Blog: Connecting to a service without SBO #5915

valaparthvi · 2022-07-04T10:29:49Z

Signed-off-by: Parthvi Vala [email protected]

What type of PR is this:
/kind documentation

What does this PR do / why we need it:

Which issue(s) this PR fixes:

PR acceptance criteria:

Unit test
Integration test
Documentation

How to test changes / Special notes to the reviewer:
https://deploy-preview-5915--odo-docusaurus-preview.netlify.app/blog/binding-database-service-without-sbo

netlify · 2022-07-04T10:30:29Z

✅ Deploy Preview for odo-docusaurus-preview ready!

Name	Link
🔨 Latest commit	`d5715c8`
🔍 Latest deploy log	https://app.netlify.com/sites/odo-docusaurus-preview/deploys/62c680cdf08eae000971e524
😎 Deploy Preview	https://deploy-preview-5915--odo-docusaurus-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

odo-robot · 2022-07-04T10:44:55Z

Unit Tests on commit 78b8795 finished successfully.
View logs: TXT HTML

dharmit · 2022-07-04T11:01:51Z

The blog's not showing a single instance of odo add binding. How is it justified as a blog that uses odo to connect to a service without SBO? It's using the service discovery mechanism used since a long time - manually populating the environment variables.

odo-robot · 2022-07-04T11:11:34Z

Windows Tests (OCP) on commit 78b8795 finished successfully.
View logs: TXT HTML

odo-robot · 2022-07-04T11:13:12Z

Kubernetes Tests on commit 78b8795 finished successfully.
View logs: TXT HTML

odo-robot · 2022-07-04T11:14:45Z

OpenShift Tests on commit 78b8795 finished with errors.
View logs: TXT HTML

odo-robot · 2022-07-04T11:20:39Z

Validate Tests on commit 78b8795 finished successfully.
View logs: TXT HTML

valaparthvi · 2022-07-04T11:50:51Z

The blog's not showing a single instance of odo add binding. How is it justified as a blog that uses odo to connect to a service without SBO? It's using the service discovery mechanism used since a long time - manually populating the environment variables.

It is not supposed to use SBO to connect, hence there is no odo add binding. The purpose of this blog is to show that you can connect to a service without the help of SBO. You can read the attached issue #5771 for more details.

The importance of this is to remind users that they can use their regular flow with "hardcoding" connection information to env variables in devfile.yaml.

feloy · 2022-07-04T12:03:02Z

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

+    - name: username
+      value: userAdmin
+    - name: password
+      value: userAdmin123456


This will make a secret written into the Devfile, most probably pushed to some git repository.

I'm not sure we want to document this method, as it is not encouraged at all

We could use some kind of envFrom to point to the secret, but Devfile does not support it for now

Does devfile support dynamically obtaining values? I mean if we can put kubectl get secrets minimal-secret -ojsonpath='{.data.username}' | base64 -d inside the devfile, we can avoid having to hard code password.

I could add a note acknowledging that it's a bad practice, but this is for example purpose only, or I could find a way to fetch password from the code itself to avoid this practice altogether.

Yes, you could start with this solution, by indicating from the very beginning this is not a secure solution, and then continue with more secure solutions (and probaly more difficult ones). That would show the interest of using SBO.

The simplest solution would be to have an envFrom field in the Devfile's container, but this field does not exist. Is it worth asking Devfile team to add it? I'm not sure

You could pass the secret name and the secret keys as environment variables, and the program would be responsible for getting the values from the secret. That means the program needs access to the Kubernetes API, which opens security breaches

The simplest solution would be to have an envFrom field in the Devfile's container, but this field does not exist. Is it worth asking Devfile team to add it? I'm not sure

When you say envFrom, do you mean devfile can evaluate the value from the environment variable exposed in your local system?

env: - name: password value: envFrom: $MONGODB_PASSWORD

Something like this? Or more like this https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/pods/inject/pod-secret-envFrom.yaml?

You could pass the secret name and the secret keys as environment variables, and the program would be responsible for getting the values from the secret. That means the program needs access to the Kubernetes API, which opens security breaches

I think asking the program to be responsible for fetching everything would defeat the purpose of this blog. I think I'll go with a note for now, and it's like you said, it might encourage users to try SBO.

Something like this? Or more like this https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/pods/inject/pod-secret-envFrom.yaml?

Yes, like this one

This will make a secret written into the Devfile, most probably pushed to some git repository.

Would it be possible to leverage the variable substitution feature here? I think this would solve the issue while showing this other feature of odo.

Not tested, but calling odo dev with something like this:

# Given that the variables have already been exported odo dev --var MY_MONGODB_USERNAME --var MY_MONGODB_PASSWORD

What do you think?

