DevOps on foojay.io - Friends of OpenJDK

BoxLang AWS, Azure, and Google Secrets Manager Module Released

Tue, 21 Jul 2026 11:38:18 +0000

Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them – it’s how badly the current approach is going to hurt you.

Hardcoded credentials in config files get committed to repos. Environment variables sprawl across deployment pipelines with no audit trail. Custom integration code for each cloud provider means three different patterns to maintain, test, and rotate. And when a key needs to rotate at 2am? Someone is waking up.

BoxLang 1.15.0 Released: Blazing Fast Strings, Runtime Portability, and much more

Tue, 14 Jul 2026 17:57:10 +0000

BoxLang 1.15.0 is a high-impact release with two big headlines and a long tail of hardening. The first headline is a massive performance upgrade to string handling : a new first-class BoxStringBuilder type, compile-time literal folding, smarter &= semantics, and a runtime concat strategy that automatically switches to builder-backed accumulation once your expression gets big enough. Your existing string-heavy code just got faster. No rewrites required.

The second headline is architectural. Every class loader in the BoxLang runtime and module system has been fully abstracted behind a pluggable IClassLoaderFactory interface. That single seam is what unlocks the Android runtime and Ahead-of-Time (AOT) compiled runtimes such as GraalVM Native Image that we have on the roadmap. The default behavior is unchanged, but the ceiling just got a lot higher.

What's New in actions/setup-java 5.4 and 5.5: Signature Verification, Kona JDK, and a Better Maven Experience

Wed, 08 Jul 2026 18:56:31 +0000

If you build Java on GitHub Actions, actions/setup-java is almost certainly the first step in your workflow. It installs a JDK, wires up JAVA_HOME and the PATH, configures Maven settings.xml, sets up dependency caching, and registers Maven toolchains — all before your build even starts.

The last two releases, v5.4.0 and v5.5.0 , are quietly some of the most interesting in a while. v5.5.0 in particular brings something Java developers have been asking about for years on CI: cryptographic verification of the JDK you just downloaded. There’s also a brand-new distribution, smarter version-file handling, and a batch of Maven quality-of-life fixes that make your logs cleaner and your toolchains file saner.

Quarkus Unpacked: Insights from the Foojay Podcast

Tue, 23 Jun 2026 12:36:54 +0000

I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from what makes Quarkus different to the practical trade-offs between JVM and native mode. This post captures the key questions and answers from that discussion, lightly edited for readability.{#_quarkus_unpacked_insights_from_the_foojay_podcast}

If you have been following this blog series, note that the third installment on building your own stack with Quarkus is coming next. Consider this a bonus entry that distills the podcast conversation into a format you can read, reference, and share.

Enterprise Java quality gates in the age of AI

Fri, 29 May 2026 07:00:00 +0000

People and AI can write code together, but enterprise repositories still need deterministic quality gates to protect code quality.

Enterprise quality is a scaling problem

Enterprise Java development is not only about writing correct code. It is about keeping a large, long-lived codebase understandable, reviewable and safe to change while many people and many tools touch it over time.

BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity

Tue, 19 May 2026 12:11:19 +0000

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in SystemExecute(), SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Dockerizing a Java 26 Project with Docker Init

Mon, 27 Apr 2026 09:55:12 +0000

Docker Init was introduced in Docker Desktop 4.27, before LLMs became the default answer to everything. It’s a “smart” interactive wizard that analyzes your project and generates:

A Dockerfile (multi-stage, production-ready)
A compose.yaml file
A .dockerignore file
A README.Docker.md with build and run instructions

What makes it valuable is that it’s deterministic—not a probabilistic guess. It produces the same correct output every time, following Docker’s own best practices.

AWS Nitro and CPU Graviton Meets Unikernels

Fri, 10 Apr 2026 16:26:25 +0000

AWS Nitro and CPU Graviton Meets Unikernels: Java and Quarkus on ARM64 AWS Graviton with Nanos Unikernel

Java and Jakarta EE Truly Meet Unikernels

The key message of this article is simple and strong:

any Java or Jakarta EE application is already ready to benefit from the advantages of unikernels.

Java and Jakarta EE, including modern frameworks such as Quarkus, can immediately take advantage of the unikernel model without waiting for new languages, new runtimes, or radical rewrites.

Introducing Floci: A High-Performance, GraalVM-Powered AWS Emulator

Fri, 03 Apr 2026 19:00:53 +0000

The Motivation: Why Another AWS Emulator?

As Java developers, we are used to local-first development. Tools that emulate the cloud environment have become essential for keeping feedback loops tight and costs at zero. However, the ecosystem has shifted. Many of us have felt the friction of:

Mandatory Authentication: Needing to log in or use tokens just to run local tests.
Heavy Resource Footprint: Docker containers that consume a lot of resources.
Slow Startup: Waiting several seconds for the environment to be ready.

I created Floci (from the floccus cloud formation) to solve these specific pain points. It is a 100% open-source, MIT-licensed alternative designed for speed, privacy, and simplicity.

TestBox 7: Real-Time Feedback, a Browser-Based IDE, and Modern Testing Workflows on the JVM

Tue, 24 Mar 2026 16:58:53 +0000

TestBox 7.x focuses on improving testing workflows for BoxLang and CFML applications. This release introduces improvements to the BoxLang CLI runner , real-time streaming test execution via SSE , dry run capabilities, a browser-based TestBox RUN interface, and several developer experience enhancements.

Check out the what’s new here: https://testbox.ortusbooks.com/readme/release-history/whats-new-with-7.0.0

TestBox RUN: A Browser IDE for Your Tests

The centerpiece of TestBox 7 is TestBox RUN : a self-hosted, single-page web app (bx/tests/index.bxm) that you drop into any BoxLang project and open in a browser. No build toolchain. No external service. Just BoxLang.

Azul Zulu OpenJDK Docker Images Now Available on Docker Hub

Mon, 23 Mar 2026 07:53:56 +0000

Azul recently announced that Azul Zulu Builds of OpenJDK are now available as Docker Official images on Docker Hub. That means you can pull TCK‑verified, fully compliant OpenJDK builds directly from the same Official Images library you already trust for your base OS and databases.

You can browse and pull the images here:
https://hub.docker.com/_/azul-zulu

Why should you care about official images?

With the official Docker images you get:

JC-AI Newsletter #14

Tue, 03 Mar 2026 15:11:53 +0000

Two weeks have passed and a lot have been happening on the field of artificial-intelligence.

Two weeks have passed and a lot has been silently yet visibly happening in the field of artificial intelligence. This newsletter brings interesting developments, including Dario Amodei’s (Anthropic) view on the progress achieved in the LLM field and his response to the utilization of these models for specific kinds of military purposes, as well as OpenAI’s response to it. Aside from the fact that development may follow more sigmoids instead of exponential progress, it is important to have awareness of utilization across branches. Does prompting and clarifying the goal influence agent responses, and if so, how? How far are we from reliable robotics applications? How much bias is introduced when clinical data is being analyzed?

From “Crypto AI” to general AI: Do AI agents dream of electric langoustines?

Mon, 23 Feb 2026 18:11:54 +0000

A Blade Runner riff for a world where the lobster ships paid endpoints while humans still argue about the roadmap.

The shift that matters for agent commerce - From “Crypto AI” to general AI

Today, you can search the web all day and never see an invoice.

That happens because you are not the paying client.

The commerce runs through ads, affiliate deals, and platform incentives, so results often optimize for who pays, not for what you asked for.

Shai-Hulud and the npm Worm: How Speed-Optimised Dev Ecosystems Made a Self-Propagating Supply Chain Attack Inevitable

Thu, 12 Feb 2026 11:47:48 +0000

first, a word about ecosystems

Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest about something.

The worm didn’t appear in a broken system. It appeared in the one we deliberately optimised.

In the book Dune, the worm is integral to the ecosystem. The planet, its environment, and the worms are deeply interconnected.

That’s true for the cyber-worm equivalent. The worm is an entirely predictable outcome of the ecosystem in which we, as developers, are part

Unikernel: Profiling and Troubleshooting JVM on Nanos Unikernel

Wed, 11 Feb 2026 13:50:41 +0000

Profiling a Java Application Running Inside an Unikernel with JProfiler

Unikernels are often associated with minimalism and tight resource control.

But can we profile a Java application running inside a unikernel using a standard JVM profiler?

The answer is yes.

In this guide, we will walk step by step through profiling a Quarkus

application running inside a Nanos unikernel using JProfiler and
IBM Semeru JRE 25 (OpenJ9).

No special hacks. Just standard JVM tooling.

Not a Lucid Web3 Dream Anymore: x402, ERC-8004, A2A, and The Next Wave of AI Commerce

Fri, 09 Jan 2026 16:05:58 +0000

This article is for technically savvy readers, especially developers, protocol designers, and product teams working with AI agents, APIs, or crypto rails, who want a clear view of how these areas connect.
It explains how x402, ERC-8004, and agent discovery layers turn APIs and agents into small usage-based businesses, and what that means for real systems over the next 1–3 years.

Vocabulary for this article

In this article, I use the term micro business for a very small overall business, and nano business for a single x402-priced endpoint or agent that earns on its own from per-call payments in stablecoins.

AP2 (Agent Payment Protocol): AP2 defines how agents pay each other. It standardizes how a service quotes a price, how payment is confirmed, and how both sides record what was bought, so payments fit directly into automated agent workflows. In practice, it is a protocol that lets one machine pay another machine for work, without a human in the loop.

A2A (Agent-to-Agent communication): A2A covers how agents talk, pass context, and coordinate work. It lets agents call each other, exchange structured messages, and chain tasks instead of acting as isolated scripts.

x402: x402 is an HTTP-based payment protocol for APIs. A server responds with status 402 Payment Required, the price, and a payment route, and the client pays by using stablecoins on-chain and then retries the request to get the result.

ERC-8004 (8004): ERC-8004 standard is an on-chain registry for agents. It gives each agent an identity and a place to store reputation data, so other agents and tools can decide whom to trust and which services to call.

Foreword

x402 and ERC-8004 .

Java and Jakarta EE and the Evolution of the Cloud with Nanos Unikernel

Tue, 06 Jan 2026 20:51:09 +0000

The evolution of the Java and Jakarta Enterprise ecosystem is converging toward an increasingly simple, efficient, and scalable architecture that improves security, delivers higher performance, and reduces hardware and infrastructure costs.

For years, Kubernetes has been considered the de‑facto standard for modernizing Java applications in a cloud‑native direction. However, Kubernetes is not the only way to achieve scalability, continuous upgrades, and isolation. An alternative approach — often underestimated — is to leverage the hypervisors already included and fully managed by major cloud providers , using Unikernel images based on Nanos .

How to Release a Java Module to Maven Central with JReleaser and GitHub Actions (2025 Guide)

Fri, 12 Dec 2025 07:42:00 +0000

This article is a tutorial that guides you through the process of releasing a Java module with JReleaser to Maven Central with Github Actions. It is a 2025 update of the foojay.io/today/how-to-release-a-java-module-with-jreleaser-to-maven-central-with-github-actions article.

JReleaser is a tool that streamlines the release process for Java projects, allowing developers to quickly and efficiently publish their modules to Maven Central.

This article will use the SemVer Check project as an example project that uses Maven as a build tool.

Micrometer & Prometheus in Spring Boot: Kafka Burger Orders

Fri, 14 Nov 2025 10:13:03 +0000

👨‍💻 GitHub: https://github.com/vinny59200/dukeburger

🔵⚪⚪⚪⚪⚪⚪⚪⚪⚪⚪⚪

This guide shows how to use Micrometer and Prometheus in Spring Boot to track a custom metric for a Kafka-driven Burger Orders app. You’ll post a burger order to a REST endpoint, publish it to Kafka, consume the topic, and increment a counter for all “DukeBurger” orders. Copy the snippets, run, and you’ll see your metric on /actuator/prometheus.

JC-AI Newsletter #8

Thu, 30 Oct 2025 06:36:12 +0000

Fourteen days have passed, and it is time to present a fresh collection of readings that could influence developments in the field of artificial intelligence.

This newsletter focuses on examining how AI enhances productivity through enterprise studies, agentic system architecture, attack vectors, Model Context Protocol (MCP) implementation, Agent-to-Agent (A2A) protocol, Java code generation within IDEs, LLM benchmarking methodologies, and the security challenges arising from increased AI-LLM adoption.

The world influenced by LLM is changing very quickly, let’s start…

JC-AI Newsletter #7

Tue, 14 Oct 2025 05:35:01 +0000

Fourteen days have passed, and it is time to present a fresh collection of readings that could influence developments in the field of artificial intelligence.

Beyond focused tutorials that can enhance your understanding of AI applications, this newsletter concentrates on Hallucination, Java Code Generation, Testing, Agentic System Architecture and LLM benchmarking methodologies designed to ensure models accuracy and competency in handling complex contextual information.

The world influenced by LLM is changing very quickly, let’s start…

Why Mirroring Production in Dev Helps You Avoid Costly Mistakes

Mon, 28 Jul 2025 13:31:10 +0000

Many developers start building their applications with MongoDB using a free M0 cluster or a local environment. While this is common and convenient, it can lead to issues that could easily be avoided by using a more robust setup, such as a development cluster that closely mirrors production. Problems like inefficient queries, missing indexes, or even costly mistakes often go unnoticed in limited environments like M0 or local setups.

In this article, we’ll explore why your development environment should closely reflect your production environment, and how using an M10+ cluster with tools like Query Profiler and Performance Advisor can help you catch performance issues early and build with confidence.

Cloudflare Tunnel for Home Assistant

Tue, 03 Jun 2025 11:29:18 +0000

I continue to take care of my Home Assistant. This week, I replaced my original setup with Cloudflare Tunnel .

This is the 6^th^ post in the My journey with Home Assistant focus series. Other posts include:

The initial setup

My usage of Home Assistant required external access from the beginning.

One giant Kubernetes cluster for everything

Tue, 25 Mar 2025 10:33:50 +0000

The ideal size of your Kubernetes clusters is a day 0 question and demands a definite answer.

You find one giant cluster on one end of the spectrum and many small-sized ones on the other, with every combination in between. This decision will impact your organization for years to come. Worse, if you decide to change your topology, you’re in for a time-wasting and expensive ride.

I want to list each approach’s pros and cons in this post. Then, I’ll settle the discussion once and for all and argue why selecting the giant cluster option is better.

