Serverless Development with Serverless Framework
thecloud.christmas
thecloud.christmas
I am always puzzled about this "autoscale" thing on a cloud.
If your task can be represented as something like calculate sum of some ginormous array then sure. Split array in parts and launch thousand instances each working on it's own slice and then combine.
In way more common situation you have a service hitting database and doing something with it. Sure you can spin a thousand instances of said service. But they will all be hitting the same database. So in reality I think the only really scalable part here is the database. And scalability in databases has no universal solution and the ones that exists come with the load of caveats.
I think unless you operate on FB/etc scale the simplest and cheapest solution would be to buy/rent nice piece of hardware yourself and place database on said hardware. That should give you a nice run for your money and free you from bazillion layers of abstractions, dependencies, etc. that often tend to fall apart.
For most applications, it's really not needed though.
In terms of the actual technology itself, it's very interestingly built, and as the poster above me mentioned, with a ton of caveats to the promises it makes.
I hate and love it at the same time.
This does not seem scalable for OLTP type load on some busy store. Again I think you'll be way better of money wise hosting your own database on real hardware either on prem or colocated
"Across the 48 hours of Prime Day, these sources made 7.11 trillion calls to the DynamoDB API, peaking at 45.4 million requests per second." [1]
[1] https://aws.amazon.com/blogs/aws/amazon-prime-day-2019-power...
my understanding is that most storage solution scales well when planned, but scaling during a spike only causes more stress onto the current replicas/partitions for all the time needed to boot and shift data toward new replica/partitions, and the new instances don't contribute in moving the load until the process is complete.
so they work if you can predict a spike, but they can't handle a sudden spike, especially if the data to replicate/partition is sizeable.
If you're in a traditional three tier architecture you might run into your database being overloaded by the autoscaling behavior but this is fundamentally a provisioning problem. These problems are better served in models that are scalable.
Your suggestion to by a (necessarily overprovisioned) on prem database server is cost inefficient, degrades in value over time, and is effectively a lock in.
Embracing eventual consistency is not that scary!
And nobody said anything about on-prem databases. You can hit these issues just as easily with e.g. Aurora or Dynamo.
So a lot of effort goes into producing a site that could be "Facebook scale" if it became necessary. Although since this is difficult (and expensive!) to test, it's likely that some panicked manual intervention will be required if it does take off.
It's really worth asking "what is the cost of scaling" next to "what is the cost of NOT scaling, and what are the chances of it happening?". Is your organisation even able to benefit from rapid scaling - would it be profitable? Or are you going to end up like that luggage company screaming at its customer service reps to work dozens of hours a day?
If your cloud hosting cost goes from free-tier to $100,000/month in one month, and it's real traffic, is your business actually going to be able to pay that invoice?
Is the static overhead of scalability better for your use case than what a normal PC is capable of, which these days can be quite a lot: https://adamdrake.com/command-line-tools-can-be-235x-faster-...
(Been thinking about this since I mentioned the SRCF earlier, which was a single-server host for years: https://news.ycombinator.com/item?id=21741789 )
The cost of running a production server is something small startup businesses need to budget for... And you don't want to run your production website on a 5-10/month shared server. If you design for the cloud/serverless, you can get your costs down to near-$0 for light usage... But yes, using things like lambda mean a possible bill shock if your traffic grows faster than your income can recover it.. but if you have an advertisement on the page, it probably will cover the execution cost if it's lean enough.
In another example, I inherited a CICD pipeline that cost $300/month and could run 2 of our larger test suites simultaneously.
I converted this to AWS Spot instances and now support thousands in parallel and I pay under $170/month ( https://ldoughty.com/2018/01/gitlab-multi-runner-w/docker-ma... )... But to your point about "what if" costs of this, yes, there's a limit on place for this setup so it can't go over 20 or so... And it is important to consider the impact of auto scaling with regards to the bill... For a small business, AWS effectively doesn't have a way for you to really stop "Bill attacks" or legitimate high traffic on API Gateway/Lambda short of you taking down your site.
