AVOIDING SPEED BUMPS ON THE ROAD TO MICROSERVICES Scott Shaw - - PowerPoint PPT Presentation

▶
avoiding speed bumps on the road to microservices
SMART_READER_LITE
LIVE PREVIEW

AVOIDING SPEED BUMPS ON THE ROAD TO MICROSERVICES Scott Shaw - - PowerPoint PPT Presentation

May 01, 2023 211 likes •1.01k views

AVOIDING SPEED BUMPS ON THE ROAD TO MICROSERVICES Scott Shaw Head of Technology, ThoughtWorks Australia 1 MICROSERVICE ENVY GOOGLE TRENDS DATA service oriented architecture microservices 2 THE SPEED BUMPS X 3 THE SPEED BUMPS X

slide-1
SLIDE 1

AVOIDING 
 SPEED BUMPS 
 ON THE ROAD TO MICROSERVICES

Scott Shaw Head of Technology, ThoughtWorks Australia

1
slide-2
SLIDE 2

MICROSERVICE ENVY

2

service oriented architecture microservices GOOGLE TRENDS DATA

slide-3
SLIDE 3 3

X THE SPEED BUMPS

slide-4
SLIDE 4 3

X THE SPEED BUMPS

DDD REST Automation Cloud DevOps Logging Monitoring Resilience Testing with CDCs Conway Postel

slide-5
SLIDE 5 3

X

Data Aggregation

THE SPEED BUMPS

DDD REST Automation Cloud DevOps Logging Monitoring Resilience Testing with CDCs Conway Postel

slide-6
SLIDE 6 3

X

Data Aggregation Access Control & Security

THE SPEED BUMPS

DDD REST Automation Cloud DevOps Logging Monitoring Resilience Testing with CDCs Conway Postel

slide-7
SLIDE 7 3

X

Managing Change Data Aggregation Access Control & Security

THE SPEED BUMPS

DDD REST Automation Cloud DevOps Logging Monitoring Resilience Testing with CDCs Conway Postel

slide-8
SLIDE 8 4

Aggregating Data

slide-9
SLIDE 9

SINGLE DATASTORE PRINCIPAL

5
slide-10
SLIDE 10

SINGLE DATASTORE PRINCIPAL

5
slide-11
SLIDE 11

SINGLE DATASTORE PRINCIPAL

5
slide-12
SLIDE 12 6

BUT AS A SYSTEM EVOLVES…

slide-13
SLIDE 13 6

BUT AS A SYSTEM EVOLVES…

slide-14
SLIDE 14 6

BUT AS A SYSTEM EVOLVES…

slide-15
SLIDE 15 6

BUT AS A SYSTEM EVOLVES…

slide-16
SLIDE 16 6

BUT AS A SYSTEM EVOLVES…

slide-17
SLIDE 17 7

BUT AS A SYSTEM EVOLVES…

slide-18
SLIDE 18 7

BUT AS A SYSTEM EVOLVES…

slide-19
SLIDE 19

JIA YANG’S STORY

8
slide-20
SLIDE 20

JIA YANG’S STORY

8
slide-21
SLIDE 21

SIDEBAR: SERVICE COMPOSITION

9

Customers in the EC tax regime

JOIN

Tax Regime Service

THE MONOLITHIC APPROACH

slide-22
SLIDE 22

SIDEBAR: SERVICE COMPOSITION

10

NAIVE SERVICE IMPLEMENTATION

geography customers tax

Countries 
 in the EC Customers
 in the EC

slide-23
SLIDE 23

Countries in the EC

SIDEBAR: SERVICE COMPOSITION

COMPOSED SERVICES

geography customers tax

Customers in the EC GET …
 ?country_list=UK,NL,SE...

slide-24
SLIDE 24

GET Countries in the EC

SIDEBAR: SERVICE COMPOSITION

COMPOSED SERVICES

geography customers tax

Customers in the EC GET … ?filter=https://geo/countries?r=ec

slide-25
SLIDE 25

Customers in the EC Countries in the EC

AGGREGATING DATA

12

geography customers tax

slide-26
SLIDE 26

Customers in the EC Countries in the EC

AGGREGATING DATA

12

geography customers tax

How do we know
 if these states
 are consistent?

slide-27
SLIDE 27

AGGREGATING DATA

12

geography customers tax

How do we know
 if these states
 are consistent?

