Make your Cloud Applications Function for real – A Complete Overview of Oracle Functions as a Service (Oracle Groundbreakers EMEA Virtual Tour 2020)

Make your Cloud
Applications
Function for real –
A Complete
Overview of
Oracle Functions
as a Service
Oracle Groundbreakers Tour 2020 EMEA | Make your Cloud Applications Function for real
Oracle Groundbreakers Tour 2020 EMEA, 13th October
Lucas Jellema, CTO & Architect AMIS | Conclusion Sources and slides:
http://bit.ly/function-for-real-
ogbemea2020
API
Gateway
Notifications
Function
Autonomous
Database
Streaming
Object
Storage
Vault
NoSQL
Database
Autonomous
JSON
Email Delivery
AuditingMonitoringLogging
synchronous
asynchronous

Lucas Jellema
CTO for AMIS | Conclusion
Cloud Solution Architect
lucas.jellema@amis.nl | technology.amis.nl | @lucasjellema | lucas-jellema

A traditional application
WebApp
Database
(RDBMS?)JVM
Java EE
Operating System
Hardware
3rd party libraries
& frameworks
Monolith,
Microservice,
Module
Platform & Language
runtime features
(transaction
management, HTTP
request handling, state
management & in
memory caching, IAM,
…
Custom Code

IaaS
PaaS
Cloud Native Application
Event
Hub
Vault
Function
IAM
Container
Engine
Web
App
Function
Cache
Mail
Monitor
ScalingAlert &
Notify
• Managed
• Quick Provision &
Decommission
• Distributed
• Automated
• Pay per use/TCO
• Vendor takes runtime
responsibility
• Enterprise grade platform
accessible to startups
• Rapid Innovation
• Security & Availability
• Scale
Logging

Characteristics of Cloud Native Applications
• Modern – born in the cloud (era)
• Emphasis on interaction (and decoupling) points:
• Between custom components: APIs, Events / message format
• From custom to PaaS Services: Service APIs, Formats and Protocols
• Less emphasis on [and insulation from?] implementation of PaaS (platform) services
• Key are industry standard APIs that are implemented by many different services
• Custom code in small, simple units
• No explicit Infrastructure (serverless, software defined) & managed Platform components
• Stateless and Dynamically Scalable (Elastic) – expand and contract
• Pay per Use
• Automation – no hands on ACC and Production (speed, repeatability, dynamic adjustment)
• Infrastructure/Platform as Code & Application CI/CD [pipelines]

What are Functions?
• (typically small) Stateless Execution Engines that handle one request or
event
• They can do anything regular applications can do – as long as they can
do it in limited time (a few minutes max, ideally even shorter)
• Serverless: functions are deployed and executed in an abstract, fully
managed environment that automatically scales up and down (FaaS)
• DevOps teams do not need | get to configure VMs, servers, network
• Pay per execution – and per duration, memory and CPU
• Glue and worker bees in cloud environments
• For both application functionality and Ops-automation

Function Implementation
• Implemented in any programming language –
• frequently JavaScript/Node, C#, Python, Go and Java; also shell, binary executable
• Frequently backed (visibly or implicitly) by Docker Containers
• Parametrized via Configuration Settings
• Leverage Cloud facilities
• Logging
• Monitoring
• Auditing
• Authorization
• IaaS: Compute, Network, Storage
• Container Orchestration, Container Image Registry

Introducing Serverless Functions
• The Container Native Serverless Framwork
• Project Fn is an open source FaaS platform
that you can run anywhere -- any cloud or
on-premise.
• It implements serverless Functions through
Docker containers
• Out of the box support for many runtimes
•
• also support for custom Docker
Container (white box)
• Command Line Interface
• create, develop, deploy, invoke, inspect

Fn Functions – request handling
Function
Implementation
(Node, Java, Go,
Python, custom
Docker, …)
FDK
Function as a Service framework
HTTP Request
HTTP method, headers, query
parameters, url path, body
input – derived from body
ctx – raw HTTP request components

