Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023

Simplify and Scale
Enterprise Spring Apps
in the Cloud Sree Ram
Developer
Evangelist
Microsoft
Eric Manley
Platform Architect
VMware

The world’s leading
brands run on Azure

Note: Most features covered today are only in the Enterprise Tier

Spring – trusted and growing
Spring is fantastic for developer productivity
When asked, 67% of managers, 66% of architects, and 50% of
developers strongly agreed that they care deeply about
developer productivity, and Spring delivers; 95% of
respondents agreed that Spring Boot has a huge positive
impact on productivity; and 91% agreed that, compared to
other Java development platforms, Spring has a bigger impact.
95% of respondents say
Spring Boot has a huge
positive impact on productivity.
91% say Spring has a bigger
impact on developer
productivity than other Java
programs.
Spring Boot downloads per month are
growing YoY
61% of developers surveyed use Spring Boot as their only or primary
development program.
Source – The State of Spring 2021
95%
©2022 VMware, Inc. and Microsoft Corporation. All rights reserved. 4
52%
91%
61%
2021
2020
52%
2022

Integrated into Azure’s ecosystem and services
Fully managed infrastructure Built-in app lifecycle management Productivity Boost
Jointly built, operated, and supported by Microsoft and VMware
5
Azure Spring Apps Enterprise
A Fully Managed App Platform

Zero Management. Maximum Productivity.
Focus on Code
Not Toil
K8s Without
Learning K8s
VMware Tanzu
Productivity Boost
For Developers

The Tanzu Productivity Boost
5x Productivity
Boost for Junior
Devs
(with higher quality)
70% Time Saved
for App Operators
Accelerates
Customer’s
Timelines by Years
What We’ve Seen

Zero Management. Maximum Efficiency.
Developer
Self-Service
Less Work
More ROI
Security Baked In
For Operators

Harness the power of Kubernetes.
Without having to learn or manage
Kubernetes.
9
©2022 VMware, Inc. and Microsoft Corporation. All rights reserved.

Azure Spring Apps
Spring Boot Apps Service runtime
10

Open-source client libraries, integration modules, and drivers
Data Async communications – JMS and Kafka Keys, secrets,
and certs
Storage Cache
Azure Spring Apps
Developer experiences
Data Cache Async communications – JMS and Kafka Keys, secrets & certs
Open source client libraries, integration modules and drivers
Storage
Azure Spring Cloud
Monitor – logstream, APM and end-to-end Identities
end-users and machines
Automation
Spring Boot apps Service runtime
...
App 1 App 2 App 3 App N Agents Build Service Config Server Service Registry Lifecycle Resiliency Logstream Encryption Diagnostics
Domains
Identities – end users & machines Automation
Data
Open
Monitor – logstream
Spring Boot apps
...
App 1 App 2 App 3 App N
Monitor – logstream, APM, & end-to-end
16

Three simple
operations
az spring create --name ${ASA_SERVICE_NAME}
--sku enterprise
--resource-group ${RESOURCE_GROUP}
--location ${REGION}
Create service
1
az spring app create --name ${APP_NAME}
Create app
2
Deploy app
az spring app deploy --name ${APP_NAME}
--source-path ${PATH_TO_CODE}
3
17

Spring Cloud Azure
Spring Data
• SQL Database
• MYSQL
• PostgreSQL
• Maria DB
• Cosmos DB
• SQL
• MongoDB
• Cassandra
Spring Messaging
• Service Bus
• Event Hubs
Spring Cache
• Redis Cache
Spring Security
• Active Directory
• AAD B2C
Spring Integration
• Service Bus
• Event Hubs
• Storage Queue
Zero Trust
• Key Vault Secrets
• Key Vault Certs
Micrometer
• Monitor
Spring Cloud
• App Configuration
• Event Hubs
• Kafka
• Service Bus
• Redis
• Functions
R2DBC
• SQL Database
• PostgreSQL
• MySQL
Spring Resource
• Blog Storage
• Azure Files
aka.ms/spring-cloud-azure
18

Azure Spring Apps
Home for enterprise Spring Boot applications
19

Azure Spring Apps Enterprise
20

Azure Spring Apps
Enterprise
Unlock Spring’s full potential
with VMware Spring Runtime Support
Ship faster
with VMware Tanzu components
21

Ship faster
with VMware Tanzu
components
• Buildpacks with app
integrations
• Management of app
container creation
• Out-of-the-box SSO with
any identity provider
• Out-of-the-box
throttling and caching
• Accelerators for hardening
app config and best
practices
• Cloud-native streaming
and
batch data processing
pipelines
• ….
• Build Service
• Application
Configuration Service
• Service Registry
• Spring Cloud Gateway
• API portal
• Application Accelerator
• Application Live View
• Spring Apps
Data Flow*
• ….
*Roadmap is not confirmed and subject to change.
22