Events to rescue!

Reacts to
 event streams Changes in
 customer status Changes in EC Membership

slide-28
SLIDE 28

AGGREGATING DATA

13

geography customers tax

slide-29
SLIDE 29

AGGREGATING DATA

13

geography customers tax

GET https://integration-toolkit.com/customers/events

slide-30
SLIDE 30

AGGREGATING DATA

13

geography customers tax

GET https://integration-toolkit.com/customers/events

slide-31
SLIDE 31

IMPLEMENTING EVENTS

14

OPTION 1: CHUCK ‘EM IN THE DB

slide-32
SLIDE 32

IMPLEMENTING EVENTS

15

OPTION 2: HIPSTER BATCH Shared Storage (S3)

Geography Customer Tax

slide-33
SLIDE 33

IMPLEMENTING EVENTS

16

OPTION 3: SPECIAL-PURPOSE EVENT STORE

Event Store JS

Customers Geography

Event Subscription

slide-34
SLIDE 34

IMPLEMENTING EVENTS

16

OPTION 3: SPECIAL-PURPOSE EVENT STORE

Event Store JS

Customers Geography

Event Subscription “Projections”

slide-35
SLIDE 35 17

Delegated Authority & Access Control

slide-36
SLIDE 36

OpenID 2.0

DELEGATED ACCESS MANAGEMENT

18

HMAC

SAML v2

OAuth 2.0

OpenID Connect

ADFS

JWT

slide-37
SLIDE 37

OpenID 2.0

DELEGATED ACCESS MANAGEMENT

18

HMAC

SAML v2

OAuth 2.0

OpenID Connect

ADFS

JWT

slide-38
SLIDE 38

FENDY’S STORY

19
slide-39
SLIDE 39

FENDY’S STORY

19
slide-40
SLIDE 40

THE OLD WORLD OF PERIMETER SECURITY

20

cookie

token credentials token verification

Identity
 Provider End User Application Web
 Application

slide-41
SLIDE 41

THE OLD WORLD OF PERIMETER SECURITY

20

cookie

token credentials token verification

Identity
 Provider End User Application Web
 Application

stateless?

slide-42
SLIDE 42

THE OLD WORLD OF PERIMETER SECURITY

20

cookie

token credentials token verification

Identity
 Provider End User Application Web
 Application

stateless?

whose identity?

slide-43
SLIDE 43

THE OLD WORLD OF PERIMETER SECURITY

20

cookie

token credentials token verification

Identity
 Provider End User Application Web
 Application

token token

slide-44
SLIDE 44

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21
slide-45
SLIDE 45

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

slide-46
SLIDE 46

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

slide-47
SLIDE 47

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

slide-48
SLIDE 48

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
slide-49
SLIDE 49

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
slide-50
SLIDE 50

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
  • Simple enough to be widely used?
slide-51
SLIDE 51

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
  • Simple enough to be widely used?
  • Supports a modern web integration

strategy?

slide-52
SLIDE 52

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
  • Simple enough to be widely used?
  • Supports a modern web integration

strategy?

slide-53
SLIDE 53

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
  • Simple enough to be widely used?
  • Supports a modern web integration

strategy?

  • Has proven implementations?
slide-54
SLIDE 54

VARIOUS APPROACHES

▫︎ 2-Way SSL/TLS ▫︎ HMAC signing ▫︎ JWT ▫︎ NTLM/WIF/ADFS ▫︎ SAML v2 ▫︎ OAUTH 2.0 ▫︎ OPENID Connect

21

Ask these questions ...

  • Considered both authentication 


and authorisation?

  • Based on open standards?
  • Simple enough to be widely used?
  • Supports a modern web integration

strategy?

