Enhance Your GKE Deployment with Improved Control Plane Connectivity and Isolation
2707
Of your peers have already read this article.
3:00 Minutes
The most insightful time you'll spend today!
Once upon a time, all Google Kubernetes Engine (GKE) clusters used public IP addressing for communication between nodes and the control plane. Subsequently, we heard your security concerns and introduced private clusters enabled by VPC peering.
To consolidate the connectivity types, starting in March 2022, we began using Google Cloud’s Private Service Connect (PSC) for new public clusters’ communication between the GKE cluster control plane and nodes, which has profound implications for how you can configure your GKE environment. Today, we’re presenting a new consistent PSC-based framework for GKE control plane connectivity from cluster nodes. Additionally, we’re excited to announce a new feature set which includes cluster isolation at the control plane and node pool levels to enable more scalable, secure — and cheaper! — GKE clusters.
New architecture
Starting with GKE version 1.23 and later, all new public clusters created on or after March 15th, 2022 began using Google Cloud’s PSC infrastructure to communicate between the GKE cluster control plane and nodes. PSC provides a consistent framework that helps connect different networks through a service networking approach, and allows service producers and consumers to communicate using private IP addresses internal to a VPC.
The biggest benefit of this change is to set the stage for using PSC-enabled features for GKE clusters.
The new set of cluster isolation capabilities we’re presenting here is part of the evolution to a more scalable and secure GKE cluster posture. Previously, private GKE clusters were enabled with VPC peering, introducing specific network architectures. With this feature set, you now have the ability to:
- Update the GKE cluster control plane to only allow access to a private endpoint
- Create or update a GKE cluster node pool with public or private nodes
- Enable or disable GKE cluster control plane access from Google-owned IPs.
In addition, the new PSC infrastructure can provide cost savings. Traditionally, control plane communication is treated as normal egress and is charged for public clusters as a normal public IP charge. This is also true if you’re running kubectl for provisioning or other operational reasons. With PSC infrastructure, we have eliminated the cost of communication between the control plane and your cluster nodes, resulting in one less network egress charge to worry about.
Now, let’s take a look at how this feature set enables these new capabilities.
Allow access to the control plane only via a private endpoint
Private cluster users have long had the ability to create the control plane with both public and private endpoints. We now extend the same flexibility to public GKE clusters based on PSC. With this, if you want private-only access to your GKE control plane but want all your node pools to be public, you can do so.
This model provides a tighter security posture for the control plane, while leaving you to choose what kind of cluster node you need, based on your deployment.
To enable access only to a private endpoint on the control plane, use the following gcloud command:
gcloud container clusters update CLUSTER_NAME \
--enable-private-endpoint
Allow toggling and mixed-mode clusters with public and private node pools
All cloud providers with managed Kubernetes offerings offer both public and private clusters. Whether a cluster is public or private is enforced at the cluster level, and cannot be changed once it is created. Now you have the ability to toggle a node pool to have private or public IP addressing.
You may also want a mix of private and public node pools. For example, you may be running a mix of workloads in your cluster in which some require internet access and some don’t. Instead of setting up NAT rules, you can deploy a workload on a node pool with public IP addressing to ensure that only such node pool deployments are publicly accessible.
To enable private-only IP addressing on existing node pools, use the following gcloud command:
gcloud container node-pools update POOL_NAME \
--cluster CLUSTER_NAME \
--enable-private-nodesTo enable private-only IP addressing at node pool creation time, use the following gcloud command:
gcloud container node-pools create POOL_NAME \
--cluster CLUSTER_NAME \
--enable-private-nodesConfigure access from Google Cloud
In some scenarios, users have identified workloads outside of their GKE cluster, for example, applications running in Cloud Run or any GCP VMs sourced with Google Cloud public IPs were allowed to reach the cluster control plane. To mitigate potential security concerns, we have introduced a feature that allows you to toggle access to your cluster control plane from such sources.
To remove access from Google Cloud public IPs to the control plane, use the following gcloud command:
gcloud container clusters update CLUSTER_NAME \
--no-enable-google-cloud-accessSimilarly, you can use this flag at cluster creation time.
