Kuberneters (EKS)​

At work, we faced scaling issues and downtime. At that time, the whole project was one big monolith. For one part of our application it made sense to split it from the monolith into its own microservice. While working on this, I wanted to try and learn Kubernetes, so when it is done I know how to deploy it. Therefore I moved my projects (again) to Kubernetes. Looking back...what a waste. Imagine having a couple of simple projects, used by maybe 10 users per month, on Kubernetes. The cost? Slightly below $300.

Container Service (ECS)​

A couple of months later (still paying < $300) I decided to clean things up. There is no need to run my projects in Kubernetes, so I started to read about Elastic Container Service and migrated my projects to ECS. The price dropped to ~ $180 per month. The first setup is a real pain, but once you understand how things work, it gets better.

DynamoDB​

It was still a bit expensive, especially since these were just example projects / learning projects that are not generating any revenue. I reviewed the bill and the biggest price is now EC2 and RDS. I was using Aurora MySQL, which even with the lowest requirements costs tens of dollars. I was thinking maybe the database is not needed in such small projects. But it is all about the learning and experience. If I do not have a database there, then I would not use security groups, IAM roles, etc. Reading about other options I came to DynamoDB. I had to watch several videos about data modeling and then the fun begun. Each project had to be updated to use this new NoSQL database. Finally, the price dropped again to ~ $100 per month.

AWS API Gateway and Lambda​

I started to question my setup. Do I really need a backend for my project? Do I really need worker there? Is there any other option what I can use? And just like this I started playing with an idea to use Lambda functions. I created my first API Gateway, connected it with functions and celebrated when my dev environment was working without any running container. There were other challenges, such as triggering function when a new item is added to the database. But it is really easy with Dynamo DB Streams and trigger filters. After these changes, or better, after I replicated everything using API Gateway and Lambda, the costs dropped to ~ $25.

This is where AWS X-Ray can help. It generates its own unique trace ID, which you can send to AWS services or other microservices in your environment, and then collects the data. This allows it to show a map of all services that are used along with a lot of other important information.

I first tried it on my project Zdielaj.si. This is a small application where you can quickly share photos and videos. Let me introduce the project a bit, so that you have a basic overview.

Architecture​

The whole application consists of a frontend (React), API (Node.js), User Service (Node.js), and Upload Service (Node.js).

The API is responsible for reading, creating, updating, and deleting albums. The User Service is a wrapper over AWS Cognito and is used to register, log in, and log out a user. The Upload Service handles all uploads and has its own worker to generate thumbnails and converts videos to mp4 files. Data is stored in a DynamoDB database and files are stored in an S3 bucket.

AWS X-Ray Trace Map​

I opened the application and:

1. Logged in
2. Created a new album by uploading several files
3. Checked the album and profile page

1. Logged in​

The frontend sends a request directly to the User Service to check for credentials and obtain an access token. The User Service passes the request to the AWS Cognito Identity Provider. Middlewares in both the User Service and the API use AWS Cognito to load the JSON Web Key Set for JWT token verification.

2. Created a new album​

The frontend calls the API to create a new album and then usees the Upload Service to upload files. The Upload Service stores those files in an AWS S3 bucket and notifies the Worker through AWS SQS to resize photos. Resized photos are also stored in the AWS S3 bucket.

3. Checked the album and profile page​

This last step is not that important here. When the API wants to get files details, it asks the Upload Service for those, and there is again a call to the API and User Service to get user details along with some statistics (how many albums the user has and how much space they take).

Summary​

You can see the whole communication among services from the trace map. If you click on a service or on a trace, you can check how many calls were successful, what is the response time and response code are, and much more.

Nearly every project I worked on in the past has this part done inhouse. In these cases it is not unusual to see plain text passwords stored in the database. Or passwords hashed with MD5 hash which is deprecated. And even if everything was done correctly, there are still many other things that can pop up.

For example, a larger company tests your product and their security policy tells them to use only multi-factor authentication. Another company asks if they can set rules for passwords or setup single sign-on. How many hours would it take to implement it, test it and fix bugs?

Build your product and stop wasting time for things you can buy for fraction of the price you would spend on development.

Install required dependencies​

yarn add @aws-sdk/client-cognito-identity-provider

Sign up new user​

Use SignUpCommand to register a new user in an existing user pool. If email was selected as user pool sign in option, every new user will get an email with code to confirm the registration and verify email address.

You can easily change the email template and use HTML if you want. Just go to your user pool, then choose Messaging tab and on the bottom there are Message templates.

import {
  SignUpCommand,
  UsernameExistsException,
  InvalidPasswordException,
} from '@aws-sdk/client-cognito-identity-provider';

class AWSUserController {
  // ...

  public async signUp(username: string, password: string, meta: Record<string, unknown>): Promise<User> {
    const command = new SignUpCommand({
      ClientId: CLIENT_ID,
      SecretHash: this.getSecretHash(username),
      Username: username,
      Password: password,
      UserAttributes: [{ Name: 'email', Value: username }],
    });
  
    try {
      const response = await this.cognitoClient.send(command);

      console.log('AWSUser.signUp response', response);

      const user = {
        id: response.UserSub,
        username: username,
      };
  
      return user as User;
    } catch (err) {
      console.error(err);
      
      switch (err.constructor) {
        case UsernameExistsException:
          throw new Error('Email address already exists!');
        case InvalidPasswordException:
          throw new Error('Password does not match the requirements!');
        default:
          throw new Error('Unable to create user!');
      }      
    }
  }

  // ...
}

Confirm sign up​

To verify email address and confirm the registration use ConfirmSignUpCommand. It takes two values - Username and ConfirmationCode (which was sent to the user by email).