  • Has proven implementations?
slide-55
SLIDE 55

EXAMPLE OPENID CONNECT FLOW

22

access code

OpenID 
 Connect Provider Resource

access code

Another Resource

id token

{“iss":"op.example.com", "c_hash":"HK6E_P6Dh8Y93mRNtsDB1Q", "email_verified":"true", "sub":"10769150350006150715113082367", “azp”:”another_resource", “email":"sshaw@thoughtworks.com", “aud”:[”resource”, “another_resource”], "iat":1353601026, "exp":1353604926 }

access code id token

Resource Another Resource End 
 User
 App

slide-56
SLIDE 56

BEWARE PKI

23

ssshh! secrets How to
 manage and
 distribute? keys

Also Need

  • CSRF
  • Nonce
  • Correct implementation
  • Expire
  • Revoke
  • Distribute
slide-57
SLIDE 57 24

Managing Change

slide-58
SLIDE 58

MANAGING CHANGE

25

DOES YOUR SYSTEM LOOK LIKE THIS?

?

slide-59
SLIDE 59

MANAGING CHANGE

26

MAYBE IT SHOULD LOOK LIKE THIS INSTEAD

slide-60
SLIDE 60

MANAGING CHANGE

26

MAYBE IT SHOULD LOOK LIKE THIS INSTEAD

JUICE!

slide-61
SLIDE 61

RYAN’S STORY

27
slide-62
SLIDE 62

RYAN’S STORY

27
slide-63
SLIDE 63

BACK TO THE TAX EXAMPLE …

28

geography customers tax

slide-64
SLIDE 64

BACK TO THE TAX EXAMPLE …

28

geography customers

tax

slide-65
SLIDE 65

BACK TO THE TAX EXAMPLE …

28

geography customers

tax

slide-66
SLIDE 66

BACK TO THE TAX EXAMPLE …

28

geography customers

tax

Assignment

slide-67
SLIDE 67

BACK TO THE TAX EXAMPLE …

28

geography customers

tax

Assignment Some logic
 from here Some logic
 from here And
 from
 here

slide-68
SLIDE 68

BACK TO THE TAX EXAMPLE …

28

geography customers

tax

Assignment Some logic
 from here Some logic
 from here And
 from
 here

But How?

slide-69
SLIDE 69

HOW TO MANAGE THE CHANGE

29

1.DO NOTHING
 May be better than the chaos of not having clear ownership and accountability 2.ONE BIG VERSION CHANGE
 Version all your services, test them together, release them together

slide-70
SLIDE 70

HOW TO MANAGE THE CHANGE

29

1.DO NOTHING
 May be better than the chaos of not having clear ownership and accountability 2.ONE BIG VERSION CHANGE
 Version all your services, test them together, release them together

#fail

slide-71
SLIDE 71

MANAGING CHANGE

30

geo cust tax assignment

slide-72
SLIDE 72

MANAGING CHANGE

30

geo cust tax assignment

Temp Team

slide-73
SLIDE 73

MANAGING CHANGE

31

geo cust tax assignment

?

slide-74
SLIDE 74

MANAGING CHANGE

31

geo cust tax assignment

Long-term ownership
 can’t be ambiguous

slide-75
SLIDE 75

SUMMARY

32

1.MICROSERVICES
 More than a grab-bag of techniques and tools 2.MINDSET SHIFT
 State
 Perimeter
 Punctuated equilibrium Events
 Endpoints
 Continuous evolution

slide-76
SLIDE 76

SUMMARY

32

1.MICROSERVICES
 More than a grab-bag of techniques and tools 2.MINDSET SHIFT
 State
 Perimeter
 Punctuated equilibrium Events
 Endpoints
 Continuous evolution

slide-77
SLIDE 77

SUMMARY

32

1.MICROSERVICES
 More than a grab-bag of techniques and tools 2.MINDSET SHIFT
 State
 Perimeter
 Punctuated equilibrium Events
 Endpoints
 Continuous evolution

slide-78
SLIDE 78

SUMMARY

32

1.MICROSERVICES
 More than a grab-bag of techniques and tools 2.MINDSET SHIFT
 State
 Perimeter
 Punctuated equilibrium Events
 Endpoints
 Continuous evolution

slide-79
SLIDE 79 33

THANKS!

http://www.thoughtworks.com/radar sshaw@thoughtworks.com @scottwshaw