Learn to Easily Administer Multi-cluster Kubernetes Environs: Part 4 KRM Series - Build What's Next
How-to

Learn to Easily Administer Multi-cluster Kubernetes Environs: Part 4 KRM Series

5586

Of your peers have already read this article.

4:00 Minutes

The most insightful time you'll spend today!

Operating in multi-cluster environs involves challenges. If your teams are looking to administer multiple clusters in a single go while keeping them secure, or deploy and monitor apps running across multiple clusters, refer the part 4 of KRM series.

This is part 4 in a multi-part series about the Kubernetes Resource Model. See parts 12, and 3 to learn more. 

Kubernetes clusters can scale. Open-source Kubernetes supports up to 5,000 Nodes, and GKE supports up to 15,000 Nodes. But scaling out a single cluster can only get you so far: if your cluster’s control plane goes down, your entire platform goes down; if the Cloud region running your cluster has a service interruption, so does your app. 

Many organizations choose, instead, to operate multiple Kubernetes clusters. Besides availability, there are lots of reasons to consider multi-cluster, such as allocating a cluster to each development team, splitting workloads between cloud and on-prem, or providing burst capability for traffic spikes. 

But operating a multi-cluster platform comes with its own challenges. How to consistently administer many clusters at once? How to keep the clusters secure? How to deploy and monitor applications running across multiple clusters? How to seamlessly fail over from one region to another?

This post introduces a few tools that can help platform teams more easily administer a multi-cluster Kubernetes environment. 

The platform base layer, with Config Sync 

In the last post, we explored how thoughtful platform abstractions can help reduce toil for app developers- including for a multi-cluster environment, where automation such as CI/CD handles all interactions with the staging and production clusters. But equally important is the platform base layer, the Kubernetes resources and configuration that are shared across services. Your platform base layer might consist of Namespacesrole-based access control, and shared workloads like Prometheus

Platform abstractions depend on the existence of these base-layer resources. And so does the security and stability of your platform as a whole. It’s important that these resources not only get deployed, but also stay put. CI/CD is great for deploying resources, but what about making sure resources stay deployed? What if a Kubernetes Namespace gets deleted? Or a Prometheus StatefulSet is modified? 

Kubernetes’ job is to ensure that the cluster’s actual state matches the desired state. But sometimes, the “desired” state isn’t desired at all – it’s a developer who mistakenly modified a resource, or a bad actor that’s gained access into the system. For this reason, a platform base layer needs more than a one-and-done CI/CD pipeline. A tool called Config Sync can help with this. 

Config Sync is a Google Cloud product that can sync Kubernetes resources from a Git repository to one or more GKE or Anthos clusters. Unlike CI/CD tools like Cloud Build, Config Sync watches your clusters constantly, making sure that the intended resource state in the cluster always matches what’s in Git. Config Sync is designed primarily for base-layer resources like namespaces and RBAC. In this way, Config Sync is complementary to, not a replacement for, CI/CD. 

Configs
Source: Config Sync documentation

Config Sync runs in a Pod inside your Kubernetes cluster, watching your Git config repo for changes, and also watching the cluster itself for any divergence from your desired state in Git. If any configuration drift is detected from what’s stored in Git, Config Sync will update the API Server accordingly. 

You can point multiple Config Sync deployments at the same Git repo, allowing you to manage the base-layer platform resources for multiple clusters using the same source of truth. And by using Git as the landing zone for config, you can benefit from some of the GitOps principles we discussed in part 2, including the ability to audit and roll back configuration changes.

Let’s walk through an example of how to manage base-layer resources with Config Sync. 

The Cymbal Bank platform consists of four GKE clusters: admin, dev, staging, and prod. We can install Config Sync on all four clusters using the gcloud tool or the Google Cloud Console, pointing all four clusters at a single Git repository, called cymbalbank-policy. Note that this repo is separate from the application source and config repos, and is managed by the platform team. From the Console, we can see that all four clusters are synced to the same commit of the cymbalbank-policy repo. 

anthos config

Now, let’s say that the Cymbal Bank platform team wants to limit the amount of CPU and memory resources each application team can request for their service. Kubernetes ResourceQuotas help impose these limits, and prevent unexpected Pod evictions.

