Category: Blogs

  • Why GraphQL is a Better Choice for Building Microservices

    Why GraphQL is a Better Choice for Building Microservices

    There’s been a long debate about whether it’s better to use REST or GraphQL for building microservices. Both technologies have their proponents and critics, but when it comes to the specific needs of microservices architectures, GraphQL emerges as the clear front-runner. Here’s why.

    Understanding the RESTful Concerns

    While REST has been the go-to API style for many years, lauded for its simplicity and general applicability, its limitations become glaringly apparent in the context of microservices. These limitations include:

    • Over-fetching of data
    • Multiple HTTP requests for related data
    • Complex versioning strategies

    Such issues can impede microservices architectures’ performance and scalability.

    Over-fetching of data: REST APIs are designed to return a fixed set of data, which often results in over-fetching. This redundancy is particularly problematic in mobile networks, where every extra byte of data can lead to slower applications and degraded user experiences.

    For example, imagine we have a REST API endpoint /api/user/{userId}, which returns the following data for a user:


    In scenarios where mobile apps only require specific user details like name and email for a profile overview, fetching comprehensive user data means over-fetching.

    This excess data usage can be costly for users with limited data plans and result in slower app performance and degradation of user experience.

    Latency and the N+1 problem: Microservices often require data spread across multiple services.

    Suppose you have an ecommerce application where the order domain handles product, customer, order and return entities, and the stock domain manages product, stock, warehouse and delivery entities. A common operation might be to display order details along with the current stock status for each product.

    Let’s say we have an order microservice and a stock microservice to handle orders and stocks.

    In our scenario, a customer places three orders (N=3) and each order contains four different products. To display the order details with the stock status for each product, the application initially makes one request to fetch the orders. Then, for each product in each order, it makes additional requests to the stock microservice to retrieve stock information. This results in one initial request, plus 12 subsequent requests (three orders times four products per order), summing up to 13 API calls. This multiplicative increase in requests leads to higher latency due to multiple round-trip times (RTT) and increased load on the network and servers, embodying the N+1 problem.

    Versioning challenges: Maintaining REST APIs over time involves complex versioning strategies, such as introducing new endpoints or embedding version numbers in the API path. This can lead to bloat and confusion, complicating API development and consumption.

    The GraphQL Advantage

    GraphQL addresses many REST weaknesses.

    Domain-Driven Design: Microservices thrive on a domain-driven design, where each service is built around a specific business capability. GraphQL’s schema-centric approach aligns perfectly with this, enabling a more organized and coherent structure for microservices.

    Unified schema: In a microservices architecture, each service may have its schema, representing a portion of the business domain. GraphQL stands out by allowing these schemas to be combined or stitched together, presenting a unified interface to clients. This means that clients can query data from multiple services in a single request, drastically reducing the complexity and number of network calls.

    Solving the N+1 problem: GraphQL’s ability to fetch data with a single request, regardless of how many underlying services need to be called, directly addresses the N+1 problem inherent in REST architectures. This not only improves performance but also simplifies client-side data fetching logic.

    For the N + 1 problem described earlier, if the services support GraphQL, it can be used to fetch nested data in a single query, effectively solving the N+1 problem.

    Efficiency and performance: By allowing clients to specify exactly what data they need, GraphQL eliminates over-fetching and under-fetching issues common in REST APIs. This leads to more efficient data retrieval, reduced bandwidth usage, and faster applications, particularly noticeable in mobile environments.

    In the earlier scenario where mobile apps only require specific user details like name and email for a profile overview, clients can request name and email alone.

    Simplified versioning: Unlike REST, GraphQL reduces the need for versioning by allowing new fields and types to be added to the schema without impacting existing queries. This forward compatibility means that clients and servers can evolve more smoothly over time. GraphQL stands today as a mature technology that addresses specific needs in modern web development that are not fully met by traditional REST APIs. Its design promotes efficiency, flexibility, and developer productivity.

    Looking ahead, the future of GraphQL is bright, with community-driven efforts focused on addressing its current limitations, particularly around security, performance and standardization. As these efforts bear fruit, GraphQL’s adoption is expected to widen, consolidating its position as a key technology in the API landscape.

