For far too long, cloud infrastructure has focused on raw speeds and feeds of building blocks such as VMs, containers, networks, and storage. Today, Moore’s law is slowing, and the burden of picking the right combination of infrastructure components increasingly falls on IT.

At Google Cloud we are committed to removing that burden. We’ve engineered golden paths from silicon to the console, with a recipe of purpose-built infrastructure, prescriptive architectures, and an ecosystem to deliver workload-optimized infrastructure. And at this year’s Google Cloud Next, we made some exciting new announcements across key workloads.

In this post, we will put the new Google Cloud releases and capabilities in the context of popular workloads: From AI/ML to high performance computing and data analytics, to SAP, VMware, and mainframes.

Powering AI/ML workloads

No single technology has the potential to drive more transformation than AI and ML. At Next, we announced several new AI-based services: Translation Hub and DocAI services, and the OpenXLA Project, an open-source ecosystem of ML compiler technologies co-developed by a consortium of industry leaders.

To build these innovative services, you also need a powerful infrastructure platform. Today, we announced the following additions to our compute offerings:

• Cloud TPU v4 Pods – Now in General Availability (GA), Google’s advanced machine learning infrastructure is based on the world’s largest publicly available ML hub in Oklahoma and offers up to 9 exaflops of peak aggregate compute. Developers and researchers can use TPU v4 to train increasingly sophisticated models to power workloads such as large-scale natural language processing (NLP), recommendation systems, and computer vision algorithms in a cost effective and sustainable way. In June 2022, Cloud TPU v4 recorded the fastest training times on five MLPerf 2.0 benchmarks, with up to 80% better performance and up to 50% lower cost of training than the next best available alternative.

• A2 Ultra GPU VM instances – Now GA, you can use A2 Ultra GPU VM instances with Compute Engine, Google Kubernetes Engine and Deep Learning VMs. A2 Ultra GPUs have the largest and fastest GPU memory of the Google Cloud portfolio and are optimized for large AI/ML and HPC workloads with use cases such as AI assistants, recommendation systems, and autonomous driving. Powered by NVIDIA A100 Tensorcore GPU with 80 GBs of GPU memory, A2 Ultra delivers 25% higher throughput on inference and 2x higher performance on HPC simulations than original A2 machine shapes.

Learn more about A2 Ultra and hear how you can accelerate your ML development and learn from our customers Uber and Cohere in breakout session MOD300.

Boost HPC and data-intensive workloads

Customers rely on Google Cloud to help them run data-intensive workloads such as HPC and Hadoop. The new C3 machine series (currently in Preview) is the first in the public cloud to include the new 4th Gen Intel Xeon processor and Google’s custom Intel Infrastructure Processing Unit that enables 200Gbps, low-latency networking. Learn more about top HPC best practices in breakout session MOD106.

You can pair the C3 with Hyperdisk (currently in Private Preview), our new generation block storage, which offers 80% higher IOPS per vCPU for high-end database management system (DBMS) workloads when compared to other hyperscalers. Data workloads such as Hadoop and databases may no longer need oversized compute instances to benefit from high IOPS. Learn more about Hyperdisk in breakout session MOD206.

Enable new streaming experiences

Media and entertainment customers want streaming optimized workloads that build on our innovation in edge and our global network. Here are some new developments to support streaming use cases:

• Cloud CDN, our original content delivery networking offering, now offers Dynamic compression to reduce the size of responses transferred from the edge to a client, significantly helping to accelerate page load times and reduce egress traffic.
• Media CDN, introduced earlier this year, now supports the Live Stream API to ingest and package source content into HTTP-Live Streaming and DASH formats for optimized live streaming. We are also enabling two new developer-friendly integrations in Preview for Media CDN: Dynamic Ad Insertion with Google Ad Manager, which provides customized video ad placements, and third-party Ad Insertion using our Video Stitcher API for personalized ad placement. With these options, content producers can introduce additional monetization and personalization opportunities to their streaming services.
• For advanced customization, we are introducing the Preview of Network Actions for Media CDN, a fully managed serverless solution based on open-source web assembly that enables programmability for customers to deploy their own code directly in the request/response path at the edge.