Policy repo

The platform team can define a set of ResourceQuotas for each application namespace. They can also scope the resources to only be applied to a subset of clusters – for instance, to the production cluster only. (If no cluster name selector is specified, Config Sync will deploy the resource to all clusters by default.)

  apiVersion: v1
kind: ResourceQuota
metadata:
  name: production-quota
  namespace: frontend
  annotations:
    configsync.gke.io/cluster-name-selector: cymbal-prod
spec:
  hard:
    cpu: 700m
    memory: 512Mi

From here, the platform team can commit the resources to the cymbalbank-policy repo, and Config Sync, always watching the policy repo, will deploy the resources to the production cluster:

  NAMESPACE                      NAME                  AGE     REQUEST                                                                                                                               LIMIT
balancereader                  production-quota      6m56s   cpu: 300m/700m, memory: 612Mi/512Mi

If a developer tries to delete one of the ResourceQuotas, Config Sync will block the request, helping to ensure that these base-layer resources stay put.  

  error: You must be logged in to the server (admission webhook "v1.admission-webhook.configsync.gke.io" denied the request: requester is not authorized to delete managed resources)

In this way, Config Sync can help platform teams ensure the stability of that platform base-layer, as well as ensure resource consistency across multiple clusters at once. This, in turn, can help organizations mitigate the complexity of adding new clusters to their environment.  

Enforce policies on Kubernetes resources

Config Sync is a powerful tool on its own, and can work with any Kubernetes resource that your cluster recognizes. This includes Custom Resource Definitions (CRDs) installed with add-ons like Anthos Service Mesh

But Config Sync, by default, doesn’t have an idea of “good or bad” Kubernetes resources. It will deploy whatever resources land in Git, even resources that might pose a security risk to your organization. Security is an essential feature of any developer platform, and when it comes to Kubernetes, it’s important to think about security from the initial software design stages, and set up your clusters with security best-practices in mind.   

But it’s just as important to think about security at deploy-time. Who and what can access your clusters? What kinds of Kubernetes resources – and fields within those resources- are allowed? These decisions will depend on lots of factors, including the kinds of data your application deals with, and any industry-specific regulations. 

One common security use case for KRM is the need to monitor incoming Kubernetes resources, whether they’re coming in through kubectl, CI/CD, or Config Sync. But if you have multiple clusters, your Kubernetes environment has multiple API Servers, and therefore multiple entry points.  

A Google tool called Policy Controller can help automate resource monitoring across multiple clusters. Policy Controller is a Kubernetes admission controller that can accept or reject incoming resources based on custom policies you define. Policy Controller is based on the OpenPolicyAgent Gatekeeper project, and it allows you to define policies, or “Constraints,” as KRM. This means you can deploy them using Config Sync, via Git. Once deployed, Policy Controller uses your Constraints as a set of rules to evaluate all incoming KRM, rejecting resources that fall out of compliance.  

Let’s walk through an example. Say that the Cymbal Bank security team wants to ensure that no code in development is accessible to the public. Kubernetes Services of type LoadBalancer expose public IP addresses by default, so the platform team wants to define a PolicyController constraint that blocks Services of that type on the development GKE cluster.

example

To do this, the platform team can define a Policy Controller Constraint as KRM. This Constraint uses a Constraint Template, provided through the pre-installed Constraint Template library. The ConstraintTemplate defines the logic of the policy itself, and the Constraint makes the template concrete, populating any variables needed to execute the policy logic. Here, we’re also adding a Config Sync cluster name annotation, to scope this resource to apply only to the development cluster.

  apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoExternalServices
metadata:
  name: dev-no-ext-services
  annotations:
    configsync.gke.io/cluster-name-selector: cymbal-dev
spec:
  internalCIDRs: []

The platform team can then commit the resource to the cymbalbank-policy repo, and Config Sync will deploy the resource to the development cluster. 

From here, if an app developer tries to create an externally-accessible Kubernetes Service, Policy Controller will block the resource from being created.

  for: "constraint-ext-services/contacts-svc-lb.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [denied by dev-no-ext-services] Creating services of type `LoadBalancer` without Internal annotation is not allowed

The platform team can define as many of these Constraints as they want, each defining a separate policy.

Writing custom policies 

The Policy Controller Constraint Template library provides a lot of functionality, from blocking privileged containers, to requiring certain resource labels, to preventing app teams from deploying into certain namespaces. But if you want to enforce custom logic on your organization’s KRM, you can do so by writing a custom Constraint Template. 

Constraint Templates are written in a query language called Rego. Rego was designed for policy rule evaluation, and it can introspect Kubernetes resource fields to make a conclusion as to whether the resource is allowed or not. 