  • Aembit Selected as Finalist for RSA Conference 2024 Innovation Sandbox Contest

    Aembit Selected as Finalist for RSA Conference 2024 Innovation Sandbox Contest

    Silver Spring, United States / Maryland, April 3rd, 2024, CyberNewsWire

    The Leading Company for Securing Access Between Workloads Recognized for the Aembit Workload IAM Platform

    Aembit, the Workload Identity and Access Management (IAM) Company, has been named one of the Top 10 Finalists for the RSA Conference™ 2024 Innovation Sandbox contest for its platform that manages and secures access between critical software resources, like applications and services. Aembit will present its technology to a panel of renowned industry judges and a live in-person audience on May 6 at RSA Conference 2024 at the Moscone Center in San Francisco.

    Since 2005, the RSAC Innovation Sandbox contest has served as a platform for the most promising young cybersecurity companies to showcase their groundbreaking technologies and compete for the title of “Most Innovative Startup.” The competition is widely recognized as a catapult for success as the Top 10 Finalists have collectively celebrated more than 80 acquisitions and received $13.5 billion in investments over the last 18 years. Aembit will have three minutes to pitch the panel of judges before a question-and-answer round.

    “The submissions for this year’s RSA Conference Innovation Sandbox contest were both dynamic and inspiring. Along with the rest of our entrepreneurial audience, I am excited to see these ideas come to life on stage,” said Linda Gray Martin, senior vice president of RSA Conference. “The evolution of global cyber threats is constant and there’s no better place to look for solutions and to help solve these challenges than in our own community.”

    With the rapid expansion of automated software, cloud services, and APIs, enterprises are being met with an exploding number of workloads across their IT environments. Reflect on the now-outdated practice of jotting down user credentials on sticky notes. Similarly, the current method of securing interactions between workloads typically involves the use of static, long-lived credentials, which are prone to theft and often embedded directly within code.

    This approach not only introduces security vulnerabilities but also complicates management and impedes prompt response during security incidents and compliance audits. Aembit shifts the model so enterprises can focus on managing access, instead of managing secrets.

    “Aembit automates and secures the entire workload-to-workload access workflow, from discovery, to enforcement, to audit – at scale,” said David Goldschlag, co-founder and CEO of Aembit. “Instead of building another dashboard showing you problems due to secrets and keys, we proactively fix the root cause of these challenges by systematically improving the way workloads are authorized access to your most sensitive resources, without code changes. You can think of us as Okta (or Azure AD), but between workloads instead of between users and services. The RSA Conference presents the ideal platform for us to demonstrate the significance and impact of our solution to the global security community.”

    The RSAC Innovation Sandbox contest kicks off at 10:50 a.m. PT on May 6, and winners will be announced at approximately 1:30 p.m. the same day. The panel of renowned expert judges includes Asheem Chandna, partner at Greylock; Dorit Dor, chief technology officer at Check Point Software Technologies; Niloofar Howe, senior operating partner at Energy Impact Partners; Paul Kocher, independent researcher; and Nasrin Rezai, SVP & CISO at Verizon. Hugh Thompson, RSAC executive chairman and program committee chair of RSA Conference, will return to host the contest.

    For more information regarding RSA Conference 2024, taking place at the Moscone Center in San Francisco from May 6 to 9, users can visit https://www.rsaconference.com/usa.

    To learn more about the Aembit Workload IAM Platform, watch this demo video.

    About Aembit

    Aembit is the Workload Identity and Access Management platform that secures access between workloads across clouds, SaaS, and data centers. With Aembit’s identity control plane, DevSecOps can fully automate secretless, policy-based, and Zero Trust workload access. For more information, visit www.aembit.io and follow us on LinkedIn.

    About RSA Conference

    RSA Conference™ is the premier series of global events and year-round learning for the cybersecurity community. RSAC is where the security industry converges to discuss current and future concerns and have access to the experts, unbiased content, and ideas that help enable individuals and companies advance their cybersecurity posture and build stronger and smarter teams. Both in-person and online, RSAC brings the cybersecurity industry together and empowers the collective “we” to stand against cyberthreats around the world. RSAC is the ultimate marketplace for the latest technologies and hands-on educational opportunities that help industry professionals discover how to make their companies more secure while showcasing the most enterprising, influential, and thought-provoking thinkers and leaders in cybersecurity today. For the most up-to-date news pertaining to the cybersecurity industry visit www.rsaconference.com. Where the world talks security.

    Contact

    CMO
    Apurva Dave
    Aembit
    apurva@aembit.io

  • Bringing DevOps Automation to Legacy Systems

    Bringing DevOps Automation to Legacy Systems

    A critical step toward adopting automation for legacy applications is to change your organization’s mindset about legacy systems.

