{"action":"created","issue":{"url":"https://api.github.com/repos/opentable/hobknob/issues/154","repository_url":"https://api.github.com/repos/opentable/hobknob","labels_url":"https://api.github.com/repos/opentable/hobknob/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/opentable/hobknob/issues/154/comments","events_url":"https://api.github.com/repos/opentable/hobknob/issues/154/events","html_url":"https://github.com/opentable/hobknob/issues/154","id":150528517,"number":154,"title":"Feature Toggle API","user":{"login":"tombuildsstuff","id":666005,"avatar_url":"https://avatars.githubusercontent.com/u/666005?v=3","gravatar_id":"","url":"https://api.github.com/users/tombuildsstuff","html_url":"https://github.com/tombuildsstuff","followers_url":"https://api.github.com/users/tombuildsstuff/followers","following_url":"https://api.github.com/users/tombuildsstuff/following{/other_user}","gists_url":"https://api.github.com/users/tombuildsstuff/gists{/gist_id}","starred_url":"https://api.github.com/users/tombuildsstuff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tombuildsstuff/subscriptions","organizations_url":"https://api.github.com/users/tombuildsstuff/orgs","repos_url":"https://api.github.com/users/tombuildsstuff/repos","events_url":"https://api.github.com/users/tombuildsstuff/events{/privacy}","received_events_url":"https://api.github.com/users/tombuildsstuff/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-23T07:38:44Z","updated_at":"2016-05-19T09:47:21Z","closed_at":null,"body":"Discussed in #152 \r\n\r\nRather than making clients query directly to ETCD to get the status of a toggle - it'd be good to make them query via an API. There's several benefits to this:\r\n\r\n- Allows the option of some kind of security per request\r\n- The ETCD config is set inside of Hobknob - not per-app\r\n- ETCD can be secured via routing rules\r\n- It becomes easier to scale the application as required\r\n\r\nPersonally - I'd recommend that this is done as a separate deployable unit rather than putting it in the same application for the following reasons:\r\n\r\n- From a Scalability perspective:\r\n  - it makes life a lot simpler to scale the API as required - keeping only a single instance of the front-end app\r\n- From a Security/Ops perspective:\r\n - It's possible to lock the application down via Network rules - e.g.:\r\n   - ETCD becomes a Private resource (that only the API + front-end can access) - no longer accessible to teams\r\n   - The Front-End and API can become internal-only\r\n- From a Development perspective:\r\n  - If all endpoints in a given application have to be secured - it's very easy to use middleware to handle that for all scenarios - meaning human error/unsecured endpoints won't happen\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/opentable/hobknob/issues/comments/220277645","html_url":"https://github.com/opentable/hobknob/issues/154#issuecomment-220277645","issue_url":"https://api.github.com/repos/opentable/hobknob/issues/154","id":220277645,"user":{"login":"richardhopton","id":1157451,"avatar_url":"https://avatars.githubusercontent.com/u/1157451?v=3","gravatar_id":"","url":"https://api.github.com/users/richardhopton","html_url":"https://github.com/richardhopton","followers_url":"https://api.github.com/users/richardhopton/followers","following_url":"https://api.github.com/users/richardhopton/following{/other_user}","gists_url":"https://api.github.com/users/richardhopton/gists{/gist_id}","starred_url":"https://api.github.com/users/richardhopton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richardhopton/subscriptions","organizations_url":"https://api.github.com/users/richardhopton/orgs","repos_url":"https://api.github.com/users/richardhopton/repos","events_url":"https://api.github.com/users/richardhopton/events{/privacy}","received_events_url":"https://api.github.com/users/richardhopton/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T09:47:21Z","updated_at":"2016-05-19T09:47:21Z","body":"Agreed - We need to ensure we don't adversely affect performance by having the intermediary but in principle it's a great idea."}}