Parameswaran V Vaidyanathan

Container Security & Developer Productivity with Cloud Native Buildpacks

Thu, 30 Apr 2020 13:00:40 -0500

Context & Problems

The widespread adoption of Containerized workloads to be run on cloud platforms, has given rise to two interesting problems:

Developer Productivity

First, developers writing Dockerfiles (assuming Docker is the preferred container runtime), to deal with how their applications should be installed on the container OS image, along with what kind of dependencies are required. This takes away time from the developers when they could actually invest more time in developing and delivering business features. Furthermore, the developers are burdened by:

API Authorization using Open Policy Agent (OPA) as a Sidecar Container

Mon, 13 Apr 2020 15:59:28 -0500

Problem Statement

In today’s cloud native world, authorization and policies are more complex than ever. In a typical enterprise that has been using RBAC (Role Based Access Control) traditionally, the policy management becomes a nightmare because the need for creation of new users, roles, controls keeps growing based on everyday’s needs. Besides, enforcing these mammoth set of rules or policies to secure huge monolithic application makes it even more harder to manage and maintain.

Hugo Static Site Deployment with Github Actions

Fri, 10 Apr 2020 10:34:33 -0500

Outlining the steps below to able to deploy a Hugo based Static Site to Github Pages using Github Actions

Repository creation

The first repository will host the website. It needs to be named as: <github_username>.github.io. For example, my website repository is named as parameswaranvv.github.io
The second repository will host the site in development. So, it can be named in any way. For example, my site content repository is named as param-site.

Site content development

Clone the param-site repository locally and within the directory, we will develop our content for the website. I used Hugo to generate my website content and I customized it to my needs.
Clone the other repository parameswaranvv.github.io as a submodule within the root of the current repository. We will build our code in the current repository, and deploy it via the submodule to the other repository.

Github Actions Pipeline script

Within the param-site directory, create a .github/workflows/main.yml which will contain the pipeline script for building and deploying our website to Github Pages in our website repository parameswaranvv.github.io .
For building the hugo site, we use the peaceiris/actions-hugo@v2 action, and use the Hugo extended version to build. This is to enable processing of SCSS files for CSS.
For deploying the site to the <username>.github.io or parameswaranvv.github.io in my case, use the peaceiris/actions-gh-pages@v3 with the options turned on to deploy to an external repository. Forcing orphan ensures a clean slate deployment always.

Sample Pipeline Script

# This is a basic workflow to help you get started with Actions

name: Deploy Static Site

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
 push:
 branches: [ master ]

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
 # This workflow contains a single job called "build"
 deploy:
 # The type of runner that the job will run on
 runs-on: ubuntu-latest

 # Steps represent a sequence of tasks that will be executed as part of the job
 steps:
 # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
 - name: Checkout Code
 uses: actions/checkout@v2
 with:
 submodules: true

 - name: Cleanup cache
 run: |
 rm -rf node_modules/gh-pages/.cache

 - name: Setup Hugo
 uses: peaceiris/actions-hugo@v2
 with:
 hugo-version: '0.64.1'
 extended: true

 - name: Build
 run: hugo -v

 - name: Deploy
 uses: peaceiris/actions-gh-pages@v3
 with:
 deploy_key: ${{ secrets.GHPAGESTOKEN }}
 external_repository: parameswaranvv/parameswaranvv.github.io
 publish_dir: ./parameswaranvv.github.io
 publish_branch: master
 force_orphan: true
 user_name: 'Param'
 user_email: 'you@example.com'

Handling Github Security Tokens while deploying across repositories.

Create a SSH Public and Private Key using your email address locally on a UNIX machine.
Configure the SSH Private Key as a Github Secret Token named GHPAGESTOKEN on the param-site repository, where in the pipeline is hosted.
Configure the SSH Public Key as a Deploy Key on the other repository <username>.github.io or in my case parameswaranvv.github.io.

Congratulations!! You have a static website hosted on github and with full CI/CD capabilities. In fact, you care currently reading this on my Github Pages hosted static website built on Hugo and CI/CD managed by Github Actions.

Struts1 Spring Boot Migration

Thu, 09 Apr 2020 18:05:25 -0500

This document outlines the steps necessary to make the bare minimum changes to a Struts 1 Web application, to eliminate the dependency on a hosted container and instead, operate as a Spring Boot application with embedded container.

Dependencies

 <dependencies>
 <dependency>
 <groupId>javax.servlet</groupId>
 <artifactId>jstl</artifactId>
 <version>1.2</version>
 </dependency>
 <dependency>
 <groupId>javax.servlet</groupId>
 <artifactId>javax.servlet-api</artifactId>
 <version>4.0.1</version>
 </dependency>
 <dependency>
 <groupId>javax.servlet.jsp</groupId>
 <artifactId>javax.servlet.jsp-api</artifactId>
 <version>2.3.3</version>
 </dependency>
 <dependency>
 <groupId>org.apache.tomcat.embed</groupId>
 <artifactId>tomcat-embed-jasper</artifactId>
 <version>9.0.22</version>
 </dependency>
 <dependency>
 <groupId>org.apache.struts</groupId>
 <artifactId>struts-core</artifactId>
 <version>1.3.10</version>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 <version>2.1.7.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-core</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-beans</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-context</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/org.springframework/spring-web -->
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-web</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.apache.tiles</groupId>
 <artifactId>tiles-core</artifactId>
 <version>2.0.5</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/org.projectlombok/lombok -->
 <dependency>
 <groupId>org.projectlombok</groupId>
 <artifactId>lombok</artifactId>
 <version>1.18.10</version>
 <scope>provided</scope>
 </dependency>

 </dependencies>

Plugins

 <plugins>
 <plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 <version>2.1.7.RELEASE</version>
 <executions>
 <execution>
 <goals>
 <goal>repackage</goal>
 </goals>
 </execution>
 </executions>
 </plugin>
 <plugin>
 <artifactId>maven-war-plugin</artifactId>
 <version>2.3</version>
 <configuration>
 <failOnMissingWebXml>false</failOnMissingWebXml>
 </configuration>
 </plugin>
 </plugins>

Properties

 <properties>
 <maven.compiler.source>1.6</maven.compiler.source>
 <maven.compiler.target>1.6</maven.compiler.target>
 </properties>

Code Changes

Keep web.xml as is. It is required because the Struts 1.x ActionServlet eagerly looks for the presence of the web.xml.
Add a ServletRegistration Bean in the Spring Boot Application class, that configures the struts-config.xml in the actionServlet.