My recommendation is: ideally, don't expose something that costs you much too run unless you can recoup the cost from that action (paying customer, advertising).. your homepage should be static or cached in a CDN until you're ready for that large bill.
That said, it really wasn't much work to drop the 6pm-6am costs to effectively 0 unless a developer decided to work late (it automatically scales up)
Multiply that by the amount of money you cost your employer per hour and you'll realize that your "optimization" actually resulted in a net loss.
So by that, I've saved $5,000 in pure server costs. It probably cost me 10 extra man hours to do this way... But I also resolved a bug that was not terribly worth fixing before but took up 30 minutes of time every few months.. and improved the security by taking the servers off the public web.. however you want to quantify security improvements.
I always look at opportunity costs and the automation cost/benefit! The article was researched and written on my own time for my own enjoyment (so this was actually "free" from a business perspective, but my responses factored it in as if I did it as paid work. Just clarifying in case someone wants to claim I'm publishing "work"
Google's Firebase Functions are ideal for REST endpoints, they bill by the millisecond instead of AWS's 100ms (I think?) pricing.
If you buy into Google's ecosystem entirely they provide you a lot of functionality to get off the ground running. E.g. their (free!) auth service integrates with security around functions. In less time than it takes to look up the YAML for Nginx config you can have a proper authenticated set of REST endpoints up.
Now that said all I have my CPU intensive stuff running on a fixed price VM.
- Data is replicated cross region, but your compute all lives in the same AZ, so if (when) an AZ goes down you have to wait for a new instance to be created elsewhere. AWS says the time for this is undefined, IIRC we've seen it be around 15-20 minutes before the DB is back online.
- If you have lots of long running transactions or queries, serverless can have trouble finding a scaling point and won't scale up/down. You can set it to force scaling after 5 attempts, but this results in dropped connections and 1-2 minutes of downtime every time.
- Scaling up actually takes 45s-1:30 for new capacity to be available. If your load is spiky enough that that's too slow, you're stuck with overprovisioning anyways.
- Tools like VividCortex don't work for serverless if you rely on those. Teams here that use serverless have shifted to DataDog APM for this purpose.
- Loading data from S3 doesn't work. This wasn't really a usecase we had but it's something to be aware of.
That said, for gradual load or DB downtime tolerant services it's great! Also very nice for dev environments as the scaling down to 0 can result in some very real cost savings.
> The Aurora Serverless failover time is currently undefined […]
Don't get me wrong: I really like the idea of Aurora Serverless, but with the current feature set it isn't very compelling.
[1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide...
Because Aurora separates computation capacity and storage, the storage volume for the cluster is spread across multiple AZs. Your data remains available even if outages affect the DB instance or the associated AZ.
Say you have an idea for a web app that needs a server-side component, but you only ever expect to have a few users. A VPS will cost you at least $5 a month. If you can make your backend serverless, you'll probably only pay a tiny sliver of that, if you even end up exceeding your provider's free tier.
I run a bunch of stuff on a $5 VPS and more still on small machines like raspberry pi's and so on behind it.
On my distro at least, spinning up a real paravirt container (not docker, a full OS with systemd, SSH, etc) within a VPS is a matter of unzipping a bootstrap to /var/lib/machines and running 'machinectl start whatever-you-called-it'.
It's just a different set of abstractions to learn, and at least IMO one that's more valuable.
In those scenarios, the _real_ cost isn't the $5/mo VPS but the managing upgrades, security patches, etc - which would be mostly handled for you in this scenario.
I built a simple email verification service for A company I used to work for. Used API gateway, lambda, s3, and sqs. Few thousand users a month. I don't need to maintain it, check for security updates etc.
The monthly bill for all that was ~$2 NZD.
How is this true? Cassandra/MongoDB/Scylla are all very very popular NoSQL DBs that scale very well and work for a good number of common use cases. Sure you have to be a little more clever when writing certain types of applications with them, but seems like an appropriate trade off. If you don't like that trade off, you can spend a bit more money and get Spanner/FaunaDB and you don't have really any tradeoffs (other than $$$).
