Google Cloud Offering a Natural Migration Path for Developers Accustomed to Heroku
2786
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
Modern developers worldwide have grown accustomed to the comfort of writing code, pushing to a remote Git repository and having that code be deployed at an accessible URL without having to worry about how it is deployed. This was a workflow popularized by Heroku years ago which brought joy and productivity to developers even if it did impose some loss of flexibility for operation teams.
To address that loss of flexibility when meeting security and integration requirements, Heroku introduced Private Spaces. Private Spaces provide network isolation from the internet since any application or datastore provisioned by Heroku is accessible to the internet by default.
Cloud Run is quickly becoming the “swiss army knife” of serverless here at Google Cloud and it’s a natural migration path for developers accustomed to Heroku. The fundamentals are all there:
- Continuously Deploy via Git push using open source Buildpacks or Dockerfiles
- Set CPU and Memory requirements for each instance
- Horizontally scalable apps that scale from zero to thousands of instances to meet traffic demands automatically
So while devs are kept happy, can Cloud Run do something for the Ops folks? Yes. Here are some things available right in the Cloud Run UI:
- Proper Secret Management with IAM based access control. No more setting secrets as environment variables.
- Traffic management between different revisions for blue-green or canary deployments.
- Define SLIs and SLOs with ease. Eg: 90% of requests have to be served under 200ms in a calendar month.
- Secure your service with tools such as Software Delivery Shield, Binary Authorization, and Cloud Armor. Definitely deserves its own blog post.
Recreating Private Spaces on Cloud Run
Let’s focus on network isolation now, let’s say you have an internet-facing app and a private backend API that talks to a private database. Simplest architecture ever, it conceptually looks a bit like this:
Let’s address the database first. If you want to use Postgres then Cloud SQL is most likely what you want, but do keep in mind that we have other datastores that speak Postgres such as AlloyDB and Spanner.
Cloud SQL allows you to create a Postgres instance that’s isolated from the internet by simply unchecking the Public IP checkbox and checking the Private IP checkbox. This will assign an IP address to your Postgres instance on your project’s network.
Once the DB is provisioned you’ll see the IP clearly listed, such as:
Of course there’s so much more to say about CloudSQL, to learn more please take a look at our documentation.
Ok now that you’ve dealt with Postgres, let’s address the private backend API on Cloud Run.
When creating a new Cloud Run service via the Google Cloud Console, Ingress can be limited to “Internal traffic only” so only traffic from internal sources, including your VPC, can access the service. In other words, the internet can not touch it.
As an additional level of security, it’s also possible to enforce that only requests from authorized users be served, In this case a “user” is most likely another service using its associated service account which will need the “roles/run.invoker” in order to call this service.
Now let’s make sure that our Backend API Service can reach the Postgres instance by configuring a VPC Connector. This will allow Cloud Run services to reach into the VPC and therefore, the internal IP for the Postgres instance.
Once the VPC Connector is created, you can associate it with a Cloud Run service.
Then it’s just a matter of configuring your code to use the Postgres instance’s private IP address. A good 12-Factor app friendly spot to do that is with a connection string in an environment variable as part of the Cloud Run service configuration. Better yet, as this may contain a DB password, you can use Secret Manager to mount this environment variable from an encrypted and protected secret.
Finally, let’s now set up that Front End Cloud Run service which will respond to requests from the internet, and securely communicate with the backend API service.
For the frontend service choose to “Allow all traffic” and also “Allow unauthenticated invocations” so anyone on the web can access our URL. We could of course choose the middle option and use Cloud Load Balancing in conjunction with Cloud Armor which provides defenses against DDoS and application attacks, and offers a rich set of WAF rules. However, let’s keep it simple for now.
Keep in mind that our Backend service will only accept requests from within our VPC network, and that we don’t have a private IP address for Cloud Run.