    Applying automation to operations isn’t always straightforward, especially with older systems that don’t easily fit into typical DevOps automation tools and strategies. However, legacy systems don’t have to sit on the sidelines of your DevOps automation strategy. Using the right tools and methodologies, it’s possible to integrate legacy system requirements with modern automation techniques.

    Most organizations that adopt DevOps for conventional applications use automation tools and techniques, including Infrastructure-as-Code (IaC) and Configuration-as-Code (CaC), automated testing, release automation and application orchestration. If you’ve been paying attention to DevOps for any length of time, you probably are familiar with the concepts.

    However, those DevOps automation solutions aren’t always straightforward to implement with legacy systems made up of hardware or software deployed long before modern, DevOps-friendly application architectures and deployment strategies existed.

    For example, IaC tools may not support the configuration languages or management tools that the systems require. Most current systems are configured using languages like YAML, but legacy systems may depend on proprietary configuration languages and frameworks.

    For similar reasons, test automation can be cumbersome. Today’s automation frameworks are designed for browser-based or mobile apps. Legacy systems may run locally and often use proprietary user interfaces, making automating testing using standard frameworks more difficult.

    Likewise, many release automation and application orchestration platforms are designed for applications deployed using containers. Because containers didn’t become popular until the release of Docker in 2013, most legacy systems have limited native support for application containerization.

    Bringing Automation to Legacy Systems

    Fortunately, these obstacles are possible to overcome. Addressing these challenges requires adopting innovative practices that enable the integration of automation with legacy systems:
    • Migrate to the cloud: Legacy system vendors now offer cloud-based hosting platforms. While transferring legacy workloads from on-premises to the Cloud doesn’t automatically enable all DevOps automation features, it does significantly facilitate the use of automatically scalable infrastructure. Organizations can move workloads between cloud data centers to mitigate failures in a single location.
    • Containerize legacy workloads: In certain situations, it’s possible to get a legacy application to run in a container. That allows businesses to manage the older software using orchestration solutions like Kubernetes, bringing much greater agility and scalability to legacy application management.
    • Use machine learning: Incorporating machine learning into monitoring and management operations for legacy systems helps to detect issues effectively in contexts where conventional automation is not feasible. For example, if you can’t run automated tests for a legacy application because Selenium won’t support it, advanced ML techniques might help you identify bugs based on how the application behaves.
    • Change your mindset: Instead of classifying legacy systems as outdated and inefficient environments, treat them with equal respect to all the other applications within your IT estate. When your team approaches legacy systems from a perspective that values them, it becomes much easier to refine a corporate culture toward collaboration and innovation that extends to those legacy systems as well.

    To Optimize DevOps Automation, Don’t Ignore Legacy Environments

    There’s no denying that automating the management of legacy apps for DevOps teams is often more challenging than implementing automation for modern apps. However, this doesn’t mean that it’s impossible. Many organizations successfully adopt automation as a strategy for improving the flexibility and quality of legacy apps, while also reducing the costs of building and deploying them. But to achieve this, it’s necessary to think beyond the conventional approaches of DevOps.

  • Hasura Adds “Supergraph” to Platform for Managing APIs

    Hasura Adds “Supergraph” to Platform for Managing APIs

    Hasura, whose product helps compose GraphQL APIs backed by databases and services, today made available in beta an update to its platform. The company is adding a graph modeling framework that makes it simpler to manage application programming interfaces (APIs) at scale.

    The goal is to make it easier for IT teams to declaratively create APIs and then manage them at scale, said Hasura CEO Tanmai Gopal. As application environments made up of multiple backend services and databases become the enterprise norm, there is a pressing need to simplify the management of what has become thousands of APIs in an enterprise IT environment using query compilers and routing capabilities built into the platform, he added.

    In version 3.0 of the Hasura Data Delivery Network (DDN), the “supergraph” execution engine is based on a serverless runtime engine that, the company says, will replace its previous graph technologies to manage both GraphQL and REST APIs.

    In addition, all connectors provided by Hasura have been rebuilt using an open specification and are now available as open source software on the Hasura Connector Hub. Hasura is also making available a software development kit (SDK) to enable IT teams to build custom connectors.

    Written in the Rust programming language, the supergraph framework eliminates the need to create and manage GraphQL servers or services to deploy a graph. Additional data domains as a result can be added or replaced without breaking the graph used to manage other APIs.

    The update to the Hasura DDN also adds new build system to provide instant API previews and support for rollbacks, a redesigned console featuring a graphical supergraph viewer, API analytics, observability, and auto-generated API documentation capabilities. Every iteration of the Hasura supergraph is instantly available as an immutable build that can be tested in preview. Every change to the supergraph is also validated before build, letting users identify potential bugs, stylistic issues, syntax, and type errors.