That sums it up pretty well.
The great irony here is that those thin, stateless web servers that are the only things to easily autoscale are pretty much guaranteed to never be your performance bottleneck, unless you're doing something really strange.
all you have to do is run Wordpress with Woocommerce, multiple additional plugins and an overloaded theme with visual builder/editor that needs 512 megs of RAM and 500ms to display a contact form[0]. Some themes can be amazingly CPU intensive.
[0]and 900+ queries, but since most of them are simple selects any cache like redis or memcached removes their performance impact.
I do wonder what limitations and caveats you are talking about. That is true for many databases who are only consistent on one row/collection/region/snapshot, have strange limitations such as no joins, require your data to be preformatted in a certain way etc. DynamoDB also has a few limitations in those aspects. I have both love and hate memories from my experience with DynamoDB. But nowadays you get to choose between databases like FaunaDb, Spanner, FoundationDB, CockroachDB... So what are the Caveats you still worry about?
If you would combine such distributed databases with edge serverless frameworks like Cloudflare workers I could see amazing possibilities tbh. It's strange how front-end programmers seem to be picking up distributed databases at great speeds due to the benefits of low latency for their users, zero configuration and autoscaling. But it seems that we backenders are reluctant and still prefer our hardware for some reason :). Is it pure pricing?
We have another process that is read intensive. The database is a constraint. We autoscale read replicas. With AWS, all of your read replicas read from the same storage arrays (grossly simplifying)
It seems to me, like most things in software these days, we sacrifice performance for convenience at every turn; and in the cloud case specifically we also pick up a good portion of complexity which rarely pays dividends.
I'd wager that for most non-global scale products you can spend a few thousand dollars at the local PC shop and assemble some hardware that will more than support your needs. Although, I'd still advocate backing up necessary data in the cloud for resiliency.
If your software is super resource intensive then you could have people install and run it locally gasp.
We went into the details on how a bunch of different Serverless tools and services come together on AWS to serve a RESTful API. The episode covers the development process, the deployment process, pros and cons of Serverless, prices and many other topics around running a Serverless stack with Golang.
That's at: https://runninginproduction.com/podcast/6-qvault-is-an-open-...
There's also descriptive clickable time stamps every 30-60 seconds out of the 55 minute show so if you want to skim around, go for it!
As of right now there's no newsletter but if you have an RSS reader there's a feed at: https://runninginproduction.com/podcast/feed.xml
That RSS button is up top next to all of the podcast buttons.
I will add a newsletter at some point. The podcast is very new still, so I wanted to gauge interest a bit before setting up the infrastructure for supporting an email list. It completely tanked when I posted a Show HN about it the other week, so I don't have a ton of guests lined up but it's something I for sure want to pursue.
In real life projects, you get a ton of YAML spaggetti boilerplate code and when you hit the endpoint limit on your deployment you will need to start splitting your code over multiple deployments. Compare this with other frameworks where you can actually program your URL router (Django, Rails & co) and it's definitely a step backward.
When you've past the PoC stage, DynamoDB is the first thing you want to replace with PostgreSQL because you need data integrity and migrations. But that's not your only problem ....
When endpoints depend on each other, then it becomes pretty tricky to deploy, cause you'll need to wait until your first endpoint is deployed before you can deploy your second endpoint. So, you're out of the nice "immutable image deployment" paradigm, which means that your frontend code will have to support both old and new versions of each endpoint, just like your backend code will have to support both old and new data structure versions in DynamoDB, as the deployment of a chain of endpoint will take a while and will not be done atomically. This will slow down development velocity for sure.
If you intend to make a real life project live over many fast iterations, then isolating yourself in a proprietary framework like serverless is the last thing you want to do in my experience.
So yeah, for a two-endpoints "Hello World" project where autoscaling is valued over iteration speed, then serverless and dynamodb might be a solution to consider, as long as you're willing to isolate yourself in proprietary frameworks.