User is not able to log in before this confirmation. Confirmation code is valid for 24 hours.

import {
  ConfirmSignUpCommand,
} from '@aws-sdk/client-cognito-identity-provider';

class AWSUserController {
  // ...

  public async confirmSignUp(username: string, code: string): Promise<User> {
    const command = new ConfirmSignUpCommand({
      ClientId: CLIENT_ID,
      SecretHash: this.getSecretHash(username),
      Username: username,
      ConfirmationCode: code,
    });
  
    const response = await this.cognitoClient.send(command);

    console.log('AWSUser.confirmSignUp response', response);

    return null;
  }

  // ...
}

Sign in existing user​

When user sucessfuly confirmed email address, he is allowed to log in and get accessToken along with refreshToken. Use InitiateAuthCommand to start the process. It is called "initiate" because the user may have two factor authentication enabled and in that case the sign in process will take more steps.

If the user does not have two factor authentication enabled, then the response contains accessToken, refreshToken and idToken. It is considered a good practice or recommended to store refreshToken in HttoOnly cookie and accessToken in memory.

import {
  InitiateAuthCommand,
  NotAuthorizedException,
  UserNotConfirmedException,
} from '@aws-sdk/client-cognito-identity-provider';

class AWSUserController {
  // ...
  
  public async signIn(username: string, password: string): Promise<{ user: User, refreshToken: string, accessToken: string }> {
    const command = new InitiateAuthCommand({
      AuthFlow: 'USER_PASSWORD_AUTH',
      ClientId: CLIENT_ID,
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
        SECRET_HASH: this.getSecretHash(username),
      },
    });
  
    try {
      const response = await this.cognitoClient.send(command);

      console.log('AWSUser.signIn response', response);

      const data = this.serviceToken.decode(response.AuthenticationResult.IdToken) as any;
      const user = {
        id: data.payload.sub,
        email: data.payload.email,
      }

      return {
        user: user as unknown as User,
        accessToken: response.AuthenticationResult.AccessToken,
        refreshToken: response.AuthenticationResult.RefreshToken,
      };
    } catch (err) {
      console.error(err);

      switch (err.constructor) {
        case NotAuthorizedException:
          throw new Error('Wrong email or password!');
        case UserNotConfirmedException:
          throw new Base('User is not verified!');
        default
          throw new Error('Unknown error!');
      }
    }
  }

  // ...
}

Next steps​

Now the user can register, confirm registration and log into the application. In the second part there will be middleware to check the access token, get the current user detail and sign out.

You can find the whole project on GitHub, or you can use this User Service available as Docker container in Docker Hub.

This story actually happened 2 years ago. We had a developer we were not happy with. Underperforming or not delivering at all. In the end it was clear he is not a fit and we should say goodbye to him.

He did couple of tasks but it took a lot of time. When we had team discussions how to solve a problem, he was active and often proposed solutions. But the feedback from his peers and even from his manager was still bad. Despite all that, we always decided to give him another chance and another task. It took us quite some time to realise this is not working.

When we had our last meeting where I wanted to end it, it turned really bad. I came there with a basic feedback written down and with colleague from HR. After some easy intro I started with my feedback. I cannot remember exactly what I said, so let's say it was as bad as this: "You did nothing in the last 3 weeks. There is no commit from you. I cannot see any work you did.".

This was my first talk like this ever and I did not have any training for this. I experienced it once on my own and after some time I knew the job was not for me and it was not what we agreed on. So when my manager came and told me I did nothing I agreed and left with no problem.

But this was not that case. He immediately started to defend. "I do have some commits in last days! I was working on some server solutions." and so on. I was shocked and not prepared for such answer. I tried to explain it better, but he was still defending. So I got upset and exploded. I did fire him, but even the HR told me, this was not good.

Because of this event I started to look for some help. As a company, we organized a training for giving feedback. I must say this was very helpful. It was done by a woman and she even starter with the same bad thing I did. As an example she used situation when she comes home and her husband didn't clean and didn't take away the garbage. So she said: "You are at home the whole day and you did nothing!". And it continued like my story. Her husband started to defend. On this example she explained you need to be very specific when delivering feedback. Instead of saying "you did nothing" she should say "you did not clean". Maybe continue with a question why so that she could understand the other side. I don't want to go too deep here. I can just recommend a training like this and read something before your first firing interview.

From that time I had interviews like this and I must say it was much much better. I come well prepared and I am very specific about things. Of course I am sure I can still improve and master it even better to handle all the situations.

What you need to do​

It is quite easy to implement it. You need to install cls-hooked package (there are couple of other packages) and wrap request process.

Install package:

npm install cls-hooked

# if you use yarn

yarn add cls-hooked

Add new middleware (e.g. /middlewares/trace.ts):

import { Request, Response, NextFunction } from 'express';
import { v4 as uuidv4 } from 'uuid';
import cls from 'cls-hooked';

export default function trace(req: Request, res: Response, next: NextFunction): void {
  if (req.method === 'OPTIONS') {
    next();
    return;
  }

  const namespace = cls.createNamespace('namespace');

  namespace.bind(req);
  namespace.bind(res);

  const traceId = req.query.traceId ? req.params.traceId : uuidv4();

  req['traceId'] = traceId;

  namespace.run(() => {
    namespace.set('traceId', traceId);

    next();
  });
}

Add this middleware before routes definitions:

// ...
const app = express();

app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(trace);

app.use(routes);
// ...

