Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog DevSecOps Best Practices on Alibaba Cloud – Building an E-Commerce Application

DevSecOps Best Practices on Alibaba Cloud – Building an E-Commerce Application

In this article, we will explore the concept of DevSecOps and discuss how we can apply its principles building an e-commerce application with a cryptocurrency wallet on Alibaba Cloud.

By Anand V, Alibaba Cloud Tech Share Author. Tech Share is Alibaba Cloud's incentive program to encourage the sharing of technical knowledge and best practices within the cloud community.

In this article, we will explore the concept of DevSecOps and discuss how we can apply its principles by building an e-commerce application on Alibaba Cloud. Gartner predicts that,

"By 2019, more than 70% of enterprise DevSecOps initiatives will have incorporated automated security vulnerability and configuration scanning for open-source components and commercial packages, up from less than 10% in 2016. By 2021, DevSecOps practices will be embedded in 80% of rapid development teams, up from 15% in 2017."

In recent years, we can see a shift in the maturity model of software development life cycle (SDLC) from Waterfall to Agile, and a massive culture shift to DevOps. Continuous integration, continuous deployment, and continuous delivery are now necessary for software development. One major aspect that many developers tend to ignore in DevOps is security. Integrating security at every stage of DevOps lifecycles is an essential element to DevSecOps.

What Is DevSecOps?

DevSecOps is a software development concept or mindset that aims at unifying development, operations, and security as a single process in SDLC. In simple terms, DevSecOps is very much like DevOps but with an added emphasis on security. In the process of implementing DevSecOps, there is also a need for DevOps tools, microservices, containers, automation, APIs, and testing tools.

1

Source: Annotated DevSecOps Cycle, Larry Maccherone

Let's discuss a five step process to successfully implement DevSecOps:

Step 1: Start with DevOps and Shift Left

  1. In software development, the concept of shifting left moves tasks, such as testing, earlier in the cycle so that these tasks occur in parallel with development activities.
  2. The new application landscape is an opportunity to integrate security measures earlier in the development process to improve the security of the code that reaches production.
  3. Integration of SAST, DAST, Penetration Testing with Vulnerabilities is important.

Step 2: Embrace Microservices

  1. We need to build application faster so we need a microservices architecture.
  2. With microservices, large and complex systems are decoupled into simple, independent projects. This brings agility and alignment with the overall business and helps developer make changes to the code immediately for the customers.

Step 3: Use Containers as Part of the DevSecOps Lifecycle

  1. Software containers accelerate development by enabling applications to be broken down into microservices.
  2. Containers hold packaged pieces of software that contain all the components (the software, system libraries, and file system) needed to run the service. This can improve the quality of testing and reduce the complexity of integration and deployment.

Step 4: Build Software Code with Automation

  1. Automation aims to not only enhance the software development mechanism but also fill in the loopholes created by manual efforts in the software development model.
  2. Organizations can adopt automation to tackle frequent regression testing iterations and seek to pace up the delivery process.
  3. Developers will find automation a blessing when working on microservices architecture or when working on exceptionally large projects.

Step 5: Integrate API Gateway

  1. An API gateway establishes a single entry point for all requests coming from clients. This insulates the clients from being trouble by understanding how an application may be partitioned into microservices. This also enables clients to retrieve data from multiple services with only one request.

DevSecOps on Alibaba Cloud

Alibaba Cloud offers an integrated package to achieve DevSecOps:

  1. Alibaba Cloud Container Service provides support for Kubernetes clusters.
  2. Using the application deployment capability of Alibaba Cloud Resource Orchestration Service (ROS), users can create a highly available and secure Kubernetes cluster with one click by using ROS templates.
  3. The Kubernetes cluster consolidates Alibaba Cloud's storage, network, virtualization, and security capabilities to provide a high-performance application management that simplifies cluster creation and expansion.
  4. Kubernetes deployed on Alibaba Cloud facilitates deployment, expansion, and management of containerized applications
  5. It further focuses on containerized management and application development, and comes with the following features:
    1. Elastic expansion and self-reparation.
    2. Service discovery and server load balancing.
    3. Service publication and rollback.
    4. Secrets and configuration management.