Pull request testing on Kubernetes: vCluster for isolation and costs control

Sun, 16 Mar 2025 11:47:20 +0000

This week’s article is the third and final in my series about running tests on Kubernetes for each pull request. In the first post , I described the app and how to test locally using Testcontainers and in a GitHub workflow. The second post focused on setting up the target environment and running end-to-end tests on Kubernetes.

I concluded the latter by mentioning a significant quandary. Creating a dedicated cluster for each workflow significantly impacts the time it takes to run. On , it took between 5 and 7 minutes to spin off a new cluster. If you create a GKE instance upstream, you face two issues:

Run a Java Lambda Function From a Docker image

Wed, 11 Dec 2024 16:16:36 +0000

Have you ever wanted to deploy a Java Serverless function, but package it with a Docker Image? That is possible now with AWS new Container support. This guide will show you how to try it yourself, step by step!

The Hello Lambda Function project contains an AWS Lambda maven application with AWS Java SDK 2.x dependencies.

Here follows instructions from AWS Document on building Lambda for Java .

The sample code seen below can be found in my GitHub repository: hello-lambda .

Prevent LDAP injection in #java 💥💉with #springboot

Wed, 04 Dec 2024 14:45:35 +0000

LDAP (Lightweight Directory Access Protocol) is essential for managing and accessing directory information in Java web applications. However, it’s crucial to understand and prevent LDAP Injection, a serious security vulnerability that can lead to unauthorized access and data breaches.

Following OWASP Recommendations , such as validating user inputs and using parameterized queries, is vital for securing your applications. In this article, we’ll dive into LDAP, explore LDAP Injection, share OWASP’s best practices, and demonstrate secure coding in Spring Boot.

Effortless updates requires a zero-migration policy

Tue, 05 Nov 2024 12:19:43 +0000

In today’s production environments, it is not only expected, but critical to keep your technology stack as up-to-date as possible.

Staying current helps to mitigate security risks, while also benefiting from bug fixes, performance improvements, and new features and function that can help drive your business’s success.

This is true whether you’re deploying to a cloud or locally, and applies regardless of the deployment type, whether container images, VMs, or bare metal.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Health Check Response Format for HTTP APIs

Thu, 12 Sep 2024 10:02:32 +0000

I’m continuing my journey on getting more familiar with HTTP APIs by reading related . This time, I read the Health Check Response Format for HTTP APIs on the suggestion of Stefano Fago . In this article, I’d like to summarize my reading.

Note that it’s a draft. Moreover, it has been dormant for nearly two years and, thus, has been automatically expired. However, it’s the closest to a specification on health checks and thus deserves some love.

DRY your Apache APISIX config

Thu, 12 Sep 2024 09:59:44 +0000

is an important principle in software development. In this article, you learn how to apply it to Apache APISIX configuration.

The DRY principle

“Don’t repeat yourself” (DRY) is a principle of software development aimed at reducing repetition of information which is likely to change, replacing it with abstractions that are less likely to change, or using data normalization which avoids redundancy in the first place.

– Wikipedia - Don’t repeat yourself

Implementing the Idempotency-Key specification on Apache APISIX

Mon, 02 Sep 2024 20:58:24 +0000

Recently, I wrote an analysis of the IETF Idempotency-Key specification . The specification aims to avoid duplicated requests.

In short, the idea is for the client to send a unique key along with the request:

If the server doesn’t know the key, it proceeds as usual and then stores the response
If the server knows the key, it short-circuits any further processing and immediately returns the stored response

This post shows how to implement it with Apache APISIX .

When (not) to write an Apache APISIX plugin

Mon, 02 Sep 2024 20:50:43 +0000

When I introduce Apache APISIX in my talks, I mention the massive number of existing plugins , and that each of them implements a specific feature.

One of the key features of Apache APISIX is its flexibility. If a feature is missing, you can create your own plugin in Lua or a language compiled into Wasm, showcasing the platform’s adaptability to your specific needs.

In this article, I aim to provide practical alternatives to writing a custom plugin, offering solutions you can quickly implement in your projects.

Creating 12-factor cloud-native Java apps with open source

Fri, 23 Aug 2024 05:30:51 +0000

Learn how you could create cloud-native Java apps that are portable, scalable, and reliable with the 12 factor app methodology and open source Java frameworks.

Created in 2012, the 12-factor app methodology was designed to provide a set of guidelines for helping developers and organizations to design and build cloud-native applications. We’ll explore how you can take advantage of each of these 12 factors to create applications, utilizing open source technologies, that thrive in the cloud.

OpenTelemetry Tracing on Spring Boot, Java Agent vs. Micrometer Tracing

Thu, 22 Aug 2024 08:34:57 +0000

My demo of OpenTelemetry Tracing features two Spring Boot components. One uses the Java agent, and I noticed a different behavior when I recently upgraded it from v1.x to v2.x. In the other one, I’m using Micrometer Tracing because I compile to GraalVM native, and it can’t process Java agents.

I want to compare these three different ways in this post: Java agent v1, Java agent v2, and Micrometer Tracing.

Are Critical Vulnerabilities Lurking in Your Java Ecosystem?

Mon, 19 Aug 2024 12:57:59 +0000

Java, the popular object-oriented language renowned for its portability, performance, and security, is often the preferred choice for organisations building everything from enterprise and cloud-native applications to Android apps.

However, despite these strengths, Java’s popularity and the complex ecosystem of third-party libraries it relies upon have also made it a prime target for malicious actors to exploit vulnerabilities. According to the Datadog “State of DevSecOps”[1] report, a staggering 90% of Java services are susceptible to one or more critical or high-severity vulnerabilities, often stemming from external dependencies, compared to an average of 47% for other technologies. This discrepancy is concerning and points to inherent issues within the Java ecosystem.

Free tier API with Apache APISIX

Mon, 05 Aug 2024 13:50:08 +0000

Lots of service providers offer a free tier of their service. The idea is to let you kick their service’s tires freely. If you need to go above the free tier at any point, you’ll likely stay on the service and pay.

In this day and age, most services are online and accessible via an API. Today, we will implement a free tier with Apache APISIX .

A naive approach

I implemented a free tier in my post Evolving your RESTful APIs, a step-by-step approach , albeit in a very naive way. I copy-pasted the limit-count plugin and added my required logic.

Differentiating rate limits in Apache APISIX

Mon, 05 Aug 2024 13:37:40 +0000

In my talk Evolving your APIs, I mention that an API Gateways is a Reverse Proxy “on steroids”. One key difference between the former and the latter is that the API Gateway is not unfriendly to business logic. The poster child is rate-limiting.

Rate-limiting is an age-old Reverse Proxy feature focused on protecting against attacks. It treats all clients the same and is purely technical. In this day and age, most API providers offer different subscription tiers; the higher the tier, the higher the rate limit, and the more you pay incidentally. It’s not technical anymore and requires to differentiate between clients.

Random and fixed routes with Apache APISIX

Mon, 05 Aug 2024 13:29:59 +0000

My ideas for blog posts inevitably start to dry up after over two years at Apache APISIX .

Hence, I did some triage on the APISIX repo . I stumbled upon this one question:

We have a requirement to use a plugin, where we need to route the traffic on percentage basis. I’ll give an example for better understanding.

We have an URL where ca is country (Canada) and fr is french language. Now the traffic needs to routed 10% to and the remaining 90% to. And whenever we’re routing the traffic to we need to set a cookie. So for next call, if the cookie is there, it should directly go to else it should go via a 10:90 traffic split. What is the best possible way to achieve this ??

Advanced URL Rewriting with Apache APISIX

Thu, 25 Jul 2024 09:10:06 +0000

I spoke at Swiss PgDay in Switzerland in late June. The talk was about how to create a no-code API with the famous PostgreSQL database, the related PostgREST , and Apache APISIX , of course. I already wrote about the idea in a previous post . However, I wanted to improve it, if only slightly.

PostgREST offers a powerful SELECT mechanism. To list all entities with a column equal to a value, you need the following command:

New video series "JavaFX In Action", Part 1

Tue, 16 Jul 2024 07:35:29 +0000

JavaFX is a powerful user interface framework, often overlooked in the world of desktop applications development. With this new series of video interviews, I want to take you behind-the-scenes of some applications built using JavaFX.

JavaFX combines the best features of a modern user interface toolkit with the unparalleled strength of the Java platform. This approach enables you to perform heavy “background tasks”, like processing large amounts of data, while still providing a responsive user interface.

Dynamic watermarking with imgproxy and Apache APISIX

Wed, 10 Jul 2024 13:38:07 +0000

I described how to add a dynamic watermark to your images on the JVM . I didn’t find any library, so I had to develop the feature, or, more precisely, an embryo of a feature, by myself.

Depending on your tech stack, you must search for an existing library or roll up your sleeves. For example, Rust offers such an out-of-the-box library. Worse, this approach might be impossible to implement if you don’t have access to the source image.

Foojay Podcast #55: Embedded Java, Part 2

Mon, 01 Jul 2024 08:21:42 +0000

As a backend developer, you may not realize that Java was initially born on embedded devices like set-top boxes and gateways. We discussed this topic for the first time almost three years ago in Foojay Podcast #2 with James Gosling, Johan Vos, Erik Costlow, and Frank Delporte .

In this episode #55, we look into the history of the Java Micro Edition and how things evolved. Nowadays, with processors becoming increasingly powerful, we can run the exact same Java runtime on any Linux system, from the biggest cloud servers to the smallest Raspberry Pi Zero.

Renovate for everything

Thu, 27 Jun 2024 08:18:20 +0000

In my earlier post about moving from Kotlin Scripting to Python , I mentioned several reasons:

Separating the content from the script
Kotlin Scripting is an unloved child of JetBrains
Renovate cannot update Kotlin Scripting files

I was wrong on the third point. Here’s my mea culpa.

First things first, Renovate does indeed manages Kotlin Scripting files - since 2022.

Even better, Renovate can manage any type of file. Thanks to Max Andersen for the tip:

Even More Opentelemetry!

Thu, 20 Jun 2024 06:40:47 +0000

I continue to work on my Opentelemetry demo . Its main idea is to showcase traces across various technology stacks, including asynchronous communication via an MQTT queue. Recently, I added a couple of components and changed the architecture. Here are some noteworthy learnings; note that some of them might not be entirely connected to OpenTelemetry.

Here’s an updated diagram. New components appear in violet, and updated components appear in green.

Foojay Podcast #53: JCON Report, Part 5 – CQRS, JOOQ, GraphQL, API, Vaadin, OpenRewrite, ErrorProne, Gateways, Proxies,...

Mon, 17 Jun 2024 09:24:52 +0000

This is the final part of the JCON interviews. Did I save the best for last? It’s up to you to decide…

In this episode you’ll hear Simon Martinelli, Nicolas Fränkel, Marcus Hellberg, Rick Ossendrijver, and Abdel Sghiouar.

We talked about a bunch of topics like evolving your APIs, GraphQL, Java versus Kotlin versus Rust, Vaadin, AI and ChatGPT, OpenRewrite, ErrorProne, Infrastructure, and a lot more.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Exploring Cost-Effective Solutions for Stateful Rest Services

Mon, 27 May 2024 13:13:02 +0000

A Case Study with IBM Cloud Code Engine, EclipseStore, and IBM Cloud Object Storage

In the dynamic realm of cloud computing, finding cost-effective solutions for stateful rest services that don’t necessarily require scaling can be a nuanced challenge.

In this article, we’ll take a pragmatic look at a use case leveraging IBM Cloud Code Engine , EclipseStore , and IBM Cloud Object Storage (COS) . The goal is to shed light on how this can be a practical and economical alternative, particularly when scalability is not a primary concern.

Is your Java application ready for the next generation of server CPUs?

Wed, 08 May 2024 08:03:53 +0000

If you only know about Arm CPU architecture from working on smartphones or Raspberry Pi devices, it might come as a surprise to you that there are also high-performance, cloud-scale Arm CPUs already on the Java market.

The share of cloud and server workloads running on Arm is increasing every year. Back in 2011, Arm released the AArch64 instruction set, the first 64-bit support on Arm CPUs. Since then, Arm’s silicon partners have been producing a range of systems-on-chip (SoCs) that adopt Arm’s high performance CPUs. These power a broad range of diverse devices and technologies, including flagship smartphones , laptops , industrial IoT , servers, and even powerful super computers .

Five ways to pass parameters to Apache APISIX

Tue, 30 Apr 2024 14:53:30 +0000

I recently read 6 Ways To Pass Parameters to Spring REST API .

Though the title is a bit misleading, as it’s unrelated to REST, it does an excellent job listing all ways to send parameters to a Spring application.

I want to do the same for Apache APISIX; it’s beneficial when you write a custom plugin.

General setup

The general setup uses Docker Compose and static configuration.

I’ll have one plugin per way to pass parameters.

Why This JCON Europe Talk Is Unmissable (Part 1)

Mon, 29 Apr 2024 07:29:25 +0000

JCON Europe in Cologne is around the corner (and here are your free Foojay JCON tickets ), May 13 to 16. Why should you go? Well, one reason is that the talks will be awesome. Here’s the start of a series of reasons why some of them are absolutely unmissable!

DevOps for Java Developers (Or Maybe Against Them?!) - Baruch Sadogursky

Thursday, 16 May 2024 12:30 pm - 1:15 pm - Cinema BlackBox

Using my new Raspberry Pi to run an existing GitHub Action

Tue, 23 Apr 2024 18:45:04 +0000

Recently, I mentioned how I refactored the script that kept my GitHub profile up-to-date. Since Geecon Prague, I’m also a happy owner of a Raspberry Pi:

[

](https://twitter.com/nicolas_frankel/status/1715313240568197233 )

Though the current setup works flawlessly - and is free, I wanted to experiment with self-hosted runners. Here are my findings.

Context

GitHub offers a large free usage of GitHub Actions:

GitHub Actions usage is free for standard GitHub-hosted runners in public repositories, and for self-hosted runners. For private repositories, each GitHub account receives a certain amount of free minutes and storage for use with GitHub-hosted runners, depending on the account’s plan. Any usage beyond the included amounts is controlled by spending limits.

12 Text Tools For Developers

Tue, 09 Apr 2024 07:31:13 +0000

As developer, you would think we would spend all our time in an IDE doing development. The reality is a bit different. We may need to analyze logs, test our web services, generate test data, do security tests, analyze data in the database, and so on. Text processing os also part of a developer job. Let’s see a few free text tools to simplify your job.

