Sello is a fictious company that is running a SaaS platform for selling products.
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
deploy
docs
media
src
.gitattributes
.gitignore
LICENSE
README.md
appveyor.yml

README.md

Sello

Build status License

Sello is a fictious company that is running a SaaS platform for selling products.

Everything is deployed automatically through all stages by using Visual Studio Team Services Release Management.

Scenario

API Overview

Sello exposes all their APIs via API Management in order to decouple the physical API from the endpoints that their customers are using.

This also enables them to only expose the APIs that 3rd parties need and keep the management APIs internally.

In Azure API Management we have the following setup:

3rd Party Management Operations
Product Name Sello (Free & Premium) Sello - Management Sello - Operations
Published in Developer Portal
Subscription Required
Subscription Approval
Throttling , Product-level , only on health-endpoint
API(s)
  • Sello API
  • Sello API
  • Sello Management API
  • Sello Operations API

These will communicate with the physical API that is hosted in an Azure Web App.

🚨 Security
For the sake of the demo there are some gaps in API security:
  • Physical API has no authentication and authorization
  • Physical API is publically reachable
  • No security between Azure API Management & the physical API
This is not safe for production workloads and thus not recommended.

You can find the details of the setup here.

Automating Azure API Management

We are currently automatically importing the Swagger specification for both the public & management API.

This can be achieved as following:

Import-AzureRmApiManagementSwaggerDefinition.ps1 -apiManagementInstanceName "<instance-name>" -resourceGroupName "<resource-group-name>" -swaggerDefinitionPath "<swagger-definition-path>" -apiId "<api-management-api-id>" -apiUrlSuffix "<logical-api-suffix>" -apiUrl "<url-physical-api>" -apiDefaultName "<default-api-name-in-swagger-definition>" -apiName "<desired-logical-api-name>"

Policies can be applied to both products and operations. Here is how you automatically apply policies on a product-level:

Set-AzureRmApiManagementPolicy.ps1 -apiManagementInstanceName "<instance-name>" -resourceGroupName "<resource-group-name>" -policyDefinitionPath "<policy-definition-path>" -policyType "product" -productId "<api-management-product-id>"

Simulating failures

For the sake of the demo you can simulate API failures by unleashing the chaos monkeys.

This can be achieved via:

  • Configuring the Demo.UnleashChaosMonkey application setting to true on the API
  • Sending the X-Inject-Chaos-Monkey custom header with a bogus value

This will result in operations throwing exceptions and the health endpoint to fail

License Information

This is licensed under The MIT License (MIT). Which means that you can use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the web application. But you always need to state that Codit is the original author of this web application.