Serverless computing: Ready or not?

Until a few years ago, physical servers were a bedrock technology, the beating digital heart of every data center. Then the cloud materialized. Today, as organizations continue to shovel an ever-growing number of services toward cloud providers, on-premises servers seem to be on the verge of becoming an endangered species.

Serverless computing is doing its share to accelerate the demise of on-premises servers. The concept of turning to a cloud provider to dynamically manage the allocation of machine resources and bill users only for the actual amount of resources consumed by applications is gaining increasing acceptance. A late 2019 survey conducted by technical media and training firm O’Reilly found that four out of 10 enterprises, spanning a wide range of locations and industries, have already adopted serverless technologies.

Don’t be misled, however. Despite its name, serverless computing still relies on servers. “Serverless computing is really running on a server, but your cloud provider provisions the services as needed; you don’t own the virtual server or app service,” says Joe Wilson, owner of Volare Systems, a serverless-software developer. In essence, serverless is an application-deployment architecture that enables developers to write code and then execute it on-demand.

Serverless is not just a technology, but an entirely new way of viewing fundamental IT operations. “A major benefit of serverless is that it forces you to think about designing your systems in a cloud-native way,” says Brent Austin, senior architect of cloud platform strategy at Liberty Mutual Insurance. “If you think about designing applications with a serverless-first mindset, you’re more likely to implement a cost-effective, scalable, and resilient architecture, without being bound by specific technical choices within that system.”

Where to use serverless computing

Serverless computing can be deployed in an almost unlimited number of ways. Many use cases focus on relatively simple needs, such as webpage apps, which are now commonly coded in serverless, says Miha Kralj, managing director of cloud strategy, architecture, and delivery at professional-services firm Accenture. “Because serverless platforms automatically scale up when needed, simple applications can be quickly developed without having to worry about the complexities of infrastructure.”

Serverless excels in the coordination of different application systems. “Serverless computing is ideal for detecting [an] event and informing another application or system, for example when changes in a database will trigger code change or a security review,” Kralj says. “Serverless can be a great way to create these sorts of automated workflows between systems.”

Serverless can also be a good choice for “bolt-on” needs, Kralj says. “When a client has a large or complex solution but needs to add a capability of one sort or another, serverless can be ideal.” For instance, instead of opening a large application to insert a simple function, such as adding a customer record from a new source, a serverless function can be easily created to capture the new input and call the application’s API. “A quick, painless and reliable approach” Kralj says.

Cost benefits

By nature, serverless computing architectures tend to be more cost-effective than alternative approaches. “A core capability of serverless is that it scales up and down to zero so that when it’s not being used you aren’t paying for it,” Austin says.

With serverless technology, the customer pays for consumption, not capacity, according to Kevin McMahon, executive director of mobile and emerging technologies at consulting firm SPR. He compares the serverless model to owning a car versus using a ride-sharing service. “Prior to ride sharing, if you wanted to get from point A to B reliably you likely owned a car, paid for insurance and had to maintain it,” he says. “With ride-sharing, you no longer have to worry about the car, you can just pay to get from A to B when you want; you simply pay for the job that needs to be done instead of the additional infrastructure and maintenance.”

Serverless computing can also help adopters avoid costs related to the over-allocation of resources, ensuring that expenses are in line with actual consumption, says Craig Tavares, head of cloud at IT service-management company Aptum. Additionally, by segmenting applications into simple, purpose-driven functions, they can be quickly and cheaply deployed and distributed within the cloud. “Increased velocity in the development cycle also improves go-to-market, thus enabling organizations to focus on continuous improvements and customer satisfaction,” he says.

Thanks to pay-per-use pricing, there is no uptime cost, says Tim Growney, CTO of Medinas, which operates a marketplace for pre-owned medical equipment. “Your mileage will definitely vary depending on your use case, but I can say for my company … we will typically never fall outside of the AWS free tier, making our Web hosting costs almost zero,” Growney says.