Deploy and manage
Spring and polyglot
applications.
23

Effortlessly route
client requests
to apps.
24

Commercial Support for Spring Projects
Here’s just one example: Spring Boot
2017 2018 2019 2020 2021 2022 2023 2024 2025 2026
3.0x
2.7x
2.6x
2.5x
2.4x
2.3x
2.2x
2.1x
2.0x
1.5x Today

AspectJ
Micrometer
Reactor
Spring AMQP
Spring Batch
Spring Boot
Spring Apps Commons
Spring Apps Config
Spring Apps Netflix
Spring Apps Bus
Spring Apps
Cloud Foundry
Spring Apps Open
Service Broker
Spring Apps Consul
Spring Apps Security
Spring Apps Sleuth
Spring Apps Zookeeper
Spring Apps Kubernetes
Spring Apps CLI
Spring Apps OpenFeign
Spring Cloud Gateway
Spring Apps Function
Spring Apps Contract
Spring Apps Task
Spring Apps Stream
Spring Apps Stream Binder
for Apache Kafka®
for RabbitMQ
for Kafka Streams
Spring Apps Vault
Spring CredHub
Spring Data for
Apache Cassandra™
Spring Data Commons
Spring Data KeyValue
Spring Data LDAP
Spring Data JDBC
Spring Data JPA
Spring Data MongoDB
Spring Data GemFire
Spring Data For
Apache Geode™
Spring Data Redis
Spring Data Rest
Spring Data Solr
Spring Framework
Spring HATEOAS
Spring Integration
(Core Modules + Kafka)
Spring For Apache Kafka®
Spring LDAP
Spring Kerberos
Spring Rest Docs
Spring Retry
Spring Statemachine
Spring Security
Spring Security OAuth
Spring Security SAML
Spring Apps Data Flow
Spring Session
Spring Session
for MongoDB
Spring Session for GemFire/
Apache Geode™
Spring Tool Suite
Spring Tools 4
Spring Vault
Spring Apps Skipper
Spring Apps Stream/
Task App Starters
Get 24/7 support
26

Demo:
Three simple
operations
az spring create --name ${ASA_SERVICE_NAME}
--sku enterprise
--resource-group ${RESOURCE_GROUP}
--location ${REGION}
Create service
1
az spring app create --name ${APP_NAME}
Create app
2
Deploy app
az spring app deploy --name ${APP_NAME}
--source-path ${PATH_TO_CODE}
3
27

Typical application architecture
28
Runtime
API Gateway
Frontend User Interface
Automation
Monitoring Identity Provider Databases for Business State Secrets Management
Backend APIs
Runtime

Azure Spring Apps
Azure Active Directory PostgreSQL
Automation
Monitoring
Common application architecture
29
Key Vault
Backend APIs
Identity Catalog Payment
Order
Cart
Frontend: NodeJS

aka.ms/fitness-store
Acme Fitness
30

31
Everyone that uses Kubernetes, needs images….
Where do your images come from?
Build them Source them
How much time do you [ want to ] spend on that?

32
Key Finding: There is something holding you back…What is it?
Recall:
• Goal: Reduce Dev Cycle Time
• Goal: Get Developers Focused On Code
ImageFiles Require More Automation
Dockerfiles do not scale…

Popular and easy to get started
Dockerfile: Most common way of creating containers
©2022 VMware, Inc. and Microsoft Corporation. All rights reserved. 33
Confidential │ ©2020 VMware, Inc.
• Dockerfiles are the most common way
of creating Docker Images
• Their flexibility is their power
• Run any command, mutate any file
• Their flexibility is their weakness
• Keeping consistent, ensuring security
• Takes a lot of effort for "good"
Dockerfiles
5
Creating Docker Images
DOCKERFILE TO CREATE JVM
Descriptive file specification
Good starting point
Flexibility is their power

When dev teams build images differently, they introduce vulnerabilities and complexity
Containers built using Dockerfile are hard to
productionize and scale
34
Broken
build
Unverified
update
Hard to track
and patch CVE
Out of
compliance
Image updates
Security posture
Full stack container audits
IT governance

Specification to translate application code to OCI-compliant container image
Cloud Native Buildpacks
35

Buildpacks ecosystem
36

Specification-only project that transforms application code to images
that can run on any cloud
Cloud Native Buildpacks
37
dependency

Let’s start with a route and understand how the gateway helps me with XCCs
Understanding the Spring Cloud Gateway building blocks
38
Link to Spring Cloud Gateway doc
• Routes define how the Gateway will process incoming requests.
• Each route is composed of Predicates, Filters, and a Service.
• Predicates determine whether the route matches any given
request.
• Filters apply behavior to matching requests or their responses.
• The Service determines where the request will be forwarded after
filtering.