    In addition, Hasusa has added a sub-millisecond cold start capability to enable rapid autoscaling and plane to shortly add caching to improve API performance in edge computing environments.

    Longer term, the company plans to add additional a range of artificial intelligence (AI) capabilities to enable IT teams to identify issues requiring troubleshooting earlier and generate reports, Gopal added.

    While REST APIs are still more commonly used than GraphQL, more IT teams are employing the latter. That’s because GraphQL provides more control over how data is accessed and consumed. Most organizations will soon be using a mix of REST and GrapgQL APIs, but it might be years before REST is supplanted as the dominant format simply because those APIs are more familiar to developers and easier to create.

    Regardless of the type of API used, however, their numbers continue to steadily increase with each microservice added to an IT environment. It’s not always clear which teams within an IT organization are managing those APIs but increasingly best DevOps practices are being used to deploy, manage, secure and update them alongside every other type of software artifact. The challenge, of course, is making it simple to manage those API workflows in a way that doesn’t require yet another specialist to be added to the DevOps team.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals are highlighted. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the hiring company, the vertical industry segment and naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Indeed.com

    SAP
    Bellevue, WA
    DevOps Engineer
    $182,312

    CareerBuilder.com

    HRL Laboratories
    Malibu, CA
    Senior DevOps Engineer
    $145,745 to $186,688

    LinkedIn

    Visa
    Atlanta
    DevOps Data Engineer
    $142,000 to $179,900

    SimplyHired.com

    Amazon Web Services (AWS)
    Seattle
    Senior Software Development Engineer
    $134,500

    Dice.com

    Travelers
    Hartford, CT
    DevOps/Machine Learning Operations (MLOps) Engineer
    $94,900 to $156,600

  • Survey Sees AI Playing Larger Role in Test Automation

    Survey Sees AI Playing Larger Role in Test Automation

    A survey of 1,028 senior IT professionals and application developers in the United Kingdom, U.S., Germany and Singapore finds nearly half (47%) still use manual testing for mobile applications. More than a third (38%) noted that their organization could save between half and three-quarters (51-75%) of funding allocated to testing per year by fully automating mobile application testing.

    Conducted by the market research firm Censuswide on behalf of Tricentis, a provider of a test automation platform, the survey also found that just under half of respondents (49%) reported their organization is already applying artificial intelligence (AI) to application testing. Another 21% plan to apply AI in the next six months. Almost three-quarters (74%) said their organization’s general sentiment toward AI in mobile software development testing is positive.

    Respondents also expected AI to improve mobile application quality (37%), increase productivity (36%) enhance end-user experience (34%) and to reduce the number of vulnerabilities and/or bugs (32%) in their applications.

    Mav Turner, chief product and strategy officer at Tricentis, said that rather than continuing to rely on expensive testing services, more organizations are looking to reduce costs by automating a wider range of testing workflows within the context of a DevOps workflow. In fact, the survey finds just under a third of respondents (32%) expect their organizations will invest more than $1 million to further automate testing.

    As modernization of testing processes continues, the return on investment in mobile application development will only continue to improve, noted Turner.

    The survey identifies the primary benefits of investing in test automation, which are increased productivity (32%), increased revenue (31%), increased user retention (28%) and increased compatibility across devices (28%).

    The primary obstacles organizations encounter as they strive to achieve that goal are competing priorities (28%), lack of technology and talent (25%), time (25%) and cost (24%), the survey finds.

    A full 87% said the quality of mobile applications is critical to their business, with 90% noting that poor mobile application quality costs their business as much as $2.49 million in lost revenue per year. However, just over a quarter (27%) said they believe their organization’s current mobile application development and testing strategy exceeds expectations.

    As part of efforts to automate testing, it’s not clear just how far responsibility for testing is shifting left toward developers, but there is no doubt many more are being exposed to the results earlier in the software development life cycle. The goal is to provide continuous testing capabilities without overly disrupting code writing. It’s also becoming simpler for developers to leverage generative AI tools to provide summaries of tests along with recommendations to improve code. The end result should be higher-quality applications that require less troubleshooting once deployed in a production environment.

    In the meantime, as organizations continue to become more dependent on mobile applications to drive a wide range of digital transformation initiatives, the cost of testing will continue to pale in comparison to the potential amount of lost revenue that might occur when end users either don’t invoke a specific feature or capability or, more commonly, simply abandon the application altogether.