Choose your private endpoint address
Many customers like to map IPs to a stack for easier troubleshooting and to track usage. For example — IP block x for Infrastructure, IP block y for Services, IP block z for the GKE control plane, etc. By default, the private IP address for the control plane in PSC-based GKE clusters comes from the node subnet. However, some customers treat node subnets as infrastructure and apply security policies against it. To differentiate between infrastructure and the GKE control plane, you can now create a new custom subnet and assign it to your cluster control plane.
gcloud container clusters create CLUSTER_NAME \
--private-endpoint-subnetwork=SUBNET_NAMEWhat can you do with this new GKE architecture?
With this new set of features, you can basically remove all public IP communication for your GKE clusters! This, in essence, means you can make your GKE clusters completely private.
You currently need to create the cluster as public to ensure that it uses PSC, but you can then update your cluster using gcloud with the --enable-private-endpoint flag, or the UI, to configure access via only a private endpoint on the control plane or create new private node pools.
Alternatively, you can control access at cluster creation time with the --master-authorized-networks and --no-enable-google-cloud-access flags to prevent access from public addressing to the control plane.
Furthermore, you can use the REST API or Terraform Providers to actually build a new PSC-based GKE cluster with the default (thus first) node pools to have private nodes. This can be done by setting the enablePrivateNodes field to true (instead of leveraging the public GKE cluster defaults and then updating afterwards, as currently required with gcloud and UI operations).
Lastly, the aforementioned features extend not only to Standard GKE clusters, but also to GKE Autopilot clusters.
When evaluating if you’re ready to move these PSC-based GKE cluster types to take advantage of private cluster isolation, keep in mind that the control plane’s private endpoint has the following limitations:
- Private addresses in URLs for new or existing webhooks that you configure are not supported. To mitigate this incompatibility and assign an internal IP address to the URL for webhooks, set up a webhook to a private address by URL, create a headless service without a selector and a corresponding endpoint for the required destination.
- The control plane private endpoint is not currently accessible from on-premises systems.
- The control plane private endpoint is not currently globally accessible: Client VMs from different regions than the cluster region cannot connect to the control plane’s private endpoint.
All public clusters on version 1.25 and later that are not yet PSC-based are currently being migrated to the new PSC infrastructure; therefore, your clusters might already be using PSC to communicate with the control plane.
To learn more about GKE clusters with PSC-based control plane communication, check out these references:
- GKE Concept page for public clusters with PSC
- How-to: Change Cluster Isolation page
- How-to: GKE node pool creation page with isolation feature flag
- How-to: Schedule Pods on GKE Autopilot private nodes
- gcloud reference to create a cluster with a custom private subnet
- Terraform Providers Google: release v4.45.0 page
- Google Cloud Private Services Connect page.
Here are the more specific features in the latest Terraform Provider, handy to integrate into your automation pipeline:
3788
Of your peers have already watched this video.
8:00 Minutes
The most insightful time you'll spend today!
Target Leverages Google Cloud to Create Market-defining Online Experience
In the hyper-competitive world of online retail sales, ease-of-use and transaction speed can make or break business outcomes. However, a few years ago US Retail giant Target was going through a period of uncertainty.
While the company had over 1800 stores across the US with an estimated 85% of US consumers shopping at a Target store and over 25 million people visiting the Target website or using its app each month, it was still losing ground.
In spite of having millions of loyal customers, the company was dangerously late on digital and its technology wasn’t keeping pace with unstable systems to boot. The company faced the twin challenges of trying to operate today’s business as efficiently as possible and creating tomorrow’s business as quickly as possible. On the one hand it needed productivity and stability and on the other it wanted speed and disruption. Not an easy task to accomplish.
That’s when Target decided to use Google Cloud to solve its challenges. See how Target leveraged Google Cloud to create a market-defining online experience that has made customers happier and more loyal.
Khan Academy’s Shortcut to Growth: The Trick Behind the Scenes
3585
Of your peers have already read this article.
4:15 Minutes
The most insightful time you'll spend today!
Based in Mountain View, California, Khan Academy is a not-for-profit that produces and posts a vast collection of free educational online videos about math and science topics ranging from algebra and trigonometry to biology and economics.
Millions of students, educators, and self-learners around the world watch the videos, both on the Khan Academy’s YouTube channel and on its hugely popular website (www.khanacademy.org), where students answer some 1.5 million practice questions per school day. The Khan Academy development team continually tweaks the site based on how visitors choose to learn.
Challenge
Khan Academy’s beginnings date back to 2004, when Sal Khan’s cousin asked him to remotely tutor her daughter in math. Khan was happy to help and more than qualified, given his three MIT degrees and his Harvard MBA.