For instance, let’s say that the platform team wants to limit the number of containers allowed inside a single application Pod. Too many containers per Pod can cause outage risks— when one container crashes, the entire Pod crashes.

developer

To enforce this policy, the platform team can define a Constraint Template, using the Rego language, that looks inside a resource to ensure that the number of containers per Pod is within the allowed limit: 

  apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8slimitcontainersperpod
spec:
  crd:
    spec:
      names:
        kind: K8sLimitContainersPerPod
      validation:
        openAPIV3Schema:
          properties:
            allowedNumContainers:
              type: integer
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8slimitcontainersperpod
        numTemplateContainers := count(input.review.object.spec.template.spec.containers)
        numRunningContainers := count(input.review.object.spec.containers)
        containerLimit := input.parameters.allowedNumContainers
        template_containers_over_limit = true {
          numTemplateContainers > containerLimit
        }
        running_containers_over_limit = true {
          numRunningContainers > containerLimit
        }
        violation[{"msg": msg}] {
          template_containers_over_limit
          msg := sprintf("Number of containers in template (%v) exceeds the allowed limit (%v)", [numTemplateContainers, containerLimit])
        }
        violation[{"msg": msg}] {
          running_containers_over_limit
          msg := sprintf("Number of running containers (%v) exceeds the allowed limit (%v)", [numRunningContainers, containerLimit])
        }
Then, the platform team can define a concrete Constraint, using this Constraint Template, to set the number of allowed containers per Pod to 3: 
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sLimitContainersPerPod
metadata:
  name: limit-three-containers
spec:
  parameters:
    allowedNumContainers: 3

Finally, the platform team can push these resources to the cymbalbank-policy repo, and Config Sync will deploy the policy to all four clusters. If a developer tries to define a Kubernetes Deployment containing more containers per pod than what’s allowed, the resource will be blocked at deploy time: 

  Error from server ([limit-three-containers] Number of containers in template (4) exceeds the allowed limit (3)): error when creating "constraint-limit-containers/test-workload.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [limit-three-containers] Number of containers in template (4) exceeds the allowed limit (3)

Custom Constraint Templates can give platform teams lots of flexibility in the types of policies they define and enforce in a Kubernetes environment. 

Integrating policy checks into CI/CD 

As we explored earlier, Config Sync and CI/CD are complementary tools. Config Sync works great for base-layer platform resources and policies, whereas CI/CD works well for application tests and deployment. 

But one pitfall of having two separate KRM deployment mechanisms is that app developers may not know that their resources are out of policy until they try to deploy them into production. This is especially true if some policies are scoped only to production, as we saw with the ResourceQuota example. Ideally, the platform team has a way to empower developers and code reviewers to know ahead of time whether new or modified resources are still in compliance. We can enable this use case by integrating policy checks into the existing Cymbal Bank CI/CD.

operator

Policy Controller operates, by default, as a Kubernetes Admission Controller running inside the cluster. But Policy Controller also provides a “standalone” mode, running inside a container, that can be used outside of a cluster, such as from inside a Cloud Build pipeline. 

In the example below, Cloud Build executes Policy Controller checks by getting the cymbalbank-app-config manifests, cloning the cymbalbank-policy resources, and using the “policy-controller-validate” container image to evaluate the app manifests against the policies. 

  steps:
- id: 'Render prod manifests'
  name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
  entrypoint: '/bin/sh'
  args: ['-c', 'mkdir hydrated-manifests && kubectl kustomize overlays/prod > hydrated-manifests/prod.yaml']
- id: 'Clone cymbalbank-policy repo'
  name: 'gcr.io/kpt-dev/kpt'
  entrypoint: '/bin/sh'
  args: ['-c', 'kpt pkg get https://github.com/$$GITHUB_USERNAME/cymbalbank-policy.git@main constraints
                  && kpt fn source constraints/ hydrated-manifests/ > hydrated-manifests/kpt-manifests.yaml']
  secretEnv: ['GITHUB_USERNAME']
- id: 'Validate prod manifests against policies'
  name: 'gcr.io/config-management-release/policy-controller-validate'
  args: ['--input', 'hydrated-manifests/kpt-manifests.yaml']
availableSecrets:
  secretManager:
  - versionName: projects/${PROJECT_ID}/secrets/github-username/versions/1 
    env: 'GITHUB_USERNAME'
timeout: '1200s' #timeout - 20 minutes

From here, an app developer or operator can know if their resources violate org-wide policies, by looking at the Cloud Build output for their Pull Request:  

  Status: Downloaded newer image for gcr.io/config-management-release/policy-controller-validate:latest
Error: Found 1 violations:
[1] Number of containers in template (4) exceeds the allowed limit (3)

By integrating policy checks into CI/CD, app development teams can understand whether their resources are in compliance, and platform teams add an additional layer of policy checks to the platform. 

