When working on either 2C application or 2B service, the customers do not want to or is not allowed to sign up the new account, they can login the application via existing IdP or enterprise SSO. So, building the application supports the federated OIDC login to address such requirements. This post extends the capability …
Read More
Previous post we demonstrated how distributing and securely deploying the website to global end users. The authentication and authorization are always mandatory features of web application. Amazon Cognito is a managed AWS serverless service helping the applications to implement AuthN and AuthZ, with Cognito the …
Read More
It's a well known pattern to distribute the website via CDN globally, it reduces the latency of the site and improve the availibity and security leveraging the infrastructure of cloud provider. Using CDN service CloudFront and simple storage S3 on AWS hosts the static website. It well fits the SPA(single page …
Read More
Most web applications are using Restful APIs to interactive with the backend services. In the TODO application, it's the straight forward to get, update and delete the items from backend database. Amazon DynamoDB is a key-value database, it fits for this scenario with scalability and optimized pay-as-you-go cost. Also …
Read More
Building web application is a common use case, leveraging cloud services could accelerate the builders to develop and deploy the services. With AWS serverless services, the application can easily get the capabilities like security, highly availability, scalability, resiliency and cost optimized. This is a series posts …
Read More
After enabling E2E testing of FluxCD powered GitOps continuous deployment, the feedback of new commits are quite slow. Because you have to wait for the E2E testing result, lots of time cost on setuping the environment and provisioning your development from scrath. Inspired by E2E testing in Github actions, the DevOps …
Read More
背景 密钥的管理对于使用 GitOps 方式做持续发布是一个挑战，特别是当目标部署平台是 Kubernetes 的时候。 K8S 使用声明式配置管理最终状态，而K8S中的密钥仅仅是将密钥内容做了base64格式的编码。 在基于 Flux 的 GitOps 实战介绍了使用Bitnami Sealed Secrets加密密钥内容， 可以安全的将加密后的Kubernetes Manifest文件提交到Git代码仓库，由Sealed Secrets发现这些SealedSecret的密码， 并解密后动态的创建K8S原生Secrets对象。 SealedSecret 解决了如何在 Git 代码仓库中安全的保存密钥的痛点，但是该方式仍然需要系统管 …
Read More
背景 在Flux 部署实战的总结展望中有一个方向是如何将云上基础设施资源同Kubernetes内资源统一管理， 而Crossplane提供了一个高度可扩展的后端，使用声明式程序同时编排应用程序和基础设施，不用关心它们在哪里运行。 近期 AWS 官方博客宣布了 AWS Blueprints for Crossplane，为客户提供了在 Amazon EKS 上应用 Crossplane 的参考实现。 AWS Blueprints for Crossplane AWS Blueprints for Crossplane 是一个 Github 上开源项目，它提供了如下参考架构及功能， ✅ 使用Terraform 创建 Amazon EKS …
Read More
AWS CDK is a great abstract to accelerate managing the cloud infrastructure as code. The journey will be enjoyful with leveraging the Construct Hub to use the high level contributions from AWS partners and commnunity. Use Case AWS CloudFormation is one of the underly technologies of AWS CDK to manage the cloud …
Read More
在上篇介绍基于 CNCF 下的 GitOps 工具 FluxCD v2 实现了管理多账户的 Kubernetes 集群的共享组件，Secrets 使用的最佳实践， GitOps 流水线事件同 IM(Slack) 的集成，以及对 GitOps 代码的 CI 流程。 本文将围绕如何使用 Flux 的多租户管理最佳实践，打造基于 GitOps 工作流程的共享服务平台， 实现租户(业务/应用团队)可自助的持续部署。 一、基于 GitOps 的共享服务平台设定 Kubernetes 提供了命名空间作为一种机制将同一集群中的资源划分为相互隔离的组。 同一个集群中多租户多团队的应用管理将沿用 Kubernetes 内置的各种机制来为不同的租户、团 …
Read More