The solution architecture of the services from Alibaba Cloud is shown below.

2

The container solution architecture mentioned above acts as a microservice for the software development. A Kubernetes cluster provides excellent support for micro service operations, so you can focus on the development and iteration of application.

Splitting a massive app into a collection of microservices allows for agile development, testing, deployment, and O&M. Microservices are also easy to understand, develop, and maintain. Additionally, the free framework and technical options promote efficient communication within teams.

Additionally the Alibaba micro services have the following features:

  1. Lightweight deployment
  2. Simplified container management
  3. Low impact on other service

As a final step, Alibaba Cloud offers the automation necessary to implement the DevSecOps.

Alibaba Cloud provides supports Packer and Terraform for core packaging and infrastructure provisioning. These tools allow users to swiftly deploy their infrastructure and application on Alibaba Cloud. Enterprise business's rapid iteration of applications and infrastructure along with continuous development ensure enhanced operations and minimize maintenance costs.

Furthermore, Alibaba Cloud provides a set of flexible services designed to help customers to rapidly and reliably build and deliver products using Alibaba Cloud and DevOps practices. With the support of Terraform and Packer, Alibaba Cloud customers can possess impactful workflows to manage their global infrastructure.

Subsequently, users can save time and focus on delivering business-critical needs. Packer users can easily build and configure customized images on Alibaba Cloud using the same workflow and configuration as used for managing images on other platforms. Similarly, Terraform users can provision compute, network, and storage resources on Alibaba Cloud utilizing similar workflow and configuration as they would, when managing infrastructure on other clouds.

Alibaba Cloud is the one stop solution for organizations to evolve towards the DevSecOps model.

Building an E-Commerce Portal Using DevSecOps

Based on the architecture discussed above, I have helped a customer host an e-commerce site using this platform. The e-commerce portal is equipped with simple functionalities, focusing mainly on electronic items – mobile phones, laptops, tablets, home automation products, and cameras.

The store has the minimum features below:

Order Level Data

  1. FSN ID: The unique identification of each SKU
  2. Order Date: Date on which the order was placed
  3. Order ID: The unique identification number of each order
  4. Order item ID: Suppose you order 2 different products under the same order, it generates 2 different order Item IDs under the same order ID; orders are tracked by the Order Item ID.
  5. GMV: Gross Merchandise Value or Revenue
  6. Units: Number of units of the specific product sold
  7. Order payment type: How the order was paid – prepaid or cash on delivery
  8. SLA: Number of days it typically takes to deliver the product
  9. Cust id: Unique identification of a customer
  10. Product MRP: Maximum retail price of the product
  11. Product procurement SLA: Time typically taken to procure the product

Technology Stack

  1. A Linux or Windows machine
  2. JDK 8 or later
  3. Apache Maven 3 or later
  4. Eclipse or other code editor of your choice
  5. Spring MVC 4.2.5
  6. Hibernate 5.x
  7. Database: Oracle, Mysql,SQL Server, RDS

