All right, we're live Hello and welcome to another session with Octa Octa's developer relations teams We're gonna get started a minute here. We're gonna make sure everything's all set up and give people some time to join And so it's a nice cool morning in my neighborhood. Is it a nice weather out there in New Hampshire, Brian? So far yeah, it's yesterday was nice, too It's been hovering right around 70 mid 70s, you know Fahrenheit. So that's a I'll take that any day I I wish the summers were 70 degrees and the winters were like 20 and I'd be I'd be pretty happy I'd be great. It's not like that. It's like summers are closer to 90 100 and the winters are like zero or 10 below All right here in Colorado. We get you know, June is beautiful and then after that it's definitely Can warm up. So if you're if you're in the chat, you know, let us know where you're from where you're listening from today and We want to make this fully interactive. So instead of you know, me just being the talking head with a presentation here We want to answer your questions and see what you have to say and make this so it's not just a normal virtual presentation Yeah, so so far we've got one person from New Hampshire So that's great one one other person from New Hampshire today, right? Right and the other comment from Eric is there's too much pollen So there is a ton of pollen right now. If you have allergies, it is not the time to be hanging out outside Oh, you know, we have here in Colorado is a lot of maws The maws have like taken over. So if you actually like leave your windows open or anything like that like it can all of a sudden the next morning it'd be like where'd they all come from and So much so that there was something on the news recently that was like if you're having a problem with maws turn your lights off Right, which is yeah, pretty good advice. Yep, I've got a young puppy and It's hard to train or it's been hard for us to train the dog to go in and out the door quickly I mean in the wintertime. We're trying to do that, too It's like hurry up get in but now it's like because of the moss So the lights go on to let the dog in or out and then the moss, you know fly through the window and or through that through the door and Yeah, it's it's a hard time Hasn't been excessive though. So I I don't know. I don't know what to do for you All right, we got Thiago coming in from Barcelona here. Hello, Thiago. Hopefully I'm saying your name, right? Then I mean there Good to see it. We'll wait a few more minutes to let some more folks roll in We know how developers are we like starting on time, but we don't always do it All right, so who's the in the chat so far while we're waiting who's who has the earliest time zone or maybe the latest time zone What do what do we have for the extremes here? I wear it at six o'clock Denver time here 6 a.m. I'm at 8 a.m. I Yeah, I I can I can answer Eric. I'm pretty sure Eric's in the same time zone In every islands, you know that I mean they're tuning in on vacation Right. Yeah, is that a is it a vacation or is that is that where you're normally are? All right, we got to 2 p.m. That's like Paris time, right? That was our original goal because this was a miss from Devox, France, right? So GMT working we got a 5 30 p.m. From India. I love the the half right time zone that India has yeah Yeah, they're like we're just gonna split the difference, you know, just I Like the mentality don't don't you know don't Canada one side of the other it's just everybody's just kind of You know you got a compromise, right? It's right back there. I should have got a cooler coffee cup You got one with like family pictures on it. Oh my my yeah, my wife like every year She makes these things, you know from Shutterfly Like we should get a product plug here But she sends them out as Christmas gifts as like my parents have and her parents have them my sister is like Everybody everybody's got a coffee mug with with our faces on it. So usually it's my kids face, but I guess The whole family's on this one. Nice. So we're at about five minutes You think we should get started or chat a little more Yeah, let's let's give it another minute and then we'll then we'll get rolling here Okay, maybe we can ask for who's fans of water who's using what in the chat like they're using Quarkus or spring boot or hella Donner? Mike or not Yeah, we should we should we should have had one of those pole system set up and we can pulled everybody I'll just I'll just have to keep keep count Well, it's interesting. I actually I Posted a few videos right in the last few weeks doing like building rest API is basically taken like part of the demo from this and doing it for each individual Framework and it's just interesting to see how many likes you get on ones versus the others, right like spring boot Super popular, right? Hell it on not so much, right? And you kind of just see that when you post and promote the videos, you know, how many people are in doing Yeah, I think I think spring as you know in the comparison probably as an unfair advantage Just being sort of the the incumbent right just being around longer, right? Eight years eight years is forever Boot has been around for eight years at 2014. Oh wow why that is forever And to last that long like even you know, JavaScript frameworks, right? Like those were a flash in the pan for a while there too. And you know, a lot of them have been around forever as well I do have a slide. I will talk about, you know, like the founding dates on each framework because I do think it's interesting And yeah, I think you're right that spring boot has a not really an unfair advantage But an advantage right but then when it comes to native like the other ones have an advantage because they were like We started with native, you know, that's a good point. Yeah, we should talk about that. Maybe maybe do a Do a presentation presentation on it Yeah, let's let's roll into that All right, so while you're learning we did have we did have someone for corkis A couple for spring well actually a couple for corkis and a couple for spring boots So so low data set but we've got some some fans Nice All right, let me set you up here matt and hide me and uh Let's get rolling All right So welcome everyone To native java rest api comparison if you know me you might remember my web framework comparison from back in the day the first time I ever did that was 2004 and I actually carried it all the way through like 2011 or 12 So that was my longest running presentation and with any luck Maybe this one will be a long running presentation as well And the reason I'm bringing this to you today is because I was supposed to present it at devox france back in april I think the last time I updated the presentation was april 19th and that fell through I got covid From the frozen four. So that's uh the ncda hockey championship where my school the university of denver actually won So that was fun But the week following and the several weeks following was not so i'm over that good to go no long covet yet, so life is good and The image in this photo is actually from my wife trish McGinnity She took it when we were out at a devox france in the past and so that's why I wanted to put it there So who am I well i'm a hick from the sticks I grew up in the backwoods of montana with no electricity no running water And had to walk two miles to the bus stop every day But in the winter we got to ski so that was you know a lot of fun I live in denver colorado with my beautiful wife trish and awesome kids abby and jack You can tell this photo is a bit dated because jack on the left there is now taller than me by a good six inches So we definitely need to do a new you know family shot there And brian if you have any questions from the audience or everything, you know, feel free to pipe in and ask me That's why we're doing it this way. I also have a middle child. His name is hefe I bought him off ebay in 2004 and it took 12 years to make him look like this and He's got a Porsche engine and boys. He fun to drive. I also have another Volkswagen his name is stout Um, so you can see I have an expensive obsession with classic Volkswagen's and vanagans If you have a similar problem, you know hit me up and direct messages And uh on twitter matt dot rabel at octa.com. I'd love to talk to you about it So I work for a company called octa as does brian When I first started my dad called it okra And now he's still not to octa. He's at upta now. So good grief dad. Come on I think maybe he's just joking with me these days, you know, just to see if he can get a rise out of me Uh, you're probably aware that we joined forces with oth zero back in uh about a year ago And eugenio pace is their CEO and I knew I liked the guy when I read in his bio that in his spare time He enjoys outdoors rowing riding bikes spending time with his family and restoring his 1970 karman guia All right, so I don't know if he knows that I have a bus yet, but I we're going to be good friends like maybe even best friends All right, so that's a lot of fun. So today's agenda We're going to talk about why you should use java. So I think the first time I did this presentation It was more at a a non java venue So, you know, there's always some convincing of why people should use java over other frameworks And then I'll show you how to build rest apis with java I'll talk a bit about graph ql and how you can use that to build apis as well And then how to secure your apis with oauth 2.1 You might notice that I'm saying 2.1 instead of 2.0 and then build we you know with docker and then how to go native with grail vm So there's many companies invested in You know, if you're new that industry you might not be aware, but you know netflix ebay ibn microsoft octa runs on java VMware tesla apple like there's a lot of companies that have used java to build their very successful businesses So 25 years of use abuse and improvements It's open source hasn't always been open source, but it has been for you know What almost two decades at least a decade now and hugely popular and widely used So if you want to get started with the latest and greatest that's java 18 You can download the oracle builds of open jdk. They're at jdk.java.net Or eclipse builds from adoptium So, uh, there's also even a better way than that