Overall, Config Sync and Policy Controller can provide a powerful toolchain for standardizing base-layer config across a multi-cluster environment. Check out the Part 4 demo to try out each of these examples. 

And stay tuned for Part 5, where we’ll learn how to use KRM to manage cloud-hosted resources. 

4137

Of your peers have already watched this video.

23:18 Minutes

The most insightful time you'll spend today!

How-to

Securing Remote Workers with Google and Chrome Enterprise

With the proliferation of COVID-19 across the globe, the need for a remote working strategy has become paramount to keep businesses running.

A Gartner survey found that 88% of organizations have asked their employees to work remotely. And 97% of the organizations canceled work-related travel. However, only 10% of the organizations planned to reduce working hours. For us, this shows that despite the prevalence of coronavirus across the world, business demands require that work must go on.

Technologies such as Chromebooks, Chrome Browser, and SaaS applications have helped make this strategy a reality, providing access to critical data wherever employees may be working from during this challenging time.

However, this way of working has created new security challenges for IT departments, who may not be equipped to address these issues.

This session provides a walkthrough of many of Google’s solutions, such as Chrome devices, Chrome Enterprise Upgrade, BeyondCorp Remote Access, and Chrome Browser Cloud Management to ensure your business can keep secure, even in a remote working environment.

Case Study

Dr. Agarwal’s Eye Hospital Cuts IT Support Tickets By 80% With Google

4971

Of your peers have already read this article.

3:00 Minutes

The most insightful time you'll spend today!

By running G Suite on Chromebase devices, Dr. Agarwal’s Eye Hospital lowered desktop total cost of ownership up to 70%, and cut IT support tickets by 80%. Find out how.

About Dr. Agarwal’s Eye Hospital

Dr. Agarwal’s Eye Hospital specializes in treating eye conditions such as cataracts; glaucoma; corneal problems such as ulcers, inflammation, and thinning; and retinal issues such as degeneration and detachment. The business operates 62 hospitals in cities across India and 14 hospitals in 8 countries in Africa, including Zambia, Nigeria, and Ghana.

Industries: Health & Social Care
Location: India

Founded by the late Dr. J. Agarwal, Dr. Agarwal’s Eye Hospital, headquartered in Chennai, India, operates 62 hospitals in cities across India and 14 hospitals in 8 countries in Africa, including Zambia, Nigeria, and Ghana.

According to Dilip Ramadasan, GM-IT, Dr. Agarwal’s Eye Hospital, the business is the second-largest network of eye-care hospitals globally and aims to provide the best eye care in the world.

“We have focused on service over the last couple of years and decided to completely revamp back-end operations such as information technology and finance,” says Dilip.

By switching to Chromebase devices, desktop computing costs including software license fees have fallen from about 50,000 INR (US$768) per employee to about 27,000 INR (US$415) per employee.

“Realizing our vision involved moving to a completely new infrastructure that could deliver the scalability, agility, and performance our evolving application stack required.”

Replacing Aging Desktop Hardware and Applications

The business placed particular emphasis on upgrading its aging desktop fleet and traditional productivity applications.

“When I arrived in 2015, we only had 35 hospitals and all of them were using desktops that were five years or older,” Dilip says. “These desktops were due for replacement within the following six months to a year, so I had an ideal opportunity to upgrade our capabilities and address issues such as excessive support costs and resource requirements.”

For example, if a desktop at a hospital in a remote location experienced a problem, Dilip had to dispatch one of his technology team members to fix the issue. This could take up to five days, while the employee whose desktop was underperforming or failing often needed to wait until the fix was applied before resuming work.

Three Criteria for Improvement

When evaluating options to enhance the hospital’s information technology environment, Dilip applied three criteria: increasing revenue, increasing efficiency, and reducing costs.

“The number of support tickets we used to process on the desktop computing side has fallen by a full 80%. As a result, I’ve been able to cut the number of desktop support team members from eight to three and redeploy them to server and application management and support.”
— Dilip Ramadasan, GM-IT, Dr. Agarwal’s Eye Hospital

Dilip elected to replace the traditional desktops and applications with Chromebase devices running Google Chrome and G Suite applications. “This option aligned perfectly with our efficiency and cost criteria,” he says.