Introducing Oracle Cloud Infrastructure

Oracle Cloud Infrastructure
• Generation 2 Cloud
• Main themes:
• Competitive Pricing
• Secure by Design
• Open
• Enterprise (Technology)
• Trials – 30 days, $300 credits
• An always-free tier
• With Autonomous Database and
Autonomous Data Warehouse

Oracle Functions
• Functions on OCI – based on Fn
• FaaS (Project Fn)
• Interacts with container platform – run | scale | watch | …
• Is a generic open source framework that can run anywhere on Docker
• Handles request – load balance, route, provide context
• Manages application configuration settings
• Function Container Images are stored
in OCI Container (Image) Registry
• Triggers are HTTP Requests or OCI Events
• OCI gathers logs and metrics

Quick Demo of Oracle Functions
• Create new Function (in existing App) locally
• Implement special hello world
• Deploy Function App locally
• Invoke Function App locally
• Through CLI
• Change context to OCI
• Deploy & Invoke
• Show Invocation ‘evidence’
• Metrics
• Logging

Demo Your First Function – local Fn environment
fn start
Fn server
1
fn create app
hello-app
2
Fn server
Application hello-app
fn init --runtime
node hello
3
Function
hello
<edit
function hello>
4
fn deploy -app
hello-app --local
5
Function
hello
Local Docker
Container
Image Registry
hello
fn invoke hello-app
hello
6
Docker
hello
http request

Generated Function in Node
meta-data for Fn
SDK runtime
Implementation of
the function

Generated Function in Java
meta-data for Fn
SDK runtime
Implementation of
the function
Maven pom.xml with
Fn dependencies

Demo Your First Function – on OCI - preparation
fn create context
oci-context --
provider oracle
1
fn use context
oci-context
2
OCI Cloud Tenancy
Container
Registry
Fn client
oci-context
fn update context
oracle.compartment-id
62371…8198
3
fn api-url
https://functions.$REGION
.oci.oraclecloud.com
4
OCI Config Private Key.pem
fn context registry
<region>.ocir.io/<namespace>/
<registry-name>
5
fn update context
oracle.profile FN
6
docker login
<registry-url>
7
Docker login

Demo Your First Function – on OCI – implement, deploy, invoke
OCI Cloud Tenancy
Container
Registry
Fn client
oci-context
fn create app "fun-app" --annotation
"oracle.com/oci/subnetIds=["781...82"]"
8
OCI Config Private Key.pem
Docker login
Application
hello-app
Functions
Application
fn init --runtime
node hello
9
Function
hello
<edit
function hello>
fn deploy -app
hello-app
hello
fn invoke
hello-app hello
10
11
hello
12
hello
hello
httprequest

Demo Your First Function – on OCI
Functions
Application

Demo Your First Function – on OCI

Logical Grouping on OCI to work with Functions
Policies
Groups
TENANCY
COMPARTMENT
Functions
Container
Registry
Application
Functions
Application
VCN
SUBNET

Mental Picture: Stateless and Serverless
FDK

Mental Picture: Stateless and Serverless “execution engine”
FDK
Configuration
Parameters

Mental Picture: Build Process
FDK
Container
Image
Registry
push
Operating
System
Language
Runtime
FDK
go, java8, java9, java, java11, node, python, python3.6,
python, python3.7, ruby, and kotlin
function.yaml

Mental Picture: Build & Deploy Process
FDK
Container
Image
Registry
push
Operating
System
Language
Runtime
FDK
OracleFunctionsonOCI
Deploy Function Application
Associated with Network &
Compartment
Specify max time to run and
memory shape (128, 256,
512, 1024 MB) for function
in function.yaml
function.yaml

Mental Picture and Actual Runtime
Container
Image
Registry
Container Orchestrator
VM
Server
128 | 256 | 512 | 1024 MB Memory,
32 | 64 | 128 | 256 MB File System
File system can be read, /tmp can be written to
Configuration Parameters available as
Environment Variables
Memory
Shape, Max
Time to Run,
Configuration
Parameters
Configuration
Parameters