But then devfile would have to interact with the k8s API and that does not make a lot of sense to me from the design standpoint. I don't think devfile is dependent on the K8s API right now, and I'm not sure if they'd be willing to create a dependency now. Can we take this up in cabal?

dharmit · 2022-07-04T12:40:33Z

It is not supposed to use SBO to connect, hence there is no odo add binding. The purpose of this blog is to show that you can connect to a service without the help of SBO. You can read the attached issue #5771 for more details.

Yeah, I read that issue right after commenting. It seems like we only want to show that odo can create a Deployment, and a Pod of that Deployment can talk to a Service using env vars. Anyway, it seems like that's what @kadel wants to showcase.

However, the flow here is not the same as:

$ odo init
$ odo dev

# Now create a service (using helm or operators)
# Next modify the existing devfile to hardcodde service info, and let odo dev do the magic

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

dharmit · 2022-07-04T14:59:02Z

However, the flow here is not the same as:

$ odo init
$ odo dev

# Now create a service (using helm or operators)
# Next modify the existing devfile to hardcodde service info, and let odo dev do the magic

@valaparthvi please make sure that your blog complies with this. At the moment, odo init is on Step 6. I would prefer it be Step 1 right after cloning the repo and creating a namespace (which should be mentioned as "optional", IMO.)

Signed-off-by: Parthvi Vala <[email protected]>

dharmit · 2022-07-05T08:46:44Z

@valaparthvi thanks for the fixes.

/approve

openshift-ci · 2022-07-05T08:46:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dharmit

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~docs/OWNERS~~ [dharmit]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rm3l

@valaparthvi Great blog post 👍🏿

I added a few comments below.

Another small comment. The SBO acronym is mentioned all over the place, but I saw nowhere where it was defined. It is clear to us, but might not for readers.
Maybe it could be worth changing the title to something more explicit, like "Binding to a database service without the Service Binding Operator (SBO)".

My 2 cents...

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

rm3l · 2022-07-05T10:09:48Z

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

+    - name: username
+      value: userAdmin
+    - name: password
+      value: userAdmin123456


This will make a secret written into the Devfile, most probably pushed to some git repository.

Would it be possible to leverage the variable substitution feature here? I think this would solve the issue while showing this other feature of odo.

Not tested, but calling odo dev with something like this:

# Given that the variables have already been exported odo dev --var MY_MONGODB_USERNAME --var MY_MONGODB_PASSWORD

What do you think?

…ongodb service

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

feloy · 2022-07-05T11:59:15Z

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

+
+
+## Export environment variables
+2. Export the necessary environment variables:


I find that exporting these variables at this point is premature. We cannot understand what they are for. I think it would be better to introduce the helm chart before to export them

I agree, but then if we want to maintain the order of odo init > odo dev > deploy charts > wait for odo dev to detect changes, it becomes necessary to export these variables at this point

The order

odo init

odo dev

deploy chart
is just an example provided by Tomas, I'm not sure it must be respected at all price.

By first deploying the chart (including exportint variables), then running odo init and odo dev, the flow seems more understandable to me

is just an example provided by Tomas, I'm not sure it must be respected at all price.

By first deploying the chart (including exportint variables), then running odo init and odo dev, the flow seems more understandable to me

I like the current approach of enabling Helm repo first. But I don't agree with the idea of spinning up Helm chart using it before doing odo init. If it were me, I would first show that your Go application is deployed using odo dev, but curl request made to it is throwing 404 or some error. Thereafter, we spin up the MongoDB database required by the application.

Or maybe, do an odo dev without all the variables which would help one connect to the MongoDB database. Make a curl call that returns 404 or some error. Now add information about connection to MongoDB and see how the application returns expected output.

I'm saying this because that's how I think an application developer's flow would be like. But then I have not a lot of application development myself, so correct me if I'm mistaken.

Or maybe, do an odo dev without all the variables which would help one connect to the MongoDB database. Make a curl call that returns 404 or some error. Now add information about connection to MongoDB and see how the application returns expected output.

I'm saying this because that's how I think an application developer's flow would be like. But then I have not a lot of application development myself, so correct me if I'm mistaken.

I agree with you, but I can't find a flow that works for everyone. For now, I have added a note stating that odo dev will fail if run before adding connection information(bf76584).

Works for me. I discussed this with @feloy and agree with the flow we have now.

feloy · 2022-07-05T12:01:54Z

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

+## Deploy the application
+4. Run `odo dev` to deploy the application on the cluster.
+```sh
+odo dev --var PASSWORD=$MY_MONGODB_ROOT_PASSWORD --var USERNAME=$MY_MONGODB_ROOT_USERNAME


Same here, I think it is premature to pass these variables, as they are not existing in the Devfile yet and we are not using them. I think it would be better to wait for steps 7.x before to do this

Then I can simply not do odo dev first and put it after deploying the microservice.

