"From Zero to Hero with Go and Dapr" presented at GopherCon 2021

From Zero to Hero with Go and Dapr

Slides

This is a Go application demonstrating the key features of Dapr with a few different approaches. My goal is to help you pick the best fit for your needs and level up as a microservices developer.

Dapr, at its core, is a set of building block APIs that abstract away common tasks so you can focus on what matters most-- business value/features. We will focus on the building blocks that I consider as the most useful for Go developers.

  • Publish / Subscribe (with routing)
  • Secret store
  • State store
  • Service Invocation (with discovery and tracing)

Design choices

When building Go microservices, we have many choices to make! gRPC, REST or both? Which HTTP router? How to organize packges?

In this application, packages are organized by purpose/feature. This creates a small hurdle for subscriptions because your application responds with all of the topics in a single callback. To work around this, the subscriptions from each package are merged together into a single response.

You will find examples of "helper code" like this in pkg/dapr. However, be aware that the Go SDK is an abstraction over all of the Dapr APIs. It is up to you to decide on custom code or the SDK.

The Go SDK uses the standard net/http package. To be different, I choose Fiber as the HTTP router for public API traffic and found it to be straightforward to use.

Event callbacks, such as PubSub events, should be considered private communication. Because of this, I highly recommend having Dapr callbacks listen on a separate port that is not publicly exposed. Even better, it should only listen on the loopback interface.

Application flow

With the design decisions out of the way, let's look at the scenarios and specifically how the Dapr building blocks are used.

There are three code paths. Each starts with the receipt of a Pub/Sub event. By default, Dapr uses CloudEvents envelopes to encapsulate event data. This allows Dapr to attach tracing IDs and route the event based on attributes such as type.

The application is an Inventory service, where products are persisted in different stores based on type. Widgets are stored in a PostgreSQL database. Gadgets are stored in a State store, such as Redis or MongoDB. All other product types are stored in a separate service exposed through gRPC.

Demo diagram

By inspecting event.type, Dapr selects one of three routes (URIs) to invoke.

To connect to the PostgreSQL database, the application uses a Secret Store to acquire the needed credentials in order to connect. From there, the jackc/pgx package is used to execute SQL statements.

Gadgets are saved simply by calling the "Save state" operation of the State management API.

Finally, general products are stored in the Products gRPC service. The developer uses the generated gRPC client as normal; however, the endpoint is the Dapr sidecar and an additional dapr-app-id metadata field is attached to the request so Dapr know how to route the request. See this How-To for more details.

All component configurations are located in the components directory. The main Dapr configuration is in config.yaml and is where tracing and preview features are enabled.

Running the demo

After running dapr init, you should have Redis running in a Docker container. You will need to create a PostgreSQL database and update secrets.json accordingly. Then create the widgets table from tables.sql.

I launched Postgres in a container and used pgAdmin to create the golang+dapr database and widgets table.

docker run --name postgres -e POSTGRES_PASSWORD=postgres -p 5432:5432 -d postgres

Start the Products service

make run-products

Start the main Inventory service

In a second terminal run: (Pick the client mode)

make run-custom-http
make run-custom-grpc
make run-sdk-http
make run-sdk-grpc

Send product events

In a third terminal you can publish the 3 product event types. The contents of each message are located in the messages directory.

Send a Widget: This will save in the PostgreSQL database.

make send-widget

Send a Gadget: This will save in the Redis state store.

make send-gadget

Send a Thingamajig: This will invoke the Products service using Dapr for service discovery and mTLS authentication.

make send-thingamajig

That's it!

I hope this was helpful! If you have better ways of handling anything in this sample, please submit a PR! :)

Similar Resources

CVE-2021-21978 exp

CVE-2021-21978 exp

CVE-2021-21978 CVE-2021-21978 RCE exp 影响版本 VMware View Planner Harness 4.X 与 CVE-2021-21978 类似,该漏洞可以在未授权访问的情况下,上传任意文件,并通过修改自带 py 脚本实现远程代码执行。

Nov 9, 2022

CVE-2021-26855 exp

CVE-2021-26855 exp

CVE-2021-26855 CVE-2021-26855 ssrf 简单利用 golang 练习 影响版本 Exchange Server 2013 小于 CU23 Exchange Server 2016 小于 CU18 Exchange Server 2019 小于 CU7 利用条件 该漏洞不

Sep 12, 2022

CVE-2021-26855 exp

CVE-2021-26855 CVE-2021-26855 ssrf 简单利用 golang 练习 影响版本 Exchange Server 2013 小于 CU23 Exchange Server 2016 小于 CU18 Exchange Server 2019 小于 CU7 利用条件 该漏洞不

Sep 12, 2022

Exploit for HiveNightmare - CVE-2021–36934

HiveNightmare this is a quick and dirty exploit for HiveNightmare (or SeriousSam) - CVE-2021–36934 This allows non administrator users to read the SAM

Dec 3, 2022

Một script nho nhỏ viết bằng Go để crawl toàn bộ điểm thi THPTQG-2021

Một script nho nhỏ viết bằng Go để crawl toàn bộ điểm thi THPTQG-2021

Crawl toàn bộ điểm thi THPTQG-2021 Một script nho nhỏ viết bằng Go để crawl toàn bộ điểm thi THPTQG-2021, mình đã crawl sẵn toàn bộ ở đây: https://dri

Jul 18, 2022

bytecamp 2021 project

Calldiff 背景 复杂项目的日常迭代中,研发同学想了解某个改动的影响点,往往需要深入代码细节才能获得尽可能全的 checklist 。然而,由于项目的复杂性,我们获得的 checklist 又难免会有一些遗漏。 为了减轻研发同学的心智负担,辅助同学们更有效地保证服务稳定性,本项目应运而生。 本

Oct 4, 2021

CVE-2021-3449 OpenSSL denial-of-service exploit 👨🏻‍💻

CVE-2021-3449 OpenSSL 1.1.1k DoS exploit Usage: go run . -host hostname:port This program implements a proof-of-concept exploit of CVE-2021-3449 affe

Dec 16, 2022

Confluence OGNL Injection [CVE-2021-26084].