If you want to use this variable now, you can read it from the namespace and add it to your logs:

import cls from 'cls-hooked';

const namespace = cls.getNamespace('namespace');

console.log('Whatever', { traceId: namespace.get('traceId') });

Or if you use for example winston package for logging, you can enrich logs on one place with new format:

import winston, { format } from 'winston';
import namespace from '../services/cls';

const hookedFormat = format((info) => {
  const traceId = namespace.get('traceId');

  if (typeof traceId !== 'undefined') {
    info.traceId = traceId;
  }

  return info;
});

const logger = winston.createLogger({
  level: 'debug',
  transports: [
    new winston.transports.Console({
      format: winston.format.combine(
        hookedFormat(),
        winston.format.json(),
        winston.format.errors({ stack: true }),
      ),
    }),
  ],
});

export default logger;

Logs with traceId:

{"level":"debug","message":"New request", "traceId":"f93f930f-ba7e-480b-bfd3-4e1342f08af8"}
{"level":"debug","message":"Loading data from DB", "traceId":"f93f930f-ba7e-480b-bfd3-4e1342f08af8"}
{"level":"debug","message":"Response time 11.969668ms", "traceId":"f93f930f-ba7e-480b-bfd3-4e1342f08af8"}

Update response​

You can also return traceId to the caller in response headers as x-request-id.

Update /middlewares/trace.ts:

import { Request, Response, NextFunction } from 'express';
import { v4 as uuidv4 } from 'uuid';
import cls from 'cls-hooked';

export default function trace(req: Request, res: Response, next: NextFunction): void {
  if (req.method === 'OPTIONS') {
    next();
    return;
  }

  const namespace = cls.createNamespace('namespace');

  namespace.bind(req);
  namespace.bind(res);

  const traceId = req.query.traceId ? req.params.traceId : uuidv4();

  req['traceId'] = traceId;

  namespace.run(() => {
    namespace.set('traceId', traceId);
    res.header('x-request-id', traceId); // <-- return traceId in headers

    next();
  });
}

References​

• GitHub - Continuation-Local Storage ( Hooked )
• npm - cls-hooked
• Medium - Using Multer and Cls-Hooked together
• GitHub - CLS Context is lost after using multer middleware
• GitHub - next() function not called in middleware, which breaks express-http-context (cls-hooked)

Requirements:

• Docusaurus project
• AWS account

Create S3 bucket​

AWS S3 (Simple Storage Service) is an object storage service and we will use it to store static files generated by Docusaurus. Go to AWS console and search S3:

S3 Bucket, simply explained, is a "disk" where you store your files and it provides mechanisms necessary to control access to them. Click on create bucket button:

Fill the bucket name and pick region that is closest to you:

Leave Object Ownership on predefined option (as recommended):

You don't want anyone to access files on your bucket directly, so you can block all public access:

When your bucket is ready, you can upload there the whole build folder from your Docusaurus project. It should look like this:

Create CloudFront distribution​

CloudFront is a web service (CDN) that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users.

Search cf in AWS Console:

Then click on create distribution. In origin domain choose your S3 bucket from the list and set path to /.

In the Origin access section select Origin access control settings, create control setting (where you can again use the recommended options) and copy policy, so that you can update S3 bucket afterwards.

You don't want your users to use unsecure http version, therefore change Viewer protocol policy to Redirect HTTP to HTTPS.

Last step is to set default root object to index.html. Without this, CloudFront would return error page.

Now you can create distribution and wait until it is deployed.

Update S3 bucket policy​

If you try to visit your CloudFront distribution now, it returns error, because it cannot load anything from the S3 bucket. Public access is forbidden and there is no other policy set to allow the distribution to load objects (files) from it.

You need to go back to S3 service, choose your bucket, go to Permissions tab and edit Bucket policy with JSON you copied before. It should look this:

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<your bucket name>/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::<your account ID>:distribution/<distribution ID>"
                }
            }
        }
    ]
}

CloudFront Functions​

The website is now working until you go to some blog post and try to refresh the page. CloudFront always tries to load file from S3 bucket, but you are trying to load something that does not exist (URL is /blog/some-article). You need to check the URL and return index.html file if needed (Docusaurus generates index.html file inside each folder, so /blog/some-article/index.html would work).

Go to CloudFront Functions, create new function RewriteDefaultIndex, associate it with your distribution and publish it.

function handler(event) {
    var request = event.request;
    var uri = request.uri;
    
    if (uri.endsWith('/')) {
        request.uri += 'index.html';
    } else if (!uri.includes('.')) {
        request.uri += '/index.html';
    }

    return request;
}

Summary​

Your new Docusaurs page should now work perfectly. You can try Free CDN Performance Tool by uptrends, where you can see that users from different places are loading your page from different servers.

Create non-root container​

Docker containers run by default with root privileges. Changing the configuration limits the processes that can be executed and adds an extra layer of security.

FROM node:16-alpine

RUN addgroup --gid 3000 --system juffgroup \
  && adduser  --uid 2000 --system --ingroup juffgroup juffuser

USER 2000:3000

...

