Function devops best best practices (Google Cloud Run)

[weenzeel]

Hi all!

I think this is a great project. Thanks to authors for helping us have a shared language (Dart) for client and server. Given projects like this and projects like googleapi, perhaps the era of monolithic web frameworks are over.

I would love to hear if there are any best practices in the community regarding how to handle devops for Dart functions in an efficient way? I'm thinking about topics like ...

Developer environment and set up
Testing and staging
Deployment and continuous integration
Secrets management (like service account keys for other services etc)
Logging and monitoring
...

Feel free to share your experiences below. What is working well? What are your pain points?
What tools and services do you use? What is your process?

Let's assume Google Cloud Run as a hosting plattform for this thread.

[kevmoo]

While it would be great to have Dart-specific details here, I don't think there would be anything different than what already exists for other languages/frameworks.

I'd suggest digging into general guidance in this area. Excited to see what you learn!

[weenzeel]

@kevmoo You are probably right. Running a Dart-service on Google Cloud Run is likely not that different from a dev-ops perspective than running a service written in some other language. And we shouldn't bloat the scope of this project, duplicating information and documentation that can be found elsewhere.

On the other hand ... if successful, I expect this repo to be the starting point for many server(less) newbies like myself, coming from client side development looking to extend their work on the backend side of things. And any help to get going would probably be appreciated.

I think what I was hoping to find, starting this discussion, was something like one or two detailed tutorials on how to set up a real world service use-case from start to finish. Something to help newcomers and attract opinions and feedback from more senior developers regarding best practices. But, once again, not sure this project would be the right home for something like that. Perhaps something lika a Dart Medium article would be the way to go. Preparing such an article through public discussion would be interesting to read.

To try and be a bit more concrete. Here are some of the things I've spent my time learning over the past few days. Most of it have nothing to do with the Dart Functions Framework. But without the knowledge exemplified below, the function framework is of little value. If there are resources out there that teaches these concepts in a good way I would love to know about them.
...

Understand Docker Containers.

Understand authorization via oauth2 and related technologies.

...

The dartfn Package is a CLI tool included in this project. Use it to quickly scaffold a Dart-project for a new backend service executing as a function.

Install Google Cloud SDK. If you don't want to install the tool locally there is a hosted Cloud Shell with the tool already installed. See the Google Cloud console.

Extend your IDE with Google Cloud Code to easily publish your service straight from your IDE (or the hosted Google Cloud IDE).

If you want to use other Google Cloud services, install the googleapis Package and googleapis_auth Package packages.

Do create a dedicated service account on Google Cloud for your Cloud Run service, limiting the service capabilities to a minimum.

During development, do allow your personal developer account to impersonate the services service account.

To iterate quickly on your service during development, use the gcloud cli tool to set application default credentials to your personal developer account. This way a server running locally will be able to find default credentials on your machine, just like the server will be able to find default credentials running on Google Cloud. Given that your account have been given the right to impersonate the services service account, your code will be able to run locally, just like on the server.

Remember that setting local application default credentials on your machine will place access tokens in your file system. When done with development, application default credentials should be revoked. If you think that your tokens may have been compromised you can revoke the application default credentials via your account settings on the web (taking effect within the next 60 minutes).
gcp-oauth-token-hijacking, part 1
gcp-oauth-token-hijacking, part 1

In your application do use the clientViaApplicationDefaultCredentials function from the googleapis_auth package to get credentials to call other Google Cloud Services. If you intend to run on a Google Cloud Platform like Cloud Run, do not download and store static service account credentials yourself as a file or in source.

...

Now I can run and iterate my service locally. Next I need to figure out how to test, stage and deploy my service in the best way.