Container
Image
Registry
VM
Server
Container is kept running for 10-15 minutes –
primed (hot) for handling more requests.
It is removed when it has been idle for that time.
It retains global state and file system contents
during its lifetime. Note: hold on to and reuse
expensive connections
Configuration
Parameters

Container
Image
Registry
VM
Server

Container
Image
Registry
VM A
Server 1
VM B
Server 2
Oracle Functions starts multiple Docker
containers, up to the limit specified for
your tenancy. The default limit is 30 GB
of RAM reserved for function execution
per availability domain

Mental picture vs Physical reality
• Stateless? One execution per instance? Serverless?
• Explore
• Cross execution state (memory)
• Multiple concurrent requests
• Lifetime of an instance
• Container details
• Function with
• Request counter (as cross execution state)
• Concurrent requests counter (and multi second delay)
• Write ‘still alive’ log messages
• Get host details (from Fn context)
requestCounter
concurrentRequests
lifetimeOfInstance
process.on(‘exit’,…)
console.log()

Physical Function Findings
• No concurrent request handling in a single instance
• Four concurrent requests,
four different hosts (== container instances)
• Each instance handles multiple [subsequent] requests
• State is kept in instance between requests
• Until the death of an instance
• An instance can perform some background work after a request is
responded to (13 seconds?)
• Part of pay per use?
• An instance is killed after [approximately] 10 minutes

Pricing Oracle Functions – no use, no pay
(and even if quite a bit of use – then still no pay)

Function execution is triggered by
API Gateway
Notifications
Events
Healthcheck
Resource
Manager
Service
Connector
Alarming
Functions

Function execution is triggered by
API Gateway
Notifications
Events
Healthcheck
Resource
Manager
Service
Connector
Alarming
Functions
Ops automation
Application
App
Ops
Ops
Ops
Ops
Ops
Ops
App
App

API Gateway
• Handle HTTP calls:
• Authorize
• Route
• Map
• Transform
• Observer
• Monitor
• Audit
• Log
API
Gateway
Oracle Cloud Infrastructure
Any 3rd party
HTTP endpoint
Function
Stock
Any HTTP
Endpoint
on OCI
OIC
OKE
VM
…
Any
Service
Invoker
Expose private endpoints publicly
Stable (public) endpoints
Routing (verb & wildcard based)
Parameter and Header mapping
Request Policies
Rate limiting (per client & general)
CORS (for direct web client access)
Metrics Monitoring & Logging
Authentication & Validation
Transform headers & parameters
in requests & headers in responses
API Gateway

API Gateway Configuration for public access to Function

Leverage OCI PaaS Services and Facilities from Functions
API Gateway
Notifications
Functions
Autonomous
Database
Streaming
Object
Storage
Vault
NoSQL
Database
Autonomous
JSON
Email Delivery
synchronous
asynchronous

Allow Functions to Invoke OCI APIs
through Resource Principal authorization
• Any OCI API call must be authenticated (signed) and authorized
• (Human) users can be granted permissions and can sign requests
• A function can be a resource principal – that is granted permissions (via
Dynamic Group) and gets an auto-generated key-file injected used for
signing
Function Object
Storage

Allow Functions to Invoke OCI APIs
through Resource Principal authorization
• Any OCI API call must be authenticated (signed) and authorized
• (Human) users can be granted permissions and can sign requests
• A function can be a resource principal – that is granted permissions (via
Dynamic Group) and gets an auto-generated key-file injected used for
signing
Function Object
Storage
pem rpst
Dynamic
group
Policy
Rule
Resource

Implement OCI Operations Task using Functions
• Requirement: longer term retention of
audit events for several different reasons,
including governance, compliance and
forensic requirements
• Audit events comprise: Audit Service
recording administrative operations and
Oracle Identity Cloud Service (IDCS)
tracking access and user management
events
• Approach: periodic extraction of security
event details from OCI services and
storing on OCI Object Storage
source: https://redthunder.blog/2020/10/02/simple-secure-log-retention-using-oci-services/