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

valaparthvi · 2022-07-06T06:17:21Z

One last comment. I think it would also be great to include odo list after deploying the Bitnami Helm Chart, just to show that odo can list Helm-managed resources as well. What do you think?
❯ odo list
 ✓  Listing components from namespace 'blog-helm-wo-sbo-5915' [2s]
 NAME       PROJECT TYPE  RUNNING IN  MANAGED 
 * restapi  go            Dev         odo     
 mongodb    Unknown       None        Helm    

I think it might be stirring a little away from the topic at hand. I would rather do that in a separate blog if necessary.

Signed-off-by: Parthvi Vala <[email protected]>

openshift-ci · 2022-07-06T12:04:49Z

@valaparthvi: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-and-validate-test	`bf76584`	link	true	`/test unit-and-validate-test`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

feloy · 2022-07-06T13:12:49Z

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

+- DELETE `/api/places/<id>` - Delete place with id `<id>`
+
+## Conclusion
+To conclude this blog, it is possible to connect your application with another microservice without the Service Binding Operator if you have the correct connection information. Using the Service Binding Operator with a [Bindable Operator](https://github.com/redhat-developer/service-binding-operator#known-bindable-operators) makes it easy for you to not care about finding the connection information and ease the binding.


You could add to the conclusion that it is up to the reader to manage the secrets stored in the environment variables MY_MONGODB_ROOT_PASSWORD and MY_MONGODB_ROOT_USERNAME, so they are accessible every time the following command is executed:

odo dev --var PASSWORD=$MY_MONGODB_ROOT_PASSWORD --var USERNAME=$MY_MONGODB_ROOT_USERNAME --var HOST="mongodb"

I've added this note in the section where we introduce these variables for the first time, I think it makes more sense to put them there than in the conclusion.

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

…sbo.md Co-authored-by: Armel Soro <[email protected]>

feloy · 2022-07-06T15:42:04Z

/lgtm

/hold

Feel free to unhold if other reviewers are ok

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md

sonarqubecloud · 2022-07-07T06:45:29Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
5 Code Smells

No Coverage information
0.3% Duplication

rm3l

/hold cancel

valaparthvi · 2022-07-07T08:59:48Z

/override OpenShift Integration tests/OpenShift Integration tests

feloy · 2022-07-07T08:59:49Z

/override OpenShift Integration tests/OpenShift Integration tests

openshift-ci · 2022-07-07T08:59:53Z

@feloy: Overrode contexts on behalf of feloy: OpenShift Integration tests/OpenShift Integration tests

In response to this:

/override OpenShift Integration tests/OpenShift Integration tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-07-07T08:59:58Z

@valaparthvi: Overrode contexts on behalf of valaparthvi: OpenShift Integration tests/OpenShift Integration tests

In response to this:

/override OpenShift Integration tests/OpenShift Integration tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

* Blog: Connecting to a service without SBO Signed-off-by: Parthvi Vala <[email protected]> * Dharmit's review * Dharmit/Philippe's review * Use devfile variable substitution, and bitnami charts for deploying mongodb service * More review changes * Fix netlify failures * FIx broken links * Philippe's review * Show that odo dev will fail before adding connnection information Signed-off-by: Parthvi Vala <[email protected]> * Update docs/website/blog/2022-06-30-binding-database-service-without-sbo.md Co-authored-by: Armel Soro <[email protected]> * Fix port in the devfile, add note about env vars * Change port Co-authored-by: Armel Soro <[email protected]>

openshift-ci bot added the kind/documentation label Jul 4, 2022

openshift-ci bot requested review from cdrage and dharmit July 4, 2022 10:30

feloy suggested changes Jul 4, 2022

View reviewed changes

openshift-ci bot assigned feloy Jul 4, 2022

dharmit suggested changes Jul 4, 2022

View reviewed changes

openshift-ci bot assigned dharmit Jul 4, 2022

valaparthvi added 3 commits July 5, 2022 11:07

Blog: Connecting to a service without SBO

bc7c82f

Signed-off-by: Parthvi Vala <[email protected]>

Dharmit's review

a808ba2

Dharmit/Philippe's review

78b7a37

valaparthvi force-pushed the blog-without-sbo branch from 7b087ac to 78b7a37 Compare July 5, 2022 06:27