and that is with sdk man So sdk man basically allows you to install a bunch of different You know java development kits or software development kits, not just java. There's groovy scala kotlin Salon even ant gradle grails maven spt like all kinds right so It's very easy to just do sdk install java And then if you don't specify a version I think you'll get the latest lts which is 17.0.2 from tamarin and that's adoptium's new name So it used to be what? I forget what it is eclipse adoptium or whatever is now the name I forget what it even was before that. I don't know if you remember brian But now the new name is tamarin So I think they really uh, they kind of messed up on that because why pick t When you had a they were like a before at adoptium. So if you do sdk List java, you'll actually see all the list of jdk's you can install and t is way down at the bottom So they could have done better there, but it works great So I really love sdk man there and java 18 represents the ninth feature release as part of the six month cadence So, you know, you might have seen in the java world people complain about node You know releasing so often and having a new release, you know every six to 12 months Well, guess what we do that now too in java land So you can see people starting to complain about javas frequently releases And the cool thing is it's like a train at a station right that there's always Every 20 minutes a new train you don't have to get on if you don't want to you can just wait for the next one So for over three and a half years, you know the level of predictability allows developers to more easily manage Their adoption of innovation thanks to a steady stream of incremental and expected changes I did get that from oracle So a little marketing in that slogan there or that sentence and then in this slide you can see that there's JEPs these are called jdk enhancement proposals These weren't introduced until java 10 So the vertical legend that you see on the left the features can be a bit deceiving Because there were simply features and then since then the JEP So it looks like there's more happening in the older releases and there probably was but you know Now there's a steady stream of smaller incremental things And so this talk was originally inspired by a blog post from daniel parida on the octa developer blog And so he showed you how to build, you know java rest apis and how easy it was But you can see it's also from early 2020 And so it wasn't always too easy to build, you know rest services in java until spring came along and changed the Landscapes and since then there's many new frameworks, right? that's where we get into You know things like grails came along and that really made it a lot easier and then there's corkis and then red hat, you know Supports that and delivers fast startup time and less memory usage with it And so we've really got a plethora of frameworks to choose from now And so I wrote another Post because you know 2020 is kind of old Last year in june of 2021 and it shows rest apis and also shows you how to build a meet as a native app And then I got some complaints from people who actually not really complaints just you know requests that I add heledon So I wrote another one with heledon and I did it as a standalone post and the reason I did it standalone without combining the three Was I got some advice from josh long who was like, you know, if you're Doing a post about comparing spring boot and micronaut and corkis and corkis wins. Well, the spring boot people aren't going to promote it So hey, he's right. So I decided you know to do one standalone for heledon And so you might be wondering, you know, when it comes to native java frameworks like who cares about startup time You know serverless is just someone else's computer, right? Can't you get around that by just leaving your servers running and your jvm war? Yes, but with pay-per-usage Serverless can save big companies a lot of money and when you're big you don't want money, you know flying out the window And so to get started with the first one and there's an order to these The reason I chose micronaut first was because when I first did this, you know back in june of 2021 It was the easiest, right? I never really had to change anything from its default like starting instructions And everything just worked so you can use sdk man sdk install micronaut That will install the latest version at the time of this presentation. That's three five one And then you run mn create app specify your package name and then your features So you might notice that I have dash b maven for the build tool And most people that use micronaut probably will not use maven and so I do get frequent complaints from the The micronaut folks that you know, I should be using gradle because it's better But also by using maven. I found a couple bugs and they're maven implementation of their plugin. So It's a win-win. I think That's f for security jwt that lets you set up an oa2 resource server So we can secure our rest api And then the micronaut aot is an enhancement that they recently added to do the native builds a bit faster And a bit more optimized when they start up So if you're not really, you know a command line person, you're more of a visual person You can also use micronaut launch so Just one thing to note if you use micronaut for a name that does not work They don't allow that but otherwise, you know, you select your application type your java version Your base package and then your build tool and all that kind of stuff And then you can see that I also selected a feature there security jwt And then you can build a rest controller. You see there's a Good chunk of imports that you need But then you just specify your controller and then you can secure it with the secured annotation And then you say it just produces, you know plain text And what we're doing here is we're just going to return the user's name because we want to prove that they've authenticated And so if you passed in a jwt, that's valid and it was able to read it and you know confirm that everything's okay Then it would print out your name And then for micronaut jwt security You need to enable it and then you provide a URL to the public please So you can verify the signatures of the jwt So that's a json web keyset jwks that contains the public keys that can be used to verify the signature of the tokens That you receive from the authorization server So those keys can be used locally to validate the jwts without making a call, you know to the server every time So very efficient So you can see this is a properties based version if you create a new micronaut app You'll actually get an application out yaml by default So, you know, obviously that would be much longer The reason I use properties here is much shorter and it fits on a slide So, you know, if you're not familiar with jwts, you know, you can see there's there's basically it's a long string With a couple dots in it The first section is the header the second section is the claims And then the final section is the signature and that's just a base 64 encoded string So if you unencode it, it's just json and then, you know, you can validate it using that signature And so to test it after you've built that api you can use httpi Which is one of the hardest things I've learned how to say I usually say like httpi or httpi Right, so um, it's a better curl. I suggest you install it works really nice. You can get it from httpi.org So you just install using like something like brew and then you can run http And to a url and it'll return, you know, a nice color coded view of that you can also use put, you know post And get as a default and it returns and sends, you know, json by default as its content type So works really nicely that way So to test this, you know, api that you've built with micronaut with httpi First of all, you'd start it with mn run That's the maven plugin that they use and then you hit the end point and it will return a 401 right because you're not logged in and then specify the token and then Specify the token when using httpi So that'll come back and print the user's name And you can see what it looks like in this screenshot there the 401 in the beginning And then specifying that token and getting that, you know passing it in with httpi So you might be wondering how do I get that access token? Well at the demo part, I'll show you but Long story short, it's oidcdbugger.com You can go there and set it up to actually get an access token from whatever authorization server you're using Whether it's octa os zero, maybe even keekpoke or spring authorization server. You should be able to use it with all of them So that's micronaut and then moving on to quarkis In this example, i'm using 292 And that's the latest version unless they released a new version this morning that i'm not aware of And they have basically a maven archetype that you can use so you start out with a group id artifact id Class name just for your your hello resource or you know, whatever you want the default endpoint to be And then you give it a path and then you specify the extension So if you don't specify any extensions you do get rest easy reactive, but you don't get small ride jwt So that's why i added both of them in here and then if you're more of a visual person They also have a browser based starting code at code dot quarkis dot i o So you can see there again you specify your group your artifact your build tool And your java versions and then you can select, you know the different extensions you want to use And so just like micronaut handful of imports, but you know the What do you call them annotations right are a little bit different So path which is standard from you know jacks rs And then get standard as well and then authenticated that is a quarkis annotation And then produces that text plane And then they have a security context that you can get the principle from and print out their name And so they actually use micro profile jwt security and so the long name is micro profile jwt r back security specification or mp dash jwt And so there's a link at the bottom if you want to read more about it But the interesting thing here is they specify you know a public key location and an issuer Right and those are the main like keys that you need to use