11 ms·
Guide to Serverless Architecture
- buf 9y ago> Drawback of Serverless: Vendor lock-in, statelessness, local testing, cold/warm start perf, security, deployment, execution, monitoring, remote testing, debugging. Excuse me? Let's use lambda for what it was meant to do, not replace your entire stack.
- gervase 9y agoBut 'serverless' has a much nicer ring to it than 'serverfewer'...
- wahnfrieden 9y agoWhat exactly do you think it’s meant to do? Amazon even lists web application backends as its first use case example in a recent article. All those things are necessary in production.
- bonesss 9y agoAll those issues can be postfixed with "... on Lambda". They're specific challenges that will come up when using Lambda as advertised in production :) As with most system improvements we're not really talking about removing complexity, just reshuffling it into a new and more pleasing form. Lambda will let you wildly simplify some things, but pain points otherwise accounted for in larger deployments will get moved onto your lambda services to compensate. Cold starts, for example, aren't generally an issue at the function level in web applications as the application itself is/isn't warmed up. By introducing a Lambda back-end you get to take a stance on that per-function while caring less about it in your webapp front-ends. The OP is trying to highlight where these new and less obvious challenges arise in the new stack, not pushing Lambda as the end all of app dev.
- Cthulhu_ 9y agoI'd expect a lot of those are things that should be supplied by AWS, especially things like providing a service that runs the code exactly as it would on AWS itself (which should fix the testing / debugging); monitoring and security should mostly be builtin.
- wahnfrieden 9y agoAWS does have solutions to many of these: SAM Local, X-Ray, Codestar, for instance.
- dpweb 9y agoCGI scripts with a new name. Lambda and the like are interesting but any system is a composable set of components. You can say the same about Object oriented programming or func programming. separation of concerns but on the network. Server functions arent a panecea cause you still have to manage all the other pieces. An elegant thing would be your entire app is in that single lambda but without state there goes your db. even so, people cant resist taking something and adding and adding more to it.
- emj 9y agoMore like CGI scripts with a loadbalancer that promises to run your application on a host with enough memory within at most 600ms. That solves an actual problem with CGI scripts, but I really would love to see more tiers with lower latency brackets, sub 10 milisecond should be doable for certain lambdas and costs.
- wahnfrieden 9y agoThe other key component of serverless is the pricing scheme: pay for what you use; don’t pay for provisioned capacity. This has a huge impact on how you design systems as you no longer have to consider throughput (besides account limitations that you can raise without cost), only latency. You can even treat lambda like an async queue which will never accumulate a backlog. Interestingly lambda seems to make async IO technologies like nodejs less compelling, because throughput capacity isn’t really relevant anymore.
- k__ 9y agoWhat are good alternatives to nodejs that are better suited for this kind of architecture?
- wahnfrieden 9y agoIt’s more that you’re dealing with a different set of constraints on which to evaluate technologies. There’s not an overall better suited technology than nodejs - still good reasons to use it on Lambda. To make the most of Lambda though you’ll want something that affords small code size (as there’s a 50MB limit), and has fast single execution latency.
- sidcool 9y agoIt's redirecting to their homepage. Am I missing something?
- polotics 9y agoOnly Google and Amazon exist in this write-up? This is not a guide, more an intro.
- maitrik 9y agoThe phrase that Amazon used when launching lambda was 'deploy code not servers'. To me this sums up what 'serverless' means. It means the developer doesn't have to worry about servers in any way. With AWS Lambda/API Gateway (and arguably with Google App Engine before it) you take away the toil of having to: * Manage/deploy servers * Monitor/maintain/upgrade servers * Figuring out tools to deploy your app to your server * Scaling an app globally. * Coping with outages in a data-centre/availability * Worry about load-balancing & scaling infrastructure
- deleted 9y ago[deleted]
- tyingq 9y agoExcept for max run time limitations and recurring long startup times, sure. No free lunch.
- twic 9y agoThis is exactly what PaaS's like Heroku have been doing for years, right? Isn't Lambda just an even more locked-in PaaS?
- viraptor 9y agoHeroku is a bit higher level. If you're using heroku, you're using their blocks and their methods of passing traffic, logging, etc. With lambda, it's just a function. You have to connect everything yourself, not you can do it exactly the way you want.