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. Required by Prow. label Jul 5, 2022

rm3l reviewed Jul 5, 2022

View reviewed changes

Use devfile variable substitution, and bitnami charts for deploying m…

62a7b46

…ongodb service

valaparthvi requested review from rm3l, dharmit and feloy July 5, 2022 11:41

feloy reviewed Jul 5, 2022

View reviewed changes

openshift-ci bot assigned rm3l Jul 5, 2022

valaparthvi added 2 commits July 6, 2022 10:19

More review changes

e4cdcc4

Fix netlify failures

46bb7b5

feloy reviewed Jul 6, 2022

View reviewed changes

valaparthvi added 2 commits July 6, 2022 11:14

FIx broken links

197905a

Philippe's review

39c3211

Show that odo dev will fail before adding connnection information

bf76584

Signed-off-by: Parthvi Vala <[email protected]>

valaparthvi force-pushed the blog-without-sbo branch from 111e55f to bf76584 Compare July 6, 2022 11:12

feloy reviewed Jul 6, 2022

View reviewed changes

rm3l reviewed Jul 6, 2022

View reviewed changes

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md Outdated Show resolved Hide resolved

valaparthvi and others added 2 commits July 6, 2022 19:21

Update docs/website/blog/2022-06-30-binding-database-service-without-…

efd7338

…sbo.md Co-authored-by: Armel Soro <[email protected]>

Fix port in the devfile, add note about env vars

013f6bc

openshift-ci bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. Required by Prow. lgtm Indicates that a PR is ready to be merged. Required by Prow. labels Jul 6, 2022

rm3l reviewed Jul 6, 2022

View reviewed changes

docs/website/blog/2022-06-30-binding-database-service-without-sbo.md Outdated Show resolved Hide resolved

Change port

d5715c8

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. Required by Prow. label Jul 7, 2022

rm3l approved these changes Jul 7, 2022

View reviewed changes

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. Required by Prow. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. Required by Prow. labels Jul 7, 2022

openshift-ci bot merged commit 771644e into redhat-developer:main Jul 7, 2022



		## Export environment variables
		2. Export the necessary environment variables:

Blog: Connecting to a service without SBO #5915

Blog: Connecting to a service without SBO #5915

Conversation

valaparthvi commented Jul 4, 2022 • edited Loading

netlify bot commented Jul 4, 2022 • edited Loading

✅ Deploy Preview for odo-docusaurus-preview ready!

odo-robot bot commented Jul 4, 2022 • edited Loading

dharmit commented Jul 4, 2022

odo-robot bot commented Jul 4, 2022 • edited Loading

odo-robot bot commented Jul 4, 2022 • edited Loading

odo-robot bot commented Jul 4, 2022 • edited Loading

odo-robot bot commented Jul 4, 2022 • edited Loading

valaparthvi commented Jul 4, 2022 • edited Loading

feloy Jul 4, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

feloy Jul 5, 2022 • edited Loading

Choose a reason for hiding this comment

rm3l Jul 5, 2022 • edited Loading

Choose a reason for hiding this comment

valaparthvi Jul 5, 2022 • edited Loading

Choose a reason for hiding this comment

dharmit commented Jul 4, 2022

dharmit commented Jul 4, 2022

dharmit commented Jul 5, 2022

openshift-ci bot commented Jul 5, 2022

rm3l left a comment • edited Loading

Choose a reason for hiding this comment

rm3l Jul 5, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

valaparthvi Jul 6, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

valaparthvi commented Jul 6, 2022

openshift-ci bot commented Jul 6, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

feloy commented Jul 6, 2022

sonarqubecloud bot commented Jul 7, 2022

rm3l left a comment

Choose a reason for hiding this comment

valaparthvi commented Jul 7, 2022

feloy commented Jul 7, 2022

openshift-ci bot commented Jul 7, 2022

openshift-ci bot commented Jul 7, 2022

valaparthvi commented Jul 4, 2022 •

edited

Loading

netlify bot commented Jul 4, 2022 •

edited

Loading

odo-robot bot commented Jul 4, 2022 •

edited

Loading

odo-robot bot commented Jul 4, 2022 •

edited

Loading

odo-robot bot commented Jul 4, 2022 •

edited

Loading

odo-robot bot commented Jul 4, 2022 •

edited

Loading

odo-robot bot commented Jul 4, 2022 •

edited

Loading

valaparthvi commented Jul 4, 2022 •

edited

Loading

feloy Jul 4, 2022 •

edited

Loading

feloy Jul 5, 2022 •

edited

Loading

rm3l Jul 5, 2022 •

edited

Loading

valaparthvi Jul 5, 2022 •

edited

Loading

rm3l left a comment •

edited

Loading

rm3l Jul 5, 2022 •

edited

Loading

valaparthvi Jul 6, 2022 •

edited

Loading