With Media CDN, customers like Paramount+ are able to deliver a high-quality experience on the same Google infrastructure we’ve tested and tuned to serve YouTube’s 2 billion users globally.

“Streaming is one of the key growth areas for Paramount Global. When we migrated traffic onto Media CDN, we observed consistently superior performance and offload metrics. Partnering with Google Cloud enables us to provide our subscribers with the highest quality viewing experience.” — Chris Xiques, SVP of Video Technology Group, Paramount Global

Bringing Google Cloud to your workloads

For customers in regulated markets and in countries with strict sovereignty laws, Google Cloud has a spectrum of offerings to help them achieve varying degrees of sovereignty. Sovereign Controls by T-Systems is now GA, and Local Controls by S3NS, the Thales-Google partnership, is now available in Preview. You can expect more region and market announcements in the coming months. And for the most stringent sovereignty needs, we offer Google Distributed Cloud Hosted for a disconnected Google Cloud footprint deployed at the customer’s chosen site.

We are also expanding functionality for existing offerings to give you even more options to run your cloud where you want, how you want.

• Anthos, our cloud-centric container platform to run modern apps anywhere consistently at scale, now has a more robust user interface and an upgraded fleet management experience. Create, update, and reconfigure your Anthos clusters the same way from one dashboard or command-line interface, wherever your clusters run. New fleet management capabilities let you manage growing fleets of container clusters across clouds, on-premises, and at the edge and for different use cases (isolate dev from prod, apply fleet-specific security controls, enforce configurations fleet-wide). And we are pleased to announce the GA of virtual machine support on Anthos clusters for retail edge environments. Learn more about how Anthos can help you run modern applications anywhere in breakout session MOD208.

• Google Distributed Cloud Edge GPU-Optimized Config, is now GA in server-rack form factors powered by 12 Nvidia T4 GPUs. GDC Edge is designed to enable low-latency and high-performance hybrid workloads as a complement to your primary Google Cloud environment or as an independent edge deployment. We’re seeing early adoption by customers and partners for workloads such as augmented reality and retail self-checkout. In addition, software partners such as 66degrees are taking advantage of GDC Edge GPU optimization to provide real-time insights on in-store product availability, while Ipsotek is using machine intelligence at the edge to perform crowd and foot-traffic analysis in large locations such as malls, airports and railway stations. Learn more about GDC Edge and new partner validated solutions here, or watch breakout session MOD207 to hear how you can modernize your data center and accelerate your edge.

Infrastructure building blocks for cloud-first workloads

For most new projects, developers prefer them to be cloud-first optimized workloads, and nearly half of all developers use containers today. Google Kubernetes Engine (GKE) is the most automated and scalable container management service on the market today, and when you use GKE Autopilot, developers can get started faster than other leading cloud providers. At Next ‘22, we’re excited to unveil:

• A new workshop to help you discover how to unlock efficiency and innovation with a GKE Autopilot — sign up to get started.
• A new security posture management dashboard in GKE that provides opinionated guidance on Kubernetes security along with bundled tools to expertly help improve the security posture of your Kubernetes clusters and workloads.

When building scalable web applications or running background jobs that require lightweight batch processing, developers are increasingly turning to serverless technologies. We’re helping developers choose serverless with numerous updates to Cloud Run, our managed serverless compute service.

• With new Cloud Run integrations, Cloud Run and Google Cloud services work together smoothly. For example, configuring domains with a Load Balancer or connecting to a Redis Cache is now as easy as a single click, with more scenarios on the way.
• Cloud Run customized health checks for services is now available in Preview, providing user-defined HTTP and TCP Startup probes at the container level. This capability allows Cloud Run users to define criteria as to when their application has started and is ready to start serving traffic, and is particularly useful for applications that might require additional startup time on their first initialization.
• To make continuous deployment easier for our customers, we added an integration between Cloud Deploy, our fully managed continuous deployment service, and Cloud Run. With this integration in place, you can do continuous deployment through Cloud Deploy directly to Cloud Run, with one-click approvals and rollbacks, enterprise security and audit, and built-in delivery metrics. Learn more on Cloud Deploy web page.

Learn more about how to build next-level web applications with Cloud Run in breakout session BLD203.