- Dawny33 9y ago> grouping a bundle of functions together behind an API gateway, you’ve created a microservice Always beats me why people don't warn the readers about the almost impossible nature of logging and monitoring such systems :/
- tehramz 9y agoBecause most devs aren’t the ones that will need to worry about how it’s going to be monitored once deployed. Not to mention troubleshooting a billion micro services when something breaks.
- mirko22 9y agoHow do you figure that? Who else should worry about it?
- cle 9y agoHow is it impossible? My team and I have built and maintain quite a large serverless system--logging and monitoring have been the easy parts.
- Dawny33 9y agoWe do monitor too. We made a Master-Worker architecture which scales according to the data traffic. (Talked abt it in Velocity Conf. London this year) One way is we monitor the Ansible tasks which make this happen. Apart from that, there is no way we can do it. + trying to make it happen by using something like a Prometheus+Grafana server would defeat the entire purpose of going serverless
- andre-m 9y agoDo you mind expanding on that? With APIG+Lambda you get CloudWatch integration 'out-of-the-box', and can expand the metrics and logs you send out with a few added lines of config. You can also toggle X-Ray for a detailed view of your call graph. If the default implementation isn't good enough, you can define your own CW events, alarms, and log filtering. I'll grant you that you can't just ssh into a host and tail some logs, but if you're keen you can send your logs to elasticsearch for a better arbitrary search experience.
- NetOpWibby 9y agoThis article needs more exclamation points.
- hopfog 9y agoI tried the excruciating task of building a real-time multiplayer game with server-side authority using only Firebase and Google Cloud Functions. Basically I handle all the logic in Firebase rules and lambdas. Any destructive action goes through a GCF that updates the Firebase Realtime Database. Actions that happen often (like moving) are updated directly by the client but validated with some overly complicated Firebase rules. It's very nice not having to worry about servers and scaling, but it can be a really painful development experience. Let me know if you want to try it out and I'll post the URL.
- tabdon 9y agoThat sounds really cool. I'd like to check it out. Now that you've been through it, would you do it again? Or stick to a more traditional architecture?
- hopfog 9y agoYou can play it at https://tombs.io/ https://tombs.io/ It's pretty much a collaborative and social experiment where I wanted to explore the concept of using in-browser cryptocurrency mining as a monetization and bot fighting method (something I had a problem with in the original Ludum Dare entry it's based on). That's a different discussion though. (You need to manually start the mining and you can explore the map without doing it. It's only when digging and chatting it's required.) I'm actually planning on rewriting the whole backend in a more traditional Node.js + WebSockets stack so no, I probably wouldn't do it again for this type of application. However, I will probably use it again for other things.
- mmjaa 9y agoNice little hack .. you get Monero, and I get .. 'tombs.io coins' that can be used to keep me playing each level while you mine .. more Monero! Such a great idea, I think I should do it as well .. ;). But I won't use Firebase, following your advice ..
- test1235 9y agoI get this from your site: Security risk detected: Trojan.Gen.NPE
- Vinnl 9y agoDrawbacks I experience: - Vendor lock-in: although I try to minimise this and have a clear picture of where the lock-in lies, it is very much present. - Cold/warm start: this is somewhat annoying. I haven't set up keepalive requests yet, but they feel like an ugly hack, so I'm not sure if I'm going to or if I will just suck it up. - Security/monitoring: having fewer functions make this less of a worry, but it's still difficult and it's clear that there's not much of an ecosystem and best practices. - Debugging: this can be really annoying. I can usually avoid this by having a proper local testing setup (see below), but when that doesn't cut it, this gets annoying. Drawbacks I haven't really experienced: - Statelessness: this is probably due to not splitting up my code in too many functions, and thus not having that much complex interactions, but this hasn't really been a problem for me. - Execution limits: haven't run into them yet. Drawbacks I've managed to contain: - Local testing: I'm writing Node Lambda's. Since they're just stateless functions, it was relatively easy for me to write a really simple Express server, transform the Express requests into the API Gateway format, and convert the API Gateway response format back into Express format. This works fine for local testing, and reduces the effects of vendor lock-in. That said, I do do a lot of the request parsing in the Lambda function itself, rather than letting API Gateway do this. - Deployment: this is actually pretty sweet. I'm using TerraForm which, although it's a bit immature and thus cumbersome to set up, has been getting the job done and allows me to easily deploy new copies of the infrastructure for every branch of my code. - Remote testing: as mentioned above, deploying it for every branch I have allows me to see what it's going to look like in production. Hmm, perhaps I should turn this into an article sometime...