and so the public key location again That's jwks and then the issuer I'm not sure what the relationship is between them as far as micro profiles concerned But I do like to do a little rant here because if you have that issuer And you go to it and you go to slash Or dot well known after the issuer Slash open id dash configuration the jwks uri is right there So you should only need an issuer. You should need both of them, right? It's kind of duplicate Maybe they're not looking up the jwks k us jwks uri They're just uh, you know having you specify it so they don't have to look it up But I think there's a better way spring security just requires an issuer. It doesn't require that jwks uri But maybe it's a performance optimization So then to test it with httpi same thing, you know You start with corkis dev and corkis dev is actually one of the coolest Like startup experiences or development experiences. I've seen because spring boot has like their dev tools But you have to recompile like the class is in order for it to you know re Initialize and restart and so if using eclipse you're used to that that's not a big deal You just save the class and it restarts, right? But if you're using like a telegeo you have to go and configure it to recompile to by default And so a little bit of work there, but with corkis like it picks up anytime you save a file and reloads the application And so that's a great developer experience You hit it with you know Http without an access token and it'll return a 401 you hit it with one and it doesn't so You know just to show you a visual of that again shows you the 401 Very uh concise on its response and then when you hit it with the token it comes back with your full email And so then getting started with spring boot you can use start dot spring dot i o And so they have their actual you know website at start dot spring dot i o that you can use But also you can use an api and hit it so that same website has a starter dot zip endpoint I think there's a tgz one as well so you could hit that one and get you know a tgz file But you specify the dependencies the package name You know the name of your app the type and the base directory and boom you got everything And then of course if you want to do it in a browser You can do that as well The thing I like about the browser base version is you can actually click on the explore button And you can see what the code looks like so that's a great way to compare like what you have with how they configure things there And you can also click the share button and actually send it to someone else And then they will get all the same settings. So that's pretty slick, but also with the htpia version you can do that too So if you look at the spring controller, it's the most concise right, but it's got the longest package name So they've also you know had a while to perfect things But it requires the least amount of code if you're just you know counting lines of code It's very simple with the rest controller and the get mapping there And then it just uses the regular java security principle and gets the name from that And then one thing the spring folks have suggested If using spring native and building girl vm images is to optimize tomcat for spring native So basically excluding the embed core and embed web socket and including the embed programmatic And so I think you know as spring spring boots three comes out and spring framework six This will likely go away, but there's probably tomcat optimizations that are being made that allows it to go away And so I used a lot to resource server when creating the app, but you can also use octa We have our own spring boot starter that you can use instead and our spring boot starter basically combines spring boot starter security spring security ought to client spring security ought to hosé and spring security ought to resource server So in this example, we're just using resource server But it requires a bit more configuration. The cool thing about our actual plugin is you only need the one line So you just specify the issuer and with the spring security ought to resource server That's all you need as well, but the properties are a little longer. So when we get to the demo I'll show you that part, but you know it works really nicely and In my time, you know developing like this sample one of the cool thing that's happened is as all of these frameworks Weren't as optimized as it could be. I think quark has some micronaut wear But spring security actually used that issuer and did a lookup of all the endpoints on start-up So in a serverless environment, you don't really want that right? You want things to start up super fast and maybe on the first request do that lookup And so they did actually change that based on you know the feedback that we found So testing it is the same started up with their plugin and then you hit that hello end point and then you pass in the token And the cool thing about spring security is look at those security headers, right? They're returning a ton even if you you know get a 401 They're doing all the content length and cash control and keep alive and you know setting cookies and all that So that's a lot more than you saw from the other frameworks And then also, you know hitting it with a bear token gives you a lot more Protection right like those are default like csp kind of things in there with the x content type options No sniff in the x frame options deny and all that And so now to look at the last one heledon, right? This is a a little latecomer to you know the field of all these frameworks It's it's mostly standards based just like porcus, right uses jacks rs and The micro profile standard when it can it's also from oracle So what I've seen is is there's a lot of people using it But I think there's probably a lot of customers from oracle that are using it more so than like the general open source community And so and they had a late start But to get started with heledon you can use their archetype You see that dash u is just to get the latest version and then the interactive mode to turn that off And then you just thus fine, you know the group ID the artifact ID the version and then you know other things for your actual application So one of the things that I've learned Is they do have a 3.0. That's I think m2 that's out, but it's java 17 and up So spring boot 3 will do something similar and I wouldn't be surprised if you know corkis might do that in their version 3 where you know You have to use java 17 as a baseline that makes it a lot nicer for the frameworks themselves To develop it because they can use a lot of the new features And so there's also a heledon cli That you can use and you can use heledon and knit to actually start your app up And then there's also a heledon dev command So it's similar to the other you know listening commands that will restart your app if you change anything So the heledon and knit looks like that and uh works pretty nicely I did notice uh just to warn you if use a archetype versus the cli they do produce Different like apps even though they should be the same. So I did uh let them know that but I don't think they fixed it Um, but then if you want to do an actual, you know rest endpoint You can import from their you know security packages and then the rest is jack's rs And then you specify the path to your resource You specify get and then you return the principle from that so the signature of that hello method looks very similar to corkis Um, I don't know if they had a context in there But then you know you get the name from that so a little bit different and then you also have to register that resource In a main hello application class or you can call whatever you want. It just needs to extend application You need to specify your login config there And then you need to specify application scope And so what I noticed when playing with the heledon three stuff is you don't need this class So they figured out, you know, how to optimize and and make sure that they registered automatically for you And you notice the other frameworks don't require any sort of registration either So then how do you configure security with heledon? Well, you need to go into source main resources meta imp and micro profile dash config dot properties And there's a dependency you'll need to add for jwt and then in that config file You'll need to specify the issuer in the public key location. And again, this is, you know, micro profiles jwt So they're the ones who specify, you know, these keys and make you specify the issuer and the public key location And then testing is a bit more difficult if you're not using the cli you do have to package first Right, there's no like plugin to actually start it up or anything like that So mvm package and then java dash jar and point to that target slash heledon dot jar And then hit it with htdpi and hit it with a token And so here's what it looks like pretty, you know, standard not a lot of security headers Like spring security, but you know, it works pretty nice and You know, as long as you've set everything up, you'll get a response back And so now the part that people are interested in right like what about the performance? So this is the performance check that I did on april 19th with micro knot 342 corkis 281 spring boot 266 and heledon 250 on my m1 max, right the new apple silicon So I ran it three times and I I took the last one So with micro knot I use the maven plugin with corkis I use their plugin and I wasn't actually packaging the jar and running them that way. So That was just that's the dev startup part is just doing it with maven And you can see there that micro knots starts up the fastest So if you're just doing day to day development, you know, you'll have that fast startup But then corkis, right? It always listens for changes. So it's really like a one-time thing The others have that listening ability as well depending on how you configure things And then if you package them and start it with java-jar You can see that micro knot is the fastest and and corkis is closely behind it So what about graphql apis, right? I show you how to create a rest api I used to recommend graphql speaker for spring boot But now they actually have Graphql support right in spring boot So the reason you might want to use graphql is