The Spring Observability Team has been working on adding observability support for Spring Applications for quite some time, and we are pleased to inform you that this feature will be generally available with Spring Framework 6 and Spring Boot 3!
What is observability? In our understanding, it is "how well you can understand the internals of your system by examining its outputs". We believe that the interconnection between metrics, logging, and distributed tracing gives you the ability to reason about the state of your system in order to debug exceptions and latency in your applications. You can watch more about what we think observability is in this episode of Enlightning with Jonatan Ivanov…
Project Loom has made it into the JDK through JEP 425. It’s available since Java 19 in September 2022 as a preview feature. Its goal is to dramatically reduce the effort of writing, maintaining, and observing high-throughput concurrent applications.
Where Virtual Threads make sense
This makes lightweight Virtual Threads an exciting approach for application developers and the Spring Framework. Past years indicated a trend towards applications that communicate over the network with each other. Many applications make use of data stores, message brokers, and remote services. I/O-intensive applications are the primary ones that benefit from Virtual Threads if they were built to use blocking I/O facilities such as InputStream and synchronous HTTP, database, and message broker clients. Running such workloads on Virtual Threads…
Hi, Spring fans! Welcome to another installment of This Week in Spring! I write this installment as I pack and prepare for my trip to Antwerp, Belgium, for the always-amazing Devoxx show in Antwerp, Belgium. I've so missed this show over the pandemic and am so looking forward to returning. I hope to catch any and all of you there, too! I'll be copresenting with my pal James Ward about some of the new and novel in Spring Boot 3 and Kotlin. It's going to be awesome - join us and we'll have some fun together!
Now, we've got a ton to cover so let's dive right into it!
Hi, Spring fans! In this installment of Spring Tips, I look at the venerable Apache Kafka broker and its integrations at various level of abstraction in the Spring Boot ecosystem.
Want to learn more about event driven architectures, AOT and GraalVM, Apache Kafka, and Spring Boot? SpringOne 2022 is almost here! If you want a chance to learn from the source, then I hope you’ll join us 6-8 December 2022, right here in my hometown of San Francisco, my favorite west coast city in the USA. (Psst.: If you register now, there’s a $200 discount from the pass price with this code S1VM22_Advocate_200.)
Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to longtime Spring community member and legend Marten Deinum (@mdeinum) about scuba diving, software, Spring, community, and more.
Also: I fixed the odd silence in the middle of the last few episodes! thanks for suffering through it with me. I have no idea what went wrong but I know now how to fix it
Want to meet more amazing people in our ecosystem, like Marten? SpringOne 2022 is almost here! I feel like it’s that anxious, exciting time before, sort of important holiday where you get given gifts! And with it, Spring Boot…
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's October 4th, 2022, and I'm in Austin, TX, for the new version of show formerly known as the Kafka Summit, here to talk to folks about the amazing opportunities for Spring Boot and Apache Kafka. On the 12th, I'll be in Antwerp, Belgium, for the amazing Devoxx show. On October 17-20th, I'll be in Las Vegas, for the new version of JavaOne. And, well, there's more but I can't say exactly. Stay tuned!
And as for now, well, I'm excited to be here! We've got a ton of cool stuff to cover this week, so let's dive right into it…
Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to his friend Chris Richardson (@crichardson), who helped articulate and advance cloud computing, reactive programming, microservices, domain-driven design, event sourcing, and so much more years before the zeitgeist. Also, we used to work together!
Want to meet more amazing people in our ecosystem, like Chris? SpringOne 2022 is almost here! I feel like it’s that anxious, exciting time before, sort of important holiday where you get given gifts! And with it, Spring Boot 3 and Spring Framework 6. We’re going to be announcing…
Using username/password credentials to access one application from another presents a huge security risk for many
reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database
and eventing services, letting you finally shift away from using passwords.
Security Challenges with Passwords
Passwords should be used with caution, and developers must never place passwords in an unsecure location. Many Java
applications connect to backend data, cache, messaging, and eventing services using usernames and passwords, or other sensitive credentials such as access tokens or connection strings.
If exposed, the passwords could be used to gain unauthorized access to sensitive information such as a sales catalog
that you built for an upcoming campaign, or simply all customer data that must be private.
