About
I have a passion for security and distributed systems and their application to real world…
Articles by Armon
-
HashiCorp officially joins the IBM family
HashiCorp officially joins the IBM family
Today we announced that HashiCorp has officially joined the IBM family as the acquisition announced last year was…
83 Comments -
HashiConf '24 Reflections
HashiConf '24 Reflections
I had a great time at our 10th #HashiConf this week, held in Boston for the first time. More than just a set of product…
10 Comments -
Five Trends in Cloud Infrastructure and What They Mean
Five Trends in Cloud Infrastructure and What They Mean
At our user conference, HashiConf, I shared some thoughts in my keynote about the infrastructure trends we’re seeing…
7 Comments
Activity
-
Why did we bring so many on-premise ideas to the Cloud with us and will #AI save us from a future of painful modernization? What do Ned Bellavance…
Why did we bring so many on-premise ideas to the Cloud with us and will #AI save us from a future of painful modernization? What do Ned Bellavance…
Liked by Armon Dadgar
-
Armon Dadgar and David McJannet sat down with IBM’s Rob Thomas to discuss why IBM, what this next chapter will look like for HashiCorp as part of…
Armon Dadgar and David McJannet sat down with IBM’s Rob Thomas to discuss why IBM, what this next chapter will look like for HashiCorp as part of…
Liked by Armon Dadgar
-
WOW... It's been 48 hours since we announced that IBM plans to acquire DataStax. Appreciate all the excitement and positive feedback. 🙏 As I…
WOW... It's been 48 hours since we announced that IBM plans to acquire DataStax. Appreciate all the excitement and positive feedback. 🙏 As I…
Liked by Armon Dadgar
Experience
-
-
-
-
-
-
-
-
-
-
-
Education
Publications
-
Informed Privilege-Complexity Trade-Offs in RBAC Configuration
ACM SACMAT '20
Role-Based Access Control (RBAC) has the potential both to simplify administration and improve an organization's security. But for non-trivial configurations, there is a conflict between defining fine-grained roles which adhere to the principle of least privilege, and coarse-grained roles which simplify administration by reducing configuration complexity. In this paper we propose OnPar, a multi-objective role mining approach which introduces minimization of unnecessary privilege as a role…
Role-Based Access Control (RBAC) has the potential both to simplify administration and improve an organization's security. But for non-trivial configurations, there is a conflict between defining fine-grained roles which adhere to the principle of least privilege, and coarse-grained roles which simplify administration by reducing configuration complexity. In this paper we propose OnPar, a multi-objective role mining approach which introduces minimization of unnecessary privilege as a role mining objective, along with an associated unnecessary privilege metric. These allow an RBAC configuration's level of adherence to the principle of least privilege to be reasoned about and traded off against other objectives, including minimization of configuration complexity. A key feature of our approach is the elimination of user tuning of global optimization weights. We show experimentally that this tuning typically leads to the evaluation of sub-optimal candidates, while still missing many optimal candidates. To avoid these issues we leverage Pareto optimality and introduce multi-stage Pareto filtering and the hypervolume indicator to role mining. Their use allows OnPar to efficiently select a small set of candidates for evaluation by the administrator, which are equal best and representative of the full range of trade-offs that were found. Our experimental results demonstrate the effectiveness of this approach across a wide range of input configurations.
Other authors -
-
Lifeguard : SWIM-ing with Situational Awareness
HashiCorp Research
The paper details a number of novel improvements we have introduced to Serf, Consul, and Nomad to make their underlying gossip protocol more robust. Collectively called Lifeguard, these extensions reduce by 50x the false positives produced by the failure detector and allow us to detect true failures faster.
Distributed systems such as BitTorrent, Apache Cassandra, Microsoft Orleans, and HashiCorp Consul commonly use Gossip protocols. They are typically embedded to provide features such…The paper details a number of novel improvements we have introduced to Serf, Consul, and Nomad to make their underlying gossip protocol more robust. Collectively called Lifeguard, these extensions reduce by 50x the false positives produced by the failure detector and allow us to detect true failures faster.
Distributed systems such as BitTorrent, Apache Cassandra, Microsoft Orleans, and HashiCorp Consul commonly use Gossip protocols. They are typically embedded to provide features such as cluster membership (who is in the cluster), failure detection (which members are alive), and event broadcast. Their peer to peer nature often makes them much more scalable and reliable than centralized approaches to solving the same problem. However, the reduced amount of communication makes them sensitive to slow processing of their messages.
