Authentication for your IBM Cloud Code Engine functions

Protect your Code Engine functions

How can we protect an API function implemented as IBM Cloud Code Engine function? This was one of the questions which I recently answered. When migrating from IBM Cloud Functions to Code Engine, this is a common question. Cloud Functions offer some basic security to protect against unauthorized calls. Code Engine and their functions differ in flexibility and hence you have to deal with authentication. Here is a simple solution.

Spreadsheets: How to excel with Db2 data

Generated chart in Excel file

Recently, I had to produce a spreadsheet from database data. One naive way is to export the data to a CSV file, then import the data from that file into the spreadsheet. Another option was to quickly script a small Python program that fetches the data and directly generates a Microsoft Excel file. As a bonus, I added even a line chart (as shown).

Thoughts on how to move from Cloud Functions to Code Engine

Moving code and containers

IBM Cloud Code Engine is a fully managed, serverless platform to (not only) run your containerized workloads. It has evolved a lot since March 2021, the time when I published the blog post Migrating Cloud Functions Code to Code Engine. In 2021, there were only Code Engine apps and jobs. Earlier this year, Code Engine added support for functions(Function-as-a-Service, FaaS). Thus, in this post I am going to take a fresh look at that topic and discuss the options on how to move from Cloud Functions to Code Engine. 

Tips and tricks for using IBM Cloud Code Engine functions

Utilize Code Engine runtime information

Over the past weeks, I started to use IBM Cloud Code Engine functions. Code Engine is IBM Cloud's fully managed, serverless platform to run containerized workloads. It offers apps, jobs, and most recently functions (Function-as-a-Service, Faas) as deployment model. The following tips and tricks help you in cutting down deployment cycles and in designing function-based APIs.

Simple installation: Python driver for IBM Db2 (finally) has wheel support

A quick post about a feature I have been asking for for several years: The Db2 driver for Python, ibm_db, has wheel support now. It means that the Python package distributes a pre-built binary with the Db2 driver (for many Python versions and most users). So far, in order to install the Db2 driver, you needed to have a build environment available. To create small container images, it required a multi-stage approach. Now, I can simply use a slim base image and install the Db2 driver.

If you have feedback, suggestions, or questions about this post, please reach out to me on Twitter (@data_henrik), Mastodon (@data_henrik@mastodon.social), or LinkedIn.

Blast from the past: Procfile for Python cloud apps

One of my first cloud apps

Recently, I tried out a feature of IBM Cloud Code Engine: Deploying my app directly from source code. It was a simple app, but it failed. I was stunned and investigated the problem. To my surprise, I could have known it because it was something from the past: A Procfile was needed.

Analyze your IBM Cloud access management setup

ER diagram for cloud security data

Recently, I looked into how to analyze the access management setup of my IBM Cloud account. I wanted to better understand what kind of access policies exist, what service instances are covered by rules and policies, etc. In the past, I have shared with you how to get insights into IBM Cloud account privileges or how to improve security by identifying inactive identities. This time, I looked across the existing APIs to obtain identity and access management (IAM) and resource data. I retrieved, then analyzed that security data. With these insights, it is possible to improve security for your IBM Cloud account and its resources.

Generate PowerPoint slides from your Db2 data with Python

Generated PowerPoint slide with Db2 data

How did you spend the holidays? I had some days off and then used the last day of vacation for some fun programming. Last year, I wanted to test the python-pptx package, but couldn't find time. So I used my "fun day" to generate / code up some PowerPoint slides. To make it more interesting, I added some charts from data retrieved from Db2 in my IBM Cloud account. Here is a quick recipe.

New IBM Cloud security features you should know

Custom role for operating Code Engine

Cybersecurity is always in a state of change. There are new security features and new attack methods - or was it the other way? Over the past months, several new security features were added to IBM Cloud. In this blog post, I want to quickly describe them and point you to IBM Cloud blog posts where I discuss them in greater detail.

Create a REST API with OpenAPI spec for your database objects

Swagger UI for my events API

Recently, I wanted to create REST API for data managed in a Db2 on Cloud database. It was needed for a chatbot project using Watson Assistant. After looking into my options, I settled on APIFlask. In this blog, I am going to share my experiences and some resources for creating a REST API with an OpenAPI specification for database objects.

Containerize your Db2 Python app

De-containerizing my stuff

By following my blog posts (here or at the IBM Cloud site)  or my code samples, you might know that many of my apps are coded in Python. Moreover, many projects involve IBM Db2 (see "How to connect from Python to Db2"). With Docker and other container technologies around and many projects involving Kubernetes / OpenShift or Knative / IBM Cloud Code Engine, the next question is how to containerize / dockerize your Db2 application written in Python. Well, here I share some of my experience...

On serverless data scraping, cloud object storage, MinIO and rclone

Building a data lake the serverless way

This fall, I started another side project. It involves mobility data and its analysis and visualization. As first step and still ongoing, I am building up a data lake (and maybe integrating it into a data fabric). For that, I regularly download data from various sources, then upload it to a Cloud Object Storage/S3 bucket. Once in cloud storage, I process it further, often involving tools like the MinIO client and rclone. Let me give you a quick overview and links to some more background reading...

Db2 on Cloud credentials and how to connect from your app

Over the past 12 months, Db2 on Cloud migrated instances to a new deployment model. It seems to be based on the IBM Cloud Databases model and resulted in a different structure for the service credentials. Previously, Db2 on Cloud instances were accessible on the typical ports 50000 and 50001. The JSON-based credentials object included ready-to-use connection URIs. Now, after the change, the VCAP object has more parts, but is missing the easy-to-use URIs. In the following, I am showing you how to consume the new credential structure in your app and to successfully connect to Db2 on Cloud.

How to connect from Python to Db2

One of the recurring questions I have seen is "how to connect from Python to Db2". I have blogged about Python and Db2 a couple times before. Recently, the question has been popping up again more frequently. From my view, the increased security with mandatory SSL/TLS encryption and the use of Python-based Jupyter notebooks for data science and AI / ML projects are the drivers behind that increase. Moreover, there is Db2 on-premises and the Db2 on Cloud / Db2 Warehouse on Cloud plus container-based offerings. Today, I am trying to sort this out and answer that question. Again.... :)

IBM Cloud: Send out alert emails using SMTP

Last year, I blogged about how to use Slack or email notifications for security IBM Cloud security issues. Now I added another code sample, showing how to send out notification emails using any SMTP server. The code is written in Python and Node.js and deployed as IBM Cloud Functions-based webhook. The core part in charge of connecting to an SMTP email server and sending the email is isolated as dedicated action. Thus, it is possible to use it on its own, e.g., to send out emails unrelated to the IBM Cloud Security & Compliance Center.

cron-like scheduling on IBM Cloud

cron-like scheduling

Some days ago I stumbled over my 2015 post "Bluemix: Simple cron-like service for my Python code". It is not just the name Bluemix which is dated. Since then, it has transformed into IBM Cloud Platform and has added serverless compute options like IBM Cloud Functions (OpenWhisk) and recently IBM Cloud Code Engine. Both of them support "eventing", event-based execution of code. And both support Python code as well as many other programming languages like Node.js, Go (Golang), PHP and more. So, what does it take to set up cron-like scheduling? Not much.

Cloud tutorial on serveless web app and eventing

A follow-up from my last post on Python decorators:

Solution architecture

Some years back, on IBM Cloud, we introduced an IBM Cloud solution tutorial for GitHub traffic analytics based on Cloud Foundry and IBM Cloud Functions. A Cloud Functions action is triggered daily to collect traffic data. The action stores the data in a Db2 database. Users can then analyse the data in a Python Flask app served by Cloud Foundry.

Today, that same solution scenario and app are still available, but they are served by IBM Cloud Code Engine. Code Engine is a fully managed, serverless platform that runs your containerized workloads, including web apps, microservices, event-driven functions or batch jobs. The slightly renamed tutorial — "Serverless web app and eventing for data retrieval and analytics" — demonstrates how the existing app can be containerized and both served as web app and and used to process the daily data collection event.

Continue reading the article on the IBM Cloud blog.

Pseudo-decorators for my Python Flask app

Secured Python Flask app on Code Engine

Recently, I migrated an existing Python app from a Cloud Foundry to an IBM Cloud Code Engine deployment. The Flask app uses decorators for the routes and for OIDC-based authentication. For usability, the app should start up even without anything configured yet and the OIDC decorators being invalid. It required to some IMHO tricky coding.

JWT token authentication in Db2 runtimes like Python or Node.js

Python script connecting to Db2 with JWT

Some weeks ago I discussed how to configure JWT-based token authentication in Db2. I set up Db2 to accept JWS identity tokens and then connected to my test database using the command line. But how do you connect from a programming language like Python or Node.js? Here is what I needed.

Some fun digging into IBM Cloud access policies

On IBM Cloud, I have an account with multiple other users. To organize teamwork, I followed best practices for organizing users, teams, applications and made use of the IBM Cloud IAM (Identity and Access Management) capabilities. 

With users, service IDs, access groups, and access policies in place, I wondered how to get insights into per-user privileges and the scope of service ID permissions. Sure, I could use the IBM Cloud console (UI) or the Command Line Interface (CLI), but why not test the API (Application Programming Interface) for some customized reporting? The script is available on GitHub.