because if you have, you know, a rest api At some point you probably are going to get into Your clients wanting to filter data or not return, you know, the bulk of data So when I worked at linkedin back in 2008 we struggled with this and we ended up using like query parameters Right in the rest api call to you know return a light view like the default was a light view And then you could get a heavy view And you know at some point they probably had a two-thirds view or something like that But graphql will allow you to just specify what you want when you make the call So it was invented at facebook and they have many different clients for you know their apis And so that's how it kind of came to be and it's one of those things that I've seen people like You know hate on until like their framework has support for it And then they're like wow, it's awesome. I love it And so of these frameworks who supports graphql or micronaut does you can find their guide at that URL corkis does with small ride graphql and then spring boot like I said just added spring graphql and so that was from the Graphql speaker project and speaker stands for graphql schema publisher and query resolver And then also helodon has support and I do like that helodon like You could tell it's kind of an oracle product because of the links and how they do their documentation I mean what a terrible link that is right? So you would think it would just be docs v2 like graphql or something but there you go So they all support it Works great And then if you wanted to use you know, you might have seen like how I did the oa stuff But you might want to know a bit more about that So, you know trying to understand oa if you actually look at it from A outsider's view it often feels like being trapped inside a maze of specs and Trying to find your way out before you can finally do what you actually set out to do build your application Right, you're like, which of these specs should I use and so that's why we actually started to develop OAuth 2 and or 2.1 the main goal with OAuth 2.1 is to capture the current best practices in OAuth 2.0 As well as its well established extensions under a single name So the major differences from 2.0 or pixie is required for all clients using the authorization code flow pixie stands for proof key for code exchange So this even means clients that might have a client secret and be confidential When we say confidential clients we mean like a spring boot client that runs on a server That your users can't access to right clients don't have access to it Like all the codes secure and running on the server versus public clients Which might be like a mobile phone right which you could probably jailbreak and get to the code if you really want it Redirect your eyes must be compared using exact string matches And so if you're familiar with key cloak, they allow wild cards actually octa recently added wild cards So if you want to be a lot 2.1 compliant You will delete that feature and not use wild cards And the whole reason for that is you just want to make everything more secure by specifying those You know fully redirect your eyes the implicit grant is omitted when OAuth 2, you know first came out browsers didn't actually support xhr and you know cores right cross origin resource sharing so Now they support it the implicit grant will have it so your access token is returned in the url We don't do that anymore because those might show up in server logs So and then the resource owner password credentials grant is omitted And so this was a way for old legacy clients like a windows 3.1 machine to actually send You know just a username and password to use OAuth and if you're sending a username and password like That's a whole point of a lot. So it seems kind of weird that they even had it in the first place But then you know, there's a couple other things on there So, you know, if you're doing something like this example and you're just doing a resource server Chances are you're doing, you know, OAuth 2.1 because you're not using anything like, you know implicit grant or password grant And so that's OAuth which is different from open id connect So OAuth is very much, you know for delegated authorization versus open id connect is for Authentication so you can actually know who the person is because with OAuth the access token can actually just be a random string of characters So there is no More information than that right if you were to you know, decode it you got a random string of characters There's there's nothing there. And so some people have started using, you know, JWTs for their access tokens There's a bit more information there, but if there's like identity information in there, then you're doing it wrong That's what id tokens and open id connector for so open id connect builds on top of OAuth It's, you know, just a thin layer for that authentication And all of the frameworks that I mentioned here do support open id connect authentication The thing I've noticed with helodon is I haven't been able to get it working yet But they do have a working example out there So I am working with them to make it work and I'll eventually, you know, put out an example to show you how to do that So you might be asking, you know, what about testing? My answer there is no one writes tests No, I'm just kidding So the cool thing is with the native stuff, they've really been pretty innovative, but they've also been blocked by things Makito, for instance Didn't work with spring native Up until recently, I think and I haven't tried it but That kind of, you know, if like in j hipster, we use makito everywhere So if makito didn't work then, you know, we weren't going to run tests with native But if you use spring boot and like generate, you know, everything and just, you know, run nvm package and dash p native What it'll do is actually create a native executable of your tests as well So with the new makito support, you could probably, you know, use that and it would all work great Porcus also has a really handy thing in that generated app that I showed you earlier They have a hello resource it and that actually extends the hello resource test that's there by default And it has a corcus integration test annotation on it and that's it. That's the whole class So what that allows you to do is in native mode actually run that same test. So Pretty cool how they've made it, you know, really easy And then as far as like testing rest api endpoints with like a principle or certain roles Spring security as one of the best testing frameworks I've seen for that So I think it can serve as a model for the others just because it's so full featured You can mock jwt's you can mock users and it all just works nicely So then if you wanted to build any of these with docker It's easy to just create a docker file And specify, you know from open jdk and specify where you created that jar at and then copy it in there expose 8080 And you know use java dash jar to start everything up And so that's your docker file and then to build it you just use docker build dash t And whatever tag name you want to give it and then you run it And so all that, you know, it's pretty nice if you're just using regular docker But people have kind of gotten away from docker files in the java community. Anyway, there's jib Which people are are fans of and there's maven and gradle plugins So the cool thing about those is they just read what's already in your palm dot xml or your build dot gradle file And then you can just use regular maven commands to do it I don't know if you can see my cat's tail here, but she's walking on my desk trying to block my screen I'm gonna have to kick you off kitty She's a sigmy so we'll we'll end our review there.  Bye Bye So use mvm verify to run all your tests, of course And then jib build and if you have a docker demon running and you want to you know publish it to that You can do it and it even allows you to actually publish straight to a docker registry And then you might be wondering well, what about these frameworks? Do they have anything, you know for jib or for docker built-in? So micronaut does support jib, but you must configure a plugin for it Quarkus generates four different docker related files So they have jv mo legacy jar and then native and native micro and the native micro is like How small can I be kind of thing and then quarkus plus jib you can add that extension if you want A spring boot has built-in docker support and they've done something pretty cool with What's it build packs? That'll allow you to layer everything so they have a layer of dependencies for your regular release dependencies They have a layer for snapshot dependencies They have resources for your static resources and then your application So what that allows you to do is basically build faster, right? So the first time it might take a while, but the second time it's much faster And then to build with heledon it generates Three docker related files. I got a typo in my slides there. I need to fix that So there's a docker file There's one for jlink and then there's one for girl vm and then heledon plus jib I couldn't find anything so if they actually support it. It's just not documented and I didn't try it But you know, maybe it works because jib is supposed to be smart like that and know what's in your You know palm dot xml or build dot gradle And then so if you want to go native with girl vm and micronaut you can use the micronaut cli You create the app just like we did earlier You can package it with native image so you don't have to add any extensions Just you know, it's going to happen there by default and then if using gradle You can use gradle native image or docker build native and that'll actually use docker to build it So you don't need girl vm locally to build it and what I've found is You know girl vm like builds take a while So if you're going to build it locally you might as well have girl vm installed because with like a spring boot app It takes like two minutes, right and one minute of that is a test So if you want to skip the test and you know, you can do it in one minute But then to do in docker, it's like six minutes So One minute versus six minutes. It's obvious which one's better If you want to use girl vm and corkis you would specify, you know When you're