As more relatives and friends asked Khan for tutoring assistance, he began videotaping short lessons and posting them to YouTube. His knack for distilling complex concepts into easy-to-follow tutorials helped the videos go viral.
Sal knew he needed to offload the technical and maintenance concerns so he could work on what was important. To grow, it was important for him to be able to stop worrying about things like deployment issues and running his own server.
Ben Kamens, lead developer for Khan Academy
Khan maintained a website for his growing video library for several years, but the platform experienced limitations as traffic increased.
At the same time, media attention was growing, and technology industry leaders, including Microsoft founder Bill Gates and Silicon Valley venture capitalist John Doerr, began lending their support and evangelizing Khan’s mission and work. It was at this point that Khan quit his job as a hedge fund analyst to devote his full-time attention to the site’s growing potential.
“With Google App Engine, we don’t need a system administrator or anyone dedicated to deploying our app, so 99 percent of our time is spent working on our application,” says Ben Kamens, lead developer, Khan Academy.
“Sal knew he needed to offload the technical and maintenance concerns so he could work on what was important, which was to make more videos for the Khan Academy library,” explains Ben Kamens, lead developer for Khan Academy. “To grow, it was important for him to be able to stop worrying about things like deployment issues and running his own server.”
Solution
Khan Academy chose App Engine as its hosting and application development platform because App Engine could easily house its growing collection of 2,000-plus videos, resolving the organization’s overall server and maintenance issues with a single solution.
Using App Engine freed the team to focus on the user experience and the array of content that makes the academy such a powerhouse.
“A lot of what the Khan Academy is about is collecting data on student behavior so we can teach them better,” Kamens says. “Did they use a hint? Have they watched the video before? That data is being stored on Google App Engine so we can figure out what the most effective videos are, or where students struggle the most.”
Khan Academy provides individual profiles to students so they can analyze their learning progress, which means the organization needs systems running in the background to collect and track of all this data. Because App Engine takes care of server support, Khan Academy’s five developers can spend almost all of their time improving site functionality.
“If we didn’t have Google App Engine, we’d be spending a lot more time figuring out server setup and working on routers,” Kamens says. “Our ability to focus on the actual product is the benefit of Google App Engine.”
With the App Engine dashboard, which provides information like response time, uptime, and error rates, the development team also has an easy way to watch over site performance. “It lets us see what the average response time is, so we can keep it really low,” Kamens explains.
Results
During the US school year, Khan Academy receives more than 3.8 million unique visits a month — all served through App Engine. To support this much traffic, a typical company would need an internal system administration staff.
“With Google App Engine, we don’t need a system administrator or anyone dedicated to deploying our app, so 99 percent of our time is spent working on our application,” explains Kamens. “Our application lives on Google App Engine, and we bank all of our scalability and traffic concerns on Google App Engine. Even huge traffic spikes from Sal’s media appearances don’t worry us since we know that Google App Engine will handle the spike.”
Kamens also likes the fact that he and his team can turn to the Google App Engine support team for assistance when they need it. He also finds helpful tips on the Google App Engine blog.
The Khan Academy staff has come to completely rely on App Engine. “We are constantly using more of Google App Engine’s capabilities and have been happy with the performance,” Kamens says. “It’s nice to have an easy deployment process since we deploy the site on average at least once a day, [and] sometimes up to nine or 10 times [a day].”
Contact Center AI (CCAI) with Agent Assist can Lower Opex and Handle 28% More Chats
4807
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
Contact Center AI (CCAI) brings Google’s innovation in conversational AI to solve the most challenging customer service needs while lowering operational costs. More than a thousand customers have deployed CCAI and are steadily turning it on to power their production contact centers.
Today, we’re excited to announce that we’ve made CCAI even stronger with Agent Assist for Chat, now in public preview.
Agent Assist provides your human agents with continuous support during their calls and now chats by identifying the customers’ intent and providing them with real-time recommendations such as articles and FAQs as well as responses to customer messages to more effectively resolve the conversation.
Customers using Agent Assist for Chat have been able to manage up to 28% more conversations concurrently, while also driving up customer satisfaction by 10%. Additionally, we’ve seen them respond up to 15% faster to chats, reducing chat abandonment rates and solving more customer problems.