Functions in Cloud Native Application on OCI:
Tweets to NoSQL, Streaming & Email
Streaming
NoSQL
Database
#groundbreakerstour

Tweets to NoSQL,
Streaming & Email
Healthcheck
Streaming
Events
Object
Storage
Notifications
API
Gate
way
NoSQL
Database
Function
Function
Write JSON
document with
Tweets
Retrieve X
minutes worth
of tweets
Store JSON
file with all
tweets in time
period Trigger
function with
event
Create
Tweet
Records
in NoSQL
Send
Tweet
Report as
email
Invoke Tweet
Aggregator every
X minutes
Cloud Event
for new
JSON file
Publish
each
Tweet to
Stream
Compartments
API/Service
Logging
Monitoring
OCIR
Expose
function to
external callers
Publish to
Notification
Topic
#groundbreakerstour
Vault
Get Twitter
credentials in
secure way
from vault

Functions facilitate Decoupling
Streaming
Events
Object
Storage
Notification
Topic
API
Gate
way
NoSQL
Database
Function
Function
Compartments
API/Service
Logging
Monitoring
OCIR
#groundbreakerstour
Vault
• Encapsulation (of
implementation)
• Run time availability
independence
• Independent release /
reconfigure
• Independence of scaling
• Volume Load
Throttling/Absorption
• Security Boundary
• Failure isolation

Automated Test of Functions
• Unit Test to verify the behavior of the code
• Implement functionality apart from FDK
FDK
Mock external
services
Automated Test using your favorite
language specific framework, such
as JUnit 5, Jest, pytest, …
Mock
FDK
http

Types of Tests
Testing Cloud Native Applications
ISOLATIONmore less
Unit Test
Integration Test
End to End Test
isolated sociable/ wired
Static Code
Analysis
Smoke Test/Health
Check/ Chaos Test

Types of Tests
Testing Cloud Native Applications
ISOLATIONmore less
Unit Test
Integration Test
single unit, all
dependencies
are mocked
End to End Test
isolated sociable/ wired
Unit and (most of) its internal
dependencies; external
dependenices are mocked
Some external dependencies are mocked; all
internal units are used unmocked
(aka Integration or BroadStack) test: tests
include (unmocked) external dependencies;
parts of the system can still be mocked
When used at runtime – E2E tests function
as Smoke Test/Health Check – to test
health of interactions at PaaS & IaaS level
Static Code
Analysis
Verify code quality guideline
adherence – without running any code
More:
• Speed
• Tests
• Boundary Testing
• Non-happy flows &
corner cases
• Mocks
• Maintenance
• Refactoring
Protection
• Technical
Smoke Test/Health
Check/ Chaos Test
More:
• Functional /
Specification driven
• Confidence
• Bugs caught
• Contract & Interaction
• REAL (mocks poke
holes in reality)
• Side effect
• Effort (per test)
• Execution time
Tests in full blown environment (ACC, PROD); focus
on (continuous) health – end to end availability of
connections, permissions, platform and infra
components; focus on important functional flows

Other Types and Scopes of Tests
• Integration Test
• Only mocks at the far ends of the chains
• Smoke Test/Health Check
• Live environment, no mocks
• Live test data set (with no business side effects)
FunctionsAPI Gateway
Smoketest

CI/CD –
from Dev through build, package, release, deploy to Ops
Container
Registry
Resource
Manager
CLI
Continuous
Integration
Continuous Delivery Deployment
Functions
Application
CLI

DevOps on Functions
Functions
• Monitoring
• Metrics on Number | Duration | Status
of Function calls - per time window
• Alarms on special conditions – causing notifications to be sent
• Logging
• Application Logging from Function is captured by
OCI Logging Service and can be explored and processed
• Auditing
• Management activities regarding functions are captured
by Audit Service (who, when, what, with which function)
• Application Configuration Settings
• By (re)defining Configuration Settings on
application or function can the run time behavior
of the function be influenced