The business started a four-month pilot of Chromebase devices with G Suite in October 2015 at four newly-opened hospitals.

“We wanted to see how users would react to the Chromebases running G Suite compared to the traditional desktops and applications,” he adds. “A large component of the project entailed educating users about the benefits of G Suite applications such as Google Docs and Sheets.”

Dilip cites Sheets and Google Drive as the G Suite applications most beneficial to the business.

Chromebases Running G Suite Deployed to 600 Users

Dr. Agarwal’s Eye Hospital has completed the deployment of Chromebases running G Suite to 600 users. This group comprised team members who needed to access a billing application or a human resources management system and doctors who needed to access patients’electronic medical records.

“My desktop total cost of ownership fell by up to 70% when I deployed these devices,” Dilip says.

With G Suite running on Chromebase devices, Dilip has been able to resolve many desktop support issues remotely, minimizing the need to send support team members to distant locations.

“The number of support tickets we used to process on the desktop computing side has fallen by a full 80%,” he says. “As a result, I’ve been able to cut the number of desktop support team members from eight to three and redeploy them to server and application management and support.”

Dilip cites Sheets and Google Drive as the G Suite applications most beneficial to the business.

Sheets enables hospital team members to share important cost and revenue numbers without having to attach multiple versions of spreadsheets to emails, while Google Drive facilitates collaboration by enabling the team members to store and view shared documents.

“Team members are able to spend more time on core activities rather than on picking up numbers and sharing them with regional managers,” Dilip says.

The business also uses Google Vault to protect management data held in emails and help ensure compliance with legislative requirements.

Google Cloud Platform Products Under Evaluation

Dr. Agarwal’s Eye Hospital is evaluating extending its deployment of Google Cloud Platform products to Google BigQuery and Google Data Studio.

“We are looking to add a business intelligence layer over applications running in other cloud environments, and Google potentially provides an option to do that,” Dilip says.

“This layer would enable us to analyze electronic medical record data to increase our understanding of patterns such as how a particular disease affects an individual across various stages of life and what types of interventions would deliver the best results.”

“Google has introduced the flexibility we need to reposition our engineers as needed, improved the relationship between the information technology team and operations teams, and given the information technology team greater confidence in resolving issues,” adds Dilip. “We will be continuing to scout for opportunities across Google platforms to increase our revenue and efficiencies while decreasing our costs.”

Blog

The New Google Workspace Essentials: Bring Modern Collaboration to Work!

3735

Of your peers have already read this article.

1:30 Minutes

The most insightful time you'll spend today!

Google Workspace has successfully reimagined workplace collaboration to exceed expectations in today's challenging times. With the new Essential Starter, learn to leverage the secure-by-design Google Workspace and move over legacy productivity tools!

More than 3 billion users stay in touch, share ideas, and get more done together in Google Workspace, across apps like Meet, Chat, Drive, Docs, Sheets, Slides, and more. And starting today, we’re rolling out a new version designed to help people bring the apps they know and love to use in their personal lives to their work life. The new Google Workspace Essentials Starter Edition is a no-cost solution for business users looking to enhance teamwork and unlock innovation with secure-by-design collaboration. With Essentials Starter, we’re making it easy for employees to choose their own productivity tools and bring modern collaboration to work.

Work easily and securely within your current environment

As the world of work continues to evolve in unprecedented ways, secure collaboration—at speed, at scale, across platforms, on multiple devices—has never been more important. Essentials Starter helps employees and their teams break down silos and work together in new ways, even if their organization still relies on legacy productivity tools that weren’t built for the hybrid era of work. There’s no need for a new email address, file conversions, new plug-ins, or desktop software. All of the tools in Essentials Starter will work quickly and easily within your existing environment. And because we designed Google Workspace to operate on our industry-leading cloud foundation, Essentials Starter provides encrypted and secure access to files, helping keep users safe and their information private.

Table_Checklist_Chips.gif
Fuel collaboration with smart tables and checklists in Docs

How Essentials Starter works

  1. Sign up with your work email for a no-cost Essentials Starter account. No credit card required and there’s no limited trial period.
  2. Invite teammates to collaborate using Google Docs, Slides, Sheets, Chat, Drive, and Meet.
  3. Unlock innovation with new ways of working with immersive, virtual meetings, and by storing, sharing, and collaborating on 100+ file types, including Microsoft Office, without the need for file conversions.