Using online tools makes me wonder if I’m leaking company data to the website, so I wrote a desktop freeware Japplis Toolbox containing a collection of text tools.

Improving upon my OpenTelemetry Tracing demo

Wed, 03 Apr 2024 06:35:22 +0000

Last year, I wrote a post on Open Telemetry Tracing to understand more about the subject. I also created a demo around it, which featured the following components:

The Apache APISIX API Gateway
A Kotlin/Spring Boot service
A Python/Flask service
And a Rust/Axum service

I’ve recently improved the demo to deepen my understanding and want to share my learning.

Using a regular database

In the initial demo, I didn’t bother with a regular database. Instead:

Secure your API with these 16 Practices with Apache APISIX - part 1

Mon, 11 Mar 2024 09:35:51 +0000

A couple of months ago, I stumbled upon this list 16 practices to secure your API :

Authentication 🕵️️ - Verifies the identity of users accessing APIs.

Authorization 🚦 - Determines permissions of authenticated users.

Data Redaction 🖍️ - Obscures sensitive data for protection.

Encryption 🔒 - Encodes data so only authorized parties can decode it.

Error Handling ❌ - Manages responses when things go wrong, avoiding revealing sensitive info.

Input Validation & Data Sanitization 🧹 - Checks input data and removes harmful parts.

Intrusion Detection Systems 👀 - Monitor networks for suspicious activities.

IP Whitelisting 📝 - Permits API access only from trusted IP addresses.

Logging and Monitoring 🖥️ - Keeps detailed logs and regularly monitors APIs.

Rate Limiting ⏱️ - Limits user requests to prevent overload.

Secure Dependencies 📦 - Ensures third-party code is free from vulnerabilities.

Security Headers 📋 - Enhances site security against types of attacks like XSS.

Token Expiry ⏳ - Regularly expiring and renewing tokens prevents unauthorized access.

Use of Security Standards and Frameworks 📘 - Guides your API security strategy.

Web Application Firewall 🔥 - Protects your site from HTTP-specific attacks.

API Versioning 🔄 - Maintains different versions of your API for seamless updates.

While it’s debatable whether some points relate to security, e.g.,, versioning, the list is a good starting point anyway. In this two-post series, I’d like to describe how we can implement each point with Apache APISIX (or not).

Hardening Apache APISIX with the OWASP's Coraza and Core Ruleset

Tue, 20 Feb 2024 08:01:56 +0000

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security. The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2021 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations.

Kicking the Tires of Docker Scout

Thu, 08 Feb 2024 08:47:20 +0000

I never moved away from Docker Desktop.

For some time, after you use it to build an image, it prints a message:

What's Next?
 View a summary of image vulnerabilities and recommendations → docker scout quickview

I decided to give it a try. I’ll use the root commit of my OpenTelemetry tracing demo . Let’s execute the proposed command:

docker scout quickview otel-catalog:1.0

Here’s the result:

 ✓ Image stored for indexing
 ✓ Indexed 272 packages
 Target │ otel-catalog:1.0 │ 0C 2H 15M 23L
 digest │ 7adfce68062e │
 Base image │ eclipse-temurin:21-jre │ 0C 0H 15M 23L
 Refreshed base image │ eclipse-temurin:21-jre │ 0C 0H 15M 23L
 │ │
What's Next?
 View vulnerabilities → docker scout cves otel-catalog:1.0
 View base image update recommendations → docker scout recommendations otel-catalog:1.0
 Include policy results in your quickview by supplying an organization → docker scout quickview otel-catalog:1.0 --org <organization>

Docker gives out exciting bits of information:

Java Flight Recording and Analysis with Azul Mission Control

Thu, 25 Jan 2024 07:59:42 +0000

Java Flight Recording (JFR) is a Java Virtual Machine (JVM) profiling and diagnostics tool. It enables you to collect and analyze data regarding the performance and behavior of a Java application. As JFR is included in the JVM, there is no need for additional tools or installations to make recordings of your applications.

By utilizing JFR, you gain valuable insights into the runtime behavior of your Java applications. It helps you to optimize performance, identify and troubleshoot issues, and ensure better overall reliability. JFR is designed with very low overhead, allowing its use in production environments with minimal impact on the performance of your application.

Unlocking Scrum: A Software Engineer's Journey - Part 1

Thu, 04 Jan 2024 16:12:26 +0000

Introduction

Hey there 🖐️, have you heard of Agile and Scrum?

If not, buckle up because we’re about to embark on a journey to Scrumland!

Scrum is a framework under the Agile umbrella that makes software development a breeze (or at least, less of a hurricane 🌪️).

It’s all about collaboration, flexibility, and delivering value in small, tasty chunks. 🍫

Understanding Scrum

Scrum is like a game with its own rules and players. It’s anchored on principles like transparency, inspection, and adaptation. Imagine a GPS that reroutes you when you take a wrong turn – that’s Scrum! 🗺️

Playing with WASM on Docker

Wed, 03 Jan 2024 07:48:29 +0000

The idea of bytecode that can run anywhere dates back to the JVM inception (as far as I know).

WebAssembly is the new implementation of an old idea. While WebAssembly is meant to run in the browser, Docker recently announced its capability to run WASM code without needing containers.

In this post, I want to explore how it can work.

Prerequisite

Running WebAssembly is a beta feature and requires using containerd. To enable containerd, go to the Docker Desktop dashboard, then Settings > Features in development > Beta features > Use containerd for storing and pulling image.

Foojay Podcast #38: Java in the Cloud

Mon, 25 Dec 2023 12:02:46 +0000

Java was born in 1995, when the internet as we know it today didn’t exist yet.

Cloud servers, Docker, Kubernetes, distributed systems, scaling up and down… these things are now part of our daily job, but Java wasn’t originally designed for it.

In this episode, we want to learn if the recent evolutions in OpenJDK, and ongoing related projects, will make Java a full Cloud member.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Five Apache Projects You Probably Haven't Heard Of (Yet)

Sun, 24 Dec 2023 10:17:38 +0000

In early 2021, I started to work on the Apache APISIX project. I have to admit that at the time I had never heard about it before.

As a result, in this article, I’d like to introduce some Apache projects that are less well-known than HTTPD or Kafka.

Apache APISIX

APISIX is an API Gateway . It builds upon OpenResty , a Lua layer built on top of the famous nginx reverse-proxy. APISIX adds abstractions to the mix, e.g. , Route, Service, Upstream, and offers a plugin-based architecture.

Canary Releases with Apache APISIX

Tue, 19 Dec 2023 08:01:55 +0000

In a few words, the idea of canary releases is to deliver a new software version to only a fraction of the users, analyze the results, and decide whether to proceed further or not. If results are not aligned with expectations, roll back; if they are, increase the number of users exposed until all users benefit from the new version.

In this article, I’d like to detail this introduction briefly, explain different ways to define the fraction, and show how to execute it with Apache APISIX.

Creating Executables For JavaFX Applications

Fri, 08 Dec 2023 13:46:50 +0000

Here on Foojay, you can already find some great articles on how to create native executables from your JavaFX code:

Let’s take a look in this article at the current state of what can be done with jpackage and GitHub Actions.

All the sources and workflow files used here can be found in the JavaPackageDemo repository .

Exploring the OpenTelemetry Collector

Sun, 03 Dec 2023 12:57:06 +0000

The OpenTelemetry Collector sits at the center of the OpenTelemetry architecture but is unrelated to the W3C Trace Context.

In my tracing demo , I use Jaeger instead of the Collector.

Yet, it’s ubiquitous, as in every OpenTelemetry-related post. I wanted to explore it further.

In this post, I explore the different aspects of the Collector:

The data kind: logs, metrics, and traces
Push and pull models
Operations: reads, transformations, and writes

First steps

A long time ago, observability as we know it didn’t exist; what we had instead was monitoring. Back then, monitoring was a bunch of people looking at screens displaying dashboards. Dashboards themselves consisted of metrics and only system metrics: mainly CPU, memory, and disk usage. For this reason, we will start with metrics.

Generative AI and Java - hype or urgent reality?

Mon, 06 Nov 2023 07:59:04 +0000

It’s hard to grasp that it’s been about a year since Chat GPT and other generative AI tools burst onto the scene. We’re all still grappling with, well, everything about them. Whatever equilibrium we eventually find, it’s clear that the world is changing. The whole world mind, not just the IT industry.

Olimpiu Pop and I have debated the situation multiple times, and we realised that there’s lots of rumour around AI and Java but not much in the way of fact.

Controlling JIT Compiler Overhead to Avoid CPU Autoscaling

Wed, 01 Nov 2023 07:54:33 +0000

Today’s modern, containerized, elastically scaling Java clusters often rely on CPU utilization as the main trigger for scaling out new instances. Imperfect as this metric may be, it is ubiquitous to scale out new instances based on CPU utilization going over some limit. Often that limit is surprisingly low, somewhere around 40 to 50%.

Azul Platform Prime replaces OpenJDK’s HotSpot C2 compiler with the Falcon JIT compiler. Falcon generates much faster code than OpenJDK, allowing you to handle more transactions in a container before hitting your CPU utilization limit. And, Prime’s smoother and more consistent execution allows you to safely raise your CPU utilization to 60-70%, resulting in massive gains in carrying capacity for each container and lower overall cloud costs to handle your total Java workload.

Resizing images on-the-fly

Mon, 23 Oct 2023 18:01:05 +0000

As a web architect, one of the many issues is asset management. And the most significant issue in assets is images. A naive approach would be to set an image and let the browser resize the image via CSS:

img {
 height: 100%;
 width: 100%;
 object-fit: contain;
}

However, it means that you download the original image. It entails two problems: the size of the original image and the suboptimal browser-based resizing.

Send Your Logs To Loki

Thu, 12 Oct 2023 08:00:12 +0000

One of my current talks focuses on Observability in general and Distributed Tracing in particular, with an OpenTelemetry implementation. In the demo, I show how you can see the traces of a simple distributed system consisting of: the Apache APISIX API Gateway, a Kotlin app with Spring Boot, a Python app with Flask, and a Rust app with Axum.

Earlier this year, I spoke and attended the Observability room at FOSDEM. One of the talks demoed the Grafana stack: Mimir for metrics, Tempo for traces, and Loki for logs. I was pleasantly surprised how one could move from one to the other. Thus, I wanted to achieve the same in my demo but via OpenTelemetry to avoid coupling to the Grafana stack.

Down the Rabbit Hole of an Apache APISIX Plugin

Wed, 27 Sep 2023 08:43:49 +0000

My demo, Evolving your APIs, features a custom Apache APISIX plugin. I believe that the process of creating a custom plugin is relatively well-documented. However, I wanted to check the parameters of the _M.access(conf, ctx) function, especially the ctx one.

The documentation states:

The ctx parameter caches data information related to the request. You can use core.log.warn(core.json.encode(ctx, true)) to output it to error.log for viewing.

Unfortunately, core.log ultimately depends on nginx’s logging, and its buffer is limited in size. Thanks to my colleague Abhishek for finding the info . For this reason, the ctx display is (heavily) truncated. I had to log data bit by bit; however, it was instructive.

System Architecture: Move Authentication to the API Gateway

Fri, 15 Sep 2023 07:47:04 +0000

When exposing an application to the outside world, consider a Reverse-Proxy or an API Gateway to protect it from attacks. Rate Limiting comes to mind first, but it shouldn’t stop there. We can factor many features in the API Gateway and should be bold in moving them from our apps. In this post, I’ll show how to implement authentication at the Gateway API stage.

Overall authentication flow

The API Gateway doesn’t authenticate but delegates authentication to an authentication provider. After authentication, the Gateway forwards the request to the app. The app checks authentication and gets the associated identity and permissions.

The DiscoAPI Helps You To Find Any OpenJDK Distribution

Tue, 12 Sep 2023 03:42:44 +0000

Did you know Foojay is not only a human-readable OpenJDK knowledge base but also provides the Disco API that lets you search all OpenJDK distributions? And even if you didn’t know, you probably already are using it, as it’s integrated into SDKMAN! , JReleaser , JBang! , Gradle toolchain , Paketo buildpacks ,and more.

The Disco API (i.e., the short name for the Universal OpenJDK Discovery API) is a database and API with all the available OpenJDK versions from all distributors, like Corretto, Liberica, Oracle, Temurin, Zulu, and many others. In total, there are now 89352 different packages at the end of August 2023.

Ops friendly Apache APISIX

Wed, 06 Sep 2023 06:27:42 +0000

Though I always worked on the Dev side of IT, I was also interested in the Ops side. I even had a short experience being a WebSphere admin: I used it several times, helping Ops deal with the Admin console while being a developer.

Providing a single package that Ops can configure and deploy in different environments is very important. As a JVM developer, I’ve been happy using Spring Boot and its wealth of configuration options: command-line parameters, JVM parameters, files, profiles, environment variables, etc.

Evaluating Apache APISIX vs. Spring Cloud Gateway

Thu, 27 Jul 2023 06:29:55 +0000

Given the number of API Gateways available on the market, I’m regularly asked which is better. Better is a very subjective term. However, there’s no denying that if you’re advocating for a product, you should know your product and its competitors. In this article, I’d like to share my understanding of Spring Cloud Gateway and how it compares to Apache APISIX.

I’m cautious when comparing products because most comparisons I read are heavily biased. That’s a risk, especially when working on one of the products one is comparing. I’ll also avoid “benchmarketing” - when you benchmark products in a context that favors your own; I’ll focus on the so-called Developer Experience.

Sticky sessions with Apache APISIX - the demo

Fri, 07 Jul 2023 16:54:25 +0000

We’ve described the concept behind sticky sessions : you forward a request to the same upstream because there’s context data associated with the session on that node.

However, if necessary, you should replicate the data to other upstreams because this one might go down. In this post, we are going to illustrate it with a demo.

The overall design

Design options are limitless. I’ll keep myself to a familiar stack, the JVM. Also, as mentioned in the previous post, one should only implement sticky sessions with session replication.

Sticky sessions with Apache APISIX

Fri, 07 Jul 2023 16:51:01 +0000

Sticky sessions, also known as session affinity, is a mechanism by which a routing component that acts as a facade always routes a request to the same underlying upstream node.

In this article, I’ll describe the reason behind sticky sessions, available alternatives, and how to implement them via Apache APISIX.