Impact on IT workload

Serverless computing can lighten IT workloads in several ways, most noticeably by freeing staff from routinely managing server performance, reliability, maintenance and security tasks. “The need to implement health checks to ensure application uptime, managing the underlying OS in regard to applying the latest security patch, or ensuring the underlying infrastructure has been provisioned with enough capacity to handle peak workloads are all things that are essentially handled for you by the serverless platform,” Austin says.

Serverless also lightens developers’ workloads. “Writing less code, particularly infrastructure code, is attractive to the IT bottom line,” Austin says. “Having more developers deploying business functionality while letting the serverless technology handle infrastructure provisioning is a powerful benefit to an IT organization.”

Accelerating development speed can also make organizations nimbler and more innovative. Serverless is the fastest way to turn an idea into a functional solution, Kralj says. “The approach is perfect for rapid application development; you can now achieve it with just a few lines of code.”

Paradoxically, serverless can sometimes also increase workloads, although not to the extent that it will nullify the technology’s many benefits. “There will be more work involved in creating functionalities … and stitching together APIs to accomplish what the business needs,” says Greg Cox, senior CTO architect with disaster-recovery service provider Sungard Availability Services.

Squashing bugs can add to workloads, too. “Without standardized security, testing, monitoring and configuration management, serverless bugs are insidious,” says Bert Johnson, principal consultant, cloud, at digital business platform developer AHEAD. He says bugs magnify deficiencies in the software development process while forcing developers to abandon critical tasks to join search-and-repair missions.

Drawbacks

For all its benefits, serverless computing also presents a few significant drawbacks. The technology isn’t particularly good, for example, at supporting prolonged operations. “Serverless wouldn’t be the right approach if you’re running a task or process that takes a long time to compute,” McMahon says. “Currently, Azure Functions and AWS Lambda can only run for a maximum of 10 and 15 minutes, respectively.”

Cold starts can also send a chill through some serverless adopters. “A cold start is the time period—typically a few dozen milliseconds—needed to wake a function in order to execute it,” McMahon says. “For the vast majority of use cases this time is negligible, but there are some use cases where this delay is unacceptable and serverless computing would not be ideal.”

Potential adopters may also be dissuaded by the prospect of vendor lock-in. “IT and development leaders … should be aware that the major serverless systems—AWS Lambda, Azure Functions and Google Cloud Functions—are not interchangeable,” Kralj says.

From a security perspective, serverless presents a unique challenge. “On the one hand, the risk is limited by the short runtime durations and isolation from the underlying host OS,” says Rani Osnat, vice president of strategy for security software developer Aqua Security. “On the other hand, functions are often provisioned with too many permissions or with vulnerable components, which may lead to the serverless functions being used as an intermediary step in an attack to get access to other resources.” Serverless should be configured securely and monitored for anomalies and abuse, he says.

Serverless adopters should also be cautious when calculating their capacity needs. “Traditional servers fall over when they’re over capacity, preventing cost overage,” Growney says. “Serverless tends to be able to scale in a relatively unlimited fashion, which can lead to very costly mistakes if you’re not careful.”

Finally, serverless converts may also see their payrolls rise. “If your firm is tech-focused, one of the more significant outlays will be allocated to hiring developers,” says Patrick Navarro, executive vice president and head of cloud at IT recruitment agency Jefferson Frank. “Qualified, skilled developers are thin on the ground and, in turn, expensive to hire and retain.”

Serverless aids integration efforts

As cloud providers continue introducing new services, IT leaders face the challenge of gluing everything together to form a coherent solution that’s capable of integrating with legacy applications running either in the cloud or in the data center. Serverless computing is ideal for these sorts of new integration challenges, Kralj says. “With its reactive, event-driven nature, serverless enables the sorts of real-time connections between services that modern solutions demand.”

Newcomers should approach serverless in the same way they would evaluate any disruptive technology. “Take the time to learn and understand the [serverless] product prior to implementation,” says John Kovolski, cloud architect at IT consulting firm Anexinet. “At the very least, have a rollback process.” To gain insight into potential operational and cost benefits, Kovolski suggests measuring the performance of current systems for comparison against the planned serverless replacement.

Growney suggests gradually easing into serverless technology. “Serverless isn’t necessarily an all-in technology,” he says. “It can be used as little or as much as is needed.”