book

Microservices with Spring Boot 3 and Spring Cloud - Third Edition

by Magnus Larsson

August 2023

Beginner to intermediate

706 pages

17h 34m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversGet in touchShare your thoughts
Technical requirementsMy way into microservicesBenefits of autonomous software componentsChallenges with autonomous software componentsEnter microservicesA sample microservice landscapeDefining a microserviceChallenges with microservicesDesign patterns for microservicesService discoveryProblemSolutionSolution requirementsEdge serverProblemSolutionSolution requirementsReactive microservicesProblemSolutionSolution requirementsCentral configurationProblemSolutionSolution requirementsCentralized log analysisProblemSolutionSolution requirementsDistributed tracingProblemSolutionSolution requirementsCircuit breakerProblemSolutionSolution requirementsControl loopProblemSolutionSolution requirementsCentralized monitoring and alarmsProblemSolutionSolution requirementsSoftware enablersOther important considerationsSummary
Technical requirementsSpring BootConvention over configuration and fat JAR filesCode examples for setting up a Spring Boot applicationThe magic @SpringBootApplication annotationComponent scanningJava-based configurationWhat’s new in Spring Boot 3.0Migrating a Spring Boot 2 applicationSpring WebFluxCode examples of setting up a REST serviceStarter dependenciesProperty filesSample RestControllerspringdoc-openapiSpring DataEntityRepositoriesSpring Cloud StreamCode examples for sending and receiving messagesDockerSummaryQuestions
Technical requirementsIntroducing the microservice landscapeInformation handled by the microservicesThe product serviceThe review serviceThe recommendation serviceThe product composite serviceInfrastructure-related informationTemporarily replacing service discoveryGenerating skeleton microservicesUsing Spring Initializr to generate skeleton codeSetting up multi-project builds in GradleAdding RESTful APIsAdding an API and a util projectThe api projectThe util projectImplementing our APIAdding a composite microserviceAPI classesPropertiesThe integration componentComposite API implementationAdding error handlingThe global REST controller exception handlerError handling in API implementationsError handling in the API clientTesting APIs manuallyAdding automated microservice tests in isolationAdding semi-automated tests of a microservice landscapeTrying out the test scriptSummaryQuestions
Technical requirementsIntroduction to DockerRunning our first Docker commandsRunning Java in DockerLimiting available CPUsLimiting available memoryUsing Docker with one microserviceChanges in source codeBuilding a Docker imageStarting up the serviceRunning the container in detached modeManaging a landscape of microservices using Docker ComposeChanges in the source codeStarting up the microservice landscapeAutomating tests of cooperating microservicesTroubleshooting a test runSummaryQuestions
Technical requirementsIntroduction to using springdoc-openapiAdding springdoc-openapi to the source codeAdding dependencies to the Gradle build filesAdding OpenAPI configuration and general API documentation to the ProductCompositeServiceAdding API-specific documentation to the ProductCompositeService interfaceBuilding and starting the microservice landscapeTrying out the OpenAPI documentationSummaryQuestions
Technical requirementsChapter objectivesAdding a persistence layer to the core microservicesAdding dependenciesStoring data with entity classesDefining repositories in Spring DataWriting automated tests that focus on persistenceUsing TestcontainersWriting persistence testsUsing the persistence layer in the service layerLogging the database connection URLAdding new APIsCalling the persistence layer from the service layerDeclaring a Java bean mapperUpdating the service testsExtending the composite service APIAdding new operations to the composite service APIAdding methods to the integration layerImplementing the new composite API operationsUpdating the composite service testsAdding databases to the Docker Compose landscapeThe Docker Compose configurationDatabase connection configurationThe MongoDB and MySQL CLI toolsManual tests of the new APIs and the persistence layerUpdating the automated tests of the microservice landscapeSummaryQuestions
Technical requirementsChoosing between non-blocking synchronous APIs and event-driven asynchronous servicesDeveloping non-blocking synchronous REST APIsAn introduction to Project ReactorNon-blocking persistence using Spring Data for MongoDBChanges in the test codeNon-blocking REST APIs in the core servicesChanges in the APIsChanges in the service implementationsChanges in the test codeDealing with blocking codeNon-blocking REST APIs in the composite servicesChanges in the APIChanges in the service implementationChanges in the integration layerChanges in the test codeDeveloping event-driven asynchronous servicesHandling challenges with messagingConsumer groupsRetries and dead-letter queuesGuaranteed order and partitionsDefining topics and eventsChanges in the Gradle build filesConsuming events in the core servicesDeclaring message processorsChanges in the service implementationsAdding configuration for consuming eventsChanges in the test codePublishing events in the composite servicePublishing events in the integration layerAdding configuration for publishing eventsChanges in the test codeRunning manual tests of the reactive microservice landscapeSaving eventsAdding a health APIUsing RabbitMQ without using partitionsUsing RabbitMQ with partitionsUsing Kafka with two partitions per topicRunning automated tests of the reactive microservice landscapeSummaryQuestions
Technical requirementsThe evolution of Spring CloudUsing Netflix Eureka for service discoveryUsing Spring Cloud Gateway as an edge serverUsing Spring Cloud Config for centralized configurationUsing Resilience4j for improved resilienceSample usage of the circuit breaker in Resilience4jUsing Micrometer Tracing and Zipkin for distributed tracingSummaryQuestions
Technical requirementsIntroducing service discoveryThe problem with DNS-based service discoveryChallenges with service discoveryService discovery with Netflix Eureka in Spring CloudSetting up a Netflix Eureka serverConnecting microservices to a Netflix Eureka serverSetting up the configuration for development useEureka configuration parametersConfiguring the Eureka serverConfiguring clients to the Eureka serverTrying out the discovery serviceScaling upScaling downDisruptive tests with the Eureka serverStopping the Eureka serverStarting up an extra instance of the product serviceStarting up the Eureka server againSummaryQuestions