You also need confidence in the building blocks that make up your workloads from the outset. To help get you started, we introduced Software Delivery Shield, which provides a comprehensive suite of tools offering a fully managed, end-to-end solution that helps protect your software supply chain. The Software Delivery Shield launch also included the following announcements:

• Cloud Workstations, currently in Preview, provides fully-managed development environments built to meet the needs of security-sensitive enterprises. With Cloud Workstations, developers can access secure, fast, and customizable development environments via a browser anytime and anywhere, with consistent configurations and customizable tooling. To learn more about Cloud Workstations, please visit the web page and check out breakout session BLD100.
• A new partnership with JetBrains provides fully managed Jetbrains IDEs as part of Cloud Workstations. This integration can give developers access to several popular IDEs with minimal management overhead for their admin teams.

Read more about Software Delivery Shield.

Open source and open standards are an important part of building applications. With that, we are excited to announce that Google has joined the Eclipse Adoptium Working Group, a consortium of leaders in the Java community working to establish a higher quality, developer-centric standard for Java distributions. Also, we are making Eclipse Temurin available across Google Cloud products and services. Eclipse Temurin provides Java developers a higher quality developer experience and more opportunities to create integrated, enterprise-focused solutions, with the openness they deserve.

Pioneering new technology with Web3 optimized infrastructure

It’s incredible to see the energy in Web3 right now and the focus on developing the broader benefits, use cases, and core capabilities of blockchain. We are helping customers with scalability, reliability, security, and data, so they can spend the bulk of their time on innovation in the Web3 space — unlocking deep user value and building the next app to attract a billion users to the ecosystem.

Companies like Near, Nansen, Solana, Blockdaemon, Dapper Labs & Sky Mavis use Google Cloud’s infrastructure. Yesterday, we announced a strategic partnership with Coinbase to better serve the growing Web3 ecosystem.

“We could not ask for a better partner to execute our vision of building a trusted bridge into the Web3 economy and accelerating broader growth and adoption of blockchain technology. I started Coinbase with a desire to create a more accessible financial system for everyone, and Google’s history of supporting open source and decentralized ecosystems made this a natural fit. Our partnership marks a major inflection point and, together, we are removing barriers to blockchain adoption and accelerating innovation.” — Brian Armstrong, CEO, Coinbase

Lift and transform traditional workloads

Not all workloads were born in the cloud — or have completed their journey to it. Google Cloud offers a variety of programs and capabilities to help optimize traditional workloads for a new cloud era, regardless of whether you’re looking to migrate it as-is, do light optimizations, or fully modernize and transform:

• Migration Center – Now in Preview. For organizations looking to migrate to the cloud and transform their businesses, Migration Center can reduce the complexity, time, and cost by providing an integrated migration and modernization experience. It brings together our assessment, planning, migration, and modernization tooling in one centralized location with a shared data platform so you can proceed faster, more intelligently, and more easily through your journey. Learn more at the Migration Center webpage.

• Google Cloud VMware Engine – Google Cloud is the first VMware partner to market with VMware Cloud Universal support, simplifying the migration of on-premises VMware VMs to VMware Engine in the cloud. With a cloud market-leading 99.99% availability SLA in a single site, VMware Engine is helping large organizations like Carrefour move to Google Cloud.

• Dual Run for Google Cloud – Now in Preview, this first-of-its-kind solution helps eliminate many of the common risks associated with mainframe modernizations by letting customers simultaneously run workloads on their existing mainframes and their modernized version on Google Cloud. This means customers can perform real-time testing and quickly gather data on performance and stability with no disruption to their business. Once satisfied that the performance of the two systems is functionally equivalent, the customer can make the Google Cloud environment the system of record, and operate the existing mainframe system as needed, typically as a backup. Learn more about Dual Run in this press release or on our Mainframe Modernization webpage.

• Google Cloud Workload Manager – Now in Preview for SAP workloads, and available in the Google Cloud console, Workload Manager provides automated analysis of your enterprise systems on Google Cloud to help continuously improve system quality, reliability, and performance. Google Cloud Workload Manager evaluates your SAP workloads by detecting deviations from documented standards and best practices to help proactively prevent issues, continuously analyze workloads, and simplify system troubleshooting.