Agent Assist provides two key components to help agents manage conversations better:
- Smart Reply provides response suggestions to agents so they can quickly and appropriately respond to customer messages. These suggestions can be taken from your top performing agents as well as modified even further to ensure suggestions properly reflect the tone and voice of your brand. Agent Assist learns when and what recommendations to make by building a custom model that’s trained on your (and only your) data.
- Knowledge Assist unlocks the power of your knowledge base to provide articles and FAQ suggestions to agents in real-time as the conversation progresses. When using Knowledge Assist, agents no longer need to make the customer wait while they navigate multiple applications and data to find the resolution to the customer’s issue — the answer is delivered right to them.
“We’ve been very impressed by the chat capabilities of Agent Assist,” said Chris Smith, Vice President of Digital Service at Optus, one of the largest telecommunications companies in Australia
Optus has been using CCAI Dialogflow CX to send queries to virtual agents and sees great potential to use Agent Assist to provide recommendations to their customer support representatives. They expect Agent Assist to help minimize repetitive tasks by providing response and typeahead suggestions, helping improve the efficiency of their agents and the quality and consistency of service they provide.
Another customer, LoveHolidays, is using Agent Assist to support their agents and customers in the travel industry.
“Agent Assist has been a beneficial aid to agents and our customers alike… It gives us the power to flex our contact center staff levels in hours not weeks,” said Eugene Neale, Director of CX Engineering & Business IT at LoveHolidays
Analysts say online chat is becoming one of the most popular ways to reach out to businesses for customer support. IDC research finds that single-function contact centers worldwide are increasingly rare — in 2020, although phone/voice is still responsible for most interactions (at around 18%); email is responsible for around 13% of interactions, and live chat (without automation) is responsible for around 8% of interactions, according to IDC, Toward the AI-Powered Contact Center, Doc # EUR147017320, December 2020.
Deploying CCAI with Agent Assist for Chat
As part of Google’s Contact Center AI suite, Agent Assist provides a seamless handoff from chats managed by your Dialogflow CX virtual agents. If a conversation or customer requires a live agent, Agent Assist will help your team pick it up quickly and drive it to a satisfying resolution.
Historically, when managers saw contact center volumes increase they had two choices: allow customers to wait longer to speak to someone (lowering customer satisfaction) or bring on more agents (increasing cost to serve). Deploying CCAI provides contact center leaders with a third choice: equip agents with tools like, Agent Assist for Chat, to efficiently manage customer interactions while maintaining high quality service.
Global CCAI partners support Agent Assist for Chat
Agent Assist for Chat is a set of public APIs that your engineering team can integrate directly into an agent desktop to control the agent experience from end-to-end. For a more out-of-the-box solution, we have partnered with LivePerson and 247.ai to build Agent Assist directly into their agent desktops.
“Integrating our Conversational Cloud directly with Agent Assist means agents can leverage cutting-edge productivity AI to build even further on the massive ROI of conversational commerce, from reduced agent effort and time-to-respond to increased customer satisfaction and revenue,” said Alex Spinelli, CTO of LivePerson.
More Agent Assist resources
To learn more, check out the Agent Assist webpage. Give Agent Assist a try by training a model and then testing it using the Agent Assist simulator.
Rubin Observatory Leverages Google Cloud to Power Astronomical Research
6068
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
This week, the Vera C. Rubin Observatory is launching the first preview of its new Rubin Science Platform (RSP) for an initial cohort of astronomers. The observatory, which is located in Chile but managed by the U.S. National Science Foundation’s NOIRLab in Tucson, AZ and SLAC in California, is jointly funded by the NSF and the U.S. Department of Energy. The platform provides an easy-to-use interface to store and analyze the massive datasets of the Legacy Survey of Space and Time (LSST), which will survey a third of the sky each night for ten years, detecting billions of stars and galaxies, and millions of supernovae, variable stars, and small bodies in our Solar System.
The LSST datasets are unprecedented in size and complexity, and will be far too large for scientists to download to their personal computers for analysis. Instead, scientists will use the RSP to process, query, visualize, and analyze the LSST data archives through a mixture of web portal, notebook, and other virtual data analysis services. An initial launch with simulated data, called Data Preview 0, builds on the Rubin Observatory’s three-year partnership with Google to develop an Interim Data Facility (IDF) on Google Cloud to prototype hosting of the massive LSST dataset. This agreement marks the first time a cloud-based data facility has been used for an astronomy application of this magnitude.
