All is not completely rosy in microservice-land. It is often a sign of an architectural approach’s maturity that in addition to the emergence of well established principles and practices, that anti-patterns also begin to be identified and classified. In this talk Daniel will introduce the 2016 edition of the seven deadly sins that if left unchecked could easily ruin your next microservices project... This talk will take a tour of some of the nastiest anti-patterns in microservices, giving you the tools to not only avoid but also slay these demons before they tie up your project in their own special brand of hell. Topics covered include: Envy - introducing inappropriate intimacy within services by creating a shared domain model, and how many teams deploy and use data stores incorrectly; Wrath - failing to deal with the inevitable bad things that occur within a distributed system; Sloth - ignoring the importance of NFRs; and Lust - embracing the latest and greatest technology without evaluating the impact incurred by these choices. This is an all-new 2016 version of Daniel's popular 'deadly sins talk' that was recently presented at QCon NY. The talk received 94% highest rating, and was the fifth most attended talk at the conference. Daniel plans to continually improve the presentation based on his learnings and attendee feedback.

1. The Seven (More) DEADLY SINS OF Microservices
Daniel Bryant
@danielbryantuk
OpencRedo / Spectolabs

2. Previously, AT Devoxx UK & QCON NYC 2015...
07/11/2016 @danielbryantuk
https://www.infoq.com/presentations/7-sins-microservices

3. The Seven (more) Deadly Sins of Microservices
1. LUST - Using the (Unevaluated) latest and greatest tech…
2. GLUTTONY - Communication lock-in
3. GREED - What'S Mine is mine (within the organisation)…
4. SLOTH - Getting lazy with NFRs
5. WRATH - Blowing up when bad things happen
6. ENVY - The shared single domain (and data store) fallacy
7. PRIDE - testing in the world of transience
07/11/2016 @danielbryantuk

4. @danielbryantuk
• Chief Scientist at OpenCredo, CTO at SpectoLabs
ü Transforming organisations through technology and teams
ü Agile, Lean, Architecture, CI/CD, DevOps
ü Microservices, cloud, Containers, Java, Go, Docker, Kubernetes
• London Java Community Associate
• Adopt OpenJDK and JSR
• InfoQ Editor, DZone MVB, VOXXED, O'Reilly
07/11/2016 @danielbryantuk

5. 1. Lust - Using THE LATEST and Greatest Tech…
07/11/2016 @danielbryantuk

6. New technology is great... Until it isn'T
07/11/2016 @danielbryantuk
developers with new tech be like
F**king new technology...
Credit to Michael Hausenblas
This has been me
many times!

7. Evaluation is a key skill...
07/11/2016 @danielbryantuk

8. Evaluation - are Microservices A good fit?
• “our 'mode TWO' apps are Microservices”
– Middle-management latch on to Buzzword
– New app evolution limited by existing system
– Lipstick on the pig
• Not understanding architecture principles
– Not building around business Functionality
– Creating Mini-monoliths (no twelve factors)
• No Well-defined DevOps / SRE / Ops
– Deployment/ops free-for-all
07/11/2016 @danielbryantuk

9. Evaluation of tech - The’Spine Model
• Effective conversations make for effective
collaboration
• It's a TOOL Problem
– As a species, we have always been Tool users
and makers.
– We use _____ to get our work done
• People get stuck in a dilemma where equally
plausible options are available
• “Going up the Spine” breaks deadlock http://spinemodel.info/explanation/introduction/

10. Evaluation of tech - Fitness functions
• Great for evaluation and documentation
– Platforms / Language
– Middleware
– Data stores
• Microservices as an Evolutionary Architecture
– Neal Ford and Rebecca Parsons
07/11/2016 @danielbryantuk

11. AN example: To containerise, or not to containerise?
(dockaH, dockah, dockah... Dockah?)
07/11/2016 @danielbryantuk

12. Strategy #fail
07/11/2016 @danielbryantuk

13. Architecture/ops: Expectations versus reality
07/11/2016 @danielbryantuk
“DevOps”

14. Choices: Beware of Confirmation bias
07/11/2016 @danielbryantuk
https://thehftguy.wordpress.com/2016/11/01/docker-in-production-an-history-of-failure/ http://patrobinson.github.io/2016/11/05/docker-in-production/

