Go Engineering - Specification - Design Pattern
GoF 创建型模式 提供一种在创建对象的同时隐藏创建逻辑的方式，而不是直接使用 new 运算符直接实例化对象 单例模式 分为饿汉方式（包被加载时创建）和懒汉方式（第一次使用时创建） 饿汉方式1234567891011package hungertype singleton struct {}// 实例是在包被导入时被初始化的var ins *singleton = &singleton{}func GetIns() *singleton { return ins} 懒汉方式 非并发安全，需要加锁 1234567891011121314151617181920package singletonimport "sync"type singleton struct {}var ins *singletonvar lock sync.Mutexfunc GetIns() *singleton { if ins == nil { lock.Lock(...
Go Engineering - Specification - Design Method
Go 项目 Go 项目是一个偏工程化的概念，包含 Go 应用 Go 应用 代码结构按层拆分 最大的问题：相同功能可能在不同层被使用，而这些功能又分散在不同的层中，容易造成循环引用 12345678910├── controllers│ ├── billing│ ├── order│ └── user├── models│ ├── billing.go│ ├── order.go│ └── user.go└── views └── layouts 按功能拆分 Go 项目最常用的拆分方法 不同模块，功能单一，可以实现高内聚低耦合的设计哲学 所有功能只实现一遍，引用逻辑清晰，大大减少循环引用的概率 12345pkg├── billing├── order│ └── order.go└── user 代码规范编码规范 Uber Go 语言编码规范 静态代码检查工具：golangci-lint 最佳实践 Effective Go Go Code Review Comments Style guideline for Go packages 代码质量编写...
Cloud Native - Security & Compliance - OPA - Philosophy
Overview A policy is a set of rules that governs the behavior of a software service. Authorization is a special kind of policy. difference Authentication: how people or machines prove they are who they say they are. Authorization: which people or machines can run which actions on which resources. Authorization and more generally policy often utilize the results of authentication (the username, user attributes, groups, claims), but makes decisions based on far more information than just who the user is....
Cloud Native - Security & Compliance - OPA - Introduction
Overview The Open Policy Agent is an general-purpose policy engine that unifies policy enforcement across the stack. OPA provides a high-level declarative language that lets you specify policy as code and simple APIs to offload policy decision-making from your software. OPA decouples policy decision-making from policy enforcement. When your software needs to make policy decisions it queries OPA and supplies structured data (e.g., JSON) as input. OPA accepts arbitrary structured data as input. OPA gen...
Cloud Native - Security & Compliance - OPA - Glance
Overview Policy-based control for cloud native environments Flexible, fine-grained control for administrators across the stack Use OPA for a unified toolset and framework for policy across the cloud native stack. Decouple policy from the service’s code, so you can release, analyze, and review policies without sacrificing availability or performance. Declarative Policy Declarative Express policy in a high-level, declarative language that promotes safe, performant, fine-grained controls. DSL : Use a lan...
Go Engineering - Specification - Life Cycle
生命周期管理 研发模式瀑布模式 按照预先规划好的研发阶段来推进研发进度，串行执行（在每个阶段完美完成后，才会进入到下一阶段） 迭代模式 研发任务被切成一系列轮次，每一个轮次是一个迭代，每一次迭代都是从设计到实现的完整过程 不要求每个阶段的任务都做到最完美，先把主要功能搭建起来，然后再通过客户的反馈信息不断完善 缺点：比较专注于开发过程，很少从项目管理的视角去加速和优化项目开发过程 敏捷模式 将一个大的需求分成多个、可分阶段完成的小迭代，在开发过程中，软件一直处于可用状态！ 敏捷模式需要高频地开发、构建、测试、发布和部署，进而催生了 CICD 技术 CICD CICD 通过自动化的手段，快速执行代码检查、测试、构建、部署等任务，解决敏捷模式带来的弊端 CI：Continuous Integration 频繁地将开发者的代码合并到主干上 流程 开发人员完成代码开发，push 到 git 仓库 CI 工具对代码进行扫描、单元测试和构建，并将结果反馈给开发者 CI 通过后会将代码合并到主干 CI 可以让问题在开发阶段暴露，CI 执行很频繁，需要自动化工具支撑 CD：Continuous ...
Go Engineering - Specification - Workflow
集中式 在本地仓库的 master 分支开发，将修改后的代码 commit 到远程仓库，如有冲突先本地解决再提交 适合场景：团队人员少、开发不频繁、不需要同时维护多个版本的小项目 功能分支 12345678910# git checkout -b feature/rate-limiting# git add limit.go# git commit -m "add rate limiting"# git push origin feature/rate-limiting# Github: Compare & pull request -> Create pull request# Github: Code Review -> Merge pull request Merge PR Create a merge commit – 推荐 底层操作：git merge --no-ff With --no-ff, create a merge commit in all cases, even when the merge could instead be...
Go Engineering - Specification - Directory
平铺式 主要用在 Go 包（框架、库）中，相对来说比较简单，如 glog 12# lsLICENSE README.md glog.go glog_file.go glog_test.go go.mod 结构化 主要用在 Go 应用中，相对来说比较复杂，事实规范：project-layout 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485├── api│ ├── openapi│ └── swagger├── build│ ├── ci│ ├── docker│ │ ├── iam-apiserver│ │ ├── iam-authz-server│ │ └── iam-pump│ ├── package├── CHANGELOG├── cmd│ ├...
Infrastructure - Authentication - LDAP
What is LDAP 目录服务 目录 ≈ 树状结构的数据库 目录服务 ≈ 以树状结构的目录数据库为基础，外加各种访问协议的信息查询服务 目录数据库 vs 关系型数据库：读取性能极高，写入性能非常差（不支持事务），不适合频繁修改数据 用途：具有层次性且不需要频繁修改的数据，例如企业员工信息、企业设备信息等 LDAP DAP = Directory Access Protocol X.500 是一套目录服务的标准（协议族） 通过 X.500 可以将局部的目录服务连接起来，构建基于 Internet 的分布在全球的目录服务系统 DAP 是 X.500 的核心组成之一，但非常复杂，因此诞生了 LDAP LDAP 是基于 X.500 的 DAP 发展而来，目前是第 3 版 LDAP 特点 基于 TCP/IP 以树状结构存储数据 读取速度快，写入速度慢 服务端用于存放数据，客户端用于操作数据 跨平台，维护简单 支持 SSL/TLS 加密 协议是开放的 样例
Infrastructure - Authentication - Basic + JWT
HTTP Authentication Some common authentication schemes include: Basic Bearer The server responds to a client with a 401 (Unauthorized) response status and provides information on how to authorize with a WWW-Authenticate response header containing at least one challenge. A client that wants to authenticate itself with the server can then do so by including an Authorization request header with the credentials. Usually a client will present a password prompt to the user and will then issue the request inc...
