5 ms·

This is a great post. We've been talking to a lot of people about going "on-prem". This post is right on in that the deployment is the relatively easy part. The

This is a great post. We've been talking to a lot of people about going "on-prem". This post is right on in that the deployment is the relatively easy part. The ongoing operations is where you will get killed. Luckily, for those that are thinking about doing this, for the end customers "on-prem" many times means single-tenant, private cloud (usually AWS) which makes things slightly easier (as the op mentions). The vendors that do it right make their multi-tenant cloud app and "on-prem" environments as similar as possible. So that means containerizing and using an orchestration layer like Kubernetes or Mesos everywhere (multi-tenant and single-tenant). Then you need to make sure you have a secure and scalable way to access all environments for upgrades, patches, support. We open sourced an SSH framework specifically for this purpose[1]. Bottom line: no special snowflakes. Edit: for more info feel free to reach out: http://gravitational.com/vendors.html http://gravitational.com/vendors.html [1]: http://gravitational.com/teleport/ http://gravitational.com/teleport/

rdtsc 10y ago
> for the end customers "on-prem" means single-tenant, private cloud (usually AWS) Nope. On prem means in their own private data center. Also possibly airgapped from the outside.
- twakefield 10y ago
  Yes, that is true. I meant it more that a new class of "on-prem" is being created.
- azernik 10y ago
  Depends on the customer. Often, the motivations that push them to demand on-prem can be fulfilled just as well by a less-demanding single-tenant SaaS solution; you just have to convince the customer's IT department that such a thing exists. Sure, there are some (mostly in defense, finance, and a few other security-sensitive fields) where physical on-prem is non-negotiable, but in my experience customer demands for on-prem are far more likely to be driven by outdated and/or overly-conservative IT practices than by real need.
  - johnbellone 10y ago
    What you're describing is a private, separated installation on the Internet. In all cases "on-prem" is inside of a customer's datacenter/office.
    - brazzledazzle 10y ago
      I've learned to live with the meanings of things getting mangled. Once marketing requires that a definition change it's pretty much game over. You can try to fight it but quite often it's the marketing department and customer working together to change how something is defined because it's easier than changing outdated policies or thinking. At that point you're just a stick in the mud, pining for the good ol' days when clouds were just called "other people's computers".
    - azernik 10y ago
      Which is what this article does too - they very specifically distinguish between what they call really "on-prem" and "single-tenant", and one of their suggested strategies is to make them go for the latter if at all possible.
    - emodendroket 10y ago
      I mean, the article linked describes the two scenarios both as "on-prem."
  - rdtsc 10y ago
    For some, but depending on markets (say DoD) on prem means air-gapped. Basically in last 5 years less than 10% of our customers agreed to that sort of a managed AWS VPC deal. A lot of the time, the direct customer doesn't even want the hassle either, they want a solution that works. But they are forced by rules and regulation, and their own customers.
    - deleted 10y ago
      [deleted]
  - Spooky23 10y ago
- jitl 10y ago
  For us, "on-prem" means "in our private AWS cloud, with no dependencies on the Public Internet". For critical services for engineering, we want to know that your service is not going to stop working if Github or some CDN goes down or has latency problems. We want to know that you aren't going to toggle some feature switch on your service and expose us to some new bug. We want to know how much headroom your software has, so we know if it can scale with us. I think this concept of "on-prem" being "in our private cloud, firewalled from the internet" is pretty well-understood among consumers of AWS or other IaaS products.
brazzledazzle 10y ago
Teleport looks really cool–I can't wait to try it out. Thanks for releasing it.

rdtsc 10y ago

> for the end customers "on-prem" means single-tenant, private cloud (usually AWS) Nope. On prem means in their own private data center. Also possibly airgapped from the outside.

twakefield 10y ago
Yes, that is true. I meant it more that a new class of "on-prem" is being created.
azernik 10y ago
Depends on the customer. Often, the motivations that push them to demand on-prem can be fulfilled just as well by a less-demanding single-tenant SaaS solution; you just have to convince the customer's IT department that such a thing exists. Sure, there are some (mostly in defense, finance, and a few other security-sensitive fields) where physical on-prem is non-negotiable, but in my experience customer demands for on-prem are far more likely to be driven by outdated and/or overly-conservative IT practices than by real need.
- johnbellone 10y ago
  What you're describing is a private, separated installation on the Internet. In all cases "on-prem" is inside of a customer's datacenter/office.
  - brazzledazzle 10y ago
    I've learned to live with the meanings of things getting mangled. Once marketing requires that a definition change it's pretty much game over. You can try to fight it but quite often it's the marketing department and customer working together to change how something is defined because it's easier than changing outdated policies or thinking. At that point you're just a stick in the mud, pining for the good ol' days when clouds were just called "other people's computers".
  - azernik 10y ago
    Which is what this article does too - they very specifically distinguish between what they call really "on-prem" and "single-tenant", and one of their suggested strategies is to make them go for the latter if at all possible.
  - emodendroket 10y ago
    I mean, the article linked describes the two scenarios both as "on-prem."
- rdtsc 10y ago
  For some, but depending on markets (say DoD) on prem means air-gapped. Basically in last 5 years less than 10% of our customers agreed to that sort of a managed AWS VPC deal. A lot of the time, the direct customer doesn't even want the hassle either, they want a solution that works. But they are forced by rules and regulation, and their own customers.
  - deleted 10y ago
    [deleted]
- Spooky23 10y ago
jitl 10y ago
For us, "on-prem" means "in our private AWS cloud, with no dependencies on the Public Internet". For critical services for engineering, we want to know that your service is not going to stop working if Github or some CDN goes down or has latency problems. We want to know that you aren't going to toggle some feature switch on your service and expose us to some new bug. We want to know how much headroom your software has, so we know if it can scale with us. I think this concept of "on-prem" being "in our private cloud, firewalled from the internet" is pretty well-understood among consumers of AWS or other IaaS products.

brazzledazzle 10y ago

Teleport looks really cool–I can't wait to try it out. Thanks for releasing it.