Learn more about how organizations like Global Payments and Loblaw Technology have migrated with ease and speed in breakout session MOD104.

Protect all your workloads

The foundation of any workload is storage, and this year we expanded the number of supported regions with our Cloud Storage dual-region buckets (GA), so you can ensure that your workloads are protected. In the event of an outage, your application can easily access the data in the alternate region. You can add Turbo replication (GA) with your dual-region buckets. Turbo replication is backed by a 15-minute Recovery Point Objective (RPO) SLA.

Also, we recently announced Google Cloud’s Backup and DR Service (GA). This service is a fully integrated data-protection solution for critical applications and databases that lets you centrally manage data protection and disaster recovery policies directly within the Google Cloud console, and fully protect databases and applications with a few mouse clicks.

Learn more about Storage best practices in breakout session MOD206.

Migrate, observe, and secure network traffic

We also announced many new capabilities and enhancements to the Cloud Networking portfolio that help customers migrate, modernize, secure, and observe workloads traveling to and in Google Cloud:

• Private Service Connect helps simplify migrations by giving more control to users and integrations with 5 new partners.
• Network Intelligence Center can monitor the network for you with enhanced capabilities like the Performance Dashboard that will give you latency visibility between Google Cloud and the Internet.
• We expanded our Cloud Firewall product line and introduced two new tiers: Cloud Firewall Essentials and Cloud Firewall Standard.

For more information on what’s new with networking, read this blog and check out breakout session MOD205.

Optimize costs

Our customers’ workloads also require technical and commercial options that can deliver the best return on their investments. Here are some new enhancements that can help:

• Flex CUDs – GA coming soon, Flexible Committed Use Discounts help you save up to 46% off on-demand Compute Engine VM pricing, in exchange for a one- or three-year commitment. Like standard CUDs, you can apply Flex CUDs across projects within the same billing account, to VMs of different sizes, and across operating systems. Learn more.
• Batch – Now GA, Batch is a fully managed service that helps you run batch jobs easily, reliably, and at scale. Without having to install any additional software, Batch dynamically and efficiently manages resource provisioning, scheduling, queuing, and execution, freeing you up to focus on analyzing results. There’s no charge for using Batch, and you only pay for the resources used to complete the tasks.

Learn more about how you can optimize for cost savings with Google Cloud in MOD103.

Optimize for sustainability

Any new workloads you develop should have the smallest possible carbon footprint. Google Cloud Carbon Footprint helps you measure, report, and reduce your cloud carbon emissions, and is now GA. Since introducing Carbon Footprint last year, we added features that cover Scope 1, 2 and 3 emissions, and provided role-based access to other users such as sustainability teams. Active Assist’s carbon emissions estimates related to removing unattended projects are also now GA. Learn how to build a more sustainable cloud with lower carbon emissions in MOD103, and start using Carbon Footprint today.

“At Box, we’re focused on reducing our carbon footprint and we’re excited for the visibility and transparency the Carbon Footprint tool will provide as we continue our work to operate sustainably.” — Corrie Conrad, VP Communities and Impact and Executive Director of Box.org at Box

“At SAP we’re working to achieve net-zero by 2030, making it crucial to measure carbon emissions all along our value chain. Collaborating with Google Cloud on Carbon Footprint ensures that accurate emissions data is available in a timely manner, helping our many Solution Areas make more sustainable decisions.” — Thomas Lee, SVP and Head of Multicloud Products and Services at SAP

Designed around your workloads

These are only a few examples of the many golden paths we are enabling for your workloads. We strive to be the ‘open infrastructure cloud’ that is the most intuitive to consume because everything is designed around your workloads, providing tremendous TCO benefits.

To get even more information on all of this and more check out the Modernize breakout session track and these “What’s New” sessions available on demand at Next ’22:

• MOD105 to learn about new infrastructure solutions for enterprise architects and developers.
• BLD106 to learn what’s new to help developers build, deploy, and run applications.
• OPE100 to learn about the biggest announcements for DevOps teams, sysadmins, and operators.

