Microservices – Demo Project in Python
github.com
Microservices – Demo Project in Python
1–10 of 21 posts
Re: Microservices – Demo Project in Python
#2The thing I really want to see is how a good authentication and authorization system works, for both the user-facing services and interservice calls. I've looked around a bit and never found a resource that addresses that important problem.
Re: Microservices – Demo Project in Python
#3The thing I really want to see is how a good authentication and authorization system works, for both the user-facing services and interservice calls. I've looked around a bit and never found a resource that addresses that important problem.
You wouldn't want authorization for internal interservice calls, way too much overhead and a firewall is more secure.
Re: Microservices – Demo Project in Python
#4The thing I really want to see is how a good authentication and authorization system works, for both the user-facing services and interservice calls. I've looked around a bit and never found a resource that addresses that important problem.
You wouldn't want authorization for internal interservice calls, way too much overhead and a firewall is more secure.
Firewall != AAA != encrypted transport
They have different usages; I wouldn't say one is more secure than the other.
Re: Microservices – Demo Project in Python
#5This shows a few of the drawbacks of microservices one of which is memory. This project used about 15mb per python instance = 60mb total when the entire stack is launched.
Once you load a few largish python libraries like sqlalchemy you can get up to 100mb per instance x 4 = 400mb.
What would be interesting is a framework that allows you to run the entire microservice stack in a single interpreter (shouldn't be hard with flask blueprints) and break off the subapps as necessary when the need arises.
You would need a way of managing the current endpoints for each service vs a requests.get('http://localhost:ARBITRARY_PORT') in the code, but if done correctly would make managing a cluster much simpler.
Does anyone know if such a thing exists?
Re: Microservices – Demo Project in Python
#6Earlier quoted context omitted.
You wouldn't want authorization for internal interservice calls, way too much overhead and a firewall is more secure.
Firewall != AAA != encrypted transport They have different usages; I wouldn't say one is more secure than the other.
For interservice calls a firewall is much more secure than any auth system, way less vectors of attack. Encrypted transport on public networks should be a given anyway, although if you have a private network then that is unnecessary also.
The only place auth is needed is for services that interact with users, and that works well in the microservice philosophy having an auth service which talks to all services as in user service auth
You can scale the auth system indirectly to the other services, and since auth is required almost everywhere means that you'll have a large part of your resources devoted to that.
Where it gets interesting is when you use external microservices for auth like stormpath - is it a good idea to talk to that directly, or use a mediation auth service of your own - I usually prefer the 2nd method since while there is an extra hop - it makes the api more static and allows you to swap out what your app uses for auth much more easily.
Re: Microservices – Demo Project in Python
#7Number 1 problem with microservices here:
https://github.com/umermansoor/microservices/blob/master/ser...
N+1 HTTP requests. Ouch. Wouldn't it be nice to be able to do a database join?
Re: Microservices – Demo Project in Python
#8The thing I really want to see is how a good authentication and authorization system works, for both the user-facing services and interservice calls. I've looked around a bit and never found a resource that addresses that important problem.
You wouldn't want authorization for internal interservice calls, way too much overhead and a firewall is more secure.
That assumes you have complete trust and confidence in the integrity and security of every single process running within your internal network.
I personally prefer to maintain a "need to know" approach to communication between all systems on my network (including services, databases, infrastructure).
This means that, for example, if my public-facing vehicle lookup service is compromised, my users' data is still a long way away. This is enforced by: (1) not providing an address to the service, (2) not providing the keys/passwords required to authenticate with the service.
Not doing authorization internally means that the moment a single process running on your network is compromised (which almost certainly is possible), your attacker now has access to the entirety of your system, and you're fucked.
Also, the overheads can be extremely low - to the point that they're not noticeable. It just depends how you do it.
Re: Microservices – Demo Project in Python
#9This shows a few of the drawbacks of microservices one of which is memory. This project used about 15mb per python instance = 60mb total when the entire stack is launched. Once you load a few largish python libraries like sqlalchemy you can get up to 100mb per instance x 4 = 400mb. What would be interesting is a framework that allows you to run the entire microservice stack in a single interpreter (shouldn't be hard…
Have you looked at Kong? (https://getkong.org)
Re: Microservices – Demo Project in Python
#10Number 1 problem with microservices here: https://github.com/umermansoor/microservices/blob/master/ser... N+1 HTTP requests. Ouch. Wouldn't it be nice to be able to do a database join?
or just retrieve a list of movies
movies_resp = requests.get("http://127.0.0.1:5001/movies?id=1&id=2&id=3")