Why sticky sessions?

Sticky sessions became popular when we stored the state on the upstream node, not the database. I’ll use the example of a simplified e-commerce shop to explain further.

Foojay Podcast #26: The Future of Source Control and CI/CD

Mon, 26 Jun 2023 08:35:21 +0000

As developers, we like to automate the boring parts of our job. This automation includes the source control system, build pipelines, and code analysis tools.

In recent decades, we have seen evolutions from CVS to Subversion to Git. Is this the endpoint? Did we find the holy grail in version control? Or what evolutions are waiting for us?

Let’s find out together with these fantastic guests…

This is the final episode of season 2 of the Foojay Podcast. See you in September for the start of our new season with more JUGs, the launch of Java 21, and much more!

GitLab Pages Preview

Mon, 12 Jun 2023 08:55:31 +0000

When I write Apache APISIX-related blog posts, I want my colleagues to review them first. However, it’s my blog, and since I mix personal and business posts, I want to keep them from the repository. I need a preview, accessible only to a few, something like Vercel’s preview . I’m using GitLab Pages, and there’s no such out-of-the-box feature.

I tried two methods: GitHub gists and PDFs. Both have issues.

Managing Data Residency: The Demo

Mon, 29 May 2023 07:33:28 +0000

I explained the concepts and theory behind Data Residency in a previous post .

It’s time to get our hands dirty and implement it in a simple demo.

The sample architecture

In the last section of the previous post, I proposed a sample architecture where location-based routing happened at two different stages:

The API Gateway checks for an existing X-Country header. Depending on its value, it forwards the request to the computed upstream; If no value is found or no value matches, it forwards it to a default upstream.
The application uses Apache Shardingsphre to route again depending on the data. If the value computed by the API Gateway is correct, the flow stays “in its lane”; if not, it’s routed to the correct database, but with a performance penalty as it’s outside its lane.

I simplified some aspects:

Foojay Podcast #23: Java Profiling and Performance

Mon, 22 May 2023 10:23:52 +0000

How do you get the maximum performance out of your Java application?

And how to use profiling to find the bottlenecks?

Let’s learn all about it in this podcast, with Heinz Kabutz, Marcus Lagergren, Chris Newland, and Frank Delporte!

Java profiling is a crucial technique for measuring and improving the performance of applications.

It helps identify bottlenecks, memory leaks, and other application performance issues.

There are various challenges with using Java profiling, and the need for profiling depends on the complexity of the application and the performance requirements.

Fearless Distroless

Fri, 21 Apr 2023 08:59:50 +0000

With the rise of Docker came a new focus for engineers: optimizing the build to reach the smallest image size possible.

A couple of options are available.

Multi-stage builds. A Dockerfile can consist of multiple steps, each having a different Docker base image. Each step can copy files from any of the previous build steps. Only the last one will receive a tag; the others will be left untagged.This approach separates one or more build steps and a run step. On the JVM, it means that the first step includes compiling and packaging, based on a JDK, and the second step comprises running, based on a JRE.
Choosing the smallest base image size. The smaller the base image, the smaller the resulting image.

In this post, I’m going to focus on the second point.

DevOps For Developers: Continuous Integration, GitHub Actions

Tue, 04 Apr 2023 07:35:12 +0000

I first ran into the concept of Continuous Integration (CI) when the Mozilla project launched.

It included a rudimentary build server as part of the process and this was revolutionary at the time.

I was maintaining a C++ project that took 2 hours to build and link.

We rarely went through a clean build which created compounding problems as bad code was committed into the project.

A lot has changed since those old days.

Analyzing & Tuning Warm-up: Azul Zulu Prime Builds of OpenJDK

Sat, 01 Apr 2023 16:35:31 +0000

Warm-up is the time taken for the Java application to reach the optimum compiled code performance.

It is the task of the Just-in-Time (JIT) compiler to deliver optimal performance by producing optimized compiled code from application bytecode. This article will give you a basic understanding of how JIT compilation works and how to optimize warm-up using Azul Zulu Prime Builds of OpenJDK (Azul Zulu Prime JDK).

This post has been reviewed and extended on July 20th of 2023 thanks to the contributions of Matt Van Order.

How to create SBOMs in Java with Maven and Gradle

Fri, 17 Mar 2023 09:08:28 +0000

When building applications in Java, we highly depend on external libraries and frameworks. And each Java package that is imported likely also depends on more libraries. This means that the amount of Java packages included in your application is often not really transparent.

As a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using.

Recently, we discussed why and how we should maintain our dependencies carefully. In the article Best practices for managing Java dependencies , I discussed the options and tools available for setting up a dependency management strategy.

DevOps for Developers - Introduction and Version Control

Sun, 12 Mar 2023 09:13:33 +0000

I start some of my talks with a joke: back in my day we didn’t have monitoring or observability. We’d go to the server and give it a kick. Hear the HD spin? It’s working!

We didn’t have DevOps. If we were lucky we had some admins and a technician to solve hardware issues. That’s it.

In a small company, we would do all of that ourselves. Today this is no longer practical. The complexity of deployment and scale is so big, it’s hard to imagine a growing company without an engineer dedicated to the operations.

Event Driven Hello World Program

Thu, 02 Mar 2023 16:34:35 +0000

Event-driven microservices can be straightforward to describe before they are implemented, tested and maintained.

They are also highly responsive to new information in real time, with latencies in Java of below 10 microseconds 99.99% of the time depending on the functionality of the small independently deployable microservice.

In this introductory article, we use an example event-driven Hello World program (a programming paradigm where the program flow is determined by events) to step through behaviour-driven development , where we describe the behaviour the business needs first as test data, and writing a very simple microservice which turns input events like this:

SBOMs and Software Composition Analysis │ Foojay.io

Mon, 27 Feb 2023 08:11:28 +0000

This article is the second in a series about SBOMs, software supply chains, the government and you.

I hope you are still hungry after the first article as more cake is available below!

If you have read the first article in this series that introduces SBOMs SBOMs: First Steps in a New Journey for Developers | Foojay.io then you already know how important they are and will be increasingly going forward.

Journeys in Java, Level 9: Docker compose all the things

Sun, 26 Feb 2023 10:02:15 +0000

Our microservices project contains quite a few pieces now.

We have two databases, three API services, a user-view service for books, and a service to host our configuration.

With so many pieces to manage, it would be nice to have something that orchestrates the individual services into a system, such as Docker Compose.

Back in our Level 5 rendition, we did exactly this for our smaller version of the project.

Now that we have expanded our services, we need to add those new pieces into the existing Docker Compose management umbrella.

Update or Upgrade Java... and Which Version Should You Use?

Thu, 23 Feb 2023 09:12:39 +0000

Update versus Upgrade: what’s the difference and what are the consequences of your decision?

Since 2018, every six months we get an upgrade to a new OpenJDK version, and this year versions 20 and 21 will be released.

Next to these six-month releases, OpenJDK distributor Azul, amongst others, provides four critical patch updates (CPU) and patch set updates (PSU) per year.

So what’s the difference between a Java upgrade and an update?

SBOMs: First Steps in a New Journey for Developers

Tue, 14 Feb 2023 10:01:28 +0000

This article is the first in a series about SBOMs, software supply chains, the government and you. Buckle up - it’s going to be a wild ride. Luckily there is cake to see you through.

Software bill of materials, anyone? A year ago, most developers had not heard of the ‘SBOM’ acronym.

Indeed, related terms like “software supply chain” or “security hygiene” were absent from most developers’ vocabularies.

Things are about to change! This year is already shaping up to be the year of SBOMs, of securing the software supply chain, and of the appearance of legislation that enforces better security practices among those involved in software. Whether in creation, testing, deploying, securing or operating, we all have specific security responsibilities in protecting our part of the software supply chain.

Securing Admin Access to Apache APISIX

Sat, 11 Feb 2023 16:34:59 +0000

API Gateways are critical components in one’s infrastructure.

If an attacker could change the configuration of routes, they could direct traffic to their infrastructure.

Consequences could range from data theft to financial losses.

Worse, data theft could only be noticed after a long time by mirroring the load.

Hence, protecting your API Gateway is of utmost importance.

In this short article, I’ll list a couple of ways to secure your Apache APISIX admin access.

How to Run a Java Application with CRaC in a Docker Container

Wed, 01 Feb 2023 09:41:11 +0000

CRaC (Coordinated Restore at Checkpoint) is an OpenJDK project that was developed by Azul to solve the problem of “slow” startup times of the Java Virtual Machine in a microservice environment.

The most up-to-date guidelines can be found on “Coordinated Restore at Checkpoint Usage Guidelines ” in the Azul Docs.

When the JVM runs your application code, it does things like interpreting, compiling and optimizing code to make your application run as fast as possible under the given workload. This is great but can take some time and especially when you run short lived microservices you don’t want to wait until the JVM has produced the most optimized code.

Release with JReleaser to Maven Central with GitHub Actions

Wed, 18 Jan 2023 08:55:48 +0000

This guide is outdated since 2024. There is a new version here: https://foojay.io/today/how-to-publish-a-java-maven-project-to-maven-central-using-jreleaser-and-github-actions-2025-guide/

{#more-61688}

This article is a tutorial that guides you through the process of releasing a Java module with JReleaser to Maven Central with Github Actions.

JReleaser is a tool that streamlines the release process for Java projects, allowing developers to quickly and efficiently publish their modules to Maven Central.

If you just want to publish your Maven project by hand, then you can follow How to Publish a Java Maven Project to the Maven Central Repository by @Tobias Briones .

Azul Provides the CRaC in AWS SnapStart Builds

Tue, 20 Dec 2022 07:45:54 +0000

At Azul, we are very excited about the Amazon Web Services launch of SnapStart for Lambdas .

SnapStart is based on the CRaC (Coordinated Restore at Checkpoint) API developed in OpenJDK, which was originated and led by Azul.

What is the CRaC API?

The CRaC API provides a common way for Java applications to coordinate with underlying checkpoint/restore mechanisms, allowing Java code to work seamlessly and portably across various checkpoint/restore mechanisms as they become available.

Compilation Avoidance with Gradle

Tue, 13 Dec 2022 15:35:31 +0000

We at Gradle recently noticed some community chatter about speeding up Gradle compilation on the JVM by ignoring changes not affecting the application binary interface (ABIs) of dependencies.

What a great idea! In fact, Gradle has used ABIs for Java out of the box for this without any extra configuration since version 3.4 .

We refer to this feature as compilation avoidance .

This post explains what ABI-based compilation means for the average workflow. Spoiler: utilizing compilation avoidance is one of the best performance enhancements for any build.

A Poor Man's API

Tue, 29 Nov 2022 09:13:38 +0000

Creating a full-fledged API requires resources, both time and money.

You need to think about the model, the design, the REST principles, etc., without writing a single line of code.

Most of the time, you don’t know whether it’s worth it: you’d like to offer a Minimum Viable Product and iterate from there.

I want to show how you can achieve it without writing a single line of code.

The solution

The main requirement of the solution is to use the PostgreSQL database . It’s a well-established Open Source SQL database.

Foojay Podcast #7: Security in Java -- what do we need to know?

Mon, 21 Nov 2022 10:22:14 +0000

For this Foojay Podcast**,** we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.

How can you make and keep your systems safe?

That’s what we want to find out…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Reducing Tail Latencies with Chronicle Queue Enterprise

Wed, 09 Nov 2022 15:07:36 +0000

Persistent queue solutions are frequently used when designing low-latency applications.

The problem is that high sustained message rates, or bursty workloads, can lead to delays caused by the OS or hardware which are challenging to mitigate.

In this article, we will describe how Chronicle Queue Enterprise solves this.

Background

When benchmarking Java low-latency persistent queue solutions, latencies tend to be excellent up to high percentiles until sustained throughput limits are reached; these sustained throughput limits are determined by disk performance, OS version, and configuration.

Geo-routing with Apache APISIX

Mon, 07 Nov 2022 16:41:47 +0000

Apache APISIX, the Apache-led API Gateway, comes out of the box with many plugins to implement your use case.

Sometimes, however, the plugin you’re looking for is not available.

While creating your own is always possible, it’s sometimes necessary.

Today, I’ll show you how to route users according to their location without writing a single line of Lua code.

Why geo-routing?

Geo-routing is to forward HTTP requests based on a user’s physical location, inferred from their IP. There are many reasons to do that, and here is a couple of them.

Creating Terabyte Sized Queues with Low-Latency

Wed, 02 Nov 2022 10:45:07 +0000

Queues are often fundamental components in software design patterns.

But, what if there are millions of messages received every second and multi-process consumers need to be able to read the complete ledger of all messages?

Java can only hold so much information before the heap becomes a limiting factor with high-impacting garbage collections as a result, potentially preventing us from fulfilling targeted SLAs or even halting the JVM for seconds or even minutes.

Discuss the Problem, Not the Solution!

Tue, 01 Nov 2022 10:56:17 +0000

As a tech guy, I love to discuss technologies. And as discussions go, it’s generally the comparison kind: JVM vs. Net, Java vs. Kotlin, Go vs. Rust, Maven vs. the unspeakable one, etc.

However, it’s too easy to fall into the quagmire of the merits and flaws of our beloved toys, talk about them for hours, and not reach a satisfactory agreement.

A couple of years ago, I worked as a “Solution Architect”.

Renovate: Dependabot Alternative

Fri, 28 Oct 2022 07:17:55 +0000

I won’t introduce Dependabot . Lots and lots of developers use it daily on GitHub. I do use it as well. However, it suffers from two drawbacks:

While it’s perfectly integrated with GitHub, integrations with other platforms are less seamless.
It’s limited in the list of ecosystems it supports For example, I generally use Docker Compose files for my demos. When necessary, I use Kubernetes. Dependabot supports none.Worse, Dependabot doesn’t accept contributions to add new ecosystems .

Recently, I watched Viktor Farcic’s Automate Dependency Management With Renovate . I found Renovate super neat, thought about using it, and… forgot. Then I stumbled upon another mention of it. It pushed me to implement it in two locations:

Why the Fastest Way of Serializing a Java Field is not Serializing it at All

Tue, 25 Oct 2022 12:54:49 +0000

This article elaborates on different ways of serializing Java objects and benchmarks performance for the variants. Read this article and become aware of different ways to improve Java serialization performance.

