thomasvitale/spring-cloud-gateway-resilience-security-observability

Example with Spring Boot 3 focused on resilience, security and observability. It uses Spring Cloud Gateway, Spring Security and Spring Cloud Circuit Breaker.

Spring Cloud Gateway - Resilience, Security, and Observability

Do you want to use a microservices architecture? Are you looking for a solution to manage access to single services from clients? How can you ensure resilience and security for your entire system? Spring Cloud Gateway is a project based on Reactor, Spring WebFlux, and Spring Boot which provides an effective way to route traffic to your APIs and address cross-cutting concerns.

In this session, I'll show you how to configure an API gateway to route traffic to your microservices architecture and implement solutions to improve the resilience of your system with patterns like circuit breakers, retries, fallbacks, and rate limiters using Spring Cloud Circuit Breaker and Resilience4J. Since the gateway is the entry point of your system, it’s also an excellent candidate to implement security concerns like user authentication. I'll show you how to do that with Spring Security, OAuth2, and OpenID Connect, relying on Spring Redis Reactive to manage sessions. Finally, I'll show you how to improve the observability of your system using Spring Boot Actuator and Spring Cloud Sleuth and relying on the Grafana stack.

Stack

• Java 17
• Spring Boot 3
• Grafana OSS

Usage

You can use Docker Compose to set up the entire system, including applications, data services, and the Grafana observability stack.

First, package both the Edge Service and Book Service application as container images leveraging the Cloud Native Buildpacks integration provided by Spring Boot. For each application, run the following task:

./gradlew bootBuildImage

Then, from the project root folder, run Docker Compose.

docker-compose up -d

The Edge Service application is exposed on port 9000 while Book Service on port 9001. The applications require authentication through OAuth2/OpenID Connect. You can log in as Isabelle (isabelle/password) or Bjorn (bjorn/password).

Observability Stack

Both Spring Boot applications are observable, as any cloud native application should. Prometheus metrics are backed by Spring Boot Actuator and Micrometer Metrics. Distributed tracing is backed by OpenTelemetry and Micrometer Tracing.

Grafana lets you query and visualize logs, metrics, and traces from your applications. After running the Docker Compose configuration as explained in the previous section, you can access Grafana on port 3000. It provides already dashboards to visualize metrics from Spring Boot, Spring Cloud Gateway, and Spring Cloud Circuit Breaker. In the "Explore" panel, you can query logs from Loki, metrics from Prometheus, and traces from Tempo.

Loki is a log aggregation system part of the Grafana observability stack. "It's like Prometheus, but for logs." Logs are available for inspecting from Grafana.

Tempo is a distributed tracing backend part of the Grafana observability stack. Spring Boot applications sends traces to Tempo, which made them available for inspecting from Grafana. The traces follows the OpenTelemetry format and protocol.

Prometheus is a monitoring system part of the Grafana observability stack. It parses the metrics endpoints exposed by Spring Boot applications (/actuator/prometheus). Metrics are available for inspecting and dashboarding from Grafana.

spring-cloud-gateway-resilience-security-observability's Issues

No traceId and spanId

Hi,

I just cloned and run the applications on my local, however traceId and spanId are empty in the logs, like below:

2023-01-27T15:03:21.000+04:00 INFO [book-service,,] 99000 --- [nio-8001-exec-6] c.t.bookservice.BookController : Returning list of books in the catalog

What can be the problem?

/auth/realms/PolarBookshop is invalid with Keycloak - Version 22.0.3

Using services.keycloak.image: quay.io/keycloak/keycloak:latest
which based on /opt/keycloak/version.txt it is actually Keycloak - Version 22.0.3.

I was unable to start edge-service with property:
spring.security.oauth2.client.provider.keycloak.issuer-uri: ${KEYCLOAK_URL:http://localhost:8080}/auth/realms/PolarBookshop
showing error message:
Caused by: java.lang.IllegalArgumentException: Unable to resolve Configuration with the provided Issuer of "http://localhost:8080/auth/realms/PolarBookshop"

After change it to http://localhost:8080/realms/PolarBookshop, then it can work as normal.

Not Really An Issue, but needed assistance with a particular requirements

Hi Again, this is not really an issue, but seeking help. Thought of using this as a channel for the same. Apologies if used incorrect means.

I created a sample project under (NOTE: Just sample projects , feel free to modify)

https://github.com/jobas2007/spring-cloud-gateway-demo (runs on 9000)
https://github.com/jobas2007/book-service (destination with 2 services running on 9001/9002)

Basically, gateway demo project has a listener that consumes JSON msg from kafka topic , and then finally POST/route to either "walmart book service" OR "target book service" (based on customer in mgs).

---

Sample Msg On Topic:
{

"title" : "Lord of the rings",
"author" : "Will Miller",
"customer":  "walmart"

}

---

Because i am trying to use a single app as consumer, for POST to gateway routes, with Feign as a sudo client (tried with other reactive clients as well), the route configuration is yet to work properly.

Appreciate any assistance in fixing the route. If that is fixed, next step would be to

1. secure book services with their respective OAuth2 and then add filters in gateway to call with token
2. Add 3rd and more book services with other security mechanisms (like Basic Auth, API keys etc), and have corresponding routes to support.

Appreciate any help/assistance.