’s private managed network.
• Multi-factor Identification — Multi-factor identification verifies users against multiple identifying items to ensure the person is who they say they are. Popular methods include receiving a text message or email with a validation code that also must be given when signing into a system.
• Intrusion Detection Systems — Intrusion detection systems can be combinations of software and appliances that can passively or actively monitor a network to discover malicious users of any policy violations. IDS’ older brother, Intrusion prevention systems (IPS), have features that take action against violations or bad users, from reporting the violations to dropping and blocking violators.
• Infrastructure Protection — CSPs serve hundreds of tenets and can offer several safeguards to protect their infrastructure from intruders. By design, virtualization in the cloud offers compartmentalization and tremendous security benefits. While CSPs responsibly protect accounts, storage, databases, servers, and hypervisors, they also offer more advanced security features, such as automatic DDoS protection, or application firewalls to eliminate malicious web traffic. Each CSPs capabilities are different and should be aligned to your business goals.
• Data Protection — More and more, data is becoming abundant, portable, and more valuable to businesses which is why it is an attractive target for hackers. CSP security uses traditional and modern network security features to protect their user’s data, however, cloud consumers must also be aware of the Cloud Shared Responsibility Model, which outlines the cloud consumer’s and cloud provider’s responsibility for data security. For example, for IaaS, providers are fully responsible for physical infrastructure security, and share responsibility for host infrastructure and network controls with the consumer; at the application level and above the consumer is 100% responsible for data security. SaaS providers, in contrast, are usually fully responsible for a customer’s application data.