packaging it dash p native and if you want, you know without girl vm use that native container build equals true And that will you know use Docker as well and then build it with docker like that and run it So that's if you know if you just wanted to build it with girl vm You can use dash p native And then start dot spring dot. Oh, you do need spring native To add to your existing app So it's different from micronaut corkis where they have native built in and with spring boot You do need to go and get some plugins and profiles, you know from start dot spring dot. Oh So that's where that explore feature comes in handy where you can just go and grab those plugin configurations And then you'll need to add some milestone repositories to your pump And then you'll also need to add a spring native dependency But if you start that spring dot. Oh, it'll have it all in there And then you can build it using boot build image But that's you know to use the docker version like it is much better use the dash p native stuff And so we posted this video it's a recording of a live twitch stream We're in brian and i and josh long make octa spring boot starter work with spring native So this was around, you know, a similar time to me publishing the java native post so june of 2021 And as of spring or as of 211 the spring boot starter only required that you enable HTTPS for it to work with girl vm And unfortunately since then spring native 011 Broke our starter because environmental post processor implementations are not invoked at build time. So That's unfortunate, but you know, you can still use the regular spring oas support and that'll work just fine And then girl vm with heledon you can use docker build and use the docker file that native and run it they don't have jib support and As far as I can tell there's well, you can just do mvm package, you know dash p native as well And so then to compare the native startup time performance with heledon 42 seconds with micronut 29 you can see quarkus is at 19.2 And 61 for spring boot. So this was on an intel macbook pro. I think it was 2019 64 gigs of ram which doesn't really matter for startup time. The disc speed is more important But you can see quarkus wins But you know what I've noticed is every like month or two I will you know recompile these numbers and they all seem to Like go up a millisecond or two or down a millisecond or two. So there's there's not a lot of You know stability for each framework on how fast they start up but comparing them like this graph always looks the same Like no one's really getting faster or slower like by a big Wave between each release. So it's great to see the competition though And then if you were to look at memory used after five requests So just starting up the app and measuring memory is one thing, right? But but hitting it with some requests is another thing and so in the last year when I've updated, you know for different Versions what I found is sometimes like the memory just keeps climbing Right, like it's super low memory when you start out like 30 megs But then as you hit it with request it like adds 10 megs each time So I experienced that with heledon and I was like hey guys like I've even tested this and uh and since they've optimized it Fixed it right you can see it's the same as spring boot and uh mic are not pretty much there And then corkis is one of the best performing from a memory perspective And like I said, all these numbers are from a 2019 macbook pro And today I'm using an m1 max. So what I'd like to do is is pause for questions And then uh, I'll go ahead and do a quick demo Right. So there's a couple questions matt. I've been saving along the way here Uh a few minutes ago somebody asked about serialization. So we noticed that your your examples are just strings. They're just hello worlds Uh, which I love and all but uh, how about some jason? Is there anything special you need to do? No, they they've all like included jason by default. So, um, that should work just fine and You know, I think uh, if you have more complex Right json or jpa or something like that. It could uh, it could certainly throw a wrench into things, but you know, this is similar to there's like There's a major like Benchmarking site out there. I forget what's called tech meme or it can't be tech meme, right the cat's back Um, but basically, you know, it it shows you, you know, how fast various rest frameworks can be and uh And they just use strings right or barely anything at all. So I think you know, that's why I kind of followed the same path here Cool one more question. Um This was partially answered in the chat Where'd it go? Uh, so how adaptive are these frameworks with the latest additions to uh, the jdk like virtual threads and structured concurrency So those the that's some of the new fun. That's coming out. Have you tried any of this with? Sort of the newer newer jvms So the virtual thread thing is from loom, right and loom You know promises to make it so we can have you know instead of 10,000 threads You can have 100,000 or a million threads or whatever, but yeah, you know, it's uh, it's funny because at first I thought you know loom is going to solve all our problems So we could issue spring mbc and we don't need like spring web flex or anything But the problem is you run into the same issue that spring web flux ran into and they came out is what about your database drivers Right. So if you have any sort of connectivity in your app That needs to be non-blocking too Right.  It's just at your database now instead of at your rest api So I do think for the most part unless you're doing threading code right now It doesn't really affect most of us that do java using frameworks I think the frameworks themselves will leverage it and then we can do that right, but this is just a preview in java 19 So it's probably not going to release till the next lts 21 And then the frameworks aren't going to adopt it for a couple more years, right So like we're a long ways off from seeing it I think in our frameworks and now in our apps And hopefully because of it there will be more Like reactive database drivers right database drivers that are non-blocking But the whole reactive, you know thing with the non-blocking Really is going to help loom more than hurt it like looms not going to replace it They're actually going to leverage a lot of the reactive stuff that's already been built Awesome. So I think those are the big questions if I miss something ask it again, please I'll apologize now in advance, but I think I've asked all the questions So take away the demo Let me try to uh turn my mirroring on Oh boy Close that one down. So here we got the uh the demo steps, and I'm not going to do all these I just wanted to show you that they're here in case you want to do them all yourself and compare them Also, you'll start with generating or installing sdk man with java 17 And then you'll generate a no to access token So we have the octa cli that allows you to easily do that and set up an account with octa And then you can create a spa and set up an oidc debugger app That'll give you a client id that then you can use on the open idc debugger website So if I was to go here, it's already, you know, remember is my information from last time And so I can just scroll down to the bottom And you know Click code there click use pixie and make sure and specify this token uri and then click send request And this will do the pixie dance once i'm logged in here And then it'll give me an access token. So I got this access token here and so if i'm to go to dev Octa where I keep everything native java examples What I do in that demo is I I create everything from scratch, but they're already created here So if i'm to open this up in intelligent You see all the code Hopefully there's not too much indexing What is the problem with intelligent you're like stop indexing I just want to do a demo So the first one is micronaut right if we were to go and look at the source code for that You can see that the controller Is just like the one I created You know 20 lines of code or so and if we were to open up a terminal here And cd into micronaut I've already built it right because you don't want to wait for me to build it with growlvm So if I do target, you know app It'll start up and if we were to look at you know the resources Like I said, I used a property sponsored of yaml file, but if you used to use yaml You know, you'll enable security you'll specify the issuer there for claims validation and then that jwks uri And this is something that's in there by default. So really you're just adding like this information And then you know it started up in 282 And what I found is that varies right now we got 20 milliseconds 18 milliseconds 16 milliseconds 17 An interesting thing is recording this like with stream yard Does make a huge impact on the intel macbook pro that I have but on the m1 max It doesn't seem to as much at all. So that's pretty slick. So if we were to go back here We could specify our token and then we could hit that endpoint And it's all working right so that's that's micronaut there and then if we wanted to you know test the memory I have a shortcut for that. So functions memory is what I call it. You can see what it looks like there. So if I did memory And uh app is the name of it. You can see there 59 mics, right? So similar to what I had in my diagram And then if we were to Look at the next one corkis Right close that one down a low resource Same code as I showed before application dot properties There's the micro profile JWT stuff We're going to corkis and the file name for this is corkis 1.0 snapshot runner So kind of hard to see here with the cat in my way Uh 51 milliseconds there 11 millisecond 12 millisecond So faster than micronaut and then if we wanted to test it out back here Use that access token and then you'll see it's all working and then if we wanted to do memory Runner whatever the executable is you'll see, you know, 46 megs if we hit it a couple more times that could climb try it 47 so not much right that's pretty uh pretty good for corkis and then spring boot target demo That's up in uh 41 milliseconds try a couple more times 35 41 Uh, it does do like 60 milliseconds on the intel so you can see it's almost twice as fast on m1 max there And then