- Agebor 9y agoI think most of those drawbacks will go away in the next years after we have: - a standard function packaging and manifest that each vendor will support - cheaper + easier tracing, logging, graphs
- alien_at_work 9y ago>- Vendor lock-in: although I try to minimise this and have a clear picture of where the lock-in lies, it is very much present. I feel like this is the most overstated draw back in cloud computing by far. I don't know how most people write their code but me and most people I've ever worked with have a natural tendency to seperate out abstractions to protect you from "likely to change" parts of your application. In fact, if you use Spring boot in Java it already abstracts away a lot of the differences for various cloud scenarios. Further, in the worst case you have to rewrite some stuff. Before you skip a solution for fear of vendor-lock-in you should attempt a cost analysis: how much will you save on these platform-specific advantages and how does that offset your cost of rewriting when some other solution becomes more desiable? How long will it take to reach break even and how does that time compare to how often software is just rewritten or abandoned in your organization anyway?
- sidhuko 9y agoWhat I've found having to use serverless is the local development tools are broken. You'll find cloudformation is the only way to reliable manage all the proprietary paid for services which will require you to read several documentation on various tools (kinesis, dynamodb stream or fifo, standard queues) to work out which one might work. To find out it doesn't necessarily work in your applied function (CloudWatch Insufficient Alarms I'm looking at you). So you then have a choice to use cloudformation and another deployment tool to push your services. This is more typical after you've given up trying to manage dynamodb-local across platforms for your codebase.
- songshu 9y agoI’m looking forward to Amazon Fargate which is less extreme than Lambda but still server less in some sense. Basically you can still write proper apps (Spring Boot apps in my case) but, so long as you containerize them, you don’t have to provision servers, just tell Amazon what resources they need and how many instances you want.
- NKCSS 9y agoPage doesn't load... maybe they need a server...
- fuball63 9y agoOne thing I would like to see in articles like this are more concrete use cases for using serverless. The article begins talking about the concept as though you should write your entire app in serverless, and then in their case study, use serverless as a background process to convert image types. The other use case I always come across is image scaling. I'd be interested if anyone would like to share their use cases as entire apps or background processes.
- laurentl 9y agoWell, I'll add my own use of serverless. We use Lambda + API GW to manage the glue between our different data/service providers. So for instance we expose a "services" API (API GW) that takes a request, does some business logic (lambda code), calls the relevant provider(s) and returns the aggregate response. That principle can (and probably will) be extended to hosting our own back-end / business logic. We're trying to get to the point where a dev only needs to write a Swagger file, the lambda code and a bit of configuration, and the rest is taken care of by AWS and our CI framework.
- fuball63 9y agoVery cool, thanks for sharing. The last part about just writing Swagger, Lambda, and a little config is very interesting. Do you worry about vendor lock in, which is coming up a lot on this comment section?
- laurentl 9y agowe're a small start-up, so I worry about shipping as fluidly as possible, and being confident that my infra just runs (security, patch management, scalability, uptime, etc.) All of which serverless gives me much more easily, and at a lower cost (for now) than running my own EC2 instances. I'll worry about vendor lock-in (or dumping serverless for that matter) once I start to get ridiculous bills from AWS, or hit performance issues, or whatnot. But I try to mitigate by relying on standard formats (Swagger) and keeping my code as close to the business logic as possible - which is fairly easy with Lambda. The only thing that is really tied to AWS is the framework we use to build and deploy the architecture: a large Cloudformation file basically. We explored Serverless (the app) to manage this, but it didn't fit our need (in particular, Serverless has apparently never heard about Swagger, so that sucks).
- MPSimmons 9y agoIs this supposed to be comedic? It seemed comedic to me in several places. Is that the joke?