That said, you can have autoscaling with iteration speed using open source frameworks anyway (ie. with GKE) so why bother with serverless at all ? Anything you can do with serverless can be done better with k8s and any actually powerful framework such as Django, Rails, Dancer, perhaps even Laravel, CakePHP or Symfony if PHP is your thing.
But let's face it, 99.999% of projects don't need more than 99.9% of uptime which is extremely easy to achieve with a single dedicated server, which gives you a lot of hardware for cheap (unlike AWS). Once you've outscaled a RAM128GB dedicated server then it's time to consider extracting parts of your app into something like serverless.
When you start hitting endpoint limits there's a very strong sign that you've had responsibility creep for a microservice, or even worse you're treating your serverless deployment as a monolith.
Your insistence on integrity issues with DynamoDB is also strange. Religious adherence to ACID is not going to be your silver bullet for application design. Learning how to reason about distributed systems and their eventual consistency is necessary to begin with in most cloud setups.
Anything you can do with serverless can be done better with k8s? Cool, have it provision my underlying infrastructure
As for provisioning, I mentioned GKE already, but I can throw in some more:
https://www.scaleway.com/en/docs/get-started-with-scaleway-k... https://www.ovh.com/world/public-cloud/kubernetes/ https://github.com/bbelky/hkube https://github.com/kubernetes-sigs/kubespray
I cannot fathom the process through which one arrived at that file. It started out looking like someone who did not know that shell scripting was a thing, only to morph into a golang program writing out a shell script and exec-s it: https://github.com/bbelky/hkube/blob/master/hkube.go#L193
The icing on the cake is committing a compiled binary for some unknown platform into git
The split stack resources thing is extremely difficult to manage due to serverless not supporting CF params. so you have to use CF cross stack references which are horrible or hack in support like we did.
I’ve seen issues where you can’t put the value of a variable as an arn in an event due to the poor abstraction across the top of it as they’ve tried to make it cross provider, completely pointless. Just breaks.
Stick with cf/terraform if you’re starting a big project.
Firebase allows for 1000 functions per project, all of which can be deployed at once.
If I have more than a 1000 endpoints sitting in a single folder I'll consider that I've gone a bit too micro on the idea of micro-services!
> Anything you can do with serverless can be done better with k8s
The cloud vendors work hard to make ecosystem buy-in convenient. E.g. reduced/no egress charges between their services hosting on the same cloud, and smooth integration between services.
As an example, with Google Firebase I am using their auth, database, and serverless solutions. When I needed to start storing user assets somewhere it was less than half an hour to get everything working end to end including proper security and permissions in place.
Could I have setup a VM and built out some sort of service to manage/serve assets? Sure. There is probably some open source project out there that if I spend a day or two reading up on it I could get it configured, and then get it integrated with my existing auth system.
And then I'd have one more VM to manage security updates on, and worry about deploying.
With Firebase I get test and production environments all setup for me automatically[1], with separate credentials and the works.
It isn't necessarily about scaling speed, it is also about not having to worry about infra.
AWS's "Serverless" (wow that name...) looks like a suite of existing products advertised under one label. From their splash page it looks mostly equivalent to what Firebase, although it seems Amazon has some functionality that Firebase itself doesn't have (necessitating using the full Google Cloud).
I think you are confused about those.
> Serverless is an Amazon service,
No, it's not.
1. The “Serverless Application Model” is an AWS functionality (a transform for CloudFormation templates for serverless [see #3] compute.)
2. “Serverless Framework” is an open-source product that is independent of Amazon (though it originally targeted only AWS) which supports multiple cloud provider.
3. “serverless” is a broad concept for cloud computing without managing server instances, encompassing, among other things, FaaS—AWS popularized the term, but it's used generally across the industry.
> Firebase is not serverless
Someone tell Google: https://cloud.google.com/blog/products/application-developme...