if we wanted to test it out Make sure it works If we wanted to do a memory on demo If we were at 77 megs hit it a couple more times And stays at 77 so once it gets to a certain point it just kind of stays there I did notice the memory goes up like 25 on the m1 versus the startup time goes down by like half And then if we were to go to helodon and target helodon This one, uh, you can see the logging right like they're hiding everything Uh, the others do a little bit better logging. You have to find it out here. So 145 milliseconds 34 milliseconds 21 I'm going down a lot 22 At 22 so that's pretty slick and then make sure it works with htp pie And then memory and this one's called helodon You can see that said 80 megs if we hit it a couple more times. Let's see if it climbs 83 so not much But uh, but yeah, that works pretty nice. Let me make sure I got all my steps Yep So that was just you know a quick demo to show you you know the uh How they all work and you're welcomed, you know clone that repo yourself and uh, try it out So I do like to talk about the community for each of these. Let me uh admire here So I have my speaker notes, uh, but mostly in my speaker notes is the 1.0 release of these various frameworks So, you know, this section also is mostly pretty graphs And so I do get some plaque from people because they're like those graphs don't mean anything And that is true in some senses, but in some senses they do mean something So I'll try to explain what I think each of them mean as we go along But I want to point out release dates right spring boot 1.0 April 1st 2014 so in the u.s. That's april fool's day. I'm not sure if that's everywhere in the world But you know, that's a bold move. I think gmail was released on april fool's day as well, but 2014 spring cloud was released in 2015 that kind of kicked off microservices and java as far as I'm concerned But the next release of a major framework didn't come out until micronaut 1.0 in october 2018 so that was a full four years later and then quarkus didn't come out till november 2019 and heledon was that same year february 2019 so, you know, basically like spring boot had a pretty good head start Micronaut had, you know a year head start before everyone else and then, you know, the late mover advantage That's what java has as well was, you know heledon and then quarkus And I think or I like to think that red hat and oracle Both have armies of developers that they could dedicate to working on heledon and quarkus I don't know if they do but I imagine they have that capability. So on to the community aspects stack overflow tags When I look at stack overflow tags, what I think is there's a lot of people using this framework And this goes back to the days when I did my java web frameworks comparison The wicket guys I used to have a slide. We didn't have stack overflow back in and right We had mailing lists. So I would do mailing list traffic and struts was the spring boot of this slide and the wicket folks in like 2004 or five were like It seems like most people have problems with struts and that's why the mailing list has so much traffic, right? It's not that they're popular that the community is huge Well, then two years later update the slides and it's wicket that has the most, you know traffic And I'm like, do you have the most problems and they're like, no, we have the biggest community So I do think it's a good sign of, you know, the biggest community So you can see that spring boot, you know early mover advantage They have the biggest community and everyone else like Even heledon like on stack overflow. I don't know if the questions are getting answered in oracle But they've had two more questions since I last updated this slide right before devox france april 19th So, you know, not a lot of action going on stack overflow for him And then github stars, right spring boots got the most and what I like to talk about here is I recorded these numbers in december 19th 2022 and since then a spring boot has gone up 3000 stars The next closest one is quarkus and they've only gone up 1100, right? So spring boot has like three times the growth that quarkus does Micronaut has only gone up 200 Heledon has gone up 200 as well So you can see that growth is certainly behind spring boot and if we look at the star growth, right? Like they are certainly Still trending up and to the right versus the other ones are trending up But they're flatter than spring boot is and then jobs on indeed is is kind of crazy, right? So this is just in the u.s As far as I know if there's another website, you know, you want to look up and compare you could certainly do that The search terms I use are just micronaut quarkus spring boot in quotes and then heledon And uh, yeah, there's a ton of people hiring for spring boot Micro profile if you actually search for micro profile, there's only six in the entire us So people aren't really hiring for that that much One thing I did notice that even since april 2019 Or not 2019 but 2022 of this year, you know, just a month and a week or two ago There's been a drop in the java jobs in general by 10 000 and even javascript, right? So there's 159 000 java jobs. There's 126 000 javascript jobs So we're beating them there and then the funny thing is kotlin has been steady. They only have 7 000 You know half of what spring boot is but just some interesting stats there Twitter followers you can see that most people follow spring boot and Since december 3rd of 2021 The people that have gone up the most is spring boot. They have 8100 new followers, you know in the last six months The next closest one is quarkus. They have 1900. So that's like forex the growth on twitter for spring boot And I just like to mention this site I don't think they've updated in a little while hop frameworks.com is a github score number of stars plus stack overflow score And so this has like you can see react and rubion rails and all that kind of thing in there But when they last updated it which I believe was q1 2021. So a year ago spring was number 10 And j hipster was number 26 and nothing else ranks I think that's mostly because you know micronaut like quarkus. They aren't really web frameworks or more API frameworks or rest frameworks, right? They do have the ability to do templating, but I just don't see people doing it a lot And so you might be asking well matt you're a hipster, you know, what about j hipster? Well spring boot we have support for that we've had 240 releases our latest version is 781 and uh, you know, it's used by 46 000 projects on github And we also have no j s and dot net core blueprints And there's even a helodom blueprint under construction, but we do have a micronaut blueprint And we do have a quarkus blueprint So you can see they've only had, you know, 18 releases So quite a few for micronaut there Uh, the reason for the micronaut one and all its success has been Because the people that work on the micronaut project actually contributed and helped out with it So that was awesome And then quarkus, uh, we still got some work to do there getting up to the latest quarkus release You see my slides not even up to date at 2.8 was the last time I updated it So I need to put 2.9 in there like using dev services adding reactive microservices So a little bit of work to do there And then if you're interested in j hipster a bit more, you know, check out my reactive java microservices post I also have one on micronaut just developing a monolith And then quarkus as well and showing how we built, you know, the oidc in there and how to use it with octa and keycloak And I mentioned the m1 max which I'm using today and this is from when I first, you know, got it and installed like a A version of grawl vm that worked on the m1 That wasn't fully released until the end of april actually after devox But what I noticed is still consistent and that is the startup times are twice as fast But the memory is a little bit higher. So I'm not sure why but uh, it is what it is So, you know, chances are that if you're running in production, you're probably not going to run on an m1 max That's a pretty expensive way to run your hardware, right? Probably do it on linux and I'm sure it'll be just fine I don't know if there's going to be that much of a difference So my thoughts on all the frameworks is basically quarkus provides the best devx That's because you know, all you got to do is save files and it restarts, you know, the server and what I've heard from Folks when I've shared this slide or shared these thoughts is like micronaut does that too And guess what I found a bug and so it does now But when I first, you know, published these slots, it didn't right and I think that was again an example of the maven plugin Not being as good as their gradle support And so the startup time memory usage, right? You can't argue that those are pretty impressive And then micronaut is easiest to use, right? I've experienced the least amount of problems with them Um, I have experienced some, you know, maven issues lately, but for the most part, you know When I first started with all of them, it just worked Spring boot is the strongest community ecosystem and growth the growth thing is something I only started tracking in the last six months But yeah, it's still growing like three or four times faster than the other frameworks And then helodon has some catching up to do I found a lot of performance issues memory issues when I first started and they've been quick to fix those And it's nice to see that, you know, the last time I started up there, what 22 milliseconds So, you know, it's right on par with micronaut there and spring six could be a game changer because they're rewriting spring framework As native, you know, or native capable just like the other frameworks and getting rid of a lot of refraction Adding ahead of time compiling so your build times might increase But your your run times will be super fast and I have played with the same example and just upgraded Like the top version number to three zero zero m three And everything works from a no-off perspective and a rest api perspective I didn't try the native stuff, but as far as I know, I saw that demoed at spring i o and the native Profile is in the parent palm So you just have to specify a dash p native and it should build and