Solution Architecture of the E-Commerce Platform

3

How to Implement the Solution with DevSecOps

  1. Build the store modules using Java and JDK. This includes Order Management, Shop Management , Customer management,Payment module, Customer service
  2. Shift left in the continuous delivery. This is done by integrating security solutions to the modules, including adding WAF, anti-fraud, Server Guard, security testing, and CloudMonitor.
  3. Enable the microservices architecture in the above 2 steps. This makes the portal scalable and brings agility and alignment to the business. With this solution, you can make changes to the code immediately for customers.
  4. Integrate elastic computing in the cloud deployment using Server Load Balancer, Auto Scaling and Elastic Compute Service (ECS). We used containers as a part of DevOps lifecycle. Containers hold packaged pieces of software that contain all the components (the software, system libraries, and file system) needed to run the service. We used Auto Scaling to adjust to the demand of the customer spike during peak shopping season.
  5. Also as a part of Development lifecycle, you can use Message Service to help with automation. Message Service is useful for typical large-scale, high-reliability, high-concurrency software code automation.
  6. Integrate object storage and also the backend with APIs. You'll also need databases to process massive volumes of images and transcoding capabilities for image processing, and handling audio and video content.
  7. Merge CDN with the lifecycles to accelerate content delivery for end users.

Once you complete the 7 steps above, you'll need to maintain the operations of the lifecycle with Cloud Monitor.

Hosting the E-Commerce Portal

There are many available ways for you to host your e-commerce portal. For my solution, I have chosen the web hosting solution by Alibaba Cloud. Alibaba Cloud Web Hosting is a flexible and easy-to-use product that allows you to build or transfer a website using FTP. It supports a wide variety of web builders and is ideal for all kinds of applications, from personal blogs to e-commerce websites. All you need to do is select your preferred package and log in to the Alibaba Cloud Management Console.

4

As the next step we need to obtain FTP credentials. On your console, navigate to the Web Hosting section under the Domains & Websites. Go to File management and select upload site. On the Upload Site page, you can get the credentials for the FTP or reset the password for the FTP login.

Once this is completed then we can now manage our web files using an FTP client. We will be using Filezilla as our FTP client. We need to open Filezilla and enter the Hostname, Username, and Password obtained from the Web Hosting management console to enable a quick connect.

5

Upload your codebase in the htdocs folder. Then, you'll need to bind a domain to the Alibaba Cloud Server. We have to visit the console and click on Add-on Domains on the left-hand panel. Then enter the domain name to bind it with the test domain name by clicking OK. Resolve the domain name to *.aliwebs.com using CNAME. Hit the domain name and you will be able to see the website homepage.

Reference Microservices

We later integrated the whole solution using kubernetes and automated deployment. The architecture is very flexible and allows integration with microservices. I have used a few open-source microservices such as Hystrix and Chaos monkey.

I've also added a basic cryptocurrency wallet and the APIs for cryptocurrency API integration using blockcypher.

Conclusion

We have demonstrated the ability to create an e-commerce application with crypto-wallet integration using DevSecOps principles on Alibaba Cloud. This platform also utilizes continuous deployment and automation using DevOps.

Because continuous integration and continuous deployment (CI/CD) are core features of DevOps, it is clear that automation is a significant contributor to the entire DevOps model. Automation aims to not only enhance the software development mechanism but also fill in the loopholes created by manual efforts in the software development model. Organizations can adopt automation to tackle frequent regression testing iterations and seek to pace up the delivery process.

Additionally, developers will find automation a blessing when working on microservices architecture. And finally with SecOps, security features such as OAuth are also integrated into the platform.

Resources:
https://github.com/Netflix/Hystrix
https://github.com/Netflix/chaosmonkey
https://www.blockcypher.com/dev/dash/#wallet-api
https://block.io/docs/basic

DevOps Security Microservices E-Commerce Tech Share DevSecOps
3 2 1
Share on

Read previous post:

4 Ways Alibaba Cloud Transformed the 2018 Winter Olympics

Read next post:

China Developer Survey Report 2017 Revisited

Alibaba Clouder

2,599 posts | 764 followers

You may also like

Comments

Raja_KT February 14, 2019 at 6:54 am

Good one. Secops layer is interesting. WAF is https....and Server guard is for host....?

Stephanie March 28, 2019 at 8:50 am

I like this article.

Alibaba Clouder March 28, 2019 at 8:51 am

This is a great article!

Alibaba Clouder

2,599 posts | 764 followers

Related Products

More Posts by Alibaba Clouder

See All