- neya 9y agoFor me the BIGGEST gain of using serverless architecture is security. For example, this year I started two ecommerce platforms. One's a digital delivery e-shop - selling ebooks, training and stuff and the other is a physical delivery e-shop. Normally, I'd write my own Phoenix/Rails app, but this time, I decided to go serverless for my furniture shop and wrote it all in Jekyll. Yes, the static site builder. I use netlify to manage the production aspect of it (which IS pretty AWESOME) and simple excel sheets to track inventory (which is what my vendor provides me, anyway). For payment, I simply use the checkout/cart functionality provided by Paypal and all this just works! The site is designed in such a way that you can't even tell anyway what's being used for the backend. No one can tell it's just a bunch of static HTML pages on display. Whereas, for my digital delivery store, I regularly need to check my logs to see if anyone's doing anything suspecious. For example, a lot of IPs randomly try to visit wp-login.php or /phpmyadmin. Maintaining a production web application is a full time job by itself, if you don't have a team. Having said that, many people would immediately assume static page builders are generally dumb. That isn't exactly true - You can automate a lot of stuff. For example, my local machine has a custom Jekyll plugin for my store that resizes and optimizes product images before pushing to prod to keep the page load time small. IF I had chosen the Rails/Phoneix route, I'd need to worry about hosting imagemagick or the like somewhere. Or maybe write some code to communicate with an third party API and usually, it's not free. End of the day, I make sales and that's all that matters. That's when it hit me hard that my customers needn't care nor know what's behind their favorite site.
- icebraining 9y agoIf static sites are now also Serverless, the word has lost all meaning. IF I had chosen the Rails/Phoneix route, I'd need to worry about hosting imagemagick or the like somewhere. Static sites have no option but to run that stuff ahead of time, but that doesn't mean that dynamic sites can't do the same. Asset Pipelines with precompilation are pretty common - both Rails and Phoenix have one.
- cryptonector 9y ago"Serverless" is itself a bit of a misnomer. The point seems to be to distribute stateless sub-computations. Whoop dee doo. At some point you need a "server" to modify application state. A static site has no state modifications, so it actually is serverless in this sense of having stateless computation.
- cle 9y agoI've built and maintain quite a large serverless system, with a large team of people, and most of these issues aren't really a big deal. Cold start is well-known and also has well-known mitigations (e.g. don't use the JVM, which wasn't designed for fast startup times). I use AWS extensively, so I can elaborate on AWS's approach to these problems. Deployment is straightforward with CloudFormation, VPCs/security groups/KMS/etc. provide well-documented security features, CloudWatch provides out-of-the-box logging and monitoring. Integration testing is definitely important, but becomes a breeze if your whole stack is modeled in CloudFormation (just deploy a testing stack...). CloudFormation also makes regionalization much easier. The most painful part has been scaling up the complexity of the system while maintaining fault tolerance. At some point you start running into more transient failures, and recovering from them gracefully can be difficult if you haven't designed your system for them from the beginning. This means everything should be idempotent and retryable--which is surprisingly hard to get right. And there isn't an easy formula to apply here--it requires a clear understanding of the business logic and what "graceful recovery" means for your customers. Lambda executions occasionally fail and need to retry, occasionally you'll get duplicate SQS messages, eventual consistency can create hard-to-find race conditions, edge cases in your code path can inadvertently create tight loops which can spin out of control and cost you serious $$$, whales can create lots of headaches that affect availability for other customers (hot partitions, throttling by upstream dependencies, etc.). These are the real time-consuming problems with serverless architectures. Most of the "problems" in this article are relatively easy to overcome, and non-coincidentally, are easy to understand and sell solutions for.
- Hnrobert42 9y agoBe more concise.
- cryptonector 9y agoTFA is unintelligible mumbo jumbo describing an architecture that amounts to (I think!) minimizing statefulness and moving all stateless computation out to a cloud. Well, OK, but how about some examples? How about some advice as to where to draw lines? E.g., if the computations take less time to do on a server than to distribute, then maybe don't?
- Turbots 9y agoI hate calling it serverless... Just call it function-as-a-service because of course there's gonna be servers involved. You just don't have to care about them. Also here to point out one of the latest FaaS frameworks based on Kubernetes: https://github.com/projectriff/riff https://github.com/projectriff/riff