Engineers that build last-mile delivery services belong to an elite order, a hallowed subcategory. Delivery customers are incredibly demanding when it comes to speed and convenience, and the services they use must take variables like increased traffic, road conditions, human error, and even driver availability into account every day.

Nuro is a company with a new approach to delivery services. Nuro has a fleet of autonomous vehicles designed to address many of the problems related to last-mile delivery. And every day, these vehicles — and their sensors — generate a lot of data before parking for the night. For Nuro engineers, that data can help them understand the impact of new on-road features, make improvements to their vehicles’ software, and ensure even better deliveries for their customers.

For Nuro, the key challenge is how to move petabytes of data as quickly, securely, and easily as possible from their edge environments, like vehicle depots, to Google’s Cloud Storage. For this delivery effort, Nuro selected Google’s Transfer Appliance with its new online transfer capability, now generally available.

Helping Nuro to speed up data delivery from the edge to the cloud

Like many Google Cloud customers, Nuro collects data from remote environments, like vehicle depots, that have different networking and storage capabilities when compared to a traditional data center. For a transfer solution to be effective moving unstructured data from these environments to the cloud, the solution needs to be easy to deploy and automate, while still providing similar performance as a more complicated alternative.

The Transfer Appliance was built for this use case. It arrives to customers as a physical appliance with a preconfigured version of Google’s Storage Transfer Service software already installed. Customers can move files to the appliance by using SFTP or SCP, or, alternately, can mount the appliance as an NFS share and copy target. Data can be stored locally on the appliance or transferred over the network, and secure encryption — at-rest and in-flight — is enabled by default.

With these new appliances, Nuro will be able to automate much of their storage transfer needs. When their autonomous vehicles return to the depot, they can move data like software logs, LIDAR data, and sensor data — all ideal fits for Google’s Cloud Storage — from parked vehicles to the Transfer Appliance. Online transfers can then be performed throughout the day, ensuring a steady stream of valuable data in the cloud for developers to analyze and use in their nightly builds. All of this will help Nuro’s engineering leaders like Jie Pan to run more productive development teams with less operational overhead.

“Our autonomous vehicles generate a tremendous amount of useful data, and our goal is to get that data to our engineers as soon as possible,” said Jie Pan, Engineering Manager at Nuro. “When vehicles return to the depot, we can move data hourly into Cloud Storage over the network. We also have the flexibility to return the Transfer Appliance back to Google Cloud. Most importantly, this rapid transfer architecture gives a meaningful boost to engineering productivity and development velocity.”

Going the extra mile

Engineering and infrastructure leaders understand the value of delivering the right data to the right teams, as fast as possible. By adding preconfigured, over-the-network transfer into a turnkey Transfer Appliance, Google Cloud customers can more easily automate these data deliveries by scheduling regular migrations of on-premises files, objects, and other unstructured data to our Cloud Storage.

As Nuro continues to grow their manufacturing and testing footprint, they plan to use Transfer Appliances to further scale and simplify their data migration from on-premises to Google Cloud. Cutting the time to migrate their data by more than half will make for happier, more productive developers, and that will help Nuro bring us all the future of delivery a little faster.

If you’d like to learn more about Transfer Appliance and its new online transfer capability, click here or reach out to your Google Cloud account team.

What do CIOs and CTOs deliver for the company? If you said “technology,” that’s just the beginning. According to their research, McKinsey found that 85% of CIOs and CTOs interviewed in the spring of 2019 said they were essential for at least two of the three most common CEO priorities—revenue acceleration, improved agility and time to market, and cost reduction.

IT modernization – including migrating to the cloud – is key to business growth and agility. Yet, according to a recent McKinsey study, 80% of CIOs report that regardless of their level of cloud migration, they still haven’t reached their projected agility and business benefits. Sometimes, this is because of issues like training and skills gaps in the IT workforce. Surprisingly often though, the barrier to reaching the goals is based on trade-offs that CIOs themselves feel they must make to strike a balance between the perfect and the possible.

But what if you could have it all without the trade-offs? As Will Grannis, Managing Director of the CTO Office at Google, and Arul Elumalai, Partner at McKinsey & Company discussed in our recent digital conference, many of the compromises CIOs make can be avoided with new technology, modern architectures and by encouraging a transformation mindset across the business. In interviews, CIOs explained how they’ve leveraged the best of the cloud without compromising on security, agility, and flexibility. Here’s how these leaders avoid three of the top perceived trade-offs—both with technology and by transforming their operating model.