Technical requirementsAdding an edge server to our system landscapeSetting up Spring Cloud GatewayAdding a composite health checkConfiguring Spring Cloud GatewayRouting rulesTrying out the edge serverExamining what is exposed outside the Docker engineTrying out the routing rulesCalling the product composite API through the edge serverCalling the Swagger UI through the edge serverCalling Eureka through the edge serverRouting based on the host headerSummaryQuestions
Technical requirementsIntroduction to OAuth 2.0 and OpenID ConnectIntroducing OAuth 2.0Introducing OpenID ConnectSecuring the system landscapeProtecting external communication with HTTPSReplacing a self-signed certificate at runtimeSecuring access to the discovery serverChanges in the Eureka serverChanges in Eureka clientsAdding a local authorization serverProtecting APIs using OAuth 2.0 and OpenID ConnectChanges in both the edge server and the product-composite serviceChanges in the product-composite service onlyChanges to allow Swagger UI to acquire access tokensChanges in the test scriptTesting with the local authorization serverBuilding and running the automated testsTesting the protected discovery serverAcquiring access tokensAcquiring access tokens using the client credentials grant flowAcquiring access tokens using the authorization code grant flowCalling protected APIs using access tokensTesting Swagger UI with OAuth 2.0Testing with an external OpenID Connect providerSetting up and configuring an account in Auth0Applying the required changes to use Auth0 as an OpenID providerChanging the configuration in the OAuth resource serversChanging the test script so it acquires access tokens from Auth0Running the test script with Auth0 as the OpenID Connect providerAcquiring access tokens using the client credentials grant flowAcquiring access tokens using the authorization code grant flowCalling protected APIs using the Auth0 access tokensGetting extra information about the userSummaryQuestions
Technical requirementsIntroduction to the Spring Cloud Config ServerSelecting the storage type of the configuration repositoryDeciding on the initial client connectionSecuring the configurationSecuring the configuration in transitSecuring the configuration at restIntroducing the config server APISetting up a config serverSetting up a routing rule in the edge serverConfiguring the config server for use with DockerConfiguring clients of a config serverConfiguring connection informationStructuring the configuration repositoryTrying out the Spring Cloud Config ServerBuilding and running automated testsGetting the configuration using the config server APIEncrypting and decrypting sensitive informationSummaryQuestions
Technical requirementsIntroducing the Resilience4j resilience mechanismsIntroducing the circuit breakerIntroducing the time limiterIntroducing the retry mechanismAdding the resilience mechanisms to the source codeAdding programmable delays and random errorsChanges in the API definitionsChanges in the product-composite microserviceChanges in the product microserviceAdding a circuit breaker and a time limiterAdding dependencies to the build fileAdding annotations in the source codeAdding fail-fast fallback logicAdding configurationAdding a retry mechanismAdding the retry annotationAdding configurationAdding automated testsTrying out the circuit breaker and retry mechanismBuilding and running the automated testsVerifying that the circuit is closed under normal operationsForcing the circuit breaker to open when things go wrongClosing the circuit breaker againTrying out retries caused by random errorsSummaryQuestions