Relative to the baseline, which is the implementation prior to Lifeguard, we reduce the rate of false positives by more than 50x. End users will perceive a faster and more robust system as a result of Lifeguard. Many of these improvements were incorporated in September 2016, and have been running in production at scale since.Other authors -
-
Retaining Sandbox Containment Despite Bugs in Privileged Memory-Safe Code
ACM Conference on Computer and Communications Security (CCS)
Projects
-
Nomad
- Present
Nomad is a tool for managing a cluster of machines and running applications on them. Nomad abstracts away machines and the location of applications, and instead enables users to declare what they want to run and Nomad handles where they should run and how to run them. Nomad is focused on flexibility, supporting a range of workload types (service and batch), operating systems (Windows, Linux, BSD, OS X), and packaging formats. Nomad supports container based applications, including Docker, Rkt…
Nomad is a tool for managing a cluster of machines and running applications on them. Nomad abstracts away machines and the location of applications, and instead enables users to declare what they want to run and Nomad handles where they should run and how to run them. Nomad is focused on flexibility, supporting a range of workload types (service and batch), operating systems (Windows, Linux, BSD, OS X), and packaging formats. Nomad supports container based applications, including Docker, Rkt, and LXC. VM based applications, and standalone binaries like Java JARs or statically linked Go, C/C++, and Rust applications. Nomad spans
Other creators -
-
Vault
- Present
Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Vault presents a unified API to access multiple backends: HSMs, AWS IAM, SQL databases, raw key/value, and more.
Other creators -
-
Consul
- Present
Consul is a complete solution for service discovery and orchestration built on top of Serf. Consul is extremely scalable, highly available, and comes out of the box with support for multiple datacenters.
Other creators -
-
Serf
- Present
Serf is a decentralized solution for service discovery and orchestration that is lightweight, fault tolerant, and highly available.
Other creators -
Honors & Awards
-
UW Diamond Award, Early Career Achievement
University of Washington
The Diamond Awards honor outstanding alumni who have made significant contributions to the field of engineering.
https://www.engr.washington.edu/alumni/diamond/2020honorees -
Forbes 30 Under 30
Forbes
https://www.forbes.com/sites/kathleenchaykowski/2017/01/03/30-under-30-2017-the-young-innovators-transforming-enterprise-tech/#1b59a64335b3
More activity by Armon
-
We are excited to announce that IBM has completed its acquisition of HashiCorp, a leading hybrid cloud infrastructure automation company:…
We are excited to announce that IBM has completed its acquisition of HashiCorp, a leading hybrid cloud infrastructure automation company:…
Liked by Armon Dadgar
Other similar profiles
Explore more posts
-
Aled Sage
Well done #AWS for promptly fixing an S3 billing edge-case! Interesting S3 cost issue in this blog: "How an empty S3 bucket can make your AWS bill explode". In brief: external unauthorised (denied) requests to a new empty S3 bucket were being charged - $1,300 within two days. The author had inadvertently chosen the same bucket name that was the placeholder default configuration in a popular open-source tool! https://lnkd.in/eNEqedR8 That blog was published on 29th April 2024. On 13th May, AWS fixed this problem: "Amazon S3 will no longer charge for several HTTP error codes". https://lnkd.in/eMXuhhu8 To quote that announcement: "bucket owners will never incur request or bandwidth charges for requests that return an HTTP 403 (Access Denied) error response if initiated from outside their individual AWS account or AWS Organization."
-
Surya Oruganti
Your periodic reminder that containers and k8s are not secure boundaries for isolation. Don't let others run your workflows (especially CI/CD) in containers / kubernetes. At WarpBuild, we've taken extra steps to only run customer workloads in secure, isolated, ephemeral VMs. https://lnkd.in/gCwwZadG
-
Kyle Kingsbury
In late 2023 we reported that MySQL and MariaDB’s REPEATABLE READ did not, in fact, provide repeatable reads. The MariaDB team has been hard at work this past year. They’ve added a new flag, --innodb-snapshot-isolation=true, which causes REPEATABLE READ to prevent Lost Update, Non-repeatable Read, and violations of Monotonic Atomic View. Jepsen has not yet tested this, but it looks like MariaDB might, with the new flag enabled, offer Snapshot Isolation at REPEATABLE READ. https://lnkd.in/dw_SFhjh https://lnkd.in/dc_9-P26
-
Neal Gamradt
This is a notable increase in the number of S3 buckets that a single account can have, and I could see this being a welcome improvement for folks that use a lot of S3 buckets. It should be mentioned that with this change comes the possibility of a new fee, $0.02 per additional general purpose bucket (when you have more than 2,000 S3 buckets in your account). So you still probably want to be smart about the number of S3 buckets you create. #aws #s3 #cloudstorage #awspricing https://lnkd.in/eQFNd48c
