Cloud native is an application development approach that uses technologies such as microservices, containers, container orchestrators and immutable infrastructure to build, deploy, run and manage responsive, scalable and fault-tolerant software applications in a cloud computing environment.
Cloud native describes the design and operation of software applications built to operate in the cloud. Cloud native accelerates digital transformation because it maximizes the flexibility, scalability and resilience of cloud-based services to efficiently deliver applications that are easy to manage and maintain.
Imagine a bank needs to create a new application. Before cloud computing, the bank would hire developers to build the app, purchase the physical infrastructure needed to run the application on-premises, and maintain that infrastructure throughout the application’s lifetime. To access the app, users would connect to the bank’s servers, and because those servers hosted each individual service provided by the app — looking up account numbers, transferring funds, etc. — updating and maintaining any one service would require shutting down the entire system.
When developers began hosting apps in the cloud, they “lifted and shifted” their apps from on-premises environments while preserving their apps’ overall architecture, as well as their limitations. Instead of buying and managing servers to host their apps, they rented compute resources from a cloud service provider (CSP). But new services, such as platform as a service, containers as a service and serverless infrastructure, have opened new opportunities to build, deploy and manage applications at break-neck speed — relatively speaking.
The practice of building applications on-premises began to shift in the early 2000s with the advent of virtualization and emergence of infrastructure as a service (IaaS) providers, such as Amazon Web Services (AWS), which enabled developers to provision and manage virtual machines in the cloud. This paved the way for the development of platform as a service (PaaS) offerings, such as Google App Engine and Heroku, which provided a higher-level abstraction layer for building and deploying cloud-based applications.
But early platforms lacked flexibility, and developers were locked in, having to use proprietary APIs and tools. In response, a new approach focusing on building applications designed for the cloud and using open-source technologies emerged.
An early example of this approach was the Twelve-Factor App methodology, which consists of a set of principles for building cloud-native applications engineered for portability, scalability and resiliency. These principles include using declarative formats for configuration, relying on stateless processes, and treating backing services as attached resources.
Around the same time, the Docker containerization technology emerged as a key building block for cloud-native applications. Docker enabled developers to package their applications and dependencies into lightweight containers that could easily be deployed across different cloud environments, solving the problem of application portability.
In 2014, Google released Kubernetes, an open-source container orchestration platform. Kubernetes — providing a powerful set of tools for automating the deployment, scaling and management of containerized applications — became the standard for managing containerized applications in the cloud.
In the years since, the cloud-native approach for building applications has been embraced by organizations across all industries, from startups to large enterprises, and has led to the development of an ecosystem of open-source technologies, tools and platforms.
On a basic level, cloud-native applications are software programs where the functionality is broken down into microservices — small, loosely coupled services that operate independently of each other. Because of this modular structure, cloud-native applications are easier to build and change than traditional monolithic applications. Developers can deploy new features and updates to an application without disrupting the system.
By comparison, monolithic applications are built as a single codebase, with all components tightly coupled and running on a single server or machine. This means that changes or updates to the application require the entire application to be recompiled and redeployed.
Other technologies and methodologies characteristic of cloud-native applications include:
Cloud-native architecture is a design methodology that supports fast, nimble application development techniques to build cloud-native applications as sets of smaller, composable pieces, which are easy to maintain, change, scale and migrate. Components of cloud-native architecture follow.
Immutable infrastructure is a paradigm in which servers and virtual machines (VMs) are replaced rather than changed when something needs to be updated, fixed, or modified. If a change needs to take place, new components that incorporate those changes are built from a common image and the old ones are taken out of production. This approach creates a predictable process for cloud-native deployment.
The rise of cloud native has been driven by microservices architecture, a software design pattern emphasizing the use of independently deployable services, each with a specific business function, that work together in the cloud-native application. Microservices allow developers to build complex applications by composing smaller, more manageable components, which can be scaled and updated independently.
APIs are a communication tool used in cloud-native applications. They facilitate a standard, effective transfer of information between independent microservices, enabling them to share information so they can function as a cohesive whole.
A service mesh is a layer in cloud-native architecture that manages communication among microservices. Services meshes also make it possible to add traffic management, security and additional functions to services without having to add new code.
Containers allow microservices to be packaged in self-contained environments with their dependencies — code, resource files, system tools and system libraries — so they perform consistently in any circumstance. This allows developers to easily reproduce or analyze and isolate a service. Because they hold everything an application needs to run, containers enable cloud-native applications to be deployed anywhere, either on-premises or in the cloud.
With each microservice deployed in a container, groups of containers work together as a system, or “stack,” to form the complete native app. A dynamic orchestration system automatically monitors each container, starting them up and shutting them down according to user need and resulting in greater scalability and efficiency.
Cloud-native application development is the process of building stable, scalable apps for operation in a private, public or hybrid cloud. Common cloud-native development practices include:
Continuous integration (CI) is a practice that involves automatically building, testing and integrating code changes into a central repository. This helps to ensure that code changes are thoroughly tested and integrated with the rest of the application codebase. In cloud-native development, CI is often used in conjunction with containerization, which allows developers to package their code, dependencies and configuration into a single self-contained unit.
Continuous delivery (CD) is the process of delivering applications created in the CI process to a production-like environment where they’re put through additional automated tests to eliminate unexpected performance problems. By allowing for more incremental updates to applications in production, CD helps reduce the cost, time and risk of delivering changes and enables developers to build, test and release high-quality software with greater speed and frequency. In cloud-native development, CD is often used in conjunction with automation and DevOps practices, which help to streamline the software development and deployment process.