Technical requirementsIntroducing distributed tracing with Micrometer Tracing and ZipkinAdding distributed tracing to the source codeAdding dependencies to build filesAdding configuration for Micrometer Tracing and ZipkinAdding Zipkin to the Docker Compose filesAdding workarounds for lacking support of reactive clientsAdding custom spans and custom tags to existing spansAdding a custom spanAdding custom tags to existing spansTrying out distributed tracingStarting up the system landscapeSending a successful API requestSending an unsuccessful API requestSending an API request that triggers asynchronous processingSummaryQuestions
Technical requirementsIntroducing Kubernetes conceptsIntroducing Kubernetes API objectsIntroducing Kubernetes runtime componentsCreating a Kubernetes cluster using MinikubeWorking with Minikube profilesWorking with the Kubernetes CLI, kubectlWorking with kubectl contextsCreating a Kubernetes clusterTrying out a sample DeploymentManaging a local Kubernetes clusterHibernating and resuming a Kubernetes clusterTerminating a Kubernetes clusterSummaryQuestions
Technical requirementsReplacing Netflix Eureka with Kubernetes ServicesIntroducing how Kubernetes will be usedUsing Spring Boot’s support for graceful shutdown and probes for liveness and readinessIntroducing HelmRunning Helm commandsLooking into a Helm chartHelm templates and valuesThe common library chartThe ConfigMap templateThe Secrets templateThe Service templateThe Deployment templateThe component chartsThe environment chartsDeploying to Kubernetes for development and testBuilding Docker imagesResolving Helm chart dependenciesDeploying to KubernetesChanges in the test script for use with KubernetesTesting the DeploymentTesting Spring Boot’s support for graceful shutdown and probes for liveness and readinessDeploying to Kubernetes for staging and productionChanges in the source codeDeploying to KubernetesCleaning upSummaryQuestions
Technical requirementsReplacing the Spring Cloud Config ServerChanges required to replace the Spring Cloud Config ServerReplacing the Spring Cloud GatewayChanges required to replace the Spring Cloud GatewayAutomating certificate provisioningTesting with Kubernetes ConfigMaps, Secrets, Ingress, and cert-managerRotating certificatesDeploying to Kubernetes for staging and productionVerifying that the microservices work without KubernetesChanges in the Docker Compose filesTesting with Docker ComposeSummaryQuestions
Technical requirementsIntroducing service meshes using IstioIntroducing IstioInjecting Istio proxies into microservicesIntroducing Istio API objectsSimplifying the microservice landscapeReplacing the Kubernetes Ingress controller with an Istio ingress gatewayReplacing the Zipkin server with Istio’s Jaeger componentDeploying Istio in a Kubernetes clusterSetting up access to Istio servicesCreating the service meshSource code changesContent in the _istio_base.yaml templateContent in the _istio_dr_mutual_tls.yaml templateRunning commands to create the service meshLogging propagation of trace and span IDsObserving the service meshSecuring a service meshProtecting external endpoints with HTTPS and certificatesAuthenticating external requests using OAuth 2.0/OIDC access tokensProtecting internal communication using mutual authentication (mTLS)Ensuring that a service mesh is resilientTesting resilience by injecting faultsTesting resilience by injecting delaysPerforming zero-downtime updatesSource code changesVirtual services and destination rulesDeployments and servicesTying things together in the prod-env Helm chartDeploying v1 and v2 versions of the microservices with routing to the v1 versionVerifying that all traffic initially goes to the v1 version of the microservicesRunning canary testsRunning a blue-green deploymentA short introduction to the kubectl patch commandPerforming the blue-green deploymentRunning tests with Docker ComposeSummaryQuestions
