A very small start-up approached us do a POC build of their core business product. They had no technical staff or infrastructure, and we needed to build something quickly and easy to hand off to a freelance technical team of the client’s choosing.
We opted for a simple container based front and back end microservice that was easily bootstrapped with JHipster. We were able to do so without any VMs, and were able to balance the simplicity of AWS’s modern serverless frameworks and the familiarity of some of the traditional services they provided:
That balance let us codify the deployment and hand it off to a freelance DevOps engineer to quickly bringing the site up in a live state. Just by providing a handful of Git repos and basic documentation, they were running in a weekend.
Automate everything.
--Every DevOps talk, blog, and whitepaper.
There's a lot of pressure out there to automate, scale, and be infinitely flexible. There's also a lot of pressure to ship. Don't get tangled in trying to automate everything. If you don't have some frameworks in play, don't expect to have much automation bundled into your project. It takes time. Balance what is flexible vs what just needs to work, while insulating yourself from the long-term impact of any tempermanent solutions.
This is kind of microservices 101, but go ahead and separate front-end code early. They will deploy and scale differently. Segmenting also makes it easy to get truthful metrics about network traffic and system load.
Gitlab-CI's YAML job descriptions are really quick to implement and modify. Our job would build, test, push to repo, and call for the service to redeploy in 50 lightweight lines of YAML. The client was able to sign up for the base-level hosted Gitlab offering, and their engineer was able to drop in the repo and CI integration.
AWS Fargate has its place. IMHO that's for small green field projects, where there's a very basic need to run containers without persistent storage, and no other infrastructure to integrate. Our client's project met this criteria with flying colors. Ansible 2.7 has Fargate support, which further sweetened the proposition.
Rather than the front end forward API requests to the back end nodes, we let ALB rules route traffic to the appropriate front or back end target group based on URL. Service discovery was not needed since the balancer took care of routing to the different services. Deployments instantly become transparent because ALB's healthchecks will respond to a node's availability.
Since we were using Spring Boot, we had a lot of configuration methods to choose from. Due to the small scale of the application, we opted for 12-factor style config by setting environment variables for the JDBC path and credentials. It did not require any code changes to use. AWS Systems Manager Parameter Store was a simple solution that could easily be extended for more configurations. To inject the configuration, a function was added to the Docker entrypoint shell script to extract the values from the parameter store and inject into the environment.
Although Terraform would likely be fewer lines of code and CloudFormation would be the most AWS native, we chose to use Ansible for our VPC build. Since the deployment code would be used by other people, we felt that Ansible code would be the easiest to read and modify. The role was a great time saver. We were able to build concurrent test environments by changing only a few configuration values.
The role will be covered in more depth in another blog post, but here are the functionality highlights:
Don't worry about auto scaling out of the gate. Do assure that someone can easily launch additional nodes or replace nodes with larger instances. A properly defined ECS task will make it easy to launch additional nodes.
Have the pattern in place for secrets management, even if the preferred secrets provider isn't available. 12-factor style is a good place to start.
Preconfiguring network subnets, and security in the infrastructure deployment code can assure that safe practices for network security make it all the way through deployment. Having it codified also creates more visibility to help developers build with security in mind.
It takes time to build reliable infrastructure code. Identify your common design patterns and build flexible deployment code before you need it. We have been able to quickly re-use our Ansible Fargate VPC role for testing and prototyping.