DevOps is an approach that combines software development and IT operations to increase the efficiency, speed, quality and security of software development and delivery.
In cloud-native development, DevOps is often used to automate many aspects of the software development and deployment process. The focus on a rapid, iterative approach aligns with the cloud-native model and helps organizations to deliver applications and services at velocity. This enables enterprises to provide better service to their customers and compete more effectively in their industry.
Serverless computing, used in conjunction with microservices, is a cloud-native development model that allows developers to write and deploy code without having to manage the underlying cloud infrastructure. Because resources are allocated dynamically based on demand, serverless computing can reduce costs and improve scalability.
Cloud-native practices offer the best opportunities to drive digital transformation and business growth. Native application development is cost-efficient, enabling applications to be easily updated and maintained through continuous integration/continuous delivery (CI/CD). It also helps organizations to break down silos across development, operations and security to deliver a consistent experience across the application development lifecycle.
Other benefits of cloud-native application development include:
Cloud-native applications are developed using an agile development process, with individual services developed and deployed independently, which allows for more rapid iteration and deployment of new features or updates.
With cloud-native application development, developers can focus on delivering value in the app because the cloud provider manages the underlying infrastructure. This also improves the consistency and reliability of the operating environment.
Cloud-native applications are designed to be horizontally scalable, where resources can be added or removed dynamically based on demand. Conversely, monolithic applications are typically scaled vertically, meaning that additional resources are added to the server or machine to handle increased demand. This approach can be expensive and inefficient, as it often requires over-provisioning of resources to handle peak demand.
Cloud-native application development makes it easy to keep up with the changing needs of customers and the business because it delivers applications made of loosely coupled microservices that are easy to update, change and scale in real time.
Cloud-native application development improves resilience because it uses microservices that can be isolated. If one component of a monolithic application fails, it can bring down the entire system. But fault-tolerant, cloud-native applications are designed to continue functioning even if individual services fail.
Because cloud-native application development uses containers to transfer microservices between the infrastructures of different vendors, organizations aren’t tied to a particular vendor. They can use the services of multiple cloud providers and select options best suited for their business.
Cloud-native application development simplifies troubleshooting because its microservices architecture makes it easy to track issues to the source service and fix the problem without server downtime.
Cloud-native applications are designed for security, with individual services typically isolated from each other. This reduces the attack surface from traditional monolithic applications constructed with tightly coupled components that make it easier for attackers to access sensitive data.
Cloud-native stack refers to the layers of tools and technologies developers use to build, manage and run cloud-native applications. Layers in the cloud-native stack include:
The infrastructure layer forms the foundation of the cloud-native stack. It’s made up of the supporting components of cloud-native application development, including operating systems, storage, network and other computing resources. The infrastructure layer is managed by third-party cloud providers.
The provisioning layer in the cloud-native stack is made up of the tools used to create and secure the infrastructure. This includes tools to scan and store container images and enable policy setting and enforcement.
The runtime layer encompasses everything a container needs to run in a cloud-native environment. This includes the code used to start a container and the tools that make persistent storage available to containers.
The orchestration and management layer is similar to an operating system, responsible for pulling together cloud components so that they can work together as a single, cohesive unit. Orchestration tools like Kubernetes, Docker and OpenShift enable developers to deploy, manage and scale containerized applications.
The application definition and development layer is made up of all the technologies developers use to build applications, including databases, messaging systems, container images and CI/CD pipelines.
Observability and analysis tools observe all layers in the cloud-native stack to monitor and evaluate the health of cloud applications to make sure there’s no disruption to the app's service quality. They are broken down into the categories of logging, monitoring and tracing and are used to monitor metrics like CPU usage, latency and memory.
Because cloud and cloud-native environments have different architectures that rely on different technologies, cloud security and cloud-native security differ. Cloud security requires a broad, holistic approach to security, since it covers a range of assets and applications. Cloud-native security, on the other hand, requires a specialized approach that accounts for the unique security concerns of cloud-native applications and infrastructure.
Common cloud-native security challenges include:
Lack of Visibility: The complexity of the cloud environment makes it difficult to gain complete visibility, creating blind spots where security risks can fester.
Diverse Threats: Cloud threat actors find creative attack paths and workarounds to security solutions as fast as they’re created.
Inability to Enforce Consistent Policies: An organization’s cloud-native infrastructure typically entails multiple cloud service providers and disparate security tools, making it difficult to centralize security policies and apply them consistently.
Misconfigurations: A historical lack of security integrated into the application development process leaves room for misconfigurations and open-source code vulnerabilities that can result in data exposure and unauthorized workload access.
Slow Security Processes: Maintaining the vigilant compliance and security required by high-velocity CI/CD pipelines slows the inherent flexibility, agility and speed of cloud computing.
Insecure Defaults: Many cloud-native tools provided by CSPs offer flexible settings, including insecure default settings that can lead to security violations.
Software Supply Chain Vulnerabilities: Unpatched vulnerabilities in open-source software increase the fragility of the software supply chain.
With the right tooling, security teams can tame cloud-native security challenges. A cloud-native application protection platform (CNAPP) will provide continuous visibility in a single dashboard, as well as consistent enforcement of security policies across the entire cloud environment.