work So maybe that's an exercise for you to try today or maybe I'll do it and so If you're new to java I would say try spring boot because it has so much documentation And good stack overflow like question and answers and backwards compatibility They do a really good job of making it so it doesn't break, you know, things with major releases And if you're familiar with spring boot, you know, micronaut and corkis both have migration pass even Micronaut has the ability for you to use the same annotations that you're familiar with From spring. I'm not sure if corkis does but maybe but they've they've recognized that spring boot has a large community And hey, if we can get those folks over to our side, then you know, it's a good way to do it Testing is important invest early and often and you know quality is important You know take it seriously and design your ops with security in mind and you know Use open id connect if you can because friends don't let friends write authentication And so we have lots of tutorials on java spring boot micro services and j hipster on the octa developer blog And we have a few on corkis micronaut and helodon as well And you can see the tags there blog slash tag slash java. So that's all of our java posts Well, if you want to see corkis is you could just do tag slash corkis or tags slash, you know, micronaut And we are working on surfacing those tags So you'll see them in the posts and you can you know get to them all easier And then at octa dev there is our github twitter youtube and dev dot to handle And so I invite you to giddy up and use the source Check out, you know, this repository clone it all the instructions are in the readme to build it and test it And you could even do the the json stuff if you want to and see if you know those times are much different So thank you We'll certainly have some time for questions after this Keep in touch if you want to take a screenshot of my contact information there You can find me and the presentation. I actually uploaded to speaker deck this morning So you can see it there I originally had the one that I updated in april and I just replaced it with this one I'll fix that thing about the number of docker files for heledon and I'll reupload it later And then all the code that I write these days you can find a lot of it on octa dev So may the off be with you awesome Thanks matt So there's a couple comments in the chat at the end here. So from eric um Definitely wanted to point out that uh, the percentage of growth for for corkis It might might actually um be edging out over spring. So I think you know, watch out Maybe we're starting to see the elbow of the of the curve graph, right? right All right, and uh, so you said micronaut had support for um spring annotations I think yes, I believe so. Yep. So apparently corkis does too. So you were right As well as uh spring mvc Spring data gpa and spring cloud config. So thank you eric for chiming in Nice All right, so we have a couple more minutes. I know we're a little over time But uh, I don't know what time it is for where everyone is but it's still early for me So I've got all the time. So if anyone has some questions drop me the chat and uh, Otherwise we'll hang out for a minute here and then let you get back to your day Uh, douglas wants to know if you've tried something similar with vert x I have not but as far as I know like corkis and vert x are related Right, they're uh, like corkis might be based off vert x And so I like to think that what corkis is doing Vert x would be very similar But no, I haven't tried it All right, so we've got I've got a couple. Thanks you. Yes, eric eric points out that corkis sits on top of vert x Yeah, and I think you know vert x was was very popular and we did a few posts on it You know when we first started brian, I started here at octin 2017 and I think we had some early posts on it 2017 and 18 and it really didn't have like we track keywords right when we post blog posts and we track You know traffic on the blog posts and vert x was kind of similar to grails where It seems popular in the java community, but what we saw Was not a whole lot of interest like from people reading our blog versus like spring boot blows up But I realized that's a lot of my background too, right? I've been in the spring community for since 2004 And you know, I haven't been as involved in the other community. So I could be Related to that as well Awesome. Well, we've got a few other comments people are thanking you matt So I I definitely want to thank you for for your time and everyone who asked asked questions and Provided more information for us. That's awesome too. So thank you for for engaging with us and if you have any other questions matt you want to throw your uh Your contact info back up here and we'll we'll call it a day Yeah, I can do that Oh if I could find the right the right one to click on Maybe There we go. All right So if you have any questions reach out so our twitter handles are are under our faces anyway, but uh Let us know what you think if you have any questions security related Topics related java related just hit us up Yeah, and one thing I'd like to say is you know, this is an exciting time in java, right? Like it seemed like we had a couple years there where you know, things kind of stagnated and There's spring boot and not much else. There was verdicts and grails But like I said, they didn't really get a lot of traction when we talked about it And now, you know, all these frameworks are are kind of exciting and the fact that you know Brian and I have found some securely related issues in them with oauth is that is kind of, you know Exciting that they fixed them so fast, right? So we've had, you know, very good luck with that and I didn't show it But I will right now one of the things that we've added to the octa cli Is you can actually do like octa start micronaut And it'll actually create and configure a micronaut app for you. I've got too many apps there. So I'd have to delete one apps I gotta pick one to delete Who likes angular anyway? talk to apps All right. So while you're doing that Diego asked if anyone's found any issues with uh, post-wares client Uh, I found some issues with the corgis and the post-wares client related to connection management. Have you faced something similar? uh, I think I think that's a In general, it's a very difficult topic to To chat about just based on, you know, the architecture of your application versus other applications Um, or if there's something, you know, obviously there could be a bug somewhere in a framework But it could just be how you're running queries or or anything But if anyone has any comments or thoughts Um, definitely respond to the I can I can speak to what we've seen in j hipster Right because we've actually experienced like most of the issues we've seen in j hipster related to like corgis and post-gres or Or spring boot and reactive and stuff like that is uh is often like low level like liquid base Right like liquid base. We found that if it's uh, if it's doing reactive JDBC, which is r2 dbc with postgres or My sequel or mariah db It can't like send null values or something like that. You have to send blank strings instead So, you know, there's different nuances like that But we haven't actually seen anything with corgis and postgres and we do have, you know Jay hipster supports generating a postgres app, you know with corgis So i'm not sure but at the same time just to, you know Clarify like the blueprints that we have for corgis and micronaut for j hipster received a lot of love in 2021 Not so much love this year And so I think that's because the people that were working on them like maybe they got new jobs or you know We're no longer just in corgis or whatnot So personally for me that's something that I want to take on and make sure Those blueprints get updated and are using, you know, the latest versions because they did work great at one time Right, so we just got to keep them updated and they should work great in the future Awesome. Well, that was quick. I I should have known your demo here would have been would have been seconds, right, but uh So you were able to create it create an app with one command. That's pretty it's pretty slick right, so we have octa start micronaut corgis spring boot and helodon and if you were to go to HDTP s here github Octa samples that's where we keep them all so you could see the source code forum and they're basically They're very much, uh, you know based on the examples that I showed you today The micronaut helodon and spring boot ones do have oidc support so you can actually log into those ones The helodon one doesn't yet. It's just an api that you can hit with the jw2. So I'll be doing a post on a lot to support with all these frameworks And then I'll do another post on open id connect with all these frameworks as well. So look for that in the coming months awesome All right. Well, I think we're uh, I think we're at time, but I don't see any more questions So once again, thanks matt for doing this and uh, obviously we're glad you're You you no longer have cove it and you were still able to deliver this talk to you to everybody All right, and thank you everyone for taking the time today awesome everyone