Logging

Monitoring | Health Checks
• Verify through the eyes of an external client
if endpoints are available
and respond quick and well
• Periodic or Adhoc call to an endpoint
• HTTP(S) or Ping
• Specify Headers
• Specify Interval (check frequency)
• From selected Vantage Points
• 3rd party clouds, geographic locations around the world
• Health Check results can be inspected through the Monitor in the Console
• Use health checks for live function smoke tests
Functions
Healthcheck
API Gateway

[tricks for] Scheduling Functions
• OCI does not currently have a way to schedule jobs
• Health Checks are scheduled, periodic HTTP(S) requests
• Once every 30 | 60 seconds or 5 | 10 | 15 minutes
• Monitoring Alarms are evaluated and repeated on the
indicated specific interval
Functions
Healthcheck
API Gateway
Configuration
Parameters
CRON expression to run
once every hour | day |
Sunday | …
When triggered evaluate
CRON expression and
decide whether to run
CRON expression passed as
header or parameter in
healthcheck configuration
Notifications
Alarming
Monitoring
Define an Alarm that will be
triggered; set repeat interval at
desired function execution interval

Get going with Functions on OCI
katacoda.com/redexpertalliance/courses/oci-course

Functions vs Containers vs VMs
• Serverless
• No IaaS DevOpS
• Stepless Pay per use
• Free-Tier
• Auto-Scale
• Automatic Fail Over
• Integration with OCI
• Triggered by OCI
• Call OCI services
• Leverage OCI for
Audit, Log, Monitor
• Restricted, simple
programming model
• Short running
Functions Containers on OKE
• Serverless runtime
• Initial IaaS Setup
• Pay per VM,
scale per VM
• Auto-Scale by K8S
• Some auto Fail Over
• Little integration with OCI
• Kubernetes for Ops
• Flexible programming
model – any container goes
VMs
• Fully Servered
• DIY IaaS Op
• Pay per VM, scale per
VM, cheap at large scale
• Manual Scaling
• Manual Fail Over
• Little integration with OCI
•
• Flexible programming
model
Virtual
Machine
Functions Container Engine
For Kubernetes

Oracle Functions - Points for improvement
• Function to Function invocation could be much simpler
• Simple Fn SDK call instead of complex OCI API call
• Automatic tracing of function calls
• Asynchronous mechanism for function triggering
• OCI Streaming does not trigger function execution
• OCI Notification Topics are capped at 60 messages
per minute
• OCI API Gateway only handles synchronous requests
– not fire & forget
• Function orchestration or coordination
• Workflow, parallel execution, transaction handling
(Saga pattern)
• Project Fn is showing hardly any activity on GitHub
• Is it alive? Does it have a future?

Functions are crucial part and great example of cloud native
• Serverless in all the good ways
• Simple and cheap
• Freedom of implementation – little lockin
• Rapid start
• Easy to get started with
• Native fit with OCI
• Leverage FaaS, invoke and triggered by PaaS, automated Ops (OCI worker bees)
Cloud Native:
Platform Services
Managed
Quick Provision & Decommission
Distributed
Automated
Pay per use/TCO
Vendor takes runtime responsibility
Enterprise grade platform for all
Security & Availability
Scale
Ops facilities (monitor, log, failover)
Rapid Innovation (new services, new
features, new pricing)
Functions

Thank you
for your attention
I hope
this was
useful
lucas.jellema@amis.nl | technology.amis.nl | @lucasjellema | lucas-jellema
Sources and slides:
http://bit.ly/function-for-real-
ogbemea2020

Make your Cloud Applications Function for real – A Complete Overview of Oracle Functions as a Service (Oracle Groundbreakers EMEA Virtual Tour 2020)

More Related Content

What's hot

Similar to Make your Cloud Applications Function for real – A Complete Overview of Oracle Functions as a Service (Oracle Groundbreakers EMEA Virtual Tour 2020)

More from Lucas Jellema

Recently uploaded

Make your Cloud Applications Function for real – A Complete Overview of Oracle Functions as a Service (Oracle Groundbreakers EMEA Virtual Tour 2020)

Editor's Notes