In a previous article about open-source Chronicle Queue , there was some benchmarking and method profiling indicating that the speed of serialization had a significant impact on execution performance. After all, this is only to be expected as Chronicle Queue (and other persisted queue libraries) must convert Java objects located on the heap to binary data, which is subsequently stored in files. Even for the most internally efficient libraries, this inevitable serialization procedure will largely dictate performance.

High-Performance Java Serialisation to Different Formats

Wed, 12 Oct 2022 14:15:06 +0000

Java serialisation is a popular mechanism where you are able to serialise and deserialise complex object graphs; for example where object A can contain a reference to object B, which in turn has a reference back to object A.

The problem is that this rich functionality comes at a performance cost.

However, if you do not need to serialise these types of recursive graphs, you can instead use an open source solution called Chronicle Wire.

Low Latency Microservices, A Retrospective

Thu, 06 Oct 2022 06:25:56 +0000

I wrote an article on low latency microservices almost five years ago now. Chronicle Software has worked with a number of tier one investment banks to implement and support those systems. What has changed in that time and what lessons have we learnt?

Read this article and learn what we learned after five years of developing and supporting low latency microservices.

Separation of Concerns Gives Better Testability

Microservices repeatedly demonstrated that testing and debugging business components were much easier with simple, stand-alone components with clear contracts between microservices.

The Maze of Python Dependency Management

Mon, 03 Oct 2022 12:49:11 +0000

For over 20 years, I’ve developed code for the JVM, first in Java, then in Kotlin.

However, the JVM is not a silver bullet, e.g., in scripts:

Virtual machines incur additional memory requirements.
In many cases, the script doesn’t run long enough to gain any benefit performance-wise. The bytecode is interpreted and never compiles to native code.

For these reasons, I now write my scripts in Python. One of them collects social media metrics from different sources and stores them in BigQuery for analytics.

Starting Docker Desktop with Spring Boot

Fri, 30 Sep 2022 05:37:53 +0000

I came across Docker Desktop for the first time about three years ago, when I was working as a Principal Architect (Strategic R & D) on the Microservices Reference Architecture for a product development organization.

At that time, when I was working on my corporate laptop - It became a tedious task to configure virtualization and settings to get it to work. Once I got it running smoothly, I realized that the memory requirements required to run it is quite high. At times, I found it tough to use my laptop for daily development with it running. It was also because I was working on microservices and had almost 6+ spring boot applications running.

Reclaiming Persistent Volumes in Kubernetes

Wed, 28 Sep 2022 09:55:19 +0000

Kubernetes is a widely used open-source container management platform for running stateless, containerized applications at scale. In recent years, Kubernetes has been extended to also support stateful workloads, including databases and key-value stores.{#43de}

There are three important API resources when it comes to managing stateful applications in Kubernetes:{#8e8a}

STSs schedule stateful pods, which can claim PVs through PVCs and mount them as volumes. Once a PV is claimed by an STS replica, Kubernetes will make sure that the volume stays with the replica, even if the pod gets rescheduled.{#e855}

Storing 1TB in Virtual Memory on a 128GB Machine

Tue, 27 Sep 2022 09:10:43 +0000

If you use a standard JVM like the Oracle JVM or the OpenJDK, you might find that as the heap size grows the performance of your JVM can drop as GC pause time escalates.

This tends to be a problem around 32 GB of heap, but it often depends on the application at which point the size of your heap becomes a problem.

One way around this is to use an always concurrent collector such as Azul Platform Prime which is designed to both scale to much larger heap sizes and even reduces the GC pause times for smaller heap consistently.

Apache APISIX Loves Rust! (And Me Too)

Mon, 26 Sep 2022 09:23:23 +0000

Apache APISIX is built upon the shoulders of two giants:

NGINX , a widespread Open Source reverse-proxy
OpenResty , a platform that allows scripting NGINX with the Lua programming language via LuaJIT

This approach allows APISIX to provide out-of-the-box Lua plugins that should fit most business requirements. But it always comes a time when generic plugins don’t fit your requirements. In this case, you can write your own Lua plugin.

A Better Way To Use Gradle With Github Actions

Wed, 21 Sep 2022 12:54:10 +0000

Running Gradle builds on GitHub Actions

GitHub Actions provides a convenient and powerful CI platform for projects hosted on GitHub. To enhance the experience of building Gradle projects on GitHub Actions, the Gradle team has developed the gradle-build-action.

Together with Gradle Build Scans™, the gradle-build-action provides deep integration between Gradle and GitHub Actions, providing easier setup and a better experience when building and testing your Gradle project with GitHub Actions.

Introduction to Kubernetes Extensibility

Tue, 20 Sep 2022 09:44:43 +0000

Kubernetes offers a lot of benefits: an enormous ecosystem with plenty of actors, self-healing capabilities, etc. There’s no free lunch, though. It also comes with downsides, chief among them its complexity and operating costs.

However, the more I work with Kubernetes, the more I think its most significant asset is extensibility. If you need something that the platform doesn’t provide by default, there’s an option to develop it yourself and integrate it. In this post, I’d like to list such extension points.

Let's Create Mappers Without Creating Underlying Objects in Java

Tue, 20 Sep 2022 09:16:35 +0000

As most Java developers know, putting values in a Java Map (like a HashMap) involves creating a large number of auxiliary objects under the covers.

For example, a HashMap with int keys and long values might, for each entry, create a wrapped Integer, a wrapped Long object and a Node that holds the former values together with a hash value and a link to other potential Node objects sharing the same hash bucket.

How the world caught up with Apache Cassandra

Thu, 15 Sep 2022 16:50:50 +0000

The O’Reilly book, Cassandra: The Definitive Guide, features a quote from Ray Kurzweil, the noted inventor and futurist: {#speakable-summary}

“An invention has to make sense in the world in which it is finished, not the world in which it is started.”

This quote has a prophetic ring to it, especially considering my co-author Eben Hewitt included it in the 2010 first edition of this book we wrote, back when Apache Cassandra, the open-source, distributed, and highly scalable NoSQL database, was just on its 0.7 release.

Best Practices for Managing Java Dependencies

Thu, 15 Sep 2022 08:21:10 +0000

Creating Java applications is great, and many resources are available.

To speed up development, many folks use frameworks and libraries that do some of the heavy lifting.

When looking at modern Java applications, almost all of them contain dependencies from libraries developed by someone else.

Dependencies take up about 80 to 90 percent of the binary — so, we should take good care of them when creating a Java project.

A Quick Glance at the Kubernetes Gateway API

Mon, 12 Sep 2022 09:55:16 +0000

In one of my recent blog posts , I described several ways to access Kubernetes pods. One can access a pod through its IP, but pods are naturally transient. The nominal way is to configure a Service: its IP is stable, and Kubernetes’ job is to keep the mapping between a Service and its underlying pods up-to-date.

Different kinds of services are available: internal only, NodePort to finally allow access from outside the cluster, and LoadBalancer that relies on a third-party component - in general, a cloud provider one.

Multi-cluster Cassandra with Google Kubernetes Engine (Pt. 2)

Thu, 08 Sep 2022 17:20:08 +0000

This is the second in a series of posts examining patterns for using K8ssandra to create Cassandra clusters with different deployment topologies.

In the first article in this series, we looked at how you could create a Cassandra cluster with two datacenters in a single cloud region, using separate Kubernetes namespaces in order to isolate workloads. For example, you might want to create a secondary Cassandra datacenter to isolate a read-heavy analytics workload from the datacenter supporting your main application.

Running your Database on OpenShift and CodeReady Containers

Tue, 06 Sep 2022 09:43:57 +0000

Let’s take an introductory run-through of setting up your database on OpenShift, using your own hardware and RedHat’s CodeReady Containers.

CodeReady Containers is a great way to run OpenShift K8s locally, ideal for development and testing. The steps in this blog post will require a machine, laptop or desktop, of decent capability; preferably quad CPUs and 16GB+ RAM.

Download and Install RedHat’s CodeReady Containers

Download and install RedHat’s CodeReady Containers as described in Red Hat OpenShift 4 on your laptop: Introducing Red Hat CodeReady Containers

Learning by Auditing Kubernetes Manifests

Mon, 05 Sep 2022 08:44:17 +0000

Last year, I spoke at the National DevOps Conference that took place at the British Museum. I had already visited the museum before, but speaking there was a fantastic experience. Besides, we had the museum all for ourselves for a couple of hours. If you’ve ever visited the place, you know what I mean.

Anyway, I also attended a talk about Checkov :

Checkov scans cloud infrastructure configurations to find misconfigurations before they’re deployed.

End-to-End Tracing with OpenTelemetry

Mon, 29 Aug 2022 14:24:00 +0000

Whether you implement microservices or not (and you probably shouldn’t), your system is most probably composed of multiple components.

The most straightforward system is probably made of a reverse proxy, an app, and a database.

In this case, monitoring is not only a good idea; it’s a requirement.

The higher the number of components through which a request may flow, the strongest the requirement.

However, monitoring is only the beginning of the journey.

Back to Basics: Accessing Kubernetes Pods

Mon, 22 Aug 2022 13:56:58 +0000

Kubernetes is a colossal beast. You need to understand many different concepts before it starts being useful.

When everything is set up, you’ll probably want to expose some pods to the outside of the cluster.

Kubernetes provides different ways to do it: I’ll describe them in this post.

Setup

For the sake of the demo, I’ll be using Kind :

kind is a tool for running local Kubernetes clusters using Docker container “nodes”. kind was primarily designed for testing Kubernetes itself, but may be used for local development or CI.

Bridge the DevOps/Dev Gap without Sacrificing Reliability

Fri, 19 Aug 2022 09:16:00 +0000

DevOps culture revolutionized our industry. Continuous Delivery and Continuous Integration made six sigma reliability commonplace. 20 years ago we would kick the production servers and listen to the hard drive spin, that was observability. Today’s DevOps teams deploy monitoring tools that provide development teams with deep insight into the production environment.

“O brave new world That has such people in’t!”

— William Shakespeare

Before DevOps practices were commonplace, production used to fail. A lot. We don’t want to go back to the time before DevOps tools were commonplace…

Secure CI/CD Pipelines with GitHub Actions for Your Java Apps

Thu, 11 Aug 2022 06:28:38 +0000

This article was originally post atSnyk.io and is used with permission

GitHub Actions has made it easier than ever to build a secure continuous integration and continuous delivery (CI/CD) pipeline for your GitHub projects.

By integrating your CI/CD pipeline and GitHub repository, GitHub Actions allows you to automate your build, test, and deployment pipeline.

You can create workflows that build and test every pull request to your repository or deploy merged pull requests to production.

Deploy a Multi-Datacenter Cassandra Cluster in Kubernetes

Wed, 10 Aug 2022 08:27:59 +0000

The Get Started examples on the K8ssandra site are primarily concerned with spinning up a single Apache Cassandra datacenter in a single Kubernetes cluster.

However, there are many situations that can benefit from other deployment options.

In this series of articles, we’ll examine different deployment patterns and show how to implement them using K8ssandra.

Flexible topologies with Cassandra

From its earliest days, Cassandra has included the ability to assign nodes to datacenters and racks. A rack was originally conceived as mapping to a single rack of servers connected to shared resources, like power, network, and cooling.

Write Your Own Service Discovery Client for Apache APISIX

Mon, 01 Aug 2022 10:27:42 +0000

API Gateways in general, and Apache APISIX in particular, provide a single entry point into one’s information system.

This architecture allows for managing load balancing and failover over similar nodes.

For example, here’s how you can create a route balanced over two nodes in Apache APISIX:

curl http://localhost:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d '{
 "uri": "/*",
 "upstream": {
 "type": "roundrobin",
 "nodes": {
 "192.168.0.1:80": 1, # 1
 "192.168.0.2:80": 1 # 1
 }
 }
}'

Every request has a 50/50 chance of being sent to either node

It worked for a long time, but in this day and age, nodes are probably not pets but cattle: they come, and they go. Hence, it’s essential to dynamically update the nodes list when it happens.

Kubernetes and the Data Centre: Is Full Scale Migration Possible?

Thu, 21 Jul 2022 13:48:13 +0000

Data centres used to be exactly that - the centres of our data worlds, where all information, files and records would be kept and controlled.

Today, that is no longer the case. More companies are moving to cloud services, whether this is dialling down on their traditional on-premises environments or never setting them up in the first place.

This is not to say that data centres will be wholly abandoned for cloud, but the mix will continue to evolve and be very different to today. Gartner predicts that by 2025, 85% of infrastructure strategies will take a more hybrid approach, integrating on-premises, colocation, cloud and edge delivery options, compared with 20% in 2020.

General Build Distribution: A Game-Changer or a Gimmick?

Wed, 20 Jul 2022 21:09:29 +0000

Understand the performance potential of remote and distributed builds and explore how to improve build feedback times.

The Remote and Distributed Build Patterns article explains the differences between remote and distributed builds and variations on each. Specifically, we distinguished between “test distribution” and “general build distribution”.

This article discusses distributed builds in a broader perspective of improving build feedback times. We’ll start by explaining the types of changes engineers tend to make, identify the typical bottlenecks and share how these relate to distributed builds. We will also study the performance potential of general build distribution. Finally, we will explore a holistic approach to improving build feedback times.

Why a Cloud-Native Database Must Run on K8s

Tue, 19 Jul 2022 17:44:09 +0000

We’ve been talking about migrating workloads to the cloud for a long time, but a look at the application portfolios of many IT organizations demonstrates that there’s still a lot of work to be done. In many cases, challenges with persisting and moving data in clouds continue to be the key limiting factor slowing cloud adoption, despite the fact that databases in the cloud have been available for years.

For this reason, there has been a surge of recent interest in data infrastructure that is designed to take maximum advantage of the benefits that cloud computing provides. A cloud-native database is one that achieves the goals of scalability, elasticity, resiliency, observability and automation; the K8ssandra project is a great example. It packages Apache Cassandra and supporting tools into a production-ready Kubernetes deployment.

Remote and Distributed Build Patterns

Tue, 19 Jul 2022 10:48:48 +0000

Remote and distributed builds are terms frequently used, misused and abused. Here we share insight for what these terms mean and how they affect your build feedback times.

A frequently-requested feature for the Gradle Build Tool is the ability to perform remote or distributed builds.

But what exactly does this mean? And what are the motivations behind the requests?

This article will explore the difference between remote vs. distributed builds and their variations. As there is no industry-wide agreement on consistent terminology for these concepts, the goal of this article is to give an overview of these patterns and how they relate to each other.