EXPOSE 3001

CMD [ "node", "dist/index.js" ]

Define securityContext for Pod​

When you want to ensure that no root container will run in your Kubernetes cluster, you can use securityContext for this. If you set runAsNonRoot to true, Kubernetes will check either runAsUser setting (also under securityContext) or USER directive defined in the image (must use numeric UID).

And while we are working with these settings, let's set other recommended policies straight away.

Containers are by default allowed to create, download or modify files. This can be misused by potential attacker. To prevent this, set readOnlyFilesystem to true and the filesystem of the container is read-only. If your application needs to write into filesystem, it is recommended to mount secondary filesystem.

Remove all unnecessary capabilities unless the application really needs it with capabilities setting. You can then add a specific capability if needed.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-express-kubernetes-example-deployment
  labels:
    # app, tier, environment, ...
spec:
  replicas: 2
  selector:
    # ...
  template:
    # ...
    spec:
      containers:
      - name: node-express-kubernetes-example-application
        image: registry.digitalocean.com/juffalow/node-express-kubernetes-example:latest
        imagePullPolicy: Always
        ports:
          - containerPort: 3001
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          capabilities:
            drop:
              - all
        env:
          # variables
        livenessProbe:
          # liveness probe settings
        readinessProbe:
          # readiness probe settings

References​

You can find working example here with basic Node application and k8s configs.

Official pages:

• Pod Security Policies
• Configure a Security Context for a Pod or Container

Tools:

• kubescape
• kube-bench

Requirements:

• Digital Ocean account
• be able to write simple Node.js application
• basic knowledge about Kubernetes

Digital Ocean Kubernetes​

In this example I am using Kubernetes from Digital Ocean.

Create Kubernetes cluster​

Create a new Kubernetes cluster and you can use the cheapest nodes (droplets) available, which are $10/month per node. You can also choose a datacenter region that is nearest to you or your potential customers.

When you hit "Create Cluster" button, you will see a list of steps through which you need to go. The cluster needs some time to initialize and be ready to use. Now you have couple of minutes, so you can continue reading and prepare the application, then return here and finish this part.

Install NGINX Ingress Controller​

In the right panel you have option to install so called 1-Click apps. Mandatory application to install is NGINX Ingress Controller.

Install Cert manager​

To be able to use secure communication (use https) we need to generate SSL certificate and "attach" it to the ingress. We use cert-manager to manage certificates (generate and renew). Install the latest available version, in this case it is v1.6.0:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.0/cert-manager.yaml

Verify the installation:

kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-5cfb94c959-lltfh              1/1     Running   0          5d9h
cert-manager-cainjector-676bbc785b-wbtbn   1/1     Running   0          5d9h
cert-manager-webhook-67574fc5f5-7j5nw      1/1     Running   0          5d9h

Application​

Let's have a basic Node.js application which will do 2 things:

• return random number generated on application start
• return environment variable that is passed to the application by Kubernetes

With random generated number we can easilly check if the application is running behind load balancer. Kubernetes is using round-robin algorithm by default, so if you make several requests you should get different number every time. For example the number of replications is 2, which means 2 applications are running, each will generate a different random number like 576 and 737. If are making requests, you should get back:

{"appId":"1.0.576"}
{"appId":"1.0.737"}
{"appId":"1.0.576"}
{"appId":"1.0.737"}
...

Because you don't want to store sensitive data with your code, you probably want to pass some variables to the application by the server. In K8S this is done through ConfigMap or Secret. That's why we need another route which will return value from the config and we will be able to verify it was passed to the application.

Initialize the project​

Create a new folder:

mkdir node-docker-kubernetes

Install dependencies:

yarn add express
yarn add --dev @types/express @types/node nodemon typescript

Add start and build script to your package.json file:

{
  "scripts": {
    "start": "tsc -w & nodemon -q -w dist dist/index.js",
    "build": "tsc"
  }
}

Create src/config.ts file​

// src/config.ts
const config = {
  exampleParameter: 'value of example parameter',
  secretParameter: process.env.SECRET_PARAMETER,
}

export default config;

Create src/index.ts file​

// src/index.ts
import express from 'express';
import config from './config';

const app = express();
const appId = `1.0.${Math.floor(Math.random() * 1000)}`;

app.get('/', (req, res) => {
  res.send('Hello kubernetes!');
});

app.get('/app-id', (req, res) => {
  res.json({ appId });
});

app.get('/env', (req, res) => {
  res.json(config);
});

app.get('/env/:name', (req, res) => {
  res.json({
    name: req.params.name,
    value: config[req.params.name],
  });
});

app.listen(3000, () => {
  logger.info('Server started at http://localhost:3001');
});

Create a dockerfile​

FROM node:16-alpine AS build

USER node
RUN mkdir /home/node/node-express-kubernetes-example/ && chown -R node:node /home/node/node-express-kubernetes-example
WORKDIR /home/node/node-express-kubernetes-example

COPY --chown=node:node . .
RUN yarn install --frozen-lockfile && yarn build

FROM node:14-alpine

USER node
EXPOSE 3001

RUN mkdir /home/node/node-express-kubernetes-example/ && chown -R node:node /home/node/node-express-kubernetes-example
WORKDIR /home/node/node-express-kubernetes-example

