Broadcom is a global technology leader that designs, develops, and supplies many semiconductor and infrastructure software solutions. Broadcom’s category-leading product portfolio serves critical markets including data center, networking, software, broadband, wireless, storage, and industrial sectors. 

Our customers, many of whom operate in the federal public sector, need ready-made SaaS solutions to secure their infrastructure while meeting compliance requirements. As head of platform engineering for Broadcom and its subsidiaries, my team is responsible for designing, testing, and building the common orchestration platform and services for our federal customers.

Since early 2021, we’ve partnered with Google Cloud to deliver best-in-class cloud solutions for  our multinational customers with speed, scale and efficiency, which earned us the Google Cloud Customer of the Year Award. When it came to creating plug-and-play security and compliance solutions for federal organizations in the United States, we turned to Assured Workloads.

Simplifying the path to compliance 

Assured Workloads provides out-of-the-box capabilities that allow us to easily create and maintain controlled environments that address security and compliance needs across different verticals and sectors. This includes enforcement of data residency, administrative and personnel controls, and managing encryption keys. 

For example, in the United States, federal government agencies need to use solutions that comply with FedRAMP, the government-wide standard for cloud computing security, while the Department of Defense (DoD) needs to comply with Impact Level (IL) standards. Assured Workloads helps us create solutions with built-in guardrails to ensure our customers automatically operate within whichever standard applies.  

Additionally, Assured Workloads guarantees that only personnel with the necessary clearance and permissions have access to information, and ​​it offers integrated cryptographic control over data, including customer-managed encryption keys based on the chosen compliance program. 

As a result of using Assured Workloads, our Symantec Security suite can provide a comprehensive set of security services that are being certified for FedRAMP. These include Web Security Service, Data Loss Prevention, Cloud Access Security Broker, and Symantec Endpoint Protection (SEP). 

We also offer our enterprise software products as services through Google Cloud. Rally Software, our enterprise agility tool, and Clarity PPM, our project and portfolio management tool, are already certified for FedRAMP. Additionally Clarity PPM is undergoing certification for IL4 compliance for our DoD clients. 

Sophisticated solutions for a secure future 

Given the intricate nature of securing the cloud environment and the business processes it handles, integrating Assured Workloads into our service offering has been simple and streamlined. Many of our services already run on Google Cloud, using Google Kubernetes Engine and Google Compute Engine, and since those Google Cloud services can be configured for all programs in an Assured Workloads environment, we were able to provide solutions to federal agencies without making significant changes to our deployment or configurations. This has helped save enormous engineering effort by avoiding a customized one-off effort to manage a Federal environment.

Google Kubernetes Engine (GKE) is one of the critical services in our environment, and Google Cloud releases many new GKE capabilities each year. Assured Workloads allows us to benefit from all the latest GKE innovations that come through automatic updates, maintaining parity with the commercial cloud without compromising on security and compliance requirements.

Compliance is a must-have for our federal clients, and our duty as providers of security and software services is to supply them with easy-to-use, efficient solutions they can trust. With the power of Assured Workloads streamlining our infrastructure software solutions hosted in Google Cloud, we can better support our regulated customers and further grow our software and security service businesses.

Mindful Containers is a fictitious company that is creating containerized microservice applications. They need a fully managed compute environment for deploying and scaling serverless containerized microservices. So, they are considering Cloud Run. 

They are excited about Cloud Run because it abstracts away the cluster configuration, monitoring, and management so they can focus on building the features for their apps. Cloud Run is a fully-managed compute environment for deploying and scaling serverless containerized microservices.

What is Cloud Run?

Cloud Run is a fully-managed compute environment for deploying and scaling serverless HTTP containers without worrying about provisioning machines, configuring clusters, or autoscaling.

• No vendor lock-in – Because Cloud Run takes standard OCI containers and implements the standard Knative Serving API, you can easily port over your applications to on-premises or any other cloud environment. 
• Fast autoscaling – Microservices deployed in Cloud Run scale automatically based on the number of incoming requests, without you having to configure or manage a full-fledged Kubernetes cluster. Cloud Run scales to zero— that is, uses no resources—if there are no requests.
• Split traffic – Cloud Run enables you to split traffic between multiple revisions, so you can perform gradual rollouts such as canary deployments or blue/green deployments.
• Custom domains – You can set up custom domain mapping in Cloud Run and it will provision a TLS certificate for your domain. 
• Automatic redundancy – Cloud Run offers automatic redundancy so you don’t have to worry about creating multiple instances for high availability

How to use Cloud Run

With Cloud Run, you write your code in your favorite language and/or use a binary library of your choice. Then push it to Cloud Build to create a container build. With a single command—“gcloud run deploy”—you go from a container image to a fully managed web application that runs on a domain with a TLS certificate and auto-scales with requests.