15. Evaluation - It'S easy to be tricked
07/11/2016 @danielbryantuk

16. Evaluation - beware of bias and heuristics
07/11/2016 @danielbryantuk

17. 2. GLUTTONY - Communication lock-in
07/11/2016 @danielbryantuk

18. Rpc - not the devil in disguise
• Don'T rule out RPC (e.g. grpc)
– Sometimes the contract (and speed) are beneficial
– Human readability of JSON can be over-rated
• Sometime events are better
– Asynchronous (AP vs CP)
– durable message queues can provide interesting benefits
– Unlearn acid principles - No one size fits all
07/11/2016 @danielbryantuk

19. The ESB is dead - long live the esb!
07/11/2016 @danielbryantuk

20. The ESB is dead - long live the esb!
07/11/2016 @danielbryantuk

21. The ESB is dead - long live the esb!
07/11/2016 @danielbryantuk
• Is this an ESB?
• Or an API gateway?

22. The ESB is dead - long live the API Gateway!
07/11/2016 @danielbryantuk
• Watch for the API Gateway morphing
into an Enterprise service bus
– Loose coupling is vital
• But let me be clear...
– The API Gateway pattern is awesome
– Centralise cross-cutting concerns
– Prevent wheel-reinvention (plugins)
– Check out kong, apigee, Mulesoft etc

23. 3. GREED - What'S mine is mine... (within the organisation)…
07/11/2016 @danielbryantuk

24. Previously...
• Conway'S Law
• Microservices are about people, as much as they are tech
– Maybe more
– Particularly in a migration / transformation
07/11/2016 @danielbryantuk

25. We hear this a lot...
“We’ve decided to reform our teams around squads, chapters and guilds”
• Beware of cargo-culting
– Repeat three times “We are not spotify”
• Understand the practices, principles, values etc
07/11/2016 @danielbryantuk

26. 4. SLOTH - Getting Lazy with NFRs
07/11/2016 @danielbryantuk

27. Getting lazy with non-Functional Requirements
“The driving technical requirements for a system should be identified early
to ensure they are properly handled in subsequent design”
Aidan Casey
Guiding principles for evolutionary architecture
07/11/2016 @danielbryantuk

28. Getting lazy with non-Functional Requirements
• The 'ilities' Can be (often) be an afterthought
– Availability, Scalability, auditability, testability etc
• Agile/Lean: Delay decisions to the ‘last responsible moment’
– NewsFlash - Sometimes this is up-front
• It can be costly (or prohibitive) to adapt late in the project
– Microservices don'T make this easier (sometimes more difficult)
07/11/2016 @danielbryantuk

29. Getting lazy with NFRs - security
07/11/2016 @danielbryantuk
www.slideshare.net/spnewman/appsec-microservices-velocity-2016 www.infoq.com/news/2016/08/secure-docker-microservices

30. Testing NFRs in the build pipeline
• Performance and Load testing
– Gatling / jmeter
– Flood.io
• Security testing
– Findsecbugs / OWASP Dependency check
– Bdd-security (OWASP ZAP) / Arachni
– Gauntlt / Serverspec
– Docker Bench for Security / Clair
07/11/2016 @danielbryantuk

31. 5. WRATH - Blowing up when bad things happen
07/11/2016 @danielbryantuk

32. Previously - Bring in Michael Nygard (Or some monkeys)
07/11/2016 @danielbryantuk

33. When bad things happen, people are always involved
07/11/2016 @danielbryantuk | @oakinger

34. People Pain point - How does Devops fit into this?
• http://web.devopstopologies.com/
• @ matthewpskelton
• @beerops and @sigje
• Google SRE
07/11/2016 @danielbryantuk