How to Secure Your Web Apps With An API Gateway

Mon, 18 Jul 2022 18:50:10 +0000

API management solutions, also known as API gateways, are a must in this day and age of APIs.

However, once you’ve set up such a gateway, you can use it for different purposes unrelated to APIs.

Today, I want to show you how to improve the security of web apps.

Prevent sniffing

Browsers are fantastic pieces of technology that try to make the life of users as comfortable as possible.

The End of the Beginning for Apache Cassandra

Tue, 12 Jul 2022 17:43:39 +0000

Image: Pixabay

Editor’s note: This story originally ran on July 27, 2021, the day that Apache Cassandra 4.0 was released.{#4bbb}

Today is a big day for those of us in the Apache Cassandra community. After a long uphill climb, Apache Cassandra 4.0 has finally shipped . I say finally, because it has at times seemed like an elusive goal. I’ve been involved in the Cassandra project for almost 10 years now and I have seen a lot of ups and downs.{#d6a4}

K8ssandra ramps up security features to match Kubernetes’ best practices

Thu, 23 Jun 2022 19:54:58 +0000

New security features are coming to the open-source data platform: K8ssandra. The goal? To align even more with the security best practices of Kubernetes. Here’s an introduction to the platform’s security mission and an update on current initiatives.{#e3b8}

The security defaults applied by K8ssandra are about to get even more aligned withKubernetes’ security practices . In an upcoming release of K8ssandra, pod and container security configurations give users full customization capabilities and default values out of the box.{#c373}

Tombstones and Ghost Data Don’t Have to Be Scary!

Thu, 09 Jun 2022 20:36:25 +0000

Working with tombstones can be one of the more frustrating aspects of Apache Cassandra®. Problems with tombstones can happen when a large number of deletes occur within a short period of time, resulting in slower queries and disk bloat. This article will discuss tombstones, including the purpose they serve, and strategies/methods on how to avoid them.{#2508}

Tombstones in Apache Cassandra ® are written markers that are created whenever a value is deleted. Their purpose is to indicate that any prior values have been deleted. When a read occurs, it pulls data from the sorted string table (SSTable) files on a node that may contain the data. All prior values for the requested key are returned, ordered by write-time.{#d711}

Managing Distributed Applications in Kubernetes Using Cilium and Istio with Helm and Operator for Deployment

Tue, 07 Jun 2022 14:51:03 +0000

This post will show you the benefits of managing your distributed applications with Kubernetes in cross-cloud, multi-cloud, and hybrid cloud scenarios using Cilium and Istio with Helm and Operator for deployment.{#6864}

In our recent post on The New Stack , we showed you how you can leverage Kubernetes (K8s) and Apache Cassandra TM to manage distributed applications at scale, with thousands of nodes across both on-premises and in the cloud. In that example, we used K8ssandra and Google Cloud Platform (GCP) to illustrate some of the challenges you might expect to encounter as you grow into a multi-cloud environment, upgrade to another K8s version, or begin working with different distributions and complimentary tooling. In this post, we’ll explore a few alternative approaches to using K8s to help you more easily manage distributed applications.{#fec3}

How to Develop and Test an Automated CI/CD Workflow with Cassandra

Fri, 03 Jun 2022 08:52:14 +0000

In this post, we’ll show you how to develop a CI/CD workflow using Apache Cassandra ™with a GitHub Actions runner. See for yourself how much time and effort you can save by deploying Cassandra cloud-natively while you test and deploy your cloud-native applications!{#6067}

If you have projects that depend on Apache Cassandra ™ and you want to develop an automated continuous integration and continuous delivery (CI/CD) flow, you’re going to need to create Cassandra clusters dynamically for your tests to make sure that your app works after each code change. DataStax does this every day — we run Cassandra in Kubernetes to power Astra DB . And, we use continuous testing of our Cassandra deployments to make sure Astra DB works reliably.{#8d10}

Publish a Java Project to the Maven Central Repository

Fri, 13 May 2022 06:22:58 +0000

This guide will describe how to publish the JDesk framework to Maven Central.

The project is written in Java using Maven as the build tool. So, the process will be detailed for Java projects with a pom.xml file.

You can follow this article if you need to publish a Java Maven-based library or artifact to Maven.

Get Ready for Publishing Packages

Publishing a Java artifact is not as trivial as Python or JavaScript packages can be deployed.

How To Modernize Legacy Code in Production

Mon, 09 May 2022 15:58:36 +0000

I spent over a decade as a consultant working for dozens of companies in many fields and pursuits. The diversity of each code base is tremendous. This article will try to define general rules for modernizing legacy code that would hopefully apply to all. But it comes from the angle of a Java developer.

When writing this, my primary focus is on updating an old Java 6 era style J2EE code to the more modern Spring Boot/Jakarta EE code. However, I don’t want to go into the code and try to keep this generic. I discuss COBOL and similar legacy systems too. Most of the overarching guidelines should work for migrating any other type of codebase too.

Conditional Builds on GitLab

Mon, 09 May 2022 09:16:26 +0000

Regular readers of my articles know that I’m using Jekyll to generate my static blog site, together with GitLab. When I push on the master branch, it triggers the generation job.

However, Jekyll is Ruby-based and requires a couple of Gem dependencies. I’ve also added a few plugins. For this reason, I’ve created a Docker image with all required dependencies . Regularly, I update the versions in the Gemfile.lock via Bundler. Afterward, I need to rebuild the Docker image.

Securely Authenticate to Google Cloud from GitHub

Mon, 02 May 2022 08:57:00 +0000

Recently, I designed a simple metrics-tracking system.

A Python script queries different providers’ APIs for metrics, e.g., Twitter, GitHub, etc.

The idea is to run this script each day, store them in Google BigQuery and provide an excellent data visualization in Google Data Studio.

I’m a big fan of automation, so I’m using GitHub Actions.

Accessing Google Cloud with a Service Account

I query the different APIs with different Python libraries. All of them allow authenticating by passing a parameter. In general, it’s a token. One can store the value in a GitHub secret, get it as an environment variable in the GitHub Action and use it in the code.

Full Stream Ahead: Astra Streaming, Powered by Apache Pulsar

Thu, 24 Mar 2022 09:22:15 +0000

With a serverless architecture, multi-region geo replication, and Apache Cassandra’s legendary performance, DataStax Astra DB makes it easy for developers and enterprises to start small with their applications and grow them to infinite scale without constant performance tuning and optimization exercises.

However, cloud app developers also face significant challenge`s beyond data at rest. Modern data apps require high-scale streaming technologies that can deliver the reactive engagement at the point of interaction that end users have come to expect. That’s why today, we’re excited to announce that these capabilities have been added to DataStax Astra.

JDKMon 17.0.23 Released

Fri, 11 Mar 2022 09:52:39 +0000

JDKMon is a little tool written in JavaFX that tries to detect all OpenJDK distributions installed on your machine while keeping track of updates for those distributions.

It will scan for new updates every three hours and will inform you about available updates.

Note: JDKMon won’t install the distributions on your machine but will enable you to download them to a place of your choice.

At the moment the following distributions are supported:

The Serverless Database You Really Want

Thu, 03 Mar 2022 20:43:05 +0000

The dreaded part of every site reliability engineer’s (SRE) job eventually: capacity planning. You know, the dance between all the stakeholders when deploying your applications. Did engineering really simulate the right load and do we understand how the application scales? Did product managers accurately estimate the amount of usage? Did we make architectural decisions that will keep us from meeting our SLA goals? And then the question that everyone will have to answer eventually: how much is this going to cost? This forces SREs to assume the roles of engineer, accountant and fortune teller.

Save Hours on your Setup of K8ssandra with the New Config Builder

Thu, 24 Feb 2022 19:36:47 +0000

Setting up K8ssandra in your workflow just got a whole lot easier. With the new Config Builder you can be running Apache Cassandra® on Kubernetes in a matter of minutes.

The purpose of K8ssandra is to make it easy to run Apache Cassandra® on Kubernetes. We recently took another big step in that direction by releasing the K8ssandra config builder .

Even if you’ve created thousands of nodes or integrated K8ssandra in your stack, you’ll probably want to give the config builder a try. Walk through the interactive wizard defining the shape of your cluster, resource requirements, and toggle features to fit your needs. This is great for smoothing out the on-ramp for a production ready environment of K8ssandra.

Why we decided to build a K8ssandra Operator - Part 4

Tue, 22 Feb 2022 17:04:28 +0000

In the first , second , and third posts in this series, we’ve shared conversations with K8ssandra core team members on our journey to build a Kubernetes operator for K8ssandra. We’ve discussed the virtues of the Helm package manager versus Kubernetes operators for deploying and managing infrastructure in Kubernetes and some of our implementation choices for the operator.

In this final post of the series, we pick up from the previous post with a discussion of how we decided to structure our projects in GitHub, how we test the K8ssandra operator, and our hopes for how the operator will expand the K8ssandra developer community.

Cassandra Database Migration to Kubernetes with Zero Downtime

Tue, 15 Feb 2022 15:22:15 +0000

K8ssandra is a cloud-native distribution of the Apache Cassandra® database that runs on Kubernetes, with a suite of tools to ease and automate operational tasks. In this post, we’ll walk you through a database migration from a Cassandra cluster running in AWS EC2 to a K8ssandra cluster running in Kubernetes on AWS EKS, with zero downtime.

As an Apache Cassandra user, your expectation should be that migrating to K8ssandra would happen without downtime. To make that happen with “classic” clusters running on virtual machines or bare metal instances, you will use the datacenter (DC) switch technique which is commonly used in the Cassandra community to transfer clusters to different hardware or environments. The good news is that it’s not very different for clusters running in Kubernetes as most Container Network Interfaces (CNI) will provide routable pod IPs.

Deploying to Multiple Kubernetes Clusters with the K8ssandra Operator

Fri, 04 Feb 2022 22:10:56 +0000

We built the new K8ssandra Operator to simplify deploying multiple Apache Cassandra data centers in different regions and across multiple Kubernetes (K8s) clusters. We’re not at the finish line just yet, but we’ve hit the first major milestone. Now, it’s easier than ever to run Apache Cassandra® across multiple K8s clusters in multiple regions with the K8ssandraCluster!

The K8ssandraCluster is a new custom resource for K8ssandra that covers all the bases necessary for installing a production-ready, multi-cluster K8ssandra deployment. Head over to the DataStax Tech blog to learn more about how to specify your remote clusters with the K8ssandraCluster, its deployment architecture, and what’s coming next in our continued development of the K8ssandra operator.

Backing up K8ssandra with MinIO

Thu, 03 Feb 2022 22:50:09 +0000

K8ssandra includes Medusa for Apache Cassandra® to handle backup and restore for your Cassandra nodes. Recently Medusa was upgraded to introduce support for all S3 compatible backends, including MinIO , the popular k8s-native object storage suite. Let’s see how to set up K8ssandra and MinIO to backup Cassandra in just a few steps.

Deploy MinIO

Similar to K8ssandra, MinIO can be simply deployed through Helm.

First, add the MinIO repository to your local list:

Lights, Camera, Action: GitHub Actions with Java (Part 3)

Thu, 03 Feb 2022 15:24:33 +0000

The Java GitHub Action that Rules them all - Disco API{#caption-attachment-51347}

When we ended Part 2 of this blog series Lights, Camera, Action: GitHub Actions with Java Part 2 , I talked about the near future of GitHub Actions. Well, today the future is now, so let’s get into this!

Welcome back to the series of articles on GitHub Actions with Java Part 3. If you didn’t catch Part 1 & 2 head over here: Part 1 & Part 2

Unboxing K8ssandra: The Data Layer For Your Kubernetes-Powered Applications

Tue, 01 Feb 2022 17:51:35 +0000

A Complimentary Live Webinar, Sponsored by DataStax

Kubernetes made it easy to deploy and scale out your cloud-native applications. With K8ssandra , you can now scale application data with the same simplicity and high availability. Join us as we unbox K8ssandra a cloud native data layer for Kubernetes and explore how you can deploy it alongside your applications.

Install k8ssandra
Authenticate with Stargate
Query your data via a convenient API (REST, document, or graphql)

Not familiar with Cassandra? Astra DB is a great (free) place to learn without any of the infrastructure setup, or management headaches.

Taking Your Database Beyond a Single Kubernetes Cluster

Wed, 19 Jan 2022 10:31:47 +0000

By Christopher Bradford and Ty Morton {#31db}

Global applications need a data layer that is as distributed as the users they serve. Apache Cassandra has risen to this challenge, handling data needs for the likes of Apple, Netflix and Sony. Traditionally, managing data layers for a distributed application was handled with dedicated teams to manage the deployment and operations of thousands of nodes — both on-premises and in the cloud.

Polyglot Cloud Native Debugging: Beyond Logs/APM

Tue, 18 Jan 2022 07:55:51 +0000

I’ve done quite a few conference talks since I became a developer advocate for Lightrun . One of my most popular talks has a title similar to the title of this article. In this article I’ll try to cover the gist of the talk.

Cloud-Native Applications

There’s practically an alphabet soup of terms covering public cloud, hybrid cloud, etc. There’s also a lot of overlap between the various terms. The nice thing about this topic is that it applies, regardless. You will run into problems with microservices, architecture and monolithic applications or serverless.

Kubernetes and Apache Cassandra: What Works (and What Doesn’t)

Fri, 14 Jan 2022 16:30:50 +0000

“I need it now and I need it reliable”

– ANYONE WHO HASN’T DEPLOYED APPLICATION INFRASTRUCTURE

If you’re on the receiving end of this statement, we understand you here in the K8ssandra community . Although we do have reason for hope. Recent surveys have shown that Kubernetes (K8s) is growing in popularity, not only because it’s powerful technology, but because it actually delivers on reducing the toil of deployment.

How to Put a Database in Kubernetes?

Thu, 13 Jan 2022 09:18:38 +0000

Learn the key steps of deploying databases and stateful workloads in Kubernetes and meet the cloud-native technologies, like K8ssandra, that can streamline Apache Cassandra for K8s.{#95cc}

The idea of running a stateful workload in Kubernetes (K8s) can be intimidating, especially if you haven’t done it before. How do you deploy a database? Where is the actual storage? How is the storage mapped to the database or the application using it?{#6cde}

Requirements for Running K8ssandra for Development

Thu, 06 Jan 2022 12:15:27 +0000

The K8ssandra Quick start is a excellent guide for doing a full installation of K8ssandra on a dev laptop and trying out the various components of the K8ssandra stack. While this is a great way to get your first hands-on experience with K8ssandra, let’s state the obvious: running K8ssandra locally on a dev laptop is not aimed at performance. In this blog post, we will start Apache Cassandra® locally then explain how to run benchmarks to help evaluate what level of performance (especially throughput) you can expect from a dev laptop deployment.