[0]https://github.com/aws/aws-cdk/tree/v1.18.0/packages/%40aws-...
Besides, you can easily do all of your configuration in the web console and export a SAM CloudFormation template for your CI/CD pipeline.
As someone else mentioned, there is also the CDK.
Ups: Low cost of development. / Only billed for function executions. / Minimal DevOps. / Automatic scaling. / Private functions.
Downs: Vendor lock-in. / No persistent connections. / Expensive. / Limited programming language availability. / No local state. / Shared runtime. / Local debugging is harder. / Cold starts.
I still recommend Heroku if you can live with the costs, but I like where Firebase Functions is going.
If you are interested, here is the full writeup:
* https://github.com/soygul/QuanticDev/blob/master/articles/se...
* Video narrative & examples: https://www.youtube.com/watch?v=Kqk013ioclA&t=12
As far as I know, at least AWS has two WebSockets based services.
> Expensive
I think there are use-cases that are rather expensive to solve with serverless technology, like realtime games and such, but overall? I don't know... many companies I've seen using serverless aren't even getting out of free-tier.
> Limited programming language availability
At least AWS has allows to bring your own runtime, it just has to be compiled for Amazon Linux 2.
> No local state
I don't think this is a good thing, but I think Azure does something like that with Durable Functions.
> Cold starts.
Only a problem if you use FaaS and that isn't a requirement for serverless. At least AWS allows to build some types of serverless applications without Lambda. For example APIs can be build with API-Gateway alone or AppSync.
True. WebSocket APIs in Amazon API Gateway looks good and is accessible from Lambda functions. Didn't try myself though: https://aws.amazon.com/blogs/compute/announcing-websocket-ap...
> At least AWS has allows to bring your own runtime, it just has to be compiled for Amazon Linux 2.
I did not know this. I will check it out.
> Azure does something like that with Durable Functions
Also didn't know this. Yes local state destroys scalability but it is such a convenience sometimes. Will also check this out.
I tried for weeks on nights and weekends to get anything beyond a simple todo app running with AWS Amplify. I kept running into issues with DynamoDB or AppSync or Cognito. Every time I tried to do something even remotely off the beaten path (e.g., sorting todos by creation date rather than by DynamoDB's non-deterministic sort), I had to tear the whole thing down and start over.
I tried to use the serverless tool, but couldn't even really tell how to get started. They usher you along a sign-up flow before you can even try anything. And a lot of the documentation is just a weird mix of sample projects in various languages.
I eventually gave up and just went back to using Heroku for now and will probably land on a DigitalOcean droplet. I really wanted to like serverless, but it wasn't saving me any time and scaling isn't a concern for a side project :-/
I guess great open-source starter kits still didn't catch up to serverless stuff so it makes jumping in a bit harder. And yes, the restrictions all need workarounds for now. But every year I check serverless stuff, it gets better. I guess it is just not there yet at the moment.
In my very limited experience, the yaml configuration was a pain, and the testing environment was different enough from production that it felt cumbersome to keep up with both of them.
So now instead of using Serverless, I use expressjs for my API controllers, and I build a Docker image that works exactly the same for testing and production.
Terraform or cloudformation are not difficult to learn. I sunk way more hours trying to bend my architecture to serverless, while with CF i still use the 8 templates i wrote 2 years ago with minimal changes
One routes file is infinitely easier than dealing with an abstraction over API gateway across multiple environments
Scripted “cloud formation” for your MVP? Just skip it
Heroku's lowest priced professional tier (Standard) is $25/mo for a $3.50/mo EC2 instance. I know they do a lot of value-add which is worth paying for but yeah, it's still crazy expensive. Elastic Beanstalk gives a comparable function for just the price of the EC2 instance itself.
From the bottom of https://thecloud.christmas :
> Bekk is all about craftmanship and the people crafting it. This year, we're creating 12 calendars, each with daily content, articles and podcasts.
It made me think that we were being hit with a bunch of blogspam, but the content appears to be original and decent quality.