35. Devops - the 'fullstack engineer' myth
“I'M sorry, but if you'RE not designing the computer chips and
writing the website, then I don'T wanna hear from you”
Charity Majors (@mipsytipsy), CraftConf 2016
http://www.ustream.tv/recorded/86181845
07/11/2016 @danielbryantuk

36. Devops - define responsibilities
• Do you really want to build an
entire microservices platform?
• Focus on what matters
– Ci/CD
– Mechanical sympathy
– Logging
– Monitoring
07/11/2016 @danielbryantuk

37. Worth considering: Open source PaaS
07/11/2016 @danielbryantuk

38. 6. ENVY - The shared SINGLE domain (and Data Store) fallacy
07/11/2016 @danielbryantuk

39. Previously - One Model to Rule Them All...
• One model…
– Breaks encapsulation
– Introduces coupling
• Know your DDD
– Entities
– Value Objects
– Aggregates and Roots
07/11/2016 @danielbryantuk

40. Context mapping (static) & event storming (dynamic)
07/11/2016 @danielbryantuk | @spoole167 40
www.infoq.com/articles/ddd-contextmapping
ziobrando.blogspot.co.uk/2013/11/introducing-event-storming.html

41. Choose (and use) data stores appropriately
• RDBMS
– Valuable for structured data
• Cassandra is Awesome
– but don'T treat it like an RDBMS!
• Don'T build a graph with RDBMS
– Use neo4j, Titan etc
• Beware of operational overhead
07/11/2016 @danielbryantuk

42. 7. PRIDE - testing in the world of transience
07/11/2016 @danielbryantuk

43. Previously...
• Local verification
– Consumer-Driven contracts
• End-to-end
– BDD-style critical path
• Remember the test pyramid
07/11/2016 @danielbryantuk
martinfowler.com/articles/microservice-testing/

44. Service virtualisation / API simulation
• Virtualise request/response of services
– Unavailable
– Expensive to run
– Fragile/brittle
– Non-deterministic
– Cannot simulate failures
https://dzone.com/articles/continuously-delivering-soa
07/11/2016 @danielbryantuk

45. Service virtualisation
• Classics
– CA service virtualization
– Parasoft virtualize
– HPE service virtualization
– IBM Test Virtualization server
• New (open source) kids on the block
– Hoverfly
– Wiremock
– VCR/Betamax
– Mountebank
– mirage
07/11/2016 @danielbryantuk

46. Hoverfly
• Lightweight Service virtualisation
– Open source (Apache 2.0)
– Go-based / single binary
– Written by @Spectolabs
• Flexible API simulation
– HTTP / HTTPS
– Highly performant
07/11/2016 @danielbryantuk

47. 07/11/2016 @danielbryantuk
• Middleware
• Remove PII
• Rate limit
• Add headers
• Middleware
• Fault injection
• Chaos monkey

48. Right, Let'S Wrap this up...
07/11/2016 @danielbryantuk

49. The Seven (more) Deadly Sins of Microservices
1. LUST - Using the (Unevaluated) latest and greatest tech…
2. GLUTTONY - Communication lock-in
3. GREED - What'S Mine is mine (within the organisation)…
4. SLOTH - Getting lazy with NFRs
5. WRATH - Blowing up when bad things happen
6. ENVY - The shared single domain (and data store) fallacy
7. PRIDE - testing in the world of transience
07/11/2016 @danielbryantuk

50. The Seven (more) Deadly Sins of Microservices
1. LUST - Using the (Unevaluated) latest and greatest tech…
2. GLUTTONY - Communication Lock-in
3. GREED - What'S Mine is mine (within the organisation)…
4. SLOTH - Getting lazy with NFRs
5. WRATH - Blowing up when bad things happen
6. ENVY - The shared single domain (and data store) fallacy
7. PRIDE - testing in the world of transience
07/11/2016 @danielbryantuk

51. Bedtime reading
07/11/2016 @danielbryantuk

52. THANKS...
@danielbryantuk
daniel.bryant@opencredo.com
http://muservicesweekly.com/
(Credit to Tareq Abedrabbo for inspiration/guidance)
07/11/2016 @danielbryantuk