-
Amin Ariana
Weird tradeoff question: You’re putting together a RAG module for an AI-assisted search solution (needs to do vector embedded search) but don’t want to use any vendor or PG database but rather a auto-shardable on-demand DB like AWS DynamoDB fits the zero-to-one phase risk profile better. I know people do FAISS in Lambda to do proximity search in memory. Is this a sane low-maintenance approach? Are there already better Dynamo abstractions without an intermediary? (Asking for a friend :D )
3 Comments -
Ziaul Kamal
Honeycomb Says Don’t Give Up on Frontend Observability https://lnkd.in/gfTxqiYr Honeycomb is emphasizing how a lack of frontend observability is unacceptable and how its fix draws largely from OpenTelemetry, with the generally available release of Honeycomb for Frontend Observability. With it, Honeycomb engineers designed the tool to debug Core Web Vitals (CWVs) and pinpoint causes — “wherever they occur in your stack,” Honeycomb claims in a blog post — with traces and and other data. Honeycomb also says it is offering “thousands” of free custom attributes. At issue is how real user monitoring (RUM) tools are always essential for accessing telemetry for the frontend. But debugging tools are often lacking. When it comes to actually debugging issues in your web app, you’re often left piecing together outputs from browser devtools, with details (if you’re lucky) from customer support tickets to replicate issues locally in hopes of identifying the source of the issue, Honeycomb says. Winston Hearn, senior product manager at Honeycomb, was previously an engineer debugging web performance issues for large media companies. “We ran into this issue often — all the RUM tools available before now collect CWV metrics which helps identify roughly that there’s a problem, but do not give you any helpful context on causes or needed fixes,” Hearn told The New Stack. “At Honeycomb, we have worked closely with our customers’ engineering teams to ensure that they have the data they need to get down to specific causes, allowing them to cut down debugging from many hours or days to a few minutes.” Without a proper tool, debugging Core Web Vitals (CWVs) to improve scores can be even worse. Literally any asset or third-party service could be affecting the performance of the page, so narrowing in on what’s affecting the metrics is a cycle of guess and check, Honeycomb says. Deeper Analysis and Scrutiny While fields can be divided up by any set of criteria, determining which ones are important for deeper analysis and scrutiny is critical. This is a key functionality of Honeycomb for Frontend Observability. When checking what is happening with poor values for cumulative layout shift and after selecting BubbleUp, Honeycomb analyzes every one of three fields and graphs them, starting with the ones that differ the most, Honeycomb showed in a demo. The yellow bars represent the poor results, and it appears they occurred after the loading was complete. They are located on the homepage, which is useful information. What element caused them? Further investigation can be conducted by any attribute, Honey cays. As the demo revealed, other information Honeycomb provides might include the ability to ask more questions such as: Which backend requests are the slowest and, more importantly, why are they slow? By filtering down to the cart page and selecting one of these slow requests, Honeycomb shows the request from the frontend all the way through backend...
-
Flynn Träger
Wanted to give a quick shout out to Pump.co - they’ve helped us save ~60% on our monthly AWS bill for free. They also stopped our AWS credits from expiring 😁 It took 5 minutes to onboard and they have no access to our infrastructure so it's super simple to just have it run in the background and know that we're covered. If you spend more than $1000/month on AWS - or have credits that you don't want to lose - you should definitely spend 2 minutes just running an estimate to see how much they can save you: https://lnkd.in/gbw4dwh2 It's literally free money.
-
Ivan Batanov
TL;dr - RIP Terraform. Time to say goodbye. I just ran into this obituary for Terraform and Hashicorp. The most probable future seems to be the maximization of sales motion and the minimization of engineering investment - just adding another product to the price list and unleashing the sales force at it. The worst possible outcome would be if IBM decided to make Terraform part of their still-born cloud offering. Or maybe we’ll have Terraform for mainframe? #terraform #hashicorp #ibm #upgrade
5 Comments -
Marc Brooker
Here's a practical example of how Formal Methods can make code faster: AWS's new proven-correct authorization engine is 65% faster (even at p99.9) than the previous version. https://lnkd.in/gVCdurKh Sean says in the talk "we wouldn't have attempted a lot of optimizations we did without this backing of proof". Formal methods allow us to optimize systems more boldly, by removing the risk that optimizations will affect correctness. They also allow our teams to move faster, with lower risk, by building confidence in correctness early on in the software development process.