@Configuration
public class FilterRegistrationConfig {

 @Bean
 public ServletRegistrationBean actionServlet() {
 ActionServlet servlet = new ActionServlet();
 ServletRegistrationBean bean = new ServletRegistrationBean(servlet, "*.do");
 bean.addInitParameter("config", "/WEB-INF/struts-config.xml");
 bean.setLoadOnStartup(1);
 bean.setName("action");
 return bean;
 }
}

Instead of annotating each Action as Spring Component (which is not possible because the Action classes are managed and loaded by the Struts Classloader and not the Spring Class loader), we would create an abstract base class which would be inherited by all the Actions.

public abstract class ApplicationContextAwareAction extends Action {

 protected AutowireCapableBeanFactory ctx;

 @Override
 public void setServlet(ActionServlet servlet) {
 super.setServlet(servlet);
 WebApplicationContext context =
 WebApplicationContextUtils.getWebApplicationContext(servlet.getServletContext());
 ctx = context.getAutowireCapableBeanFactory();
 ctx.autowireBean(this);
 }

}

Sample Action Class

Struts2 Spring Boot Migration

Wed, 08 Apr 2020 18:05:25 -0500

This document outlines the steps necessary to make the bare minimum changes to a Struts 2 Web application, to eliminate the dependency on a hosted container and instead, operate as a Spring Boot application with embedded container.

Dependencies

 <dependency>
 <groupId>javax.servlet</groupId>
 <artifactId>jstl</artifactId>
 <version>1.2</version>
 </dependency>
 <dependency>
 <groupId>javax.servlet</groupId>
 <artifactId>javax.servlet-api</artifactId>
 <version>4.0.1</version>
 </dependency>
 <dependency>
 <groupId>javax.servlet.jsp</groupId>
 <artifactId>javax.servlet.jsp-api</artifactId>
 <version>2.3.3</version>
 </dependency>
 <dependency>
 <groupId>org.apache.tomcat.embed</groupId>
 <artifactId>tomcat-embed-jasper</artifactId>
 <version>9.0.22</version>
 </dependency>
 <dependency>
 <groupId>org.apache.struts</groupId>
 <artifactId>struts2-core</artifactId>
 <version>2.5.20</version>
 </dependency>
 <dependency>
 <groupId>org.apache.struts</groupId>
 <artifactId>struts2-spring-plugin</artifactId>
 <version>2.5.20</version>
 <exclusions>
 <exclusion>
 <groupId>org.springframework</groupId>
 <artifactId>spring-core</artifactId>
 </exclusion>
 <exclusion>
 <groupId>org.springframework</groupId>
 <artifactId>spring-beans</artifactId>
 </exclusion>
 <exclusion>
 <groupId>org.springframework</groupId>
 <artifactId>spring-context</artifactId>
 </exclusion>
 </exclusions>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 <version>2.1.7.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-core</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-beans</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-context</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/org.springframework/spring-web -->
 <dependency>
 <groupId>org.springframework</groupId>
 <artifactId>spring-web</artifactId>
 <version>5.1.9.RELEASE</version>
 </dependency>

Plugins

 <plugins>
 <plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 <version>2.1.7.RELEASE</version>
 <executions>
 <execution>
 <goals>
 <goal>repackage</goal>
 </goals>
 </execution>
 </executions>
 </plugin>
 <plugin>
 <artifactId>maven-war-plugin</artifactId>
 <version>2.3</version>
 <configuration>
 <failOnMissingWebXml>false</failOnMissingWebXml>
 </configuration>
 </plugin>
 </plugins>

Properties

 <properties>
 <maven.compiler.source>1.6</maven.compiler.source>
 <maven.compiler.target>1.6</maven.compiler.target>
 </properties>

Code Changes

Remove web.xml and add a Spring Boot application class.
Add a Spring Configuration to register the Struts Filter Dispatcher

@Configuration
public class FilterRegistrationConfig {

 @Bean
 public FilterRegistrationBean<StrutsPrepareAndExecuteFilter> filterRegistrationBean() {
 FilterRegistrationBean<StrutsPrepareAndExecuteFilter> registrationBean = new FilterRegistrationBean<StrutsPrepareAndExecuteFilter>();
 StrutsPrepareAndExecuteFilter struts = new StrutsPrepareAndExecuteFilter();
 registrationBean.setFilter(struts);
 registrationBean.setUrlPatterns(Arrays.asList("/*"));
 registrationBean.setOrder(1);
 registrationBean.setInitParameters(Collections.singletonMap("actionPackages", "example.actions"));
 return registrationBean;
 }
}

Annotate all the Action Classes and depending components to be autowired as @Component.
Add a file in src/main/resources. Name: struts.properties

struts.convention.exclude.parentClassLoader=false
struts.convention.action.fileProtocols=jar,code-source

Replace the actions and results from struts.xml with corresponding annotations in the Action classes.

HelloAction.java