Collapse the boundaries between people, places, and timezones

In our recently commissioned hybrid work global survey with Economist Impact, when workers were asked what was most important to realize the benefits of hybrid work, their number one choice was “new technologies that allow for time and location flexibility.”*

Google Workspace was born in the cloud and designed for maximum flexibility; to be used from the location and device of your choice. Google Workspace brings chat, files, meetings, and your favorite apps into an intelligent hub so you—and your team—can connect, create, and collaborate from your PCs, tablets, and smartphones, across locations and time zones.

1 Accelerate projects with modern collaboration.jpg
Accelerate projects with modern collaboration

Modern collaboration capabilities

Using the cloud-first approach of Google Workspace, teams can:

  • Experience modern collaboration without the burden of version control or email attachments. Brainstorm, build presentations, and glean insights from data using Google Sheets, Slides, and Docs.
  • Host secure video meetings to bring everyone together in one place. Conduct one-to-one video meetings (unlimited) and immersive team meetings (3-100 people; up to 60 minutes in duration each).
  • Real-time messaging with Google Chat. Share quick updates, files, and high-fives across the team with Google Chat, from one-to-one messages to larger group conversations.
  • A dedicated place for team collaboration in Spaces. Spaces are tightly integrated with Google Workspace tools like Chat, Drive, Docs, Sheets, Slides, and Meet, providing a better way for people to engage in topic-based discussions, share knowledge and ideas, move projects forward, and build communities and team culture.
  • Access work content securely from your devices. With 15 GB of storage in Google Drive, you can store, share, and access work content from your mobile device, tablet, or computer, and Drive for desktop can enable you to sync files and folders to your PC or Mac. Your Drive storage limits remain separate across your personal and Google Workspace Essentials Starter user accounts.
  • Work with existing tools without file conversions. Store, share, or co-edit 100+ file types, including Microsoft Office documents and PDFs without the need for file conversions.
  • Easily manage your team of collaborators. Add and remove team members effortlessly using a simple dashboard.
2 Immersive virtual and hybrid meetings in Google Meet.jpg
Immersive virtual and hybrid meetings in Google Meet

Over the past two years, organizations around the world have relied on Google Workspace to reimagine how work happens and enable modern collaboration across their teams to unlock innovation. During a time of enormous uncertainty, our customers have launched game-changing products, reached new audiences, accelerated lifesaving research, and digitally transformed their own customer experiences. Along the way, they’ve used Google Workspace to empower their employees—across homes, offices, and on the frontlines—to connect, create, and collaborate in powerful new ways. And starting today, with Essentials Starter, employees can make the switch from legacy productivity tools and experience the difference with Google Workspace.

Get started today.


* Economist Impact survey commissioned by Google in October 2021. The most popular answer when workers were asked about the most important condition needed to achieve the long-term success of hybrid work models was based on 42% of 1,244 respondents.

Case Study

There are 2 Key Traits You Need to Battle the Slowdown. FM Logistic Know How to Enable Them

6396

Of your peers have already read this article.

4:30 Minutes

The most insightful time you'll spend today!

As companies move forward slowly to recover, many find that two key traits can help accelerate them: Openness and mobility. With over 26,000 employees worldwide, FM Logistic found a neat trick to enable it. And it did not take long to implement.

FM Logistic provides its international customers with complete logistics solutions that cover everything from warehousing and handling, to transport and distribution, co-packing and co-manufacturing, and supply chain optimization. Operating in 14 countries including France, Russia, Poland, India, Vietnam, Brazil, and China, FM Logistic supports its clients by offering specialized services across a number of markets including consumer goods, retail, cosmetics, and health.

“We are in the process of transforming all our tools and integrating new solutions to be able to work faster and more efficiently. Two main IT priorities are mobility and openness, in terms of working from anywhere and being able to interact with other information systems.”

– Communication Manager, FM Logistic

As a business that has existed since 1967 and in 2018 achieved a turnover of €1.178 billion with 9.5% annual growth, FM Logistic is always looking to help secure the company’s position within an evolving sector. To better serve its customers, FM Logistic decided to launch an innovation project in 2017 to transform the internal digital tools of the company and replace its intranet, email, and productivity software. The company looked for an integrated solution that would enable more collaborative ways of working and bring its international operations closer together. The company found that implementing G Suite and LumApps social intranet was the perfect combination.

