In a world where more than 5.6 million developers use Kubernetes, vendors are deepening their focus on simplifying the complexity of the Kubernetes ecosystem and shifting security further left in the application development process. VMware Tanzu Application Platform secures VMware's seat on that bandwagon.

Although the technological merits of Kubernetes are clear, "Kubernetes is not a developer platform," said Ajay Patel, VMware SVP of modern apps, during a press briefing. "As we talked to many enterprise customers, there has been a clear [developer experience] gap," Patel added.

VMware's Tanzu platform, which is now generally available, aims to minimize the challenge of navigating Kubernetes to boost developer productivity. "We want to make sure that developers are happy and can quickly get to value from a business perspective," added Valentina Alaria, VMware director of product.

The vendor's open source platform essentially prepackages Kubernetes, meaning developers can define what they need for a specific application, "and the platform takes care of all the rest," Alaria explained. This pre-paved path to production allows developers to build and deploy software quickly on any public cloud or on-prem Kubernetes cluster.

Bryan Kelly, lead engineering manager at Cerner, said the biggest Kubernetes-related challenge his organization faces is consistency. "You could throw a dart on the [Kubernetes] landscape, and I could probably find a team in our organization that has either tried it or is currently [using it]," Kelly said during a Tanzu customer Q&A.

Inconsistencies like this between development and production operations aren't tenable and harm the portability of employees between development or application teams, Kelly explained. Tanzu helps resolve this issue by giving consistent pathways to production even if teams have different methods or best practices.

"[Tanzu] is going to give developers a common and possibly even a standardized experience," added Greg Meyer, distinguished engineer at Cerner.

To further address the developer skills gap, Tanzu includes a learning platform that walks through how to use Kubernetes. This learning platform can also be used to educate teams on how to push code into production.

Tanzu is also a fully modular, composable, and customizable platform. "We don't just give you one way of doing this — our opinionated way," Alaria said. Instead, organizations can establish their own specific best practices as part of the Tanzu platform. And although Tanzu runs most effectively on VMware, it “should run great on any Kubernetes” platform, Patel told SDxCentral in an earlier interview.

Tanzu Community Edition has gained significant traction since its release a few months ago with the vendor reporting 15,000 downloads.

Another focus of VMware's application-aware platform is easier integration of security into an application's development lifecycle.

"Automation and security concerns can be embedded as early in the pipeline as you want — even in that local development environment," leaving one less thing for developers to worry about, Alaria said. Operators can configure the software supply chain with what the vendor calls "baked-in security and compliance guardrails" that render those security considerations invisible to developers.

Although much of Tanzu centers on improving developers' experience with Kubernetes, it also focuses on DevSecOps' users.

Tanzu creates "a separation of concerns between these two personas so that the developer can continue to have that consistent experience regardless of the best practices that the platform teams and DevSecOps teams want to establish," Alaria explained.

Tanzu is another addition to the growing number of open source groups and projects working to shift security left.

The Linux Foundation’s Open Source Security Foundation brings together players like Cisco, GitHub, Google, VMware, and others to develop better security tools and practices for open source application development without bias toward a specific ecosystem or vendor.

Additionally, Google’s Supply chain Levels for Software Artifacts (SLSA) project is a framework for ensuring the integrity of software artifacts throughout the software supply chain and is a key project within OpenSSF. Initially launched last summer, Project SLSA allows companies to audit the supply chain within internal workflows by using a system of incremental levels, each with an increasing amount of trustworthiness.