Trade-off #1: Developer agility vs. control and governance

Moving to the cloud offers new opportunities for speed, but 69% of organizations indicate that stringent security guidelines and code review processes can slow developers significantly. One CISO of a multinational company mentioned that cloud development was so fast that they had to institute manual checks on their developers’ code. So much for agility. 

To overcome this trade-off and maintain both speed and security, some respondents found success in DevOps, hiring security-experienced talent and introducing automation for security and quality. Building in security into the CI/CD pipeline and increasing automation don’t just eliminate the tradeoff, they result in higher quality and faster innovation.

At Google Cloud, we’ve also observed that customers with strong DevOps practices have increased speed-to-market and product/service quality. From our own journey, we’ve learned seven critical lessons essential to adopting a DevOps model, ranging from taking up small projects and embracing open source to building an overall DevOps culture.

Trade-off #2: Single-vendor benefits vs. freedom from lock-in

CIOs perceive benefits to using the fewest number of clouds, specifically avoiding introducing multiple systems that require their teams to develop and maintain multiple skillsets. Unfortunately, 83% of the CIOs interviewed said that while they would prefer fewer clouds, the potential financial and technical lock-in drives them to multiple providers. 

Successful CIOs said that they can avoid lock-in pitfalls not just with contractual guardrails and executive and board education, but with evolving hybrid cloud technologies that provide additional choices. Hybrid cloud platforms based on containers can further mitigate the risk of using a single cloud vendor. The key to successful hybrid architectures is the infrastructure abstraction and portability that containers create for them, enabling disparate environments to work together. 

This notion has been at the heart of our strategy at Google Cloud with Anthos, which provides an abstraction layer and an application modernization platform for hybrid and multi-cloud environments. Enterprises can use Anthos to modernize how they develop, secure, and operate hybrid-cloud environments and enable consistency across cloud environments.

Trade-off #3: Best-of-breed tools vs. standardization and familiarity

Optimizing tool chains for different environments can improve productivity, but many CIOs believe that this means reduced functionality and tools. While 77% of CIOs said they had to standardize to the lowest common denominator, some have found a better solution. Rather than giving up the languages, libraries, and frameworks that their teams prefer, effective leaders said that they found success by investing in training programs to upscale talent and adopting new open and vendor-agnostic solutions. Architectures that are based on open-source components have been the keys that helped remove this tradeoff, and eliminate the notion of a lowest common denominator. 

This is why we have built Anthos on open-source components like Kubernetes, Istio and Knative. Anthos gives your business the choice you need. With the ability to create code that works in most environments using the tools, languages, and systems you prefer, you can do more without major changes to how you work.

Regardless of your current cloud adoption level, check out “Unlock business acceleration in a hybrid cloud world” to discover more about McKinsey’s findings, including how CIOs drive agility, methods to make trade-offs unnecessary, and how to prepare your team for the cloud. Then, stay tuned for subsequent posts that  take a closer look at how hybrid solutions and strategies can help CIOs drive a transformation mindset across the business—without compromising on security, agility, and flexibility.

API gateways are a critical component of a modern architecture. Apigee X is Google Cloud’s API management platform. It also allows users of the legacy Apigee Edge product to leverage Virtual Private Cloud (VPC) products and features, like Cloud Armor and Load Balancers. With these new security and availability advantages come a new set of challenges. The biggest challenge is accessing API backends in multiple VPCs. This introduces  VPC peering transitivity restrictions. Only two VPCs can be peered in sequence, but the Apigee X Runtime already consumes one peering connection. This blog post discusses overcoming transitivity limits, with an eye on future managed services that solve the problem.

VPC Peering Transitivity Limits

The main challenge with Apigee X is that customers have backend servers in multiple distinct VPCs. This means that Apigee X Runtime traffic must traverse multiple VPC peering  connections. However, peering transitivity limits VPC networking to only one sequential VPC hop.