COPY --chown=node:node --from=build /home/node/node-express-kubernetes-example/dist ./dist
COPY --chown=node:node --from=build /home/node/node-express-kubernetes-example/package.json /home/node/node-express-kubernetes-example/yarn.lock ./
RUN yarn install --frozen-lockfile --production

CMD [ "node", "dist/index.js" ]

Build image and push it to repository​

If you are using Docker Hub as your container registry:

docker build -t <your user name>/<project name> .

docker tag <your user name>/<project name> <your user name>/<project name>:<tag>

docker push <your user name>/<project name>:<tag>

If you want to use DigitalOcean:

doctl registry login

docker build -t <your user name>/<project name> .

docker tag <your user name>/<project name> registry.digitalocean.com/<your user name>/<project name>:<tag>

docker push registry.digitalocean.com/<your user name>/<project name>:<tag>

Run the application in Kubernetes​

On the image below you can see what parts you need to define and how a request is handled inside. You need an ingress, which knows the domain name of your application and because each pod has a limited lifetime (it can be destroyed and recreated anytime) you cannot connect to pods directly. It needs a service where the request is forwarded and this service knows to which pods it should talk to.

Create deployment​

Deployment tells Kubernetes how to create or modify instances of the pods. You can define here also livenessProbe and readinessProbe.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-express-kubernetes-example-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: node-express-kubernetes-example-deployment
  template:
    metadata:
      labels:
        app: node-express-kubernetes-example-deployment
    spec:
      containers:
      - name: node-express-kubernetes-example-application
        image: registry.digitalocean.com/juffalow/node-express-kubernetes-example:latest
        ports:
          - containerPort: 3001
        env:
          - name: SECRET_PARAMETER
            valueFrom:
              secretKeyRef:
                name: node-express-kubernetes-example-secret
                key: SECRET_PARAMETER
        livenessProbe:
          httpGet:
            path: /health/liveness
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /health/liveness
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 20
      imagePullSecrets:
      - name: registry-juffalow

Create Ingress​

Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: node-express-kubernetes-example-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/issuer: node-express-kubernetes-example-letsencrypt-dev
spec:
  tls:
  - hosts:
    - node-example.juffalow.com
    secretName: node-express-kubernetes-example-tls
  rules:
  - host: node-example.juffalow.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: node-express-kubernetes-example-cluster-ip
            port: 
              number: 80

Create Production Issuer​

Issuers, and ClusterIssuers, are Kubernetes resources that represent certificate authorities that are able to generate signed certificates by honoring certificate signing requests.

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: node-express-kubernetes-example-letsencrypt-dev
spec:
  acme:
    email: juffalow@juffalow.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: node-express-kubernetes-example-letsencrypt-private-key
    solvers:
    - http01:
        ingress:
          class: nginx

Create Service​

apiVersion: v1
kind: Service
metadata:
  name: node-express-kubernetes-example-cluster-ip
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 3001
  - name: https
    port: 443
    protocol: TCP
    targetPort: 3001
  selector:
    app: node-express-kubernetes-example-deployment
  type: ClusterIP

Create Secret​

A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. The values for all keys in the data field have to be base64-encoded strings. If the conversion to base64 string is not desirable, you can choose to specify the stringData field instead, which accepts arbitrary strings as values.

apiVersion: v1
kind: Secret
metadata:
  name: node-express-kubernetes-example-secret
data:
  # Value: DatabaseCredentials
  SECRET_PARAMETER: RGF0YWJhc2VDcmVkZW50aWFscw==

To generate a base64 string, you can use command line command:

echo -n "<value>" | base64

Craete these resources in Kubernetes​

You have everything ready and now you just need to create all these resources in your Kubernetes cluster. To do this, you use apply command:

kubectl apply -f ./secret.yaml

kubectl apply -f ./deployment.yaml

kubectl apply -f ./service.yaml

kubectl apply -f ./ingress.yaml

kubectl apply -f ./production_issuer.yaml

To check if it is created, you can use get command for each resource:

kubectl get secrets

kubectl get deployments

kubectl get services

kubectl get ingresses

kubectl get issuers

Get the public IP address​

Now the application should be running inside the Kubernetes cluster. To be able to access it, you need to know the external ip address. This is IP address pointing to LoadBalancer, your nginx-ingress-controller you created in the beginning (1-Click app). You can check it with kubectl command:

kubectl get svc --namespace=ingress-nginx

NAME                                               TYPE           CLUSTER-IP       EXTERNAL-IP     PORT(S)                      AGE
nginx-ingress-ingress-nginx-controller             LoadBalancer   10.245.125.99    67.207.78.247   80:30565/TCP,443:30894/TCP   415d
nginx-ingress-ingress-nginx-controller-admission   ClusterIP      10.245.254.107   <none>          443/TCP                      415d
nginx-ingress-ingress-nginx-controller-metrics     ClusterIP      10.245.86.28     <none>          9913/TCP                     415d

Or you can see in DigitalOcean application:

So if you pointed your (sub)domain to this IP address, you should be able to connect to your application. You can check if this example application is running here https://node-example.juffalow.com.

References​

Udemy:

• Kubernetes for the Absolute Beginners - Hands-on
• Certified Kubernetes Administrator (CKA) with Practice Tests
• Kubernetes Certified Application Developer (CKAD) with Tests

Books:

• Managing Kubernetes
• Kubernetes Patterns

Running example:

• Node example
• Source code on GitHub

There were many interesting topics and speakers including Tim Berners-Lee and Garry Kasparov. My choices were mostly technical, so I watched AWS presentations, for example Security in the cloud, Chaos engineering: Why breaking things should be practiced and Zero To CTO. But also other topics like Scaling technology, people and culture post pandemic or Hiring the Amazon way.