The logic for executing the cross-cutting concerns
How they all work − Spring Cloud Gateway
39
1. Client makes a
request to the
Gateway.
2. Evaluates
Predicates to match
a request to a route.
3. Runs through the “pre” filter logic chain
specific to the request.
Pre-request
Post-request
4. Proxy routes the
request to the service.
Proxied
Service
5. Service is executed.
6. Runs the “post” filter logic.

Evaluate conditions to map requests to a route
Spring Cloud Gateway Predicates
40
• HTTP Method matches a list?
• URI Path matches a pattern?
• URI Query matches a regex?
• RemoteAddr matches CIDRs?
• Weight within a route group
Link to available Predicates
• After a certain datetime?
• Before a certain datetime?
• Between two datetimes?
• Cookie matches a regex?
• Header value matches a regex?
• Host matches a pattern list?

Allow you to do things with requests/responses
Spring Cloud Gateway Filters
41
Link to available Filters
• Add, remove, modify headers; map values; add security headers.
• Rewrite path, extract segments, add / remove prefix.
• Redirect users.
• Retry and use Circuit Breaker.
• Change response status.
• List authorized roles and scopes to access route.

Allows you to limit number of requests
Spring Cloud Gateway – Rate Limiting Filter
42
• The Rate Limiting Filter limits the number of requests
allowed from a route, with the ability to burst the limit to
a max number.
• Duration specified in seconds(s), minutes(m), or hours(h).
• Within limits: response will succeed + report how many
requests can still be made.
• Exceeded limits: fail with 429 Too Many Requests.
• Ex.: Limit users to 2 requests every 5 seconds.
Link to Rate Limit Filter

Azure Spring Apps
Azure Active Directory PostgreSQL
Common LOB architecture
43
Key Vault
Backend APIs
Order
Cart
Frontend: NodeJS

Provides several custom filters in addition to those included in the open-source project
Spring Cloud Gateway – Commercial filters
44
• Rate Limiting Filter
• Circuit Breaker Filter
• Single Sign-on Authorized Endpoint –
Security Filter
• Scope Authorization – Security Filter
• Role-Based Access Control – Security Filter
• Token Relay – Security Filter
• Request / Response Modification Filter
• Client Certificate Authorization Filter
• …
Link to Commercial Route Filters

Configurable single sign-on (SSO) integration with your preferred identity provider (IDP)
SSO integration with OIDC
45
Authenticated?
No
Yes
Azure Active Directory
Backend APIs
Order
Cart

Passes authenticated user’s identity token to the app when user accesses the app’s route
Token relay
46
Cookie
Session
Authentication:
Bearer
xznjs….
Authentication:
Bearer
xznjs….
Azure Active Directory
Backend APIs
Order
Cart

Route filter
Single sign-on authorized endpoint – Security
47
• The SSO-enabled filter will force the client to be
authenticated before allowing access to a route.
• If the client is not authenticated, they will receive a
302 HTTP response with redirect URL to API
Gateway’s configured SSO login page.
• Ex: The /api/adopt route has the SSO-enabled
filter enabled, when accessed through an HTTP
GIT request.
Link to SSO Filters

Component Frequency of
Maintenance Updates
Security
Patches
Container Image
App dependencies Every few weeks Vary
APM – Application Performance
Monitoring
Every few weeks Vary
JDK Every 3 months Vary
Base image (operating system
and runtime)
Monthly Vary
Kubernetes
K8S Quarterly Vary
Host OS – underlying operating
system that runs on each node
in a K8S cluster
Monthly Vary
Unceasing Barrage of Software Updates
Must keep your system up-to-date – regularly update your apps, dependencies, JDK, OS, K8S and Host OS

A record 26,448 software security flaws were reported in
2022, with the number of critical vulnerabilities up 59%
on 2021 to 4,135, according to analysis by The Stack of
Common Vulnerabilities and Exposures (CVEs) data.
https://thestack.technology/analysis-of-cves-in-2022-software-vulnerabilities-cwes-most-dangerous/

Maintenance Updates
Security
Patches
Container Image
APM – Application Performance
Monitoring
Base image (operating system
and runtime)
Monthly Vary
Kubernetes
K8S Quarterly Vary
Host OS – underlying operating
system that runs on each node
in a K8S cluster
Monthly Vary
What are the challenges with patching?
Must keep your system up-to-date – regularly update your apps, dependencies, JDK, OS, K8S and Host OS
• Volume of patches & updates
• Securing approvals for delaying
• Scaling coordination between
• App development teams
• DevOps teams
• Re-run pipelines for every change
to container image
• Testing
• Certification
• Staging and
• Deploy to production
• Are pipelines stateless and
reproducible?