How does Cloud Run work?

Cloud Run service can be invoked in the following ways:

HTTPS: You can send HTTPS requests to trigger a Cloud Run-hosted service. Note that all Cloud Run services have a stable HTTPS URL. Some use cases include: 

• Custom RESTful web API
• Private microservice
• HTTP middleware or reverse proxy for your web applications
• Prepackaged web application

gRPC: You can use gRPC to connect Cloud Run services with other services—for example, to provide simple, high-performance communication between internal microservices. gRPC is a good option when you: 

• Want to communicate between internal microservices
• Support high data loads (gRPC uses protocol buffers, which are up to seven times faster than REST calls)
• Need only a simple service definition you don’t want to write a full client library
• Use streaming gRPCs in your gRPC server to build more responsive applications and APIs

WebSockets: WebSockets applications are supported on Cloud Run with no additional configuration required. Potential use cases include any application that requires a streaming service, such as a chat application.

Trigger from Pub/Sub: You can use Pub/Sub to push messages to the endpoint of your Cloud Run service, where the messages are subsequently delivered to containers as HTTP requests. Possible use cases include:

• Transforming data after receiving an event upon a file upload to a Cloud Storage bucket
• Processing your Google Cloud operations suite logs with Cloud Run by exporting them to Pub/Sub
• Publishing and processing your own custom events from your Cloud Run services

Running services on a schedule: You can use Cloud Scheduler to securely trigger a Cloud Run service on a schedule. This is similar to using cron jobs. Possible use cases include:

• Performing backups on a regular basis
• Performing recurrent administration tasks, such as regenerating a sitemap or deleting old data, content, configurations, synchronizations, or revisions
• Generating bills or other documents

Executing asynchronous tasks: You can use Cloud Tasks to securely enqueue a task to be asynchronously processed by a Cloud Run service. Typical use cases include:

• Handling requests through unexpected production incidents
• Smoothing traffic spikes by delaying work that is not user-facing
• Reducing user response time by delegating slow background operations, such as database updates or batch processing, to be handled by another service, 
• Limiting the call rate to backend services like databases and third-party APIs

Events from Eventrac: You can trigger Cloud Run with events from more than 60 Google Cloud sources. For example:

• Use a Cloud Storage event (via Cloud Audit Logs) to trigger a data processing pipeline 
• Use a BigQuery event (via Cloud Audit Logs) to initiate downstream processing in Cloud Run each time a job is completed

How is Cloud Run different from Cloud Functions?

Cloud Run and Cloud Functions are both fully managed services that run on Google Cloud’s serverless infrastructure, auto-scale, and handle HTTP requests or events. They do, however, have some important differences:

• Cloud Functions lets you deploy snippets of code (functions) written in a limited set of programming languages, while Cloud Run lets you deploy container images using the programming language of your choice. 
• Cloud Run also supports the use of any tool or system library from your application; Cloud Functions does not let you use custom executables. 
• Cloud Run offers a longer request timeout duration of up to 60 minutes, while with Cloud Functions the requests timeout can be set as high as 9 mins. 
• Cloud Functions only sends one request at a time to each function instance, while by default Cloud Run is configured to send multiple concurrent requests on each container instance. This is helpful to improve latency and reduce costs if you’re expecting large volumes. 

Pricing

Cloud Run comes with a generous free tier and is pay per use, which means you only pay while a request is being handled on your container instance. If it is idle with no traffic, then you don’t pay anything.

Conclusion

After learning about the ease of set up, scalability, and management capabilities of Cloud Run the Mindful Containers team is using it to deploy stateless microservices. If you are interested in learning more, check out the documentation.https://www.youtube.com/embed/oR4btKLRdn4?enablejsapi=1&

For more #GCPSketchnote, follow the GitHub repo. For similar cloud content follow me on Twitter @pvergadia and keep an eye out on thecloudgirl.dev

What’s new with Permissions Management on the Cloud Mobile App

Identity and Access Management (IAM) is the foundation of a strong cloud security posture, ensuring that the right access and permissions for cloud resources are granted across your organization. The Google Cloud mobile app gives cloud administrators the ability to quickly and easily manage their organization’s cloud identities and access from the mobile platform of their choice. 