There were very interesting questions and discussions during presentations and I hope it will be available somewhere to watch it again.

The networking there is really strong and you can meet a lot of people, get to know startups, or request a meeting with nearly anyone you want. They have a good application with all the information about presentations, attendees and companies. It is different than the other conferences I attended in the past.

Unfortunatelly I didn't have much time to see the city. My colleagues were there 2 days before and after, so they had more time to visit couple of places. But I was walking every night to random places or viewpoints (midadouro in Portuguese), tried local restaurants, beer and wine. And if you don't know Lisbon, then I have to point out that they have lot of stairs there, so it wasn't easy.

I enjoyed this (business) trip a lot and I am looking forward to visit Lisbon again, either Web Summit or just the city.

Requirements:

• Basic knowledge about JavaScript / TypeScript, Node, GraphQL and SQL
• Node 12+
• Database (example is using MySQL but there is no major problem to use any other database)

How is GraphQL query executed​

1. parse the string, throw error if syntax error
2. validate the query against schema
3. execute
4. run query resolver which will return an object
5. run field resolvers of the specific type by passing there the object from query resolver

Setup new project​

Create a folder for your project:

mkdir graphql-example

# cd graphql-example

Install dependencies:

yarn init
yarn add express express-graphql graphql knex mysql2
yarn add --dev @types/node @types/express typescript

# or if you use npm
npm init
npm i express express-graphql graphql knex mysql2
npm i @types/node @types/express typescript --save-dev

Add scripts to package.json:

{
    "name": "graphql-example",
    "scripts": {
        "start": "tsc && node dist/index.js"
    }
}

Create a src folder where the source code will be:

mkdir src

Create src/config.ts file:

export default {
  port: 3010,
  database: {
    type: 'mysql',
    connection: {
      database : '<your database name>',
      host : '<your database host | localhost>',
      password : '',
      user : '',
    },
  },
};

Database layer​

Create src/database.ts file where we initialize Knex database client:

import knex from 'knex';
import config from './config';

const database = knex({
  client: 'mysql2',
  ...config.database,
});

export default database;

We will load data from database using Repository Pattern and we start with Author entity. At the beginning it is enough to have just one method to load a specific author. Make directory src/repositories and src/repositories/AuthorRepository.ts file:

import { Author } from '../types';

export default interface AuthorRepository {
  get(id: number): Promise<Author>;
}

Now we need to implement this interface in repository that will use our Knex database client, src/repositories/AuthorKnexRepository.ts:

import AuthorRepository from './AuthorRepository';
import database from '../database';
import { Author } from '../types';

export default class AuthorKnexRepository implements AuthorRepository {

  async get(id: number): Promise<Author> {
    return database.select()
      .from('author')
      .where('id', id)
      .first();
  }
}

GraphQL Schema​

GraphQL schema is a something like a definition of what you can use (types, enums, queries, mutations). Because in the first part of this tutorial we will work just with Author, it is enough to have just one type and query.

In src/schema/types/author.ts we define what attributes the Author entity has:

import {
  GraphQLID,
  GraphQLNonNull,
  GraphQLObjectType,
  GraphQLString,
  GraphQLInt,
} from 'graphql';
import { Author } from '../../types';

const author = new GraphQLObjectType({
  name: 'Author',
  fields: () => ({
    id: {
      type: GraphQLNonNull(GraphQLID),
      description: 'Globally unique ID of the author',
      resolve: (obj: Author): string => {
        return Buffer.from(`author-${obj.id}`).toString('base64');
      },
    },
    _id: {
      type: GraphQLNonNull(GraphQLID),
      description: 'Database ID of the author',
      resolve: (obj: Author): number => {
        return obj.id;
      },
    },
    firstName: {
      type: GraphQLNonNull(GraphQLString),
      description: 'Author\'s first name',
      resolve: (obj: Author): string => {
        return obj.firstName;
      },
    },
    lastName: {
      type: GraphQLNonNull(GraphQLString),
      description: 'Author\'s last name',
      resolve: (obj: Author): string => {
        return obj.lastName;
      },
    },
    createdAt: {
      type: GraphQLNonNull(GraphQLString),
      description: '',
      resolve: (obj: Author): string => {
        return obj.createdAt;
      },
    },
  }),
});

export default author;

Here, the most interesting part is probably id where we return Buffer.from(`author-${obj.id}`).toString('base64').