Hello, everyone. Today I will introduce the future of virtualization and how virtualization technology sits in the cloud native infrastructure. So if you look back to 10 years or 15 years ago, when we talk about virtualization, it's all about server consolidation with legacy applications. It's also the driving force for early cloud. But now with the advancement of cloud native, people care more about how to build and run applications natively in cloud. For this goal, it actually requires lots of technologies, including orchestration, container, function and service, platform and service, infrastructure and service, et cetera. Among those technologies, if we look at the core of the cloud native infrastructure, virtualization technology can still play a critical role. For what? The best isolation and security. So if you look at the ecosystem, last year, Amazon introduced Firecracker, which is a lightweight KVM-based VMM for function and service. As we also know, the Cata container, it uses hardware virtualization technology for the speed of containers and security of virtual machine. So we must shift the virtualization technology to meet those new requirements in cloud native. In this slide, I actually gave some examples of the new requirements for this shift. For virtualization technology, it needs to be nitrate. Nitrate means small memory footprint, simplicity, and also small attacking surface. And also be fast to bring us bare metal experience at the high density for the best use of the computing resource. Quick startup for the agile lifecycle management. And of course, security. It's always the fundamental requirement in cloud. So the older virtualization technology has to change. We must change it from the sole consolidating purpose to any combination of those new cloud native requirements. A recent answer to this shift is Rust-VVM. This project actually comes out of Firecracker at CrossVM, but it goes much broader. The primary goal of Rust-VM is to now build custom VM easily. So you can consider it as a library or a label, a set of virtualization components. Anyone can pick and drag to build a custom hypervisor very quickly. On top of such a trusted base, then people can focus more on the differentiating features in their own usage. So the core philosophy of Rust-VM is a modular, as shown in this figure. So the blue counterbox are already in the upstream report. And the night blue counterboxes are still under development. Currently, it's selected based on the modern correlative requirements by just a starting point. There will be more features coming in the future. And here are some examples, including the device model, the memory abstraction, the virtual V host backend, and also the V file device pass-through. Currently, KVM is the only supported hypervisor, but people are also working to extend to support other hypervisors, such as HyperV. So this is a community work. And it came to life last December, currently with active developers from Alibaba, Amazon, Google, Intel, Red Hat, many companies. At the last, I would like to give an example how to use Rust-VM to build a modern cloud hypervisor. So here, when I say modern, it means the target is for the modern cloud applications on recent hardware. For example, we don't care about the legacy devices. So the only goal is to reduce the emulation complexity. That's provide a much smaller attacking surface compared to existing VMM, for example, QMU. Of course, you also need to provide the high performance as no latency. So look at this architecture. The core of the cloud hypervisor is based on the Rust-VM. It tries to use as much of the Rust-VM code as possible. In the same time, we also use the cloud hypervisor to develop and test new features which are still missing in the Rust-VM community. For example, live migration. And once those features are done, we will contribute back to the Rust-VM community very quickly. Cloud hypervisor also supports the third party components for the MOTDTK. So this project was released this May. And the current is still new, but there are lots of good progress also reflected in the Rust-VM community. So we welcome contributions to both projects, cloud hypervisor and also Rust-VM. And then this works together to make the virtualization technology still in the center of the cloud native infrastructure. Thank you very much.


So, I turn now to Marcus. We are up to you, Marcus. What would you say? Well, I think we've reached the point in the morning where everything has been said, but I haven't said it. When I received the invitation to participate in this panel, I eagerly accepted because it's a great honor. I looked at the composition of the panel. I saw that we had so much talent on macroeconomic and financial matters and I thought I would focus on effectively microeconomic issues as kind of a compliment. I think we are in the midst of a transformation of international trade and investment relations driven by the revival of industrial policy in the major economic centers. Compared with the previous international trade regime, this system will be more complex and considerably less transparent. It will be vulnerable to political capture by special interest groups. It will possibly be accompanied by overall reductions in economic efficiency and will give rise to international tensions. So, how did we get here? There are two principal drivers. The first which I hope, if not all, most of us could agree on is global warming and the need to adopt policies to internalize externalities that the market will not do on its own. The second is more controversial and that's the geopolitical justification. I think the best intellectual rationale for this was actually provided by Canadian Deputy Prime Minister and Finance Minister, Kristia Freeland. She argues that in essence during the Cold War the West got lucky. The Soviet Union self-isolated so the West was free to construct a liberal open order and there was no contradiction between engaging in trade and investment relations, everyone prospering together in military security. In contrast in the present, China has embraced the global economy and so this creates a tension between economic integration on the one hand and military security concerns on the other. That is the intellectual justification for what was called decoupling. President von der Leyen of the European Commission more politely called derisking, which you just referred to. In the case of the United States, these two concerns have been met by two sorts of policy thrusts. In the case of the geopolitical objectives, the concern centers on semiconductor chips. The two main policies have been the CHIPS Act of the United States and then a set of export controls aimed at restricting export of chips and manufacturing equipment to countries of concern, mainly China and Russia. In the case of climate change, the thrust has been through two big pieces of legislation, the Infrastructure Investment Jobs Act and the Inflation Reduction Act, often called IRA. And for these remarks I will focus on electric vehicles and batteries. In both cases the policies are complex, they're not entirely transparent, they make considerable demands on government competency and ability to implement effectively and they've caused heartburn in partner countries. The CHIPS Act allocates a bit over $50 billion for subsidies for production and our research and development over the next four years. It prioritizes supply chain security, that is to say chips currently made in Taiwan. It is open to both domestic and foreign firms and particularly interests of firms from Taiwan and Korea and it excludes China and Russia. And companies receiving that funding have to, I cannot build new capacity in China for 10 years. The export controls aim at deterring high end production in China, which means that the policy is dependent on third party cooperation. This is a case where the US government got lucky that the nature of the semiconductor industry is there are some choke points that require minimal cooperation from third parties in order to implement. But there's no guarantee that will be the case in the future with industries of very different industrial structure. Think for example, biotech. The US is not alone, Europe has its own CHIPS Act. Japan has adopted a similar set of reshoring or friend shoring incentives and for example is providing subsidies for an American firm Micron Technology to build a plant in Hiroshima. So while the US is leading the charge, it is not alone. In the climate change, again I'll just focus on electric vehicles because that's where a lot of the current trade action is. The US legislation creates consumer incentives. It builds out the charging infrastructure, encourages domestic production. But the way it did it had a strong domestic preferences, which caused problems with our partners. And one of the things you need to understand about this legislation is the IRA is a thousand pages long. The Congress didn't know every detail of what it was voting for when it enacted it. It has all sorts of unintended consequences. One of these was to make those consumer incentives apply to American-built automobiles but not ones from Korea or European Union. Who understandably got upset? Some enterprising bureaucrat at the Department of Treasury who probably deserved some sort of Nobel Prize in Applied Economics discovered that there was a provision written for trucks which are normally leased which if reinterpreted could be applied to cars and the Koreans and the Europeans could continue to export to the United States and get the consumer subsidies. Likewise, the legislation incentivizes use of non-Chinese minerals in the production of the batteries for those cars. And it's created because of our vision that essentially endorses production and free trade partners. It has created the strange phenomenon in Washington where Korean firms who build the batteries are lobbying the US government to conclude free trade agreements with Indonesia, Philippines, Argentina, and other potential sources of supply. It appears to be kind of a software patch so to speak and it wouldn't be surprising if the Congress went back and revisited some of these provisions if the Congress could actually act which given the dysfunction is an open question. Implementation is complex. It depends significantly on administrative regulations. It's not transparent. It is costly to remain informed and that non-transparency creates opportunities for political capture by special interest. Europe has its own CHIPS Act. It also has the carbon border adjustment mechanism or CBAM which is going to create problems as well. So more broadly the European Union is tackling these problems with an emphasis on taxes. The United States is emphasizing subsidies and tax provisions and there is a need to bring to reconcile these differing approaches to generally commonly shared goals. There is a real question to me whether the US government is currently constituted is up to the task of implementing a policy as complex as this one. And I heard that President Macron has closed ENA, the French School for Training Public Administrators. He might consider reopening it in the United States. Excellent conclusion if I may Marcus. To be frank, the name is different. I'm not sure that the education will be that different but we will see. So...