BTW: There’s a fresh CVE created every 20 minutes
https://thestack.technology/analysis-of-cves-in-2022-software-vulnerabilities-cwes-most-dangerous/

What If… We managed that for you?
Maintenance Updates
Security
Patches
Container Image
APM – Application
Performance Monitoring
Base image (operating
system and runtime)
Monthly Vary
Kubernetes
K8S Quarterly Vary
Host OS – underlying
operating system that runs
on each node in a K8S
cluster
Monthly Vary
Customer updates
apps any time
Azure Spring Apps
• Autopatch runs every 6 weeks
• Planned maintenance windows
• Hotfix deployed for critical
updates

Case 1 – Apache Log4j2 exposure
CVE-2021-44228 - aka.ms/cve-log4j
Customers updated
Spring apps if they
had switched
logging framework
to Log4j 2
Azure Spring Apps
• Hotfix deployed for New Relic
and AppDynamics Java agents
• If these APMs were activated in
apps, Azure automatically
protected by re-starting them
Maintenance Updates
Security
Patches
Container Image
APM – Application
system and runtime)
Monthly Vary
Kubernetes
K8S Quarterly Vary
cluster
Monthly Vary

Case 2 – openssl exposure
CVE-2022-3602 - aka.ms/cve-openssl
Maintenance Updates
Security
Patches
Container Image
APM – Application
system and runtime)
Monthly Vary
Kubernetes
K8S Quarterly Vary
cluster
Monthly Vary
Customers - no
action was necessary
Azure Spring Apps
• Autopatch successfully resolved
the software vulnerability
identified
• Similarly, resolved for service
instances with planned
maintenance windows during
those times

Auto patching
Stay ahead of the game with auto patching -
the proactive shield against known security
threats and vulnerabilities in your systems and
software.

Azure Spring Apps
Enterprise
57
Ship faster
with VMware Tanzu components
SLA: 99.95

Ship faster
with VMware Tanzu
components
58
• Buildpacks with app
integrations
• Management of app
container creation
• Out-of-the-box SSO with
any identity provider
• Out-of-the-box
throttling and caching
• Accelerators for hardening
app config and best
practices
• Cloud-native streaming
and
batch data processing
pipelines
• ….
• Build Service
• Application
Configuration Service
• Service Registry
• Spring Cloud Gateway
• API portal
• Application Accelerator
• Application Live View
• Spring Apps
Data Flow*
• ….
*Roadmap is not confirmed and subject to change.

Azure Spring Apps in a nutshell
• Home for distributed workloads that
leverage services on Azure, on-premises,
and externals.
• Eliminate middleware management efforts
– say patching, running middleware, etc.
• Unlimited scale without additional
hardware procurement or datacenters.
• Define roles and responsibilities to match
your team structure – Azure RBAC
(developer, DevOps, SRE, tester, security).
• Monitor end-to-end – detect and react
faster.
• Automate end-to-end.
• Implement charge backs in line with your
funding model – through Azure cost
management system.
• Minimize costs.
• High availability through
unpredictable volumes and
recover faster from failures.
• Expand across the globe – 60+
Azure regions with speed and
scale to meet your needs.
• Strengthen your security
posture with Azure.
• Supported by Microsoft and
VMware.
• Build and scale distributed
workloads at cloud scale.
• Externalize config, enable
service registry, secure,
automate end-to-end, and
monitoring.
• Harness the power of K8S
without learning or operating it.
• Easy to spawn environments.
• Automate testing.
• Advance to production across
the globe.
Developers
Easily build and deploy
IT Operators
Simple to operate at scale
Executives
Peace be with you!
59
Enterprise

Special Offers
60
Interested in a hands-on workshop?
What about a free app suitability assessment?
You bring your app, and our experts will tell you
the level of effort to deploy it onto Azure Spring
Apps Enterprise.
There are limited slots for both, so sign up early!
https://via.vmw.com/asa-e-signup

Accelerate Spring apps to cloud at scale today!
Develop your first
Spring Boot app
aka.ms/Start-Spring
Learn using a self-paced
workshop
aka.ms/Learn-Spring
Watch Demos
aka.ms/Spring-Playlist
Leverage Best Practices
aka.ms/Spring-Boot
Build and Deploy Java apps
on Azure
aka.ms/LearnJava
Interact With Azure Services
Using Spring
aka.ms/Spring-Cloud-Azure

Start Today!
aka.ms/spring-apps-enterprise
50 vCPU hour
100 Memory GB h

63
We will be at Microsoft Build!

Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023

Recommended

More Related Content

Similar to Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023 (20)

More from VMware Tanzu (20)

Recently uploaded (20)

Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023