“We are in the process of transforming all our tools and integrating new solutions to be able to work faster and more efficiently,” says the Communication Manager at FM Logistic. “Two main IT priorities are mobility and openness, in terms of working from anywhere and being able to interact with other information systems.”

A global transformation

For large international companies with global operations, implementing a single integrated solution to enable collaboration across regions while respecting regional variations can be a real challenge.

“We have 26,000 employees spread across a broad geography, with a variation in cultures and technological maturity. There was an aspiration to work in collaboration, but the necessary tools were not in place,” says FM Logistic’s Communication Manager. FM Logistic looked for a solution to enable new, more collaborative work practices, which were flexible in terms of usage and that, most importantly, would work as part of an integrated solution.

To do that, FM Logistic worked with Google Partner Devoteam G Cloud to implement G Suite alongside the LumApps intranet portal. It took six months to complete the migration of 7,000 accounts, with employees accessing the Business or Basic G Suite edition according to their needs. “Before, with our physical infrastructure we found ourselves buying additional hard drives as we ran out of storage,” says the Technical Project Manager at FM Logistic. “That’s no longer a problem, and we can tailor access depending on whether or not employees need unlimited storage .”

“It’s a real advantage to be able to access your account from any device and work from anywhere. Hangouts Meet has been really transformational in that respect: it has reduced the need for travel significantly, even in the few months we’ve been using it so far.”

– Communication Manager, FM Logistic

“We followed Google’s G Suite migration advice and had early adopter ambassadors in every country. By the time we got around to the final country, very little input was needed as they were ready to go!” says the Technical Project Manager. “Many of them were already familiar with the product, so it was very intuitive. Our feedback surveys gave a satisfaction rating of almost 4.5 out of 5 in relation to the transition. We also had significant executive support, with two members of the executive committee on the steering board. That really helped the project to move quickly.”

As a result, employees were quick to understand the benefits of the new system. “It’s a real advantage to be able to access your account from any device and work from anywhere. That was clear from the start,” says the Communication Manager. “Hangouts Meet has been really transformational in that respect: it has reduced the need for travel significantly, even in the few months we’ve been using it so far.”

LumApps: a fully-integrated enterprise hub

One of FM Logistic’s main reasons for choosing G Suite was the seamless integration with LumApps’ intranet portal. LumApps adds value to G Suite, thereby boosting and sustaining employee adoption. FM Logistic chose LumApps to create a hub for its enterprise, where everything is centralized from internal communications to business apps.

“We didn’t want a patchwork of solutions, we needed a platform that worked as an integral whole,” says the Technical Project Manager. “With LumApps, employees access the intranet using their Google authentication and can access all their G Suite tools through the intranet. Moreover, LumApps is Google native, so the integration is seamless and we know that it will evolve to accommodate any changes that might take place.”

“The main advantages we see are communication and knowledge sharing,” says the Communication Manager. “With LumApps, all 26,000 of our employees are now able to access the portal in their own language and access local news.”

For the next step, FM Logistic is considering integrating social communities so that employees can express themselves and be more engaged in the corporate culture.

Supporting digital maturity

Thanks to Drive, employees can now work from wherever they are, and are able to work more efficiently and more collaboratively. “From an administrative point of view, users can benefit from automatic updates, so there is less pressure on the IT department,” says the Technical Project Manager. “And we’re seeing many innovative uses of the tools to work in more efficient ways: many services have gone paperless with Forms, so less time is wasted; commercial agents are using Drive to work together on tenders simultaneously; and with Sheets, tasks are automatically sent from the team manager’s file to employee’s Calendar.”

“G Suite and LumApps are the first step of our digital transformation, in terms of collaboration and moving into the cloud. We have real confidence in our partners LumApps and Google, and we’re investing in those relationships for the long-term benefit of the company.”

– Communication Manager, FM Logistic

Now, FM Logistic wants to further support its employees in exploring all the tools G Suite has to offer. “We are embarking on a second phase to give our employees the skills they need for advanced uses of Docs, Sheets, and Forms,” says the Communication Manager. “It’s a learning curve, but it’s key to our goal of transforming our everyday processes.”

“G Suite and LumApps are the first step of our digital transformation, in terms of collaboration and moving into the cloud. We have real confidence in our partners LumApps and Google, and we’re investing in those relationships for the long-term benefit of the company.”

Case Study

Workspace powers business as usual for Optiva during COVID-19

3825

Of your peers have already read this article.