The schema is very simple for now. It contains just one query where we return a specific Author. The author query is in src/schema/queries/author.ts:

import { GraphQLID, GraphQLNonNull } from 'graphql';
import Context from '../../context/Context';
import { default as authorType } from '../types/author';

const author = {
  type: authorType,
  args: {
    id: {
      type: GraphQLNonNull(GraphQLID),
    },
  },
  resolve: (_, { id }, context: Context): Promise<any> => {
    return context.repositories.author.get(id);
  },
};

export default author;

The only remaining step to complete the schema is src/schema/index.ts:

import { GraphQLSchema, GraphQLObjectType } from 'graphql';
import author from './queries/author';

const query = new GraphQLObjectType({
  name: 'Query',
  fields: (): any => ({
    author,
  }),
});

export default new GraphQLSchema({
  query,
});

Express and GraphQL route​

In src/index.ts we just connect all those things together and make it accessible through a /graphql route:

import express from 'express';
import graphqlHTTP from 'express-graphql';
import config from './config';
import context from './context';
import schema from './schema';

const app = express();

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

app.use('/graphql', graphqlHTTP({
  context,
  graphiql: {
    defaultQuery: config.defaultQuery,
  } as undefined,
  schema,
}));

app.listen(config.port, () => {
  console.log(`Server started at http://localhost:${ config.port }`);
});

Try it​

If you run the server with yarn start you should be able to visit http://localhost:3010/graphql, where you can find GraphiQL client. Through this, you are able to explore the options of the server - what queries are available and what they return. If you have also mutations or subscriptions, you can see it there too.

Workflow​

Let's create a basic script, to publish package to npm when a new release is created. I named the file publish.yml and the workflow name is also publish. It should run only when a release is published. (You can create just pre-release or draft, where you don't want to run this script)

name: Publish

on:
  release:
    types: [published]

Job steps are simple. We need to install dependencies, build the project and publish it. Start with the easy one - install and build:

jobs:
  build:

    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v1
    - name: Install dependencies
      run: yarn install
    - name: Build
      run: yarn run build

This will make the project ready for upload. To be able to publish it, you need to login into npm, or create there a token, which you can use for this purpose. Go to npm, log in, and create new token:

Copy the value and add it as a Secret in GitHub project settings.

npm and yarn will use this token, if it is stored in .npmrc file in your home directory. So the next step is to create such a file.

    - name: Create .npmrc
      run: echo "//registry.npmjs.org/:_authToken=$NODE_AUTH_TOKEN" >> ~/.npmrc
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

The last step is to upload it to npm. Version, which you choosed during creating the release is available in $GITHUB_REF variable as a reference to the tag (example: refs/tags/1.2.3). If you want to pass it to the publish command, you need to remove this prefix.

Btw, if you use yarn publish, it will upload files and then create a commit. The problem I encountered is, that git needs to have user name and email to be able to commit. It is not a problem to set it, if you want, or just disable this feature by adding a --no-git-tag-version argument.

    - name: Publish
      run: yarn publish --new-version ${GITHUB_REF#"refs/tags/"} --no-git-tag-version

Final script​

name: Publish

on:
  release:
    types: [published]

jobs:
  build:

    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v1
    - name: Install dependencies
      run: yarn install
    - name: Build
      run: yarn run build
    - name: Create .npmrc
      run: echo "//registry.npmjs.org/:_authToken=$NODE_AUTH_TOKEN" >> ~/.npmrc
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
    - name: Publish
      run: yarn publish --new-version ${GITHUB_REF#"refs/tags/"} --no-git-tag-version

Time to Market​

During one of the first meetings with the CEO of the US startup, he mention he wants a product (application) to be of very good quality. We also mentioned Steve Jobs and his demand for perfection. That means everything has to work perfectly, but more important, it has to be a complete product with everything (users, administration, payment system, ...). I did not know anything about startups or how to run a company. When I look back now I can say that this was a big mistake.

Reason? We spend so much time polishing the product, adding new features, etc that to this day, it is not live. The pace is almost zero, not to mention other things.

On the other side, the Slovak startup went live as soon as possible, although there were bugs. We took part in Google for Startups Academy and presented it in front of investors. All this motivated involved people to work even more.

Tech stack and costs​

I joined the US startup like 3 years ago and they already had some working prototype. I didn't know much about the technology behind, or which services (servers, mail, etc) are they using. My work was to create an Android application and I did not dig into other things. That changed a couple of weeks ago, when we had a fight about the costs.

Deal was, we will have shares in exchange for work and until we earn enough money, everything will be payed by CEO. We didn't even know how much it is.

That was the time when I found out, we are using AWS, Shopify, Box, Unbouce and other services. That is realy a lot of money for something, that is not live yet.

Of course it is cool to work with new technologies. I would love to try AI / ML but that doesn't mean I will use them in my next project. Everyone should be able to defend his own decisions. If I want to use AWS for a high demand API, it is fine. But if I used it for a page no one knows about and I pay for it couple of hundreds a month it is at least weird (and waste of money).

Slovak startup is using shared PHP server for tens of euros a year. Of course, the application is ready to be used on better solution when the load is too big to be handled by this one. The team was not that experienced, so we chose some well known frameworks and libraries. This allowed us to move really fast and be able to adapt to new requirements.

Lately, the backend was changed to GraphQL step by step and the admin part is running on React and Relay. So we got there anyway.

Code quality​

Everyone has his / her own opinion about what is good code and bad code. When you want to make a proof of concept that something can work, probably you don't care about it. And it is totally ok.

Is it ok if we are talking about MVP (Minimum Viable Product)? My view here is clear. I am building a company that should grow, last long and be successful. Therefore the code should reflect this.

We had a team member who was working hard, did a lot of functionality, but nobody understands the code. Once he came to a meeting and said, his wife is pregnant and he is not interested in the project anymore. Half of the app was running his code and now it is just black box with no maintainer.

Be careful what your colleagues are doing and don't be afraid to share the knowledge. It is not good to be the only one to know things (or to have such a guy in the team). You never know what happens next.

P.S.: we had to delete the whole thing and forget we had it.