Confluence OGNL Injection [CVE-2021-26084].

CVE-2021-26084 this is a script written in golang to exploit Confluence OGNL Injection [CVE-2021-26084]. git clone https://github.com/march0s1as/CVE-

Apr 23, 2022

CVE-2021-26084 - Confluence Server Webwork OGNL injection (Pre-Auth RCE)

CVE-2021-26084 Proof of concept for CVE-2021-26084. Confluence Server Webwork OGNL injection (Pre-Auth RCE) Disclaimer This is for educational purpose

Nov 9, 2022

System Design course at HSE (2021)

System Design course at HSE (2021) Wiki-страница курса Структура репозитория: slides - директория с презентациями с занятий tasks - материалы для выпо

Dec 25, 2022

Bot para o discord escrito em Golang durante o workshop ministrado na Codecon 2021

Codecon Bot Bot para o discord escrito em Golang durante o workshop ministrado na Codecon 2021 Primeiramente no arquivo main.go coloque o TOKEN do bot

Oct 4, 2021

Golang Clean Architecture based on Uncle Bob's Clean Architecture and Summer internship in 2021

clean-architecture-api Description This is an example of implemention of Clean Architecture in Golang projects. This project has 4 layer : Infrastruct

Feb 20, 2022

Code for the keycloak demo for the talk I gave at blablaconf 2021

Code for the keycloak demo for the talk I gave at blablaconf 2021

This demo illustrates the usage of keycloak to secure several service accross different clients using roles. How to Run: From a terminal you need to r

Oct 30, 2021

Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0.

CVE-2021-29156 Proof-of-Concept (c) 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint

Apr 13, 2022

UCSD CSE 124 Fall 2021 Project 3 Starter Code

Surfstore This is the starter code for Module 3: Surfstore. Before you get started, make sure you understand the following 2 things about Go. (These w

May 15, 2022

Advent of Code 2021 Solutions

Advent of Code 2021 Solutions for the 2021 Advent of Code Building This project makes use of Go 1.17. go mod download go test ./... Running the Soluti

Dec 1, 2022

Entry for 2021 Game Off

Entry for 2021 Game Off

Cr1ck_t Still very WIP! Entry for 2021 Game Off, themed "BUG". I'll add a link to the submission when it's published. You may be interested in help fo

Dec 21, 2022

An easy-to-use Map Reduce Go parallel-computing framework inspired by 2021 6.824 lab1. It supports multiple workers on a single machine right now.

MapReduce This is an easy-to-use Map Reduce Go framework inspired by 2021 6.824 lab1. Feature Multiple workers on single machine right now. Easy to pa

Dec 5, 2022

Distributed Systems 2021 - Miniproject 3

Distributed Systems 2021 -- Miniproject 3 Hand-in Date: 1 December 2021 (at 23:59) What to submit on learnit: a single zip-compressed file containing:

Dec 11, 2021
Explores GitHub Actions in Go Lab from GopherCon 2021

Gopher A Tweet An action that tweets. Gopher A Tweet was created based on GopherCon 2021s Gophers of Microsoft: GitHub Action in Go Lab to explore bui

Dec 10, 2021
Small Lambda function which performs a Aws:Sts:AssumeRole based on the presented JWT-Token

About This implements a AWS Lambda handler which takes a JWT-Token, validates it and then performs a Aws:Sts:AssumeRole based on preconfigured rules.

Aug 8, 2022
Gophercon lab "Get Go-ing with GitHub Actions"

GitHub Action Using Go This is a starting point for a GitHub Action based in Go. This repo provides all the structure needed to build a robust GitHub

Dec 8, 2021
vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????)
vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????)

REALITY_SMASHER vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????) "As easy to stop as it is to comprehend." What is it? "Reality

Nov 9, 2022
Advent of Code 2021 https://adventofcode.com/2021

AOC 2021 How to use Not sure yet. Maybe cd into your day folder and go run, or maybe better to try go test Dev environment Open in VSCode, enable (Rem

Apr 22, 2022
A FreeSWITCH specific scanning and exploitation toolkit for CVE-2021-37624 and CVE-2021-41157.

PewSWITCH A FreeSWITCH specific scanning and exploitation toolkit for CVE-2021-37624 and CVE-2021-41157. Related blog: https://0xinfection.github.io/p

Nov 2, 2022
Poc-cve-2021-4034 - PoC for CVE-2021-4034 dubbed pwnkit

poc-cve-2021-4034 PoC for CVE-2021-4034 dubbed pwnkit Compile exploit.go go buil

Nov 9, 2022
CVE-2021-4034 - A Golang implementation of clubby789's implementation of CVE-2021-4034

CVE-2021-4034 January 25, 2022 | An00bRektn This is a golang implementation of C

Feb 3, 2022
A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).
A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).

proxylogscan This tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and imperson

Dec 26, 2022
Auto Judger for BUAA-SE-OOP Course (2021 Spring)

patpat Auto Judger for BUAA-SE-OOP Course (2021 Spring) 1. 评测机使用方法 1.1. 一些准备工作 1.1.1. 下载评测机 见 GitHub 中的 Releases,下载对应版本即可。目前提供 Windows, Linux, MacOS(I

Sep 25, 2022