3:30 Minutes

The most insightful time you'll spend today!

When the work-at-home orders went into effect in March last year, Optiva’s business charged ahead without missing a beat, says its CMO. But how? Find out.

Established companies in any industry, including telecommunications, often take a cautious approach when it comes to adopting new technology. This is true of any technology and especially of tools used across entire organizations and at all levels—like collaboration and communication tools. I joined Optiva Inc. as its Chief Marketing Officer in August 2018, and right off the bat I faced the need for cloud-based productivity and collaboration tools like Google Workspace (formerly G Suite), which was new to me. 

Optiva was in the midst of making an organization-wide change to implement Google Workspace productivity and collaboration tools. Employees at that time—at Optiva and across other organizations I used to work with—primarily collaborated by attaching documents to company emails and meeting their colleagues in office corridors. Meetings were almost always in person or via phone. These processes were inefficient and contributed to version-control confusion and decreased overall productivity. They were also based on our pre-COVID world.

Today, Optiva is a fully remote-first organization, and our employees use all the tools in Google Workspace. Collaboration has increased dramatically, surprising even initial skeptics. Occasionally we still encounter resistance from new employees who are used to a different way of working. This is logical, but more often than not, they thank us later, and many have told me that they see the value for their productivity and the entire organization’s collaboration. 

Google Workspace has become a real advantage, especially for a global company like Optiva with employees across the world and in so many different time zones. Instead of waiting for team members’ availability to review or collaborate on a document, wasting time coordinating who works on the latest version, or who is the “owner” of a deck, employees can open a document, view new changes, and add updates, even when others are working on the same document in parallel.  

Google Workspace promotes business as usual during COVID-19

The combination of Optiva’s remote-first policy and Google Workspace collaboration tools proved a welcome addition during the challenges posed by COVID-19. Optiva was ahead of the curve of remote working policies in the telecommunications industry and in the software industry as a whole, so when the work-at-home orders went into effect in March last year, Optiva’s business charged ahead without missing a beat.

Google Meet has helped us maintain a strong corporate culture during this challenging time. For example, we constantly use video conferencing, which has been a great way to see the entire team and get a real sense for how each employee is doing—professionally as well as personally. Using Google Chat allowed us to keep in touch with everyone across our global teams. It helps us ensure that everyone feels secure and can work during this challenging time. Also, we have continued to create new teams with employees all around the world. If we attempted to onboard or train them using conference calls or emails, the experience wouldn’t be the same. Meet has helped us develop the strongest teams possible, faster, and much more effectively. 

We also use Google Workspace tools to cross-train employees on tasks and processes in departments outside their own. That way, if one of our employees has to be out of the office unexpectedly, the company benefits from full business continuity. To make this possible, various teams and departments documented their specific processes, held training sessions on Meet, and recorded them so any employee could access them on demand.

Many struggled in the early days of the self-quarantine orders, especially when it came to the sudden need to select and deploy new technologies for remote collaboration and, more importantly, to keep supporting their customers. We were fortunate that our business was unphased—and we owe a lot of this success to Google Workspace.

More Relevant Stories for Your Company

Case Study

PwC uses Connected Sheets to scale data insights

It’s important for teams across the business to understand customer adoption of products and services, whether it’s the product team tracking usage of a newly released feature or the support team trying to anticipate incoming service requests. Similarly,  IT teams need to analyze the adoption of an organization’s internal applications

Webinar

Lessons for the Indian Government: How the State of Arizona Innovates with Emerging Tech

Government agencies of every size and jurisdiction are being called upon to provide accurate and real-time information and deliver essential services across the globe in a world infested by COVID-19. Doug Lange, Chief Strategy Officer, state of Arizona, is primarily responsible for two things. One is Arizona's statewide IT Strategic

How-to

A Breakdown of Cloud-based Data Ingestion Practices

Businesses around the globe are realizing the benefits of replacing legacy data silos with cloud-based enterprise data warehouses, including easier collaboration across business units and access to insights within their data that were previously unseen. However, bringing data from numerous disparate data sources into a single data warehouse requires you

Case Study

BURGER KING Germany: Serving Up Marketing Insights and Supply Chain Visibility Easily

Do hamburgers really come from Hamburg? This may still be a matter of debate, but the popularity of American-style burger joints not just in Hamburg but all over Germany, is clear. Germany’s top two fast food companies are both burger chains. One of them is BURGER KING®, a global brand that welcomes more

SHOW MORE STORIES