Bringing the stars to the cloud
For Data Preview 0, the IDF leverages Cloud Storage, Google Kubernetes Engine (GKE), and Compute Engine to provide the Rubin Observatory user community access to simulated LSST data in an early version of the RSP. The simulated data were developed over several years by the LSST Dark Energy Science Collaboration to imitate five years of an LSST-like survey over 300 square degrees of the sky (about 1,500 times the area of the moon). The resulting images are very realistic: they have the same instrumental characteristics, such as pixel size and sensitivity to photons, that are expected from the Rubin Observatory’s LSST Camera, and they were processed with an early version of the LSST Science Pipelines that will eventually be used to process LSST data. “This will be the first time that these workloads have ever been hosted in a cloud environment. Researchers will have an opportunity to explore an early version of this platform,” says Ranpal Gill, senior manager and head of communications at the Rubin Observatory.
Broadening access for more researchers
Over 200 scientists and students with Rubin Observatory data rights were selected to participate in Data Preview 0 from a pool of applicants that represents a wide range of demographic criteria, regions, and experience level. Participants will be supported with resources such as tutorials, seminars, communication channels, and networking opportunities—and they will be free to pursue their own science at their own pace using the data in the RSP.
“The revolutionary nature of the future LSST dataset requires a commensurately innovative system for data access and analysis paired with robust support for scientists,” says Melissa Graham, lead community scientist for the Rubin Observatory and research scientist in the astronomy department at the University of Washington. “I’m personally excited to enhance my own skills by using the RSP’s tools for big data analysis, while also helping others to learn and to pursue their LSST-related science goals during Data Preview 0.”
At the same time, the fact that the RSP is hosted in the cloud provides researchers at smaller institutions access to state-of-the-art astronomy infrastructure that is comparable to that of the largest national research centers.
The launch benefits the observatory too: the development team can learn what researchers are interested in while also testing and debugging the platform. Graham says that “the platform is still in active development so researchers using it will be able to follow along in the progress, and provide feedback on ways that we can optimize the development of the tools.”
Next steps
The LSST aims to begin the ten-year survey in 2023-24 and expects it to include 500 petabytes of data. Through the cloud, Google aims to help make this extraordinary project scalable and accessible to researchers everywhere. To learn more about Data Preview 0, watch this video.
Want to ramp up your own research in the cloud? We offer research credits to academics using Google Cloud for qualifying projects in eligible countries. You can find our application form on Google Cloud’s website or contact our sales team.
Google Cloud named a Leader in API Management Solutions in The Forrester Wave
DOWNLOAD RESEARCH REPORTS3539
Of your peers have already downloaded this article
10:00 Minutes
The most insightful time you'll spend today!
The right API strategy is a key element of your digital business success, so choosing the best API management solution is critical – but often challenging. Organizations like yours need to address a wide range of criteria to support an effective digital business strategy, and that requires a robust API management solution that not only meets your immediate needs, but also supports your future digital initiatives.
The Forrester Wave: API Management Solutions, Q3 2020, provides an analysis of the most significant vendors that make up the API management market and explains why Google Cloud’s Apigee API management platform is a Leader. In addition to being named a Leader, Google Cloud received the highest score possible in criteria such as market presence, product vision, and planned enhancements.
More Relevant Stories for Your Company
Streamlining Workflow Executions: Using Cloud Tasks in Google Cloud
Introduction In my previous post, I talked about how you can use a parent workflow to execute child workflows in parallel for faster overall processing time and easier detection of errors. Another useful pattern is to use a Cloud Tasks queue to create Workflows executions and that’s the topic of this
The Unintended Consequences of Scale
Cloud infrastructure offers so many advantages: on-demand scalability, built-in security, and a bevy of tooling to scale your business at the speed of the Internet. It enables companies to pursue “blitzscaling,” as Reid Hoffman calls it. Capital expenses that take years or decades to pay off are no longer required to
Building Globally Scalable Services with Istio and ASM
Building distributed applications is hard! Building globally scalable distributed applications is harder. Maintaining and growing these services as your business grows is even harder. Learn how to create a globally scalable platform for your business on Google Cloud using service meshes. See how to build a platform on Google Cloud
Four Simple Steps to SRE Implementation
A few months ago, we wrote about how the first step to implementing Site Reliability Engineering (SRE) in an organization is getting leadership on board. So, let’s assume that you’ve gone ahead and done that. Now what? What are some concrete steps you can take to get the SRE ball rolling?