So let’s ensure that all egresses from our Frontend actually get routed to the VPC Connector, this way when our Frontend calls a Backend API via it’s URL endpoint, the Backend will receive the request from within the VPC and allow it in.
PS: If your Backend requires authentication don’t forget to create a Service Account for your Frontend Service and then give it the necessary role following a service-to-service auth pattern.
And that’s it. You now have an operationally acceptable private space like environment with an app composed of two Cloud Run services where the Backend service and Postgres instance are network isolated from the Internet. If after reading this blog you would like to get hands-on experience with the technologies mentioned above, then take a look at Google Cloud Skills Boost. There you will find learning paths, quests, and labs curated to boost your cloud skills in a particular area.
For example here’s a great lab that takes you through developing a REST API on Cloud Run using Go.
6890
Of your peers have already watched this video.
14:21 Minutes
The most insightful time you'll spend today!
How Anthos Helps Organizations Implement Multi and Hybrid Cloud Strategy
Organizations have become increasingly focused on using modernization solutions to build competitive advantage, for faster time to market, serve customers better and seamlessly operate in hybrid and multi-cloud environments. Anthos by Google Cloud, a managed application platform plays an important role in application modernization and also in empowering customers to deploy a hybrid or multi-cloud strategy with opensource technologies and platforms like Kubernetes.
Watch the video to refer to the real use-cases of Anthos for application modernization and hybrid/multi cloud deployment across retail, digital natives, banking and manufacturing space.
Also, explore the latest tool, Migrate for Anthos if you are a traditional enterprise looking to skip rewriting of applications and lift-and-shift process!
2022’s First Cloud CISO Perspectives: Recap of the Megatrends, Releases and News
9360
Of your peers have already read this article.
3:00 Minutes
The most insightful time you'll spend today!
I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance.
Cloud Security Megatrends
We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:
- Economy of scale: Decreasing the marginal cost of security raises the baseline level of security.
- Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
- Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation.
- Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
- Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
- Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
- Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically.
- Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.
If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future.
U.S. Federal government cybersecurity momentum
- Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.
- OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation.
Google Cybersecurity Action Team Highlights
Here are the latest updates, products, services and resources across our security teams this month:
Security
- Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
- Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services.
- Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work, where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
- Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
- DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
- Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.
Risk & Compliance
- Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.
- TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence. - Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.
Controls and Products
- Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS).
Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.
5630
Of your peers have already downloaded this article
1:30 Minutes
The most insightful time you'll spend today!
Even before the current crisis, IT organizations saw pressure to be more agile and innovative. Customer demographics and expectations are changing. Competition is emerging faster and from unexpected sources. Business models are being reinvented. Digital technology was at the heart of many of these challenges, and its adoption was key to every company’s response.
As a result, CIOs face a series of urgent challenges:
- How can they raise system visibility and system control over operations that are more dispersed and changing than ever?
- How can they cut costs, yet create a more agile and responsive IT system?
- How can they do more with older data, even as they understand better the data from a market that is changing every week?
- How can they help people work faster, with a minimum of change management, or set the stage for growth, while preserving capital?
In many cases the answer is a step-by-step deployment of cloud computing technology, tailored to meet the most pressing needs first.
Rollouts Made Simple: Cloud Deploy’s Deploy Hooks
924
Of your peers have already read this article.
2:30 Minutes
The most insightful time you'll spend today!
Cloud Deploy is a fully managed continuous delivery platform that automates the delivery of your application. Recently, we’ve heard from users that they want Cloud Deploy to also perform self-defined pre- and post-deployment operations to reduce the amount of additional toil required for each rollout. Examples of such operations include database schema updates, application infrastructure deployment, and network configuration adjustment.
Today, we are pleased to announce the public preview availability of Cloud Deploy deploy hooks. With this launch, Cloud Deploy now offers an easy way to define and execute pre- and post-deployment operations as part of a rollout.
Deploy hooks
The ability to run user defined actions immediately before and after deployment is a powerful feature that allows DevOps organizations to build out complete CI/CD pipelines to meet their specific deployment needs.