Why K8ssandra?

Thu, 06 Jan 2022 12:10:09 +0000

The problem: scalable data persistence for cloud-native applications

The past decade and a half has brought tremendous change in how we in the software industry think about building and delivering internet applications. With the launch of Amazon Web Services (AWS) in 2006, companies of any size could access cloud computing infrastructure. The burst of creativity that followed gave birth to concepts like cloud-native in 2010, and methodologies such as the twelve-factor app in 2011.

JReleaser 0.10.0 Released!

Tue, 04 Jan 2022 13:30:48 +0000

JReleaser is a tool that streamlines creating releases for [Java] projects.

It can create a GitHub/GitLab/Gitea release, while also packaging binaries for Homebrew, Snapcraft, Docker, Chocolatey, Scoop, JBang and, more than that, announces releases to Twitter, SdkMan!, e-mail, Zulip, Discord, Gitter, Slack, Teams, and more.

JReleaser v0.10.0 is the last push towards 1.0.0. We’ll concentrate on bug fixing and polishing from now on. Be mindful of the breaking changes introduced in this release.

New Survey Finds Data on Kubernetes Is No Longer a Pipe Dream

Thu, 30 Dec 2021 15:52:00 +0000

For people that work in infrastructure and application development, the pace of change is quick. Finish one project and it’s on to the next. Each iteration requires an evaluation asking if the right technology is being used and if it provides a new advantage. Kubernetes has been on the fast track of continuous evaluation. New projects and methodologies are continuously emerging and it can be hard to keep up. Then there is the question of running stateful services. The Data on Kubernetes community has released a report titled “Data on Kubernetes 2021” to give us a snapshot of where our industry sits with stateful workloads. Over 500 executives and tech leaders were asked some very direct and insightful questions about how they use Kubernetes. It turns out that there were a lot of surprising finds. Some that I would have never predicted. Let’s dig into some of the highlights that stood out to me.

The future of cloud-native databases begins with Apache Cassandra 4.0

Wed, 29 Dec 2021 07:40:00 +0000

“Reliability at massive scale is one of the biggest challenges we face at Amazon.com, one of the largest e-commerce operations in the world; even the slightest outage has significant financial consequences and impacts customer trust.”

This was the first line of the highly impactful paper titled “Dynamo: Amazon’s Highly Available Key-value Store.” Published in 2007, it was written at a time when the status quo of database systems was not working for the massive explosion of internet-based applications. A team of computer engineers and scientists at Amazon completely re-thought the idea of data storage in terms of what would be needed for the future, with a firm footing in the computer science of the past. They were trying to solve an immediate problem but they had unwittingly sparked a huge revolution with distributed databases and the eventual collision with cloud-native applications.

Kubernetes Data Simplicity: Getting started with K8ssandra

Thu, 23 Dec 2021 08:56:22 +0000

You might have heard about the K8ssandra project and want to start contributing, or maybe you want to start using all of its features. If you aren’t familiar with K8ssandra (pronounced like “Kate Sandra”), you can read this overview before digging into the developer activities in this post.

In a nutshell, K8ssandra is an open-source distribution of Apache Cassandra™ for Kubernetes, which includes a rich set of trusted open-source services and tooling. K8ssandra comes with handy features that are baked-in and pluggable, which allows for flexible deployment and configuration.

What is GitOps? What are its benefits?

Fri, 17 Dec 2021 16:19:17 +0000

Let’s understand what GitOps is and its benefits. You will also learn how ArgoCD can help with the continuous delivery of Kubernetes-based applications.

The following article is an excerpt from my book Effortless Cloud-Native App Development Using Skaffold from Packt Publishing.

It is available for order from Amazon.com and directly from Packt . This excerpt comes from chapter 9: Creating a Production-Ready CI/CD Pipeline with Skaffold:

What is GitOps

The word GitOps was coined by a company named Weaveworks. The idea behind GitOps is to consider Git as a single source of truth for your application and declarative infrastructure. Using Git to manage your declarative infrastructure makes it easy for developers because they interact with Git daily. Once you add configuration inside Git, you get the benefits of version control, such as reviewing changes using pull requests, audit, and compliance.

Adelphi: Apache Cassandra Testing Goes Cloud Native

Thu, 09 Dec 2021 15:55:43 +0000

|———————————————————————————————————————–| | adelphi (ancient greek ἀδελφός) - Subs.: brother or sister, son of the same mother. Adj.: double, twin, in pairs. |

What is Adelphi?

Adelphi is an open-source QA tool for Apache Cassandra™, it’s packaged as a Helm chart and it simplifies the tasks of running data integrity and performance tests on Kubernetes.

Built for simplicity, Adelphi is an opinionated tool; it runs an Argo workflow of well-defined steps and prefers convention over configuration, but it exposes some knobs that you can override.

Backing up K8ssandra with MinIO

Tue, 30 Nov 2021 17:00:00 +0000

JReleaser 0.9.0 Released!

Tue, 30 Nov 2021 10:29:17 +0000

JReleaser is a tool that streamlines creating releases for [Java] projects. It can create a GitHub/GitLab/Gitea release, while also packaging binaries for Homebrew, Snapcraft, Docker, Chocolatey, Scoop, JBang and, more than that, announces releases to Twitter, SdkMan!, e-mail, Zulip, Discord, Gitter, Slack, Teams, and more.

JReleaser v0.9.0 has just been released! JReleaser v0.9.0 is a big update as we gear towards v1.0.0. Plenty of improvements were added to this release to make it the best one so far. Be mindful of the breaking changes introduced in this release.There are plenty of improvements in several areas, a quick summary of the highlights follows:

Developer Productivity Masterclass: Interview With Leonid Blouvshtein

Tue, 30 Nov 2021 09:09:01 +0000

On December 7th, Lightrun will host a free master class with Mykyta Protsenko, Senior Software Engineer at Netflix; Michael Wood, Field CTO, HashiCorp; Ryan Menezez, Software Engineering Manager, Meta; and Leonid Blouvshtein, CTO of Lightrun.

[

](https://www.linkedin.com/events/developerproductivitymasterclas6870717107772907520/ )

I got a chance to grab Leonid and make him sit down for this quick interview…

Q: Tell us a bit about yourself?

I’ve worked in several successful startups while most of my experience is with distributed systems that require high performance. This was after I graduated from the elite 8200 intelligence unit of the IDF.

Port Management in Local Kubernetes Clusters

Mon, 29 Nov 2021 08:44:25 +0000

Most of my talks contain a demo. A fair share of these demos require multiple “infrastructure” dependencies: a database (or more), Elasticsearch, you name it. To ease my setup and avoid messing up my machine, I use either Docker Compose or Kubernetes locally on my Mac. Both rely on Docker Desktop.

To expose a cluster Service on my host, I use nodePort. Hence, I set a dedicated node port for each service. I need to remember each of them for each demo. Worse, services might be (are) declared across different manifest files.

Book Review: “Effortless Cloud-Native App Development Using Skaffold”

Thu, 25 Nov 2021 12:52:08 +0000

I’m a developer who cares deeply about production. But I’m not a devops and unfortunately I’m pretty bad at that. That’s why when I heard about Skaffold it instantly piqued my interest. Write Kubernetes cloud native apps without well… Writing Kubernetes native apps… Sign me up!

Unfortunately, as we all know. The time to pick up a new technology is when we actually need it and then it’s a rush to get something out. Few of us have time to take off from our busy day to study something and learn something new. That’s why when Ashish Choudhary , the author of the book “Effortless Cloud Native App Development Using Skaffold " asked for reviewers in the foojay.io slack group, I jumped on the opportunity. I can learn something interesting and be productive (this book review).

K8ssandra: Production-Ready Platform for Cassandra on Kubernetes

Wed, 24 Nov 2021 09:45:12 +0000

K8ssandra , an open-source distribution of Apache Cassandra for Kubernetes, aims to provide a “production-ready platform”, and this includes automation for operational tasks such as repairs, backups, and monitoring. Cassandra is a distributed NoSQL database designed for global scale and fault tolerance for the most demanding applications on the planet, written in Java.

K8ssandra is deployed using Helm and supports stateful workloads out of the box, which enables database administrators (DBAs) and site reliability engineers (SREs) to set up and operate Cassandra clusters using best practices in a Kubernetes environment.

Customer Miscommunication Leads to Ongoing Nightmare

Tue, 16 Nov 2021 08:28:01 +0000

Production disasters are sometimes those pileups we can see coming from miles away. But the train is moving so fast we can’t possibly stop it. This is one of those stories. In it a combination of bad communication, missing skills, immature technological choices created a pile up.

You can’t debug a specification. You must stay vigilant during the development cycle to find conceptual mistakes and reorient the Titanic.

This is a bit of a different story in the series. When I came up with the concept for production horrors my thoughts were mostly about a single day or a single event that made our production fail. Naturally our mind gravitates towards crashes or issues like the recent Facebook outage. But last time around, I gave the example of problematic caching that led to a billing problem…

Lights, Camera, Action: GitHub Actions with Java (Part 2)

Mon, 15 Nov 2021 14:35:43 +0000

Introduction

Have you ever been given too many choices resulting in the feeling of indifference (“not a big deal, doesn’t really matter either way”)? However, when given two choices, somehow you feel torn or become more critical of one versus the other.

In this short overview, you will learn how to create a GitHub Action workflow that allows you to choose a particular OpenJDK build distribution.

And welcome back to the series of articles on GitHub Actions with Java Part 2 . If you didn’t catch Part 1 head over here: https://foojay.io/today/github-actions-with-java-part-1 .

Production Horrors - Handling Disasters: Public Debrief. Handling failures

Wed, 03 Nov 2021 10:49:21 +0000

Just in time for Halloween failures in production are scarier than most movie monsters. Here’s a personal scary story of a production fail…

Halloween is probably the most appropriate time to start this new series of articles. I talk a lot about theory on Foojay , but when you’re on the front line of a production disaster, it “gets real” very fast. People often think of production disasters as crashes or sites going down like the recent Facebook downtime. While that’s an interesting subject, a lot of these things can go under the radar and hit you like a brick wall.

Announcement: JReleaser 0.8.0 Released!

Tue, 02 Nov 2021 12:12:29 +0000

JReleaser is a tool that streamlines creating releases for [Java] projects.

This release closes all required items in the v1.0.0 roadmap, opening the door for v1.0.0 to be released next after polish and housekeeping items are taken care of.

Lights, Camera, Action: GitHub Actions with Java (Part 1)

Thu, 28 Oct 2021 12:36:19 +0000

Have you ever heard of Jenkins , Travis , TeamCity or Bamboo ?

"Github smoothie" Acarlos1000

For those who do not know, these are build infrastructure software services that manage and schedule (notify) the building of software artifacts (yours).

Often, you might hear the term “CI/CD pipelines”, which refers to the concept of Continuous Integration and/or Continuous Delivery. In layman’s terms, it’s all about building, testing and deploying software in an automated fashion.

Git Archeology: Removing the Sands of Time from Code

Sat, 23 Oct 2021 06:55:03 +0000

Working on a large codebase, it’s pretty normal to not remember every small or large subsystem or implementation choice. Be it whether you’re new to a codebase, or you’ve been focused on a specific area of the codebase.

When working on refactorings or bug fixes, I often end up in areas I might not be too familiar with. Generally not dramatic, it happens quite often that I’m stopping what I’m doing because I need to decide on how to move forward. As software engineers, we have to make so many micro-decisions every minute that we’re pretty used to it.

PSA: The Risks of Remote JDWP Debugging: It's Like a Wide Open Door

Wed, 20 Oct 2021 08:13:29 +0000

It isn’t so much a security risk as it is a wide open door with everything labeled for anyone to take freely and matches to burn it all down…

When I teach or lecture and mention security, I always love the analogy of security as an onion. This is a common cliché yet it’s still a powerful analogy for people who are new to the concepts. The equivalent analogy I would pick for remote debugging is like leaving your front door open with all your valuables piled in easy to spot and well labeled boxes. Calling JDWP insecure doesn’t make any sense. It wasn’t designed to be secure so it isn’t…

GlassFish & Payara Auto-Clustering for Jakarta EE Applications

Wed, 13 Oct 2021 13:27:30 +0000

Ensuring trouble-proof 24/7 service delivery is among one of the most discussed areas in cloud hosting for the last few years. And the very obvious and commonly used solution here is building a clustered infrastructure for your project.

Intending to help our customers to deal with such a non-trivial task and save time for other project-related activities, we created a special high-availability solution, designed to facilitate the Jakarta EE application hosting – embedded Auto-Clustering for GlassFish and Payara application servers.

JReleaser: Looking for Translation Contributions

Fri, 08 Oct 2021 20:45:46 +0000

The JReleaser project has recently added internationalization support to its CLI tool, with complete translations for English, German, French, and Brazilian Portuguese. A translation to Italian is currently in the works.

The project is looking for people who would like to contribute translations to their native language, allowing JReleaser to reach and help an even wider audience.

If you’re interested in joining these efforts, please open a ticket at https://github.com/jreleaser/jreleaser/issues , letting the project maintainers know which language you’d like to tackle.

This Just In: JReleaser 0.7.0 Released!

Wed, 29 Sep 2021 12:12:24 +0000

JReleaser is a tool that streamlines creating releases for [Java] projects.

This is a small release as core features are mostly complete:

JDKs: The jdks-gradle-plugin now unpacks the chosen JDK distribution in a subdirectory that matches the configured named. This is a breaking change! Additionally, tasks for removing cached JDKs were also added.
GitHub: Linking a release to a discussion is automatically skipped if the release is a draft or early access.
Changelog: You can now specify if a full or partial changelog should be generated when the release is early access.
Homebrew: Fixes automatic generation of Cask v.s Formula.
Release: You may skip creating a release but keep the tag. This is useful for the case when you’d like to push release assets via an uploader but want to skip creating a Git release.

Full changelog can be found at the v0.7.0 release page.