Permissions management is one of the top user-requested features for the Cloud mobile app based on feedback we’ve received. The Permissions tab is used by more than half of our mobile users every month, highlighting the importance of easily managing permissions on-the-go.

We are excited to announce the availability of enhanced permissions management on the Google Cloud mobile app. This new capability enables you to easily view, assign and search for all the roles in your organization. 

Manage permissions easily on-the-go

The Cloud mobile app has expanded beyond supporting the three basic roles of Owner, Editor, and Reader, to supporting all the roles in your organization. Administrators are not only able to see all the roles but also assign these roles across their organization:

Administrators can also easily view a list of users, and click into each to see all the roles assigned to each user. On top of that, you can easily leverage the search capability to check if a role is assigned and modify its assignment. You can even assign multiple roles at the same time for easy editing. The app will show you a summary of changes before you will proceed.

The layout is optimized for mobile, with the categories of information organized for easy viewing. Currently assigned roles are always displayed on the top of the screen so they are easily accessible. Basic roles appear below, followed by all other roles grouped by Google Cloud products.

Get started on the Google Cloud app today

To summarize we’ve enhanced permissions management on the Google Cloud mobile app with:

• Smoother navigation
• Support for all the roles in your organization
• Easy search for assigned roles
• Ability to review changes before applying

Give enhanced permission management a try and explore the possibilities by downloading the app today from Google Play or the Apple App Store. If you have any feedback, we would love to hear from you –  simply click on the “send feedback” button in the app to share your experience.

One of the biggest challenges when serving machine learning models is delivering predictions in near real-time. Whether you’re a retailer generating recommendations for users shopping on your site, or a food service company estimating delivery time, being able to serve results with low latency is crucial. That’s why we’re excited to announce Private Endpoints on Vertex AI, a new feature in Vertex Predictions. Through VPC Peering, you can set up a private connection to talk to your endpoint without your data ever traversing the public internet, resulting in increased security and lower latency for online predictions. 

Configuring VPC Network Peering

Before you make use of a Private Endpoint, you’ll first need to create connections between your VPC (Virtual Private Cloud) network and Vertex AI.  A VPC network is a global resource that consists of regional virtual subnetworks, known as subnets, in data centers, all connected by a global network. You can think of a VPC network the same way you’d think of a physical network, except that it’s virtualized within GCP. If you’re new to cloud networking and would like to learn more, check out this introductory video on VPCs.

With VPC Network Peering, you can connect internal IP addresses across two VPC networks, regardless of whether they belong to the same project or the same organization. As a result, all traffic stays within Google’s network.

Deploying Models with Vertex Predictions

Vertex Predictions is a serverless way to serve machine learning models. You can host your model in the cloud and make predictions through a REST API. If your use case requires online predictions, you’ll need to deploy your model to an endpoint. Deploying a model to an endpoint associates physical resources with the model so it can serve predictions with low latency. 

When deploying a model to an endpoint, you can specify details such as the machine type, and parameters for autoscaling. Additionally, you now have the option to create a Private Endpoint. Because your data never traverses the public internet, Private Endpoints offer security benefits in addition to reducing the time your system takes to serve the prediction when it receives the request. The overhead introduced by Private Endpoints is minimal, achieving performance nearly identical to DIY serving on GKE or GCE.  There is also no payload size limit for models deployed on the private endpoint.

Creating a Private Endpoint on Vertex AI is simple.

In the Models section of the Cloud console, select the model resource you want to deploy.

Next, select DEPLOY TO ENDPOINT

In the window on the right hand side of the console, navigate to the Access section and select Private. You’ll need to add the full name of the VPC network for which your deployment should be peered.

Note that many other managed services on GCP support VPC peering, such as Vertex Training, Cloud SQL, and Firestore. Endpoints is the latest to join that list.

What’s Next?

Now you know the basics of VPC Peering and how to use Private Endpoints on Vertex AI. If you want to learn more about configuring VPCs, check out this overview guide. And if you’re interested to learn more about how to use Vertex AI to support your ML workflow, check out this introductory video. Now it’s time for you to deploy your own ML model to a Private Endpoint for super speedy predictions!