Conclusion​

I can only recommend you to try and run your own company. It is a great experience!

Links​

3 ways to validate your startup idea without building a damn thing

You Are Not Google

In the matter of reforming things, as distinct from deforming them, there is one plain and simple principle; a principle which will probably be called a paradox. There exists in such a case a certain institution or law; let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, "I don't see the use of this; let us clear it away." To which the more intelligent type of reformer will do well to answer: "If you don't see the use of it, I certainly won't let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it."

Links​

Chesterton's fence

On following rules

Steps​

• check lot of websites and see that there is still new and new issue
• prepare everything
• clone xdebug project
• build xdebug
• install
• enable xdebug module

Prepare everything​

MacOS has php installed with xcode, but I needed to use newer version I am already using with XAMPP. So I just created a link to XAMPP version:

sudo ln /Applications/XAMPP/bin/php /usr/local/bin/php

In XDebug readme is, that you need to use phpize. After I linked that one, it had another problem - "fatal error: 'php.h' file not found". To solve also this problem, you have to link php-config either.

sudo ln /Applications/XAMPP/bin/phpize /usr/local/bin/phpize

sudo ln /Applications/XAMPP/bin/php-config /usr/local/bin/php-config

Clone XDebug project​

You need to clone the source code, so that you are able to build it:

git clone git://github.com/xdebug/xdebug.git

Build XDebug and install it​

phpize

make clean

make

make install

Enable XDebug module​

The last step is to add zend_extension="xdebug.so" in the end of php.ini file. If you do not know where this file is located, just run php --ini.

Search for specific string​

We are working on a quite big React project at work and we found a bug in the application - something that we implemented couple of months ago is missing.

I was sure that the feature was there. Also in Jira it was marked as tested and closed so it had to be tested by our testers. But how to find it when you have hundreds of commits?

The task was about adding a new question to one of our existing forms, so I checked the text of the question and tried to search for it. For this purpose, you can use git log -S<string> command, where the -S<string> argument looks for the string in commit diffs, so it returns just related commits.

git log -S "question text"

Two commits found - first introduced the feature and second removed it ( for some reason ). So I didn't need to go through every commit, just used this command and immediately knew what happend.

Use remote changes​

I am working on two (sometimes tree) computers. I encountered a problem when I did some changes on one computer, created a commit, but did not push. Then I switched computers and I needed those changes, so I did them again, plus couple more. When I came back to the first computer I didn't want to merge those changes, I just wanted to continue on top of those new changes.

One solution is to delete last commit (n commits) and pull master. But there is another way to fetch the master and use it without merging.

# fetch the branch (in this case master)
git fetch origin master

# reset your current branch (master) to origin's master
git reset --hard origin/master

Now, I have the origin master on my computer and I lost changes I made here before.

Git branch graphs​

Maybe you've already seen some GUI tools for git where is a nice graph with all commits and branches. If you want to achieve this in command line, you can again use the git log command.

git log --all --decorate --oneline --graph

There are many options to format the graph. So you may want to play with it a little bit.

git log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all

git log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n''          %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' --all

I had a problem​

Yesterday I commited a piece of code, pushed it and after couple of minutes, the test env did not change. Problem was with jenkins build and a new package I added. That package is using a dependency with specific version which had known issue that caused problems from time to time. The issue was solved in a new version but package I used is using the old (buggy) version.

So I looked on GitHub and the package wasn't updated for a couple of months. This is a problem I wrote about in the past. Luckily this wasn't an error with the code, but with a dependency version defined in package.json.

Selective dependency resolutions​

Yarn allowes you to override package versions inside your dependencies. So now it is easy to solve this kind of problem.

  "resolutions": {
    "<package>/**/<dependency>": "<new version>"
  }

This tells yarn, that the package is using its dependency with new version and not with the version defined in its package.json.

You can read more about it in the docs.

The problem​

Of course I know that if you set some state variable and try to read it immediately, it won't be changed :

// this.state.value is 0
this.setState({value: 1});
// this.state.value is till 0

But tricky question would be, what it does if you increment that state 3 times?

// this.state.value is 0
this.setState({value: this.state.value + 1});
this.setState({value: this.state.value + 1});
this.setState({value: this.state.value + 1});

I asked it a couple of colleagues and maybe some of them did now ( or lucky guess ) the right answer, but didn't know why, or didn't know it. And I would say, this is not that tricky. Because this.state.value equals 0 you actually set it to 1 each time.

this.setState({value: 0 + 1});
this.setState({value: 0 + 1});
this.setState({value: 0 + 1});

Or maybe, you have another case. What if you count the result value from some props? Let's say, we have some parent class:

// App.js

import React, { Component } from 'react';
import IncrementButton from './IncrementButton';

class App extends Component {
  state = {
    value: 0,
  };

  onIncrementButtonClick = () => {
    this.setState({value: this.state.value + 1});
  }

  render() {
    return (
      <IncrementButton onClick={this.onIncrementButtonClick} value={this.state.value} />
    );
  }
}

export default App;

And IncrementButton looks like this:

// IncrementButton.js

import React, { Component } from 'react';

class IncrementButton extends Component {
  state = {
    value: 0,
  };

  onButtonClick() {
    this.props.onClick();
    this.setState({value: this.props.value + 1});
  }

  render() {
    return (
      <button onClick={this.onButtonClick.bind(this)}>{this.state.value}</button>
    );
  }
}

export default IncrementButton;