Looking For Free Docker Registries

Tue, 24 Aug 2021 07:19:37 +0000

Since Docker announced that it would remove unused images from Docker Hub, I’ve been interested in listing places where I could host mine.

As it’s for personal purposes, I’m interested in free plans. Here’s what I found:

| Provider | Private? | Monthly limit || Details |

Provider	Private?	Storage	Transfer	Details
Docker Hub	1	❓	* Anonymous: 100 pulls / 6 hours * Authenticated: 200 pulls / 6 hours
GitLab	✅	10Gb	❓	* Storage quota is per-project * Quota includes all artifacts, including code
GitHub	✅	> GitHub Container Registry is currently in public beta and subject to change. During the beta, storage and bandwidth are free
AWS	* First year only * 500Mb storage	50Gb	* Anonymous: 500Gb * Authenticated: 5Tb
IBM Cloud	✅	500Mb	5Gb

Here are some additional options with their associated pricing model:

SolarWinds Hack: What Does This Mean For Us?

Thu, 19 Aug 2021 08:19:56 +0000

In the past two years, we have had to learn a lot about cybersecurity. New attack vectors are becoming more and more sophisticated and are directed more and more against the value chain in general.

But what does that mean for us? What can be done about it, and what reactions have the state already taken?

Let’s start with the story that got all of this rolling and made sure that the general attention was drawn to the vulnerabilities of the available IT infrastructure.

Updating Data Files: Commits vs. Pull Requests?

Wed, 18 Aug 2021 17:22:05 +0000

For once, I’m wondering a bit if this article can be helpful to somebody else since I believe my context is pretty specific. Anyway, just in case it might be the helpful case, here it is!

My Jet Train project makes use of GTFS . GTFS stands for General Transit Feed Specification. It models public transportation schedules and their associated geographic information.

GTFS is based on two kinds of data, static data, and dynamic data. Static data may change but do so rarely, e.g., transit agencies and bus stations. They are available as static files that you need to download now and then. Before, I had to download and overwrite them every time I run the demo.

Introducing SAST, DAST, IAST and RASP

Thu, 05 Aug 2021 08:28:52 +0000

In this article, we’re going to look at the differences between the various cybersecurity defence techniques. Here you can identify four main groups, which we will go through briefly one after another to illustrate the advantages and disadvantages.

SAST: Static Application Security Testing

SAST describes the process in which the components of an application are subjected to a static analysis. This approach not only searches for security gaps but also determines the licenses for the individual elements. In the following, however, I will only deal with the consideration of vulnerabilities.

GitLab: Your Continuous Deployment One-Stop Shop

Wed, 04 Aug 2021 07:44:20 +0000

This week, I want to take a break from my Rust series and focus on a different subject. I’ve already written about my blogging stack in detail.

However, I didn’t touch on one facet and that facet is how I generate the static pages from Jekyll. As I describe in the blog post, I’ve included quite a couple of customizations. Some of them require external dependencies, such as:

A for PlantUML diagrams generation
The graphviz package for the same reason
etc.

All in all, it means that I require a fully configured system. I solved this problem by using containerization, namely Docker. Within the Dockerfile, I’m able to install all required dependencies. Then, in my GitLab build file, I can reference this image and benefit from all its capabilities.

Announcement: JReleaser 0.6.0 Released!

Tue, 03 Aug 2021 18:15:49 +0000

In this release you’ll find updates and features such as:

Several updates to the Homebrew packager, such as multi-platform (OSX & Linux) support, ability to use the binary stanza with .zip artifacts, ability to use the appcast stanza with casks, ability to explicitly enable or disable generation of Casks.
Sdkman has been split into packager and announcer, giving you more options to publish multiple candidates per project. The old behavior remains in place, that is, the announcer can publish and announce a single candidate for the whole project.
Uploaders such as JFrog Artifactory and HTTP can now configure a downloadURL variable that can be used in templates.
You can now target with pinpoint accuracy how artifacts, files, and globs should be uploaded, released, checksumed, and signed. These 4 sections offer configurable properties to activate or deactivate their targets. You also have the choice of adding extra properties to artifacts fur further tweaking the desired behavior.
Partial model evaluation lets you execute a release for artifacts matching a particular platform. Useful when dealing with Native Image and Native Package distributions when not all artifacts are locally available. Model properties may also be overridden from the command line, user or project properties (Maven), or project properties (Gradle).
Changelog formatting options now include the ability to hide specific commit categories (such as merge commits if you have configured such category) as well as contributors (such as bots). You can also format how contributors are displayed, for example linking to their Git profile with their username or name.
The Docker packager now lets you publish packaged files (Dockerfile + supporting files) to a Git repository of your choice.
The Article announcer lets you bootstrap a blog post or article based on templates.

Full changelog can be found at the v0.6.0 release page.

SKP's Primer: Failures, Pitfalls, and Disadvantages of Microservices

Mon, 02 Aug 2021 09:35:44 +0000

[About SKP’s Definitive Microservices Primer]
Series of Articles on Microservices Architecture. They Revolve Around Microservices Strategy, Decision Making, Monolithic vs Microservices, Microservices Infrastructure, Failures & Pitfalls of Microservices, Microservices Design Patterns, Database Design, Security, Logging, Messaging, Containerization, Cloud Providers and Everything that is Microservices and More!

Intro to Microservices Adoption in Real World

Microservices Adoption is almost becoming the normal in almost all software product and it services organizations. Hereby, i am taking this opportunity to make you aware of the Real-World Issues (Case Studies) that are faced by organizations (small, mid, large) of all sizes in migrating or adopting microservices. Since learning from other’s mistakes and knowing the pitfalls upfront help us prepare and plan better - this article will be helpful for those planning a shift to the Microservices Strategy organization-wide or simply making a move from Monolithic to Microservices Architecture.

Connect Stateful Workloads Across Kubernetes Clusters

Fri, 23 Jul 2021 08:44:32 +0000

One of the biggest selling points of Apache Cassandra™ is its shared-nothing architecture, making it an ideal choice for deployments that span multiple physical datacenters. So when our Cassandra as-a-service single-region offering reached maturity, we naturally started looking into offering it cross-region and cross-cloud.

One of the biggest challenges in providing a solution that spans multiple regions and clouds is correctly configuring the network so that Cassandra nodes in different data centers can communicate with each other successfully, even as individual nodes are added, replaced, or removed. From the start of the cloud journey at DataStax, we selected Kubernetes as our orchestration platform, so our search for a networking solution started there. While we’ve benefited immensely from the ecosystem and have our share of war stories, this time we chose to forge our own path, landing on ad-hoc overlay virtual application networks (how’s that for a buzzword soup?).

CVSS 101: First Steps with Common Vulnerability Scoring System

Wed, 14 Jul 2021 06:56:13 +0000

What is the Common Vulnerability Scoring System (CVSS), who is behind it, what are we doing with it, and what does a CVSS Value mean for you?

On Foojay, you can apply the insights below to understand the Security/CVE Views in the OpenJDK Update & Release Details pages , such as the one shown here:

I will explain how a CVSS Score is calculated, what the different elements of it mean, and what are the differences between the different CVSS versions.

A Case for Databases on Kubernetes from a Former Skeptic

Tue, 13 Jul 2021 09:12:18 +0000

Kubernetes is everywhere. Transactional apps, video streaming services and machine learning workloads are finding a home on this ever-growing platform. But what about databases?

If you had asked me this question five years ago, the answer would have been a resounding “No! " — based on my experience in development and operations. In the following years, as more resources emerged for stateful applications, my answer would have changed to “Maybe,” but always with a qualifier: “It’s fine for development or test environments…” or “If the rest of your tooling is Kubernetes-based, and you have extensive experience…”

About The Lifecycle of a Security Vulnerability

Thu, 08 Jul 2021 08:40:56 +0000

Again and again, we read in the IT news about new security gaps that have been identified. The more severe the classification of the loophole, the more attention the information receives in the general press. Most of the time, you don’t even hear or read anything about all the security holes found that are not as well known as the SolarWinds Hack, for example.

But what is the typical lifecycle of such a security gap?

Kubernetes Is The Best Technology For Running A Cloud-Native Database

Wed, 30 Jun 2021 09:13:19 +0000

For this reason, there has been a surge of recent interest in data infrastructure that is designed to take maximum advantage of the benefits that cloud computing provides. A cloud-native database is one that achieves the goals of scalability, elasticity, resiliency, observability, and automation; the K8ssandra project is a great example. It packages Apache Cassandra and supporting tools into a production-ready Kubernetes deployment.

Jakarta EE Application Deployment to Kubernetes Cluster in Jelastic PaaS

Wed, 16 Jun 2021 06:58:31 +0000

Recently, we were asked to sponsor cloud hosting of a Jakarta EE project, called Cargo Tracker . Being a member of Jakarta EE Working Group, Jelastic wanted to support the community and thus we started to run this application at one of our service providers (Scaleforce ).

Cargo Tracker is now deployed to Kubernetes on the cloud using GitHub Actions. Thanks sponsors Jelastic and Scaleforce! https://t.co/zhnmj0TB7Z // @Jelastic, @scaleforce pic.twitter.com/BRGkwxban2

Querying Your In-Memory-Data-Grid: Why and How?

Fri, 21 May 2021 07:11:28 +0000

An in-memory data grid (IMDG) is a set of networked/clustered computers that pool together their random access memory (RAM) to let applications share data with other applications running in the cluster. Though IMDGs are sometimes generically described as a distributed in-memory data store, IMDGs offer more than just storage. IMDGs are built for data processing at extremely high speeds. They are designed for building and running large-scale applications that need more RAM than is typically available in a single computer server. This enables the highest application performance by using RAM along with the processing power of multiple computers that run tasks in parallel. IMDGs are especially valuable for applications that do extensive parallel processing on large data sets.

Namespace Shadowing (a.k.a. “Dependency Confusion”) Attack

Thu, 22 Apr 2021 06:31:08 +0000

TL;DR: Yet Another Case for Using Exclude Patterns in Remote Repositories

The npm Registry is vulnerable to supply chain namespace shadowing, also known as “Dependency Confusion” attacks. Make sure you create npm scoped packages and force exclude patterns.

Long-time Obsession with Exclude Patterns

I remember the first JFrog customer training I delivered in February 2012. This slide was the one where I explained the importance of setting exclude patterns on your repositories (you can see it is 2012 by the slide design, right? Also, Ant was a thing.):

Jenkins Cluster for Continuous Integration and Delivery in Jelastic PaaS

Mon, 12 Apr 2021 12:44:50 +0000

Jenkins is an open-source continuous integration and delivery system designed to ensure build and deploy automation. It is well-suited to be installed in the cloud to run self-hosted pipelines.

Jenkins supports clustering via master-slave mode. A build process can be delegated to several slave (worker) nodes. This allows serving multiple projects in a single Jenkins cluster setup.

In this article, we’ll describe how to install Jenkins cluster with slave nodes auto-discovering and self-registering inside a master node. Jelastic PaaS implemented this solution in Jenkins DevOps Pack that can be installed from the Marketplace or through environment setup wizard as a New Environment. In this tutorial we’ll cover both. Also, you will find out how to build a simple Java project hosted on GitHub using Jelastic Maven plugin.

DevOps 101 Part III: Package Management

Wed, 24 Mar 2021 07:35:47 +0000

This post was originally published by Kat Costgove at Dev.to .

When you’re new to an industry, you encounter a lot of new concepts. This can make it really difficult to get your feet underneath you on an unfamiliar landscape, especially for junior engineers. What’s all this jargon? What does DevOps really mean? What’s all this software? Is DevOps a methodology, or a toolset? Is any of this actually going to make my life easier, or is it just a bunch of industry buzzwords?

DevOps 101 Part II: Introduction to Container Registries

Wed, 17 Mar 2021 08:58:35 +0000

This post was originally published by Kat Costgove at Dev.to .

When you’re new to an industry, you encounter a lot of new concepts. This can make it really difficult to get your feet underneath you on an unfamiliar landscape, especially for junior engineers.

In this series (part 1 is here ), I’m covering tools and terminology common to the DevOps space, plus the occasional newbie-friendly tutorial for emerging or established technologies. If you have a request or suggestion, let me know!

Intro for Java Devs to DevOps 101 Part I: CI/CD

Tue, 09 Mar 2021 08:00:56 +0000

This post was originally published by Kat Costgove at Dev.to .

When you’re new to an industry, you encounter a lot of new concepts. This can make it really difficult to get your feet underneath you on an unfamiliar landscape, especially for junior engineers.

In this series, I’ll cover tools and terminology common to the DevOps space, plus the occasional newbie-friendly tutorial for emerging or established technologies. If you have a request or suggestion, let me know!

Demystifying Google Container Tool, Jib: Java Image Builder

Thu, 18 Feb 2021 18:42:44 +0000

This article covers some internals of image layering created by container image builder Jib and explore what distroless images are and their benefits.

Are you wondering what Jib is, actually? You should probably read my previous article before going ahead.

In short, Jib is an excellent tool for Java developers who are interested in containerizing Java applications, but not so interested in creating and maintaining Dockerfile or installing Docker. A Java developer can add a plugin to Maven or Gradle, and that’s it. You don’t have to learn new technology just to containerize your Java application.

Quick Security Wins and Getting Started with DevSecOps

Wed, 03 Feb 2021 17:41:45 +0000

Hello and welcome to my first DevSecOps article! Here in Germany, it’s winter right now, and the forests are quiet. The snow slows down everything and it’s a beautiful time to move undisturbed through the woods. Here you can pursue your thoughts, and I started thinking about a subject that customers or participants at conferences ask me repeatedly.

The question I am asked is almost always: “What are the quick wins or low hanging fruits if you want to deal more with the topic of security in software development? And I want you to answer this question right now!”

Astra Service Broker: Tradeoff-Free Cassandra in Kubernetes

Thu, 19 Nov 2020 19:52:00 +0000

When you are designing and building a cloud-native application, you are probably thinking about deploying it with Kubernetes. What about the database? That can get a bit more complicated as you weigh out the tradeoffs of elasticity, scale, and self-healing requirements versus maintaining servers and the long term operations required. Apache Cassandra™ ticks the first three boxes easily, but what about the operational burden of managing Cassandra? That’s where the cloud-native Cassandra service, DataStax Astra , helps both operators and developers. But what makes it easy for deployments on Kubernetes to access the Astra managed service?