With the introduction of deploy hooks in Cloud Deploy, you can now take advantage of this capability by configuring your delivery pipeline to include pre-deploy and post-deploy actions. These actions take advantage of the custom actions defined through Skaffold. When enabled, two new jobs — predeploy and postdeploy — will be performed when deploying a rollout into a target.
Deploy hooks are supported for all target types (GKE, Cloud Run, Anthos, and Multi-Target) and can be used with all deployment strategies, such as canary deployments.
As enabled, deploy hooks can be used in a variety of ways, such as:
- Performing a database migration prior to deployment
- Performing infrastructure deployment prior to application deployment
- Interacting with third-party platforms post deployment, such as sending out an email or updating an open task tracker
Like other rollout jobs, Cloud Deploy provides the same observability and control for predeploy and postdeploy jobs. This includes the ability to view logs and perform control over individual jobs, such as retry, terminate, or ignore — all within the same rollout details interface.
Interested in exploring deploy hooks for yourself? Get started now with our quickstart and documentation!
The future
Comprehensive, easy-to-use, and cost-effective DevOps tools are key to building an efficient software delivery capability, and it’s our hope that Cloud Deploy will help you implement complete CI/CD pipelines. Stay tuned as we introduce exciting new capabilities and features to Cloud Deploy in the months to come.
In the meantime, check out the product page, documentation, quickstarts, and tutorials. Finally, If you have feedback on Cloud Deploy, you can join the conversation. We look forward to hearing from you!
3696
Of your peers have already downloaded this article
8:45 Minutes
The most insightful time you'll spend today!
For most established businesses today, the disruptive start-up has emerged as the biggest and most intimidating competition. A start-up’s digital prowess and astounding ability to innovate and scale massively in weeks, for what takes conventional businesses quarters, is daunting. How does one compete with that?
To play in today’s digitally-connected world, companies need to be equipped to deliver apps and digital experiences at lightning speed. How do you leverage insights from your environment of customers, partners, suppliers, and, in many cases, stores, warehouses, and inventory and use all that data to deliver relevant products and services? How do you unlock the data from your slow-moving systems of record to build those apps and experiences at the speed and agility of the App Store?
Gartner calls it bi-modal IT: an approach that enables an organization to protect the back-end systems and also drive rapid innovation. Think of it as an enterprise gearbox that enables you to scale your interactions a million times . In this eBook we explore how businesses can implement an API tier to keep backend transaction systems humming as front-end digital interactions scale to billions of requests and interactions , way beyond what your systems were designed to do.
More Relevant Stories for Your Company
How the Telegraph is Reimagining Media with Google Cloud
Whether they’re reading the newspaper on the way to work, or catching up on the latest headlines on their smartphones, readers expect up-to-the-minute news wherever and whenever makes the most sense for them. As a result, media companies are increasingly looking for ways to improve, expand, and simplify their offerings,
Google Cloud’s ML-based Image Classification App: A Key to Global Wildlife Conservation
Wildlife provides critical benefits to support nature and people. Unfortunately, wildlife is slowly but surely disappearing from our planet and we lack reliable and up-to-date information to understand and prevent this loss. By harnessing the power of technology and science, we can unite millions of photos from [motion sensored cameras]
Manage Packages Using Artifact Registry in Google Cloud Functions with Private Dependencies
Late last year, we announced that Artifact Registry was going GA, allowing GCP customers to manage their packages within the same platform as they were being deployed. In this blogpost, we want to show you how to do exactly that with a private dependency. Private dependencies allow your packages to be
1 Developer. 5 Months. A Revenue Generating App With 100K Users With Firebase
This is a guest post authored by Firebase customer, Anton Ivanov, Founder & CEO of DealCheck Real estate investing is a fantastic way to build a stream of passive income and grow your wealth. Numerous studies have pointed out that real estate investing has created more millionaires throughout history than
