apollosolutions / build-a-supergraph

Tutorial series for building an Apollo federated supergraph using GCP or AWS

Build a Supergraph

This repository contains the demos for the "Build a Supergraph" series. All you need to follow along is:

• A Github account
• An Apollo GraphOS account (free!)
• An account for either:
  • Google Cloud Platform (GCP)
  • Amazon Web Services (AWS)

What you'll build

The ending Software Development Life Cycle (SLDC)

Contents

• ⏱ estimated time: 1 hour 15 minutes
• 💰 estimated cost: $10

Step 1: Setup

• Part A: Gather accounts and credentials
• Part B: Provision resources
• Part C: Deploy applications

Step 2: Managed federation

• Part A: Apollo Studio
• Part B: Publishing subgraphs
• Part C: Deploy Apollo Router

Step 3: Schema checks

• Part A: Schema checks on pull requests
• Part B: Demonstrate a schema change

Step 4: Observability

• Part A: Setup Open Telemetry
• Part B: Demonstrate traces and metrics

Step 5: Load testing

• Part A: Deploy load testing client
• Part B: Run load test and analyze results

Step 6: Cleanup

• Part A: Automated cleanup

🌟 Bonus 🌟 Step 7: Contracts

• Part A: Tag your subgraphs
• Part B: Create a contract variant
• Part C: Deploy a contract router

build-a-supergraph's Issues

[Enhancement]: Consider Creating/Isolating Various Environments in Separate, Ephemeral GCP `Projects`

As it stands, all infrastructure resources are created in the same GCP project--i.e., the one specified by the user in tfvars. This approach has several limitations, including:

• increased complexity re: managing concurrent deployments (network overlap, resource limits, etc).
• weirdness re: service/user account IAM permissions.
• fails to follow principle of least privilege.
• increased risk of affecting existing project resources
• decreased parity between environments.
• etc

As a matter of best practice, we should consider creating separate projects for each deployment permutation and/or environment therein. In other words, rather than all resources sharing the same account, we should consider adopting a scheme akin to the following:

Infra -> my-project-1-infra
Dev -> my-project-1-dev
Prod -> my-project-1-prod

This approach would mitigate many of the challenges noted above and better conform to generally accepted principals of what it means to have well-architected cloud resources.

01-Setup: GKE Cluster and kubectl

For future steps, we'll be utilizing kubectl/kubectx to work with the K8s cluster, and as such, need to configure these tools appropriately.

The current Terraform outputs kubeconfigs for each environment defined, however since these aren't put into the PATH by default, users would need to pass those in each time to use in commands. There are a few alternatives, however:

• Remove the kubeconfigs from the Terraform, and instead leverage gcloud container clusters get-credentials (similar to other K8s tutorials) to configure the tools via script (or otherwise)
• Append each file to a KUBECONFIG environment variable
• Require a --kubeconfig flag each time

For the most part, it appears the second option (environment variable) is preferable-

• https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#append-home-kube-config-to-your-kubeconfig-environment-variable
• https://stackoverflow.com/questions/46184125/how-to-merge-kubectl-config-file-with-kube-config

However for a simple tutorial, it may not be the best path.

This issue is to track feedback and identify a path forward.

terraform destroy errors on out

Intended outcome: to have all of the resources created by terraform be completely removed.

Actual outcome: Here is the output from terraform destroy

`module.gcp-network["dev"].module.vpc.google_compute_network.network: Still destroying... [id=projects/vanns-demo/global/networks/apollo-supergraph-k8s-dev, 10s elapsed]
╷
│ Error: Error waiting for Deleting Network: The network resource 'projects/vanns-demo/global/networks/apollo-supergraph-k8s-dev' is already being used by 'projects/vanns-demo/zones/us-east1-b/networkEndpointGroups/k8s1-ddb447c6-router-router-80-9f63cdd9'

│ Error: Error waiting for Deleting Network: The network resource 'projects/vanns-demo/global/networks/apollo-supergraph-k8s-prod' is already being used by 'projects/vanns-demo/zones/us-east1-b/networkEndpointGroups/k8s1-c2594fb3-router-router-80-85833c8e'
│ `

How to recreate: Follow the setup instructions until you run the checks demo. Then run terraform destroy