Embedding passwords in an application itself presents a huge security risk for many reasons, including discovery
through a code repository (see Figure 1 below). Many developers externalize such passwords using environment
variables so that applications can load them from different environments. However, this only shifts the risk from
the code itself to an execution environment. Anyone who gains access to the environment can steal passwords, which
in turn, increases your data exfiltration risk.
Figure 1 – shows Java code with an embedded username and password to connect to a database
Our customers can have strict security requirements to connect to Azure services without exposing passwords to
developers, operators, or anyone else. They often use a vault to store and load passwords into applications, and
they further reduce the risk by adding password-rotation requirements and procedures. This, in turn, increases the
operational complexity and can lead to application connection outages.
Passwordless Connections – Zero-Trust
Now you can use passwordless connections in your apps to connect to Azure-based services with a code-free
configuration. You no longer need to rotate passwords. Using the principle of "never trust, always verify and
credential-free", Zero-Trust helps to secure all communications by trusting machines or users only after verifying
identity before granting them access to backend services.
"Every password and every Key Vault we have is a potential liability, which adds more overhead and management cost. I'm always happy to see more of the authentication and authorization handled for us and shipped as simple integrations into the Java and Spring ecosystem on Azure. And I won't shed any tears when I delete our Key Vault, now PostgreSQL supports passwordless connections."
-Jonathan Jones, Lead Solutions Architect, Swiss Re Management Ltd. (Switzerland)
Using managed identities and Azure RBAC (role-based access control) combination is the recommended authentication
option for secure, passwordless connections from Java applications to Azure services. Developers or operators do not
need to manually track and manage many different secrets for managed identities because these tasks are securely
handled internally by Azure.
You can configure passwordless connections to Azure services using Service Connector (see Figure 2 below),
or you can manually configure them. Service Connector enables managed identities in app hosting services like Azure
Spring Apps, App Service and Azure Container Apps. It configures backend services with passwordless connections
using managed identities and Azure RBAC, and supplies applications with necessary connection information – no more
passwords.
Figure 2 – Service Connector configures passwordless connection for a Java app to a PostgreSQL database
If you inspect the running environment of an application configured for passwordless connections, you can see the
full connection string. For example, Figure 3 shows how it carries database server address, database name, and an
instruction to delegate authentication to Microsoft’s Azure’s JDBC authentication plugin.
Let’s consider a Spring Boot application that connects to a PostgreSQL database that uses Spring Cloud Azure starter.
The starter composes a connection string without password for a Spring Data JPA module. From the connection string,
the driver understands that it must load the Azure’s JDBC authentication plugin which uses the Azure Identity Client
Library to get an access token. The driver logs into a database using the token as password - no more
passwords.
For local development and testing, developers can use the same arrangement to connect to services without using
passwords. You will authenticate through Azure CLI, IntelliJ or any development tool and use that identity to secure
access for the application to connect with Azure services without passwords.
Learn More and Delete Passwords!
You can shift away from using passwords in your apps. Migrate your existing Java applications to use passwordless
connections for Azure services today!
Hi, Spring fans! Welcome to another installment of This Week in Spring!
It's the last week of September, already! The year's more done than not. The days are receding into darkness earlier. And the Pumpkin Spice Lattes are upon us. The darker and colder days are kind of a bummer, but I'm stil excited and overjoyed this time of year. You know why?
SpringOne 2022 is almost here! I feel like it's that anxious, exciting time before sort of important holiday where you get given gifts! And with it, Spring Boot 3 and Spring Framework 6. We're going to be announcing everything right here on the Spring blog, of course, but if you want a chance to learn from the source, then I hope you'll join us 6-8 December, 2022, right here in my hometown of San Francisco, my favorite west coast city in the USA, and my hometown. )Psst.: If you register now, there’s a $200 discount from the pass price with this code S1VM22_Advocate_200…
The Spring Team has been working on native image support for Spring Applications for quite some time. After 3+ years of incubation in the Spring Native experimental project with Spring Boot 2, native support is moving to General Availability with Spring Framework 6 and Spring Boot 3!
Native images provide almost instant startup time and reduced memory consumption for Java applications. The recent Spring Boot 3.0.0-M5 release marks the first time we’re asking for broader community feedback on our native story. If you need to catch-up on the basics, please refer to the Ahead Of Time basics blog post from late March. You can also learn how to prepare your applications for Spring Boot 3.0…