In the past (Apigee Edge / SaaS) customers did not need to worry about securing their backend APIs across multiple VPCs. Apigee X networking is a new feature, compared to the original Apigee SaaS product.

VPC Connectivity Options

VPC peering is the easiest option. The restriction is that connectivity wise, only one peering hop is allowed, which is already consumed by a connection to the Apigee X Runtime. The Apigee X Runtime resides in a Google managed VPC.

Internal Global Load Balancers (ILBs) with Managed Instance Group (MIG) backends is the second option. This peering solution is complex though.

The open internet is the most parsimonious solution. Apigee X facilitates this, but it would violate the security mandates of many Google Cloud customers.

The final option is Cloud VPN. Cloud VPN supports transitivity across multiple VPC network hops. As well the implementation steps are relatively simple. Traffic does not traverse the open internet for VPCs within Google Cloud.

Apigee X Networking Explained

ApigeeX is a Private Service Access (PSA) based service that is deployed and managed in a tenant project. A tenant project is a project that is tied to the Apigee X Runtime, in a one-to-one relationship. The Apigee X deployment natively manages a load balancer in the customer’s VPC for ingress traffic. By default, egress to non-private routes from Apigee X is through Cloud NAT in the tenant project. The default Apigee X deployment is more suitable for non hub-and-spoke network design.

Single VPC Hub Design

Figure 3 demonstrates the API request flow. External API requests come from the internet and first encounter the XLB. The XLB has the Apigee X Runtime as a backend, using Network Endpoint Group to contain the Apigee X Environment Group domain name. From here the Apigee X Runtime sends the API request over the VPC peering connection to apigee-x-project.

Google Cloud VPN connections allow Virtual Private Clouds (VPCs) to reference each other’s internal resources, with the help of Google Cloud Routers. Cloud Routers advertise each VPCs’ IP address ranges. This enables traffic over the Cloud VPN tunnels to reference resources via their private IP addresses. Additionally, Google Cloud DNS peering facilitates a consumer VPC to reference hostnames in a producer VPC.

From the apigee-x-vpc (consumer), the API request references a backend-project-a-vpc (producer) resource hostname, via DNS peering. This would be the backend identified in an Apigee X API proxy. The request itself does not traverse the DNS peering connection. Instead, the API request goes through a Cloud VPN tunnel. In this way, Cloud VPN is used as a substitute for VPC peering.

Shared VPC Hub Design

A more advanced example is a shared VPC hub project, illustrated in Figure 4. The general idea is the same; use Cloud VPN connections instead of peering connections, advertise routes using Cloud Router and use DNS peering to reference any compute resources by their hostnames.

What is interesting is the idea that the apigee-x-project can use a subnet in a shared VPC, independently of the hub-project, which is in the same shared VPC. Shared VPC subnets do not violate the VPC peering transitivity limit (only two peered VPCs in sequence). This architecture pattern can be scaled to connect multiple shared VPCs via VPN tunnels. This is analogous to cascading hub-and-spoke architecture pattern: the inner hub-and-spoke is the shared VPC (with the apigee-x-project) and the outer hub-and-spoke is the VPN connected backend-projects.

Fixing VPC Peering with Private Service Connect

Private Service Connect (PSC) allows private consumption of services across VPC networks. This feature is coming to Apigee X in the first half of 2022. Private Services Access (PSA) is what enables you to reach services’ internal IP addresses. Apigee X is a PSA service, hence its ability to connect to backends by their internal IP addresses. PSC is the missing piece that will natively support Apigee X backends in other VPCs.

What Next?

Try it out for yourself! We built and shared a working Terraform example in our Github repository. Apigee X opens up users to the products and features of Google Cloud VPCs. VPC transitivity limits do require some work to overcome. Private Service Connect (PSC) will solve Apigee X VPC peering challenges later in 2022. A great next step would be to implement a “wheel” architecture pattern. This is an evolution of the hub-and-spoke design, where spoke VPCs peer to each other. Cloud VPN makes this possible and PSC makes a wheel more feasible to implement. The advantage of a wheel is that spokes no longer rely on a hub VPC; for example productizing APIs in a multi-tenant environment. More details are available in the following ebook: The API Product Mindset

Resources

You can find the Terraform code in the Github repository.