4 Comments -
Anthony Corletti
⎈ If you and your team are using #Kubernetes or thinking about using Kubernetes for AI and ML workloads, listen up! ⎈ Kubernetes v1.31 was announced this week, and it’s a particularly notable release for several reasons, especially for those working with AI and ML workloads. Here are the highlights: ⚙️ New DRA APIs – DRA stands for dynamic resource allocation. These new APIs introduce structured parameters, making resource management more transparent and efficient. They support features like cluster autoscaling and allow for version skew between kubelet and control plane. Classic DRA is now managed via a dedicated control plane controller, enabling custom allocation policies. 📦 Support for OCI Image Volumes – Kubernetes is stepping up for AI/ML workloads by allowing OCI-compatible images to be used directly as volumes in Pods! This simplifies the integration of OCI standards, making it easier to store and distribute content via OCI registries. Enable the "ImageVolume" feature gate to start using this powerful capability. 🩺 Device Health Reporting in Pod Status – This new feature allows teams to expose device health information directly through the Pod status. By adding the "allocatedResourcesStatus" field, you can gain critical insights into the health of devices assigned to containers, improving operational visibility and troubleshooting. Speaking from experience, working with varied hardware on Kubernetes has been a pain. These updates, all in alpha, are starting to pave the way for a much better developer and operator experience when your teams need to run varied workloads on Kubernetes that leverage CPUs, GPUs, and other types of hardware. For more on the release, here’s the announcement post. https://lnkd.in/ei5Vc9jd Are you and your teams leveraging varied hardware workloads on Kubernetes with a combination of CPUs and GPUs? I’d love to hear from you in the comments! #kubernetes #cloudcomputing #ai #ml
-
Ziaul Kamal
Istio 1.23 Drops the Sidecars for a Simpler ‘Ambient Mesh’ https://lnkd.in/gfTxqiYr Louis Ryan, CTO, Solo.io The new release of the open source Istio service mesh software offers a potentially big change in how to handle Kubernetes traffic, with the introduction of an ambient mesh option. Although the technology has been offered as an experimental feature for several releases, the core development team taking feedback from users, this is the first release to offer the feature as a production-grade capability. It’s a new architecture entirely, explained Louis Ryan, who is the CTO of commercial Istio provider Solo.io, as well as a member of Istio Technical Oversight Committee and Steering Committee, in a TNS interview. “It’s cheaper, faster, easier to deploy more scalable, better.” An “ambient” service mesh is one that, unlike traditional approaches, does not require a separate sidecar to accompany each application. Istio is a project of the Cloud Native Computing Foundation, making it a building block of many Kubernetes deployments. Istio Sans Sidecar The sidecar was a necessary byproduct of microservices architecture, noted Idit Levine, founder and CEO of Solo.io. Once applications are decomposed into individual services, these services require a way to communicate. Hence it made sense to festoon each service with a sidecar to handle all the networking traffic. The sidecar provides security, improved reliability, and dynamic networking capabilities for each application. Sidecars solved “a real problem,” Levine noted. The sidecar provided the functionality, but the designer “overlooked” how much overhead they would bring to the machine itself. In contrast, the ambient approach “is reducing costs because there is no sidecar everywhere. But it’s still giving you the security that you’re looking for, and all the functionality,” Levine said. “So it’s actually really amazing.” Solo.io engineers have been working on refining the ambient approach for several years now. How Ambient Mesh Works “This innovative approach makes networking in Kubernetes even easier. No more extra steps with sidecars. Services can now communicate more directly and simply,” wrote AWS community builder Seifeddine Rajhi, in a post explaining the technology. Ambient Mesh is built on a zero trust architecture. The ztunnel zero trust tunnel, a daemonset pod written in Rust, is installed on each cluster to handle Layer 3 and Layer 4 traffic. Then, the Envoy-based Waypoint Proxies to handle more complex Layer 7 traffic for each namespace, Rajhi explained So, as an example, for 50 pods, with each pod only receiving 50 requests per second, you can have a single proxy handle all of them. “That’s a massive resource savings,” Ryan pointed out. There are other advantages as well. Upgrades are a lot easier, as applications do not need to be taken offline to assign a sidecar. Instead, updates of the daemonsets can be done on a rolling basis. This is where the “ambien...
-
Frederick Wurden
The speed at which these models improve is staggering, so is the cost to build them. Only way to keep up is to leverage principles such as AWS Bedrock so you have the flexibility you need to quickly select the model that works best for your task. https://lnkd.in/gNAR63YC https://lnkd.in/g_FtP6e9
-
Eric Webb
There's a reason why SaaS observability is replacing the ELK stack. Think how cloud replaced on-prem, there are so many hidden costs! ELK has been the go-to for years, but it's become a real challenge to maintain since it requires more resources, and comes with higher costs, and increased complexity. By simplifying operations, enhancing insights and scaling effortlessly, SaaS allows teams to focus on delivering value instead of maintaining infrastructure. #SaaS #Transformation #Efficiency
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore More