For once, let’s start by putting ourselves in the shoes of tech event organizers. Like many other conferences this year, Snowcamp struggled to find sponsors. So first of all, a very warm thank you to those who stayed loyal.

It’s a real problem, and it has already led other conferences to be cancelled. These events are our best way to learn, share, challenge our points of view and broaden our horizons. Let’s hope it’s only temporary; in the meantime, we want to give our full support to the organizers, who do an amazing job, as volunteers!

Now on to our takeaways from a few of the talks we attended with Anaïs M. and Jérôme Tama.

Thursday kicks off with a technical dissection of the XZ Utils backdoor by Quentin Dunand and Wassim Ahmed-Belkacem. They walk us through, step by step, how the backdoor was put in place. The talk is lively, and the step-by-step explanation makes the engineering behind it very clear.

Next up is Jérôme Tama, who invites us to take (or retake) our… refactoring license! We discover how OpenRewrite works and how it lets you make large-scale code changes simply and automatically.

Loic Gudet then gives a live demo of a generative AI prototype themed around the “Paris 2024 Olympic Games”. Among other things, it’s a concrete way to show how user feedback is used to improve the answers, what it costs to maintain these AIs, and which tools are used to measure their effectiveness. An insightful talk to understand everything that goes into building a generative AI.

In the same slot, Paul Vulliemin and Mélissa Pinon share how they manage their teams’ development environments with a cloud solution, focusing on resource elasticity and fast onboarding for developers. After comparing the options they considered, they show us the one they picked, Coder, and how they rolled it out, with a demo of the tool’s features and its IDE integrations.

After these talks, it’s my turn to give my own talk, on SOPS, where I show how this tool can help you store your secrets securely in your Git repositories, even without access to an external Secret Manager or Vault.

After lunch, Léo Gatellier and 🚀 Tim Ghibaudo give us an unfiltered account of their 3 years spent maintaining their Kubernetes cluster: what worked well and what still needs improving. With the goal of making development teams autonomous, they explain how they automated recurring tasks with scripts, CLIs and/or APIs to reduce manual work, while still meeting the ops team’s security requirements. Léo and Tim also stress that the biggest change isn’t just technical but organizational, and therefore needs proper support to succeed.

In the same slot, Olivier Leplus and Yohan Lasorsa present more than 10 web features (with a soft spot for number 9 ¾), some of them available for years, little known and yet capable of making our lives easier. Whether it’s handling arrays or centering a div efficiently… this talk offers solutions to everyday problems.

To close the day, Anaïs M. takes the stage on a topic that is too rarely discussed, positive discrimination, sharing her own experiences and feelings and showing that although progress has been made, there is still a lot left to do!

These 2 days of conferences were a chance to discover new things but also to talk with many people, whether at the speakers’ dinner or over a coffee between talks. Thanks to everyone, attendees and speakers alike, for these great conversations!

We’d also like to thank Bruno Lavit for the wonderful photos he took during this edition. And finally, a big thank you to Onepoint for enabling us to share our experience at these events!

After our colleagues’ write-ups, here is ours on the Build & Deploy track of Devoxx France 2024.

And as every year, the least we can say is that there was plenty to choose from, with dozens of talks on how to package and deploy our applications! Without further ado, here are the topics in this category that stood out to @cfarges, @jtama and me.

GatewayAPI, 10 ans de maturation pour une nouvelle API Kubernetes (GatewayAPI, 10 years in the making for a new Kubernetes API)

This year, Kévin Davin came to talk to us about the Gateway API. <3

With quite a bit of hindsight, the verdict is clear: the Ingress resource is not enough. It takes on too many responsibilities, isn’t specific enough, leaves each implementation free to make different choices for the same problem (poor portability), and doesn’t provide enough features either.

The Gateway API is role-oriented, with several kinds:

• The GatewayClass:: For the provider, the one who knows the network
• The Gateway :: For the cluster operator, the one who knows the cluster 🤷
• The GRPCRoute / HTTPRoute:: For developers, the ones who know the applications.

Each person has their own skills, knowledge, responsibilities, and kind.

This API goes far enough to overlap significantly with some of the features offered by service meshes (including traffic splitting).

Replay

Multi Kubernetes, Multi Régions, Au-secours ! (Multi Kubernetes, Multi Region, Help!)

Through a REX (experience report) built around a fictional company, Aurélien Moreau and Nicolas Lavacry present the needs of their new company: CASDAL. It has 2 markets, one in the US and one in France. How do you host this application?

We then learn how to deploy a Kubernetes environment across several regions, and why several clusters are needed to keep latency low, since Kubernetes doesn’t like latency when a continent separates its nodes. Their flawlessly executed demo takes us behind the scenes and shows the tools and methods to guarantee quality of service, low latency and data integrity!

Replay

Notre dépendance à l’Open Source est effrayante. SLSA, SBOM et Sigstore à la rescousse (Our dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue)

This very interesting talk shows how much we rely on third-party software and dependencies in our applications, over which we have no control. Does that mean we should use them without checking their integrity, leaving room for a middleman to inject malicious code during a packaging step of our application?

Abdellfetah Sghiouar then presents tools we can rely on to guarantee the traceability of our applications, such as cosign to sign our images before deploying them to our cluster, or SBOMs to list every package used in our application.

Replay

Au cœur de la ruche eBPF! (Inside the eBPF hive!)

I had heard about eBPF several times without really knowing what it was. So this talk was an opportunity for me to dig into the subject! Although very technical, Mohammed Aboullaite clearly explained how a kernel module works and how eBPF has evolved. I don’t think I’ll be writing my own kernel module tomorrow, but I now better understand all the “hype” around it and the value eBPF brings by making it easier to distribute a new module, with native performance and the same level of security.

Replay

Le cauchemar des attaquants : une infrastructure sans secret (An attacker’s nightmare: a secretless infrastructure)

Thibault Lengagne shows us how to use Vault and Boundary to get rid of most passwords
in our environments while keeping a “Secure by design” approach and full traceability of every access to application components.

With a Zero-Credentials architecture, each user has a single password that gives access, through Boundary,
to our applications. Combining Boundary and Vault makes it possible to create temporary credentials and keep full traceability of access, from development environments all the way to production.

Thibault shows us an architecture and the best practices that go with these concepts. Through several short demos, we start wanting to roll this out in our own environments, especially as our teams keep growing.

No more endless password rotations: we have one access, and the rest is handled by the policies defined in our infrastructure’s source code.

Replay

Check-list ultime pour rendre vos app cloud native (The ultimate checklist to make your apps cloud native)

In this talk, Katia Himeur goes over the various contexts that may lead us to move our applications to the “cloud”.

She reminds us that the definition of “cloud” can vary widely depending on who you’re talking to. The complexity, the plethora of available solutions (over 2,000 tools in the CNCF landscape, for example) and the diversity of providers must all be taken into account in a cloud project, whether for a new application
or for migrating an existing one.

Part methodology, part experience report, Katia’s talk is a goldmine of information and inspiration on how to approach this kind of project.

The points she covers are as much about people as about technology, including team onboarding and change management. The main pain points of these projects are addressed: could this be the ultimate recipe?

Replay

Final words

Thanks to @onepoint for allowing us to take part in this special event every year!
Feel free to check out the other articles our colleagues published on the other tracks!

Read our full series of articles on Devoxx:

1. Intro
2. Frontend
3. Data/AI
4. Backend

We came (back) to DevoxxFR for this 11th edition, and there was plenty to choose from! With an average of 8 talks/tools-in-action running in parallel, there’s something for everyone! Which works out well: since we all have different preferences, we were able to cover a good number of talks across various topics: front-end, AI, CI/CD, Kubernetes…

When there’s too much to choose from in the same slot, you can always count on the Devoxx YouTube channel. Almost all the talks are already available as replays!

Out of everything we got to see, here is our top 5!

Top 5

1^st in our ❤️ “Alice au pays d’OpenTelemetry” (Alice in OpenTelemetry Land)

This is an experience report on setting up observability in a project made of several software components. After introducing the concepts of observability and OpenTelemetry, @jtama iteratively walks us through his experience and the obstacles he ran into while taming this “magic collector” to unify our logs, traces and metrics.

YouTube replay
Slides
CFP page

Comprendre et utiliser les modèles de langage d’IA (Understanding and using AI language models)

This 3-hour deep-dive session by Sébastien Collet introduces Machine Learning and Deep Learning models, how they work, their limits and how they have evolved in recent years.

It also focuses on predictive language models, which helps understand why models such as ChatGPT have the flaws that have been pointed out recently (hallucinations, toxicity…).

If you want a complete, accessible course for non-specialists, including a history of AI models, this talk is for you!

YouTube replay
Slides
GitHub repository
CFP page

Une Architecture GitOps from scratch : Gitlab, Ansible, Terraform, Kubernetes et AWS (A GitOps architecture from scratch: Gitlab, Ansible, Terraform, Kubernetes and AWS)

In this 3-hour deep-dive session, Loïc Ortola and Aurélien Moreau from Takima take us on a dive into setting up a Kubernetes cluster with Infrastructure as code.

Each tool is justified by the role it plays. The talk gradually builds up a complex, multi-cluster infrastructure, from provisioning the infrastructure all the way to continuous deployment of the applications, in a 100% GitOps approach.

YouTube replay
Gitlab repository
CFP page

Géopolitique de la data (The geopolitics of data)

In this 20-minute keynote, Benjamin Bayart, co-founder of La Quadrature du Net, uses various examples and plain-language explanations to describe what the geopolitics of data is and how European regulation on personal data protection has evolved.

He closes with the message that every software engineer is involved in the geopolitics of data.

YouTube replay
CFP page

Démystifions les composants internes de Kubernetes (Demystifying Kubernetes internals)

The goal of this talk is to show that Kubernetes isn’t an “automagic tool”, but that it relies on software components that are individually “simple” and that, put together, make Kubernetes robust.

Through a live demo, Denis Germain presents the various components that make up Kubernetes and what each one does, ending up with an application deployed on a “handmade” cluster!

If you want to know what’s behind a “kubectl apply -f mon-deploiement.yaml”, or understand how “etcd”, “api-server”, “controller-manager”, “scheduler”, “kubelet”, “containerd” or “CNI” work together, this talk is for you!

YouTube replay
Slides
GitHub repository with the demo
CFP page

SELECT ‘amazing_features’ FROM “postgresql”

In this Tools in action, Kevin Davin helps us (re)discover little-known or forgotten PostgreSQL features.

From performance to syntactic sugar and best practices, Kevin shows us the vast toolbox Postgres offers to help developers build faster, more maintainable applications.

He also points out a few bad practices that are nonetheless common when approaching this database as a newcomer.

Whether or not you use Postgres, this talk will show you its superpowers and make you want to give it a try.

YouTube replay
Slides
Gitlab repository
CFP page

Wrapping up

DevoxxFR is 3 days of talks: think of it as a marathon, not a sprint! Plan your schedule and keep some breaks to visit the many booths of the products and software we use every day (or that we got to discover), which are there to collect feedback and suggestions for improvement!

To make note-taking easier, we also built a small tool that automatically generates note templates from your favorites. The GitHub repository

Written by five of us, with the fabulous @cfrezier @cfarges @jtama and @florianallainmat!

We’d also like to say a big thank you to onepoint for organizing these 3 great days!

Thanks! 😊

I’m proud of myself, as I usually prefer being behind the camera. Being encouraged to share this experience report pushed me out of my comfort zone, and in the end, the key takeaway is that 45 minutes is both long and short :)

However, I still had the /var/lib/mysql folder, which seemed intact. So I made a tar.gz of the folder and copied it to my machine to see what I could do with it.

# create the tar.gz on the server
$ sudo tar -zcvf ~/mysql.tar.gz /var/lib/mysql
# copy it locally
$ scp pi:~mysql.tar.gz .

Once that was done, I used Docker and the mariadb image (version 10.3, the one running on my server, to avoid any incompatibility) to start a local mariadb instance with the data I had just recovered.

# Extract the tar.gz
$ tar -xzvf mysql.tar.gz
$ cd var/lib
# I'll need this folder later to retrieve my SQL dumps
$ mkdir backup

$ docker run --name restore_mariadb -v $(pwd)/data:/var/lib/mysql -v $(pwd):/backup -e MYSQL_ROOT_PASSWORD=root -d mariadb:10.3

The environment variable is required, otherwise the image won’t start, but keep in mind that you’ll have to use the password of your MySQL instance as it was on your server.

Once that’s done, just run the following command to connect to the container:

$ docker exec -it restore_mariadb bash
root@e11929a58f8b:/# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 10.3.23-MariaDB-1:10.3.23+maria~focal mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

And finally, we can run mysqldump and store the output in the /backup folder we also mounted, so we can restore the data once the database is up and running again.

mysqldump -u root -p mabase > /backup/mysql.sql

Hopefully this will be useful to others!

And if you don’t have a recent backup, go back up your data right now :)

The idea

Too much spam? Tired of handing out your email address to every service? Email aliases to the rescue!

Following an idea from Adrien Chinour, I decided to build my own small alias manager for my email addresses. The goal is to quickly generate aliases so you don’t have to give out your real email address when signing up on random websites. That way, if a site sends a bit too much email for your taste, if you no longer use the service, or if unsubscribing turns into an obstacle course, you just delete the alias, and no more unwanted email!

Since my domains are managed by Gandi, I looked into how to work with my email addresses and create aliases through their API.

As for the tech stack, I used Angular and Netlify serverless functions (in NodeJS) to handle the calls to the Gandi API.

The principle is very simple: you log in with a password, predefined in the environment variables of the Netlify serverless functions, you get a JWT signed with a secret known only to the serverless functions, and from then on you are considered authenticated. Since I don’t need to handle multiple users, this fits my use case.

Once authenticated, the serverless functions fetch the list of domains along with the mailboxes associated with them, and you land on the following screen, which lets you manage the aliases of each mailbox.

What’s next

In case other Gandi customers would like to use this project, I tried to integrate OAuth2 so that people could log in through Gandi. It also helped me better understand how OAuth2 works.

So I requested the creation of an application, which gave me an applicationId and an applicationSecret to set up authentication. To test this locally, I used an OAuth2 mock server built by AXA

Unfortunately, Gandi’s v5 API is still in beta and its authentication provider doesn’t yet allow access to domains and mailboxes. 😢

Until that becomes available, I’ve left my work on a dedicated branch.

I also added a one-click Netlify deploy button for anyone who wants to use this small project. You will still need to generate your own API key from your Gandi account settings and fill in a few environment variables, described below.

To generate the JWT secret, the following command can come in handy

cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1

The project’s source code is available on GitHub

I wanted to use FontAwesome without bundling the whole library, which is rather heavy.

So I looked for a way to include only the icons I actually use, and that’s how I ended up figuring out how to write a Jekyll plugin.

The documentation is quite thorough, which helped me get up to speed with Jekyll quickly.

Implementation

Since I only wanted to display icons, I went with 2 Tags, which let you define a tag and pass parameters to it.

I pass my first tag the type of icon I want (regular, solid or brand) and its name, and it generates the matching HTML^{note 1} markup for the icon. All that’s left is to fetch the icon’s SVG^{note 2} definition and include it in a namespace at the bottom of the HTML page.

To do this, I add the icons I use to the Jekyll page data, in a simple array.

The second tag is where I collect all the icons used on the page and fetch their SVG definitions.

I first wrote this plugin in the simplest possible way, using Jekyll’s _plugins directory. Once it worked, I wanted to turn it into a Gem published on RubyGems, so that it’s available to everyone, should it be useful to anyone :blush:.

Creating a Gem was fairly easy, as the Bundler guide is very detailed.

I tried to follow Ruby conventions as closely as possible, but since I’m not familiar with the language, I’m open to any feedback to improve the code!

I still need to test it more thoroughly and handle error cases, which are handled rather optimistically for now!

Usage

Here is how to use it:

To display an icon, use the following tag. The code below renders the Twitter icon.

{% fa_svg fab.fa-twitter %}

Here is the result:

{% fa_svg fab.fa-twitter %}

Then add the tag that generates the SVG sprite sheet somewhere shared by every page (usually a footer).

{% fa_svg_generate %}

Links

If you want to look at the code, it’s available in this repository.

To download the Gem, head over here!

I built this personal project to have a template ready whenever I write documents with LaTeX.

It also uses Travis CI to automatically build the PDF when a tag is pushed to the GitHub repository, and runs a basic spell check.

Visit the Ansible website

I built this personal project to get familiar with Ansible and be able to recreate an identical server without any human intervention.

Ansible seemed like an interesting choice because it doesn’t require installing an agent on the target server to deploy to it. Only Python is required, and most Linux servers, if not all of them, ship with Python out of the box. On top of that, playbooks (sets of instructions) are written in YAML, which is easy to read and write.

I tried to make the various playbooks as modular as possible, so that adding features stays simple.

This project lets you:

• Deploy a server and secure it with SSH keys, Fail2Ban and iptables.
• Deploy some of the applications I built during my studies (to try out several kinds of deployment, whether PHP or NodeJS applications)
• Set up monitoring with Monit
• Automatically configure a web server (Nginx) and request HTTPS certificates from Let’s Encrypt, renewals included.

The project isn’t finished yet: for instance, backing up and restoring the data of the installed applications still needs to be handled. You can contribute to the project here.

I built this bot to keep track of service interruptions on the Bordeaux tramway.

The information comes from the official Twitter accounts of TBM (the Bordeaux public transport network): the bot looks for keywords in their tweets to count the days without interruptions.

The project was built in Python by a team of three.

We worked with agile methods (SCRUM) to build a tool able to adapt to several RDBMSs.