Technical requirementsIntroducing FluentdOverview of FluentdConfiguring FluentdDeploying the EFK stack on KubernetesBuilding and deploying our microservicesDeploying Elasticsearch and KibanaA walkthrough of the manifest filesRunning the deploy commandsDeploying FluentdA walkthrough of the manifest filesRunning the deploy commandsTrying out the EFK stackInitializing KibanaAnalyzing the log recordsDiscovering the log records from microservicesPerforming root cause analysesSummaryQuestions
Technical requirementsIntroduction to performance monitoring using Prometheus and GrafanaChanges in source code to collect application metricsBuilding and deploying the microservicesMonitoring microservices using Grafana dashboardsInstalling a local mail server for testsConfiguring GrafanaStarting up the load testUsing Kiali’s built-in dashboardsImporting existing Grafana dashboardsDeveloping your own Grafana dashboardsExamining Prometheus metricsCreating the dashboardTrying out the new dashboardExporting and importing Grafana dashboardsSetting up alarms in GrafanaSetting up a mail-based notification channelSetting up an alarm on the circuit breakerTrying out the circuit breaker alarmSummaryQuestions
Technical requirementsInstalling toolsInstalling HomebrewUsing Homebrew to install toolsInstall tools without HomebrewInstall tools on an Intel-based MacInstall tools on an Apple silicon-based MacPost-installation actionsVerifying the installationsAccessing the source codeUsing an IDEThe structure of the codeSummary
Technical requirementsInstalling toolsInstalling tools on WindowsInstalling WSL 2 together with a default Ubuntu server Installing a new Ubuntu 22.04 server on WSL 2Installing Windows TerminalInstalling Docker Desktop for WindowsInstalling Visual Studio Code and its extension for Remote WSLInstalling tools on the Linux server in WSL 2Installing tools using apt installInstalling the Java and Spring Boot CLI using SDKmanInstalling the remaining tools using curl and installVerifying the installationsAccessing the source codeThe structure of the codeSummary
Technical requirementsWhen to native-compile Java source codeIntroducing the GraalVM projectIntroducing the Spring’s AOT engineHandling problems with native compilationChanges in the source codeUpdates to the Gradle build filesProviding reachability metadata and custom hintsEnabling Spring beans at build time in application.yml filesUpdated runtime propertiesConfiguration of the GraalVM Native Image tracing agentUpdates to the test-em-all.bash verification scriptTesting and compiling Native ImagesInstalling GraalVM and its Native Image compiler Running the tracing agentRunning native testsCreating a Native Image for the current OSCreating a Native Image as a Docker imageTesting with Docker ComposeTesting Java VM-based microservices with AOT mode disabledTesting Java VM-based microservices with AOT mode enabledTesting natively compiled microservicesTesting with KubernetesSummaryQuestions

Content preview from Microservices with Spring Boot 3 and Spring Cloud - Third Edition

11 Securing Access to APIs

In this chapter, we will see how we can secure access to the APIs and web pages exposed by the edge server introduced in the previous chapter. We will learn how to use HTTPS to protect against eavesdropping on external access to our APIs, and how to use OAuth 2.0 and OpenID Connect to authenticate and authorize users and client applications to access our APIs. Finally, we will use HTTP Basic authentication to secure access to the discovery server, Netflix Eureka.

The following topics will be covered in this chapter: