Securing apps using Anthos Service Mesh
3974
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
Hi there! I’m David Challoner from Access Site Reliability Engineering (SRE), here with Anthony Bushong from Developer Relations to talk about how Corp Eng is adopting Anthos Service Mesh internally at Google.
Corp Eng is Google’s take on “Enterprise IT”. A big part of the Corp Eng mission is running the first and third party software that powers internal business processes – from legal and finance to floor planning and even the app hosting our cafe menus – all with the same security or production standards as any of Google’s first party applications.
Googlers need to access these applications, which sometimes then need to access other applications or other Google Cloud services. This traffic can cross different trust boundaries which can trigger different policies.
Access SRE runs the systems that mediate this access, and we implemented Anthos Service Mesh as part of our solution to secure the way Googlers access these applications.
But why?
You can probably tell, but the applications Corp Eng is responsible for have disparate requirements. This often means that certain applications are tied to disparate infrastructure due to legal, business or technical reasons – which can be challenging when those infrastructures work and operate differently.
Enter Anthos. Google Cloud built Anthos to provide a consistent platform interface unifying the experience of working with apps on these varying underlying infrastructures, with the Kubernetes API at its foundation.
So when searching for the right tool to build a common authorization framework to mediate access to CorpEng services, we turned to Anthos – specifically Anthos Service Mesh, powered by the open-source project, Istio. Whether these services were deployed in Google Cloud, in Corp Eng data centers, or at the edge onsite at actual Google campuses, Anthos Service Mesh delivered a consistent means for us to program secure connectivity.
To frame the impact ASM had on our organization, it’s helpful to introduce the roles of the folks who manage and use it:
For security stakeholders, ASM provides an extensible policy enforcement point running next to each application capable of provisioning a certificate based on the identity of the workload and enforcing mandatory fine-grained application-aware access controls.
For platform operators, ASM is delivered as a managed product, which reduces operational overhead by providing out-of-the-box release channels, maintenance windows, and a published Service Level Objective(SLO).
For service owners, ASM enables the decoupling of their applications from networking concerns, while also providing features like rate limiting, load shedding, request tracing, monitoring, and more. Features like these were typically only available for applications that ran on Borg, Google’s first-party cluster manager that ultimately inspired the creation of Kubernetes.
In sum, we were able to secure access to a plethora of different services with minimal operational overhead, all while providing service owners granular traffic control.
Let’s see what this looks like in practice!
The architecture
In this flow, user access first reaches the Google Cloud Global Load Balancer [1], configured with Identity Aware Proxy (IAP) and Cloud Armor. IAP is the publicly available implementation of Google’s internal philosophy of BeyondCorp, providing an authentication layer that works from untrusted networks without the need for a VPN.
Once a user is authenticated, their request then flows to the Ingress Gateway provided by Anthos Service Mesh [2]. This provides additional checks that traffic flows to services only when the request has come through IAP, while also enforcing mutual TLS (mTLS) between the Anthos Service Mesh Gateway to the Corp services owned by various teams.
Finally, additional policies are enforced by the sidecar running in every single service Pod [3]. Policies are pulled from source control using Anthos Config Management[4], and are propagated to all sidecars by the managed control plane provided by Anthos Service Mesh[5].
Managing the mesh
If you’re not familiar with how Istio works, it follows the pattern of a control plane and a data plane. We talked a little bit about the data plane – it is made up of the sidecar containers running alongside all of our service Pods. The control plane, however, is what’s responsible for updating these sidecars with the policies we want to enforce:
Figure 3 – High-level architecture for Istio
Thus, it is critical for us to ensure that the control plane is healthy. This is where Anthos Service Mesh gives our platform owners a huge advantage with its support for a fully-managed control plane. To provision cloud resources, like many other companies, our organization uses Terraform, the popular open-source infrastructure as code project. This gave us a declarative and familiar means for provisioning the Anthos Service Mesh control plane.
First, you enable the managed control plane feature for GKE by creating the google_gke_hub_feature resource below using Terraform.
resource "google_gke_hub_feature" "feature_asm" {
name = "servicemesh"
location = "global"
provider = google-beta
}Keep in mind that at publication time, this is only available via the google-bet provider in Terraform.
Once created, we then provision a ControlPlaneRevision custom resource in a GKE cluster to spin up a managed control plane for ASM in that cluster:
apiVersion: mesh.cloud.google.com/v1alpha1
kind: ControlPlaneRevision
metadata:
name: asm-managed
namespace: istio-system
spec:
type: managed_service
channel: regularUsing this custom resource, we are able to set the release channel for the ASM managed control plane. This allows for our platform team to define the pace of upgrades in accordance with our team’s needs.
In addition to managing the control plane, ASM also provides management functionality around the data plane to ensure each sidecar Envoy is kept up to date with the latest security updates and is compatible with the control plane – one less thing for service operators to worry about. It does this using Kubernetes Mutating Admission Webhooks and Namespace labels to modify our Pod workload definitions to inject the appropriate sidecar proxy version.
Syncing mandatory access policies
With the core Anthos Service Mesh components in place, our security practitioners can define consistent, mandatory security policies for every single GKE cluster, using Istio APIs.
For example, one policy is enforcing strict mTLS between Pods using automatically provisioned workload identity certificates. Earlier, we talked about how this is enforced between the Istio Gateway; that same policy enforces mTLS between all Pods in our cluster.
Another policy we implement is denying all egress traffic by default, requiring service teams to explicitly declare their outbound dependencies. The following is an example of using an Istio Service Entry to allow granular access to a specific external service – in this case, Google. This helps prevent unintended access to external services.
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: google
spec:
hosts:
- www.google.com
ports:
- number: 443
name: https
protocol: HTTPS
resolution: DNS
location: MESH_EXTERNAL
EOFThese policies are automatically synced to all service mesh namespaces in each cluster using Anthos Config Management. By using our internal source control system as a source of truth, Anthos Config Management can sync and reconcile policies across all of our GKE clusters, ensuring that these policies are in place for every single one of our services. You can find more details about our implementation of Anthos Config Management here.
With this in place, our team plans on eventually migrating away from security automation that operates solely based on explicit IP, port and protocol policies.
Integration with Identity-aware Proxy
The publicly available version of the BeyondCorp proxy used by CorpEng is called Identity-aware Proxy (IAP), which offers an integration with Anthos Service Mesh. IAP allows you to authenticate users trying to access your services and apply Context-Aware-Access policies. This integration comes with two main benefits:
- Ensuring that user traffic to services in the service mesh only come through Identity-aware Proxy
- Enforcing Context-aware access (CAA) trust levels for devices, defined by multiple device signals we collect
Identity-aware Proxy allows us to capture this information in a Request Context Token (RCToken), which is a JSON Web Token (JWT) created by Identity-aware Proxy that can be verified by ASM. IAP inserts this JWT into the Ingress-Authorization header. Using Istio Authorization Policies similar to the following policy, any requests without this JWT are denied:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: iap-gateway-require-jwt
namespace: istio-system
spec:
selector:
matchLabels:
app: istio-iap-ingressgateway
action: DENY
rules:
- from:
- source:
notRequestPrincipals: ["*"]
Here is an example policy that requires a fullyTrustedDevice access level – this might be a device in your organization that is known to be corporate-owned, fully-updated, and running an IT-approved configuration :
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: require-fully-trusted-device
namespace: fooService
spec:
selector:
matchLabels:
app: fooService
action: ALLOW
rules:
- from:
- source:
requestPrincipals: ["*"]
when:
- key: request.auth.claims[google.access_levels]
values: ["accessPolicies/$orgId/accessLevels/fullyTrustedDevice"]This allows our security team to not only secure service to service communications, or outbound calls from services, but also specifically require incoming requests come from trusted devices and authenticated users using a trusted device.
Enabling service teams
As an SRE, one of our priorities is ensuring Service-level indicators (SLIs), SLOs, and Service-level agreements (SLAs) exist for services. Anthos Service Mesh helps us empower service owners to do this for their services, as it exposes horizontal request metrics like latency and availability to all services in the mesh.
Before Anthos Service Mesh, each application had to export these separately (if at all). With ASM service owners can easily define their Service’s SLOs in the cloud console or via terraform using these horizontally exported metrics. This then allows us to integrate SLOs into our higher-level service definitions so we can enable SLO monitoring and alerting by default. You can see the SRE book for more details on SLOs and Error budgets.
The takeaway
ASM is a powerful tool that enterprises can use to modernize their IT infrastructure. It provides:
- A shared environment-agnostic enforcement point to manage security policy
- A unified way to provision identities, describe application dependencies
This also enables previously unheard of operational capabilities such as distributed tracing or incremental canary rollouts – which were difficult to find in the typical enterprise application landscape.
Because it can be incrementally adopted and composed with existing authorization systems to close gaps – barriers to adoption are low and we recommend you start evaluating it today!
3913
Of your peers have already downloaded this article
5:30 Minutes
The most insightful time you'll spend today!
The 2019 Accelerate State of DevOps Report confirms analyst reports that DevOps is crossing the chasm with the proportion of elite performers almost tripling compared to last year.
The report finds that delivering software quickly, reliably, and safely is at the heart of technology transformation and organizational performance. The report also finds that there’s a right way to handle the change approval process, and it leads to improvements in speed and stability and reductions in burnout.
Download this report and get:
- Insights on how to achieve elite performance in software development and delivery so you can deliver more value to your customers and stakeholders.
- Role of cloud computing in driving technology and organizational performance, with guidance on how to improve your use of the cloud.
- Smart ways to improve productivity and how the highest performers scale DevOps to maximize success.
Kaluza & Google Cloud: Committed to Powering Up 73 Million EVs by 2040
1221
Of your peers have already read this article.
4:00 Minutes
The most insightful time you'll spend today!
Electric vehicles already account for one in seven car sales globally, and with new gas and diesel cars being phased out across the world, global sales are forecast to reach 73 million units in 2040. But with power grids becoming increasingly dependent on variable energy sources such as wind and solar, rising demand from electric vehicles risks overstraining grids at peak times, potentially leading to power outages.
At Kaluza, we believe that our platform has a vital role to play in helping power grids and utility companies to stabilize their networks, while at the same time delivering more affordable, cleaner energy to the consumer. Powered by Google Cloud, the advanced algorithms behind our Kaluza Flex solution automatically charge electric vehicles when the power supply is at its cheapest and greenest, helping to accelerate the global transition towards a zero-carbon future.
Decarbonizing the grid with low-cost smart charging programs
Launched by OVO Energy in 2019, Kaluza has taken its deep understanding of the energy market to partner with some of the world’s major energy suppliers and vehicle manufacturers, including AGL in Australia, Fiat and Nissan in the UK, and Mitsubishi Corporation and Chubu in Japan, to launch smart charging programs that help customers save money while reducing their carbon footprint.
A good example of this is Charge Anytime, which we recently launched with OVO Energy in the UK. With this tariff, customers use Kaluza to smart-charge their electric vehicle, and pay just 10p per kWh — a third of their household electricity rate — to do so. This means that if the customer plugs in their vehicle to charge when they get home from work at, say, 6:00 p.m. — a time when both demand and the carbon intensity on the grid are at their highest — their vehicle will then be smartly charged at the lowest cost and greenest periods throughout the night, ready for when they need it in the morning.
This smart charging reduces the energy company’s costs by enabling them to take advantage of lower wholesale electricity prices. These savings are then passed on to the end customer through tariffs such as Charge Anytime, saving customers hundreds of pounds a year and reducing their carbon footprint. Meanwhile, the National Grid is able to reduce the strain on the network during peak hours, while simultaneously using up the excess renewable energy that might otherwise have gone to waste.
Optimized charging schedules, fueled by Google Cloud
Behind Kaluza’s smart charging solution lies some sophisticated technology, all of which is built on Google Cloud. Our core optimization engine gathers real-time data from a wide range of sources, including battery and charging data from the electric vehicles, and data from the energy suppliers and grid operators, such as the carbon intensity, and price forecasts.
After passing through our real-time data backbone, that data is stored in BigQuery where it’s used to train and validate our smart charging optimization models. These models are then deployed with Google Kubernetes Engine so that whenever a customer plugs in an electric vehicle, data from that vehicle passes in real-time through our optimization engine to calculate the ideal charging schedule for that vehicle, ensuring it uses the cheapest, least carbon-intensive energy available.
Customer interface: easy to use, simple to build
Of course, the customer isn’t aware of any of this complexity. All they need to do is open their charging app and use Kaluza’s intuitive interface to set what time they want their car to be ready and how much charge they want in their battery. Then they simply plug in their car, and our algorithms take care of the rest.
Customers can also use Kaluza to view breakdowns of how much carbon and money they’ve saved, along with insights around things like billing and battery life, all of which is backed by Cloud SQL.
With Google Cloud, we were able to roll out this end-user app very quickly. Instead of having to build a different version of the app for each operating system, we were able to build an OS-agnostic version using Flutter, which then builds the app for each platform, enabling us to get to market faster.
This has been a benefit of our architecture in general. With Google Cloud taking the complexity out of otherwise time-consuming development processes, we’ve been able to experiment with and validate propositions rapidly, and roll out new products and features at speed, to ensure that we remain at the vanguard of a rapidly evolving sector.
Giving energy companies full visibility with BigQuery and Looker
As for the grid operators and energy companies, the Kaluza platform allows them to visualize how many participating electric vehicles are plugged into the network at any one time. BigQuery and Looker Studio dashboards provide granular insights, such as how many vehicles are idle, how many are charging, and how well our optimization engine is working.
The platform also allows companies to view those vehicles on an aggregate level, and identify any issues. Google Cloud machine learning capabilities can even allow grid operators to use this aggregate view to forecast how much energy will be required at any one time, and dial the power generation up or down accordingly.
Ultimately, these insights help network operators and utility companies to optimize energy usage, and balance out the peaks and troughs of supply and demand, ensuring that excess renewable energy is captured, while carbon-intensive fuel use is reduced.
Feeding energy back into the grid with bidirectional charging
Vehicle-to-Grid (V2G), or bidirectional, charging is something that we are very excited about, and have begun rolling out in the UK, as we prepare to launch in other global markets. Built on the same Google Cloud architecture as the rest of Kaluza Flex, V2G not only enables smart charging, but allows electric vehicles to feed stored energy back into the grid.
Imagine an electric vehicle battery that can store 40 kWh of energy, but only uses 5 kWh a day. That leaves 35 kWh a day that can be charged to the battery during times of low demand, when energy is cheapest and greenest, then fed back into the network during peak periods, removing the need for more fossil fuels to be burned to meet demand.
Not only does V2G go further than conventional smart charging to make use of renewable energy when it’s abundant and support the balancing of the energy system, it also results in even lower energy prices for the customer, as they are effectively selling energy back to the grid. For example, as part of a large domestic V2G trial made in partnership with OVO and Nissan, Kaluza saved customers an average of £450 a year, with some customers saving up to £800/year by selling surplus energy back to the grid — transforming their homes into mini power stations.
With Kaluza Flex, we have a platform that offers benefits for all parties, from the grid operators, through to energy retailers and vehicle manufacturers, and all the way to the customer. Now, our aim is to bring this exciting offering to as many markets as possible, a goal which is made easier thanks to the scalable infrastructure and time-saving solutions of Google Cloud.
As more people make the switch to electric vehicles, our goal is to ensure that smart charging becomes standard practice, as we help to deliver on the potential of electric vehicles to contribute to a greener, decarbonized future.
Modernize your Windows Server Workloads using Google Cloud Platform
DOWNLOAD RESEARCH REPORTS6238
Of your peers have already downloaded this article
1:30 Minutes
The most insightful time you'll spend today!
Application Modernization is an important enabler of Digital Transformations (DX), which fuel competitive advantage through increased productivity and business agility. Public cloud infrastructure proves to be a solid foundation for application modernization by providing Self-Service Provisioning capabilities, cloud-based & cloud-native technologies, and easier access to technology innovations such as AI/ML.
Windows Server-based enterprise applications rely on the underlying infrastructure for platform performance, security, and availability. A better performing cloud platform enables them to perform better and hence prove to be more resource-optimized and cost-effective.
Download this IDC report to understand why you should move your Windows Server workloads to Google Cloud and the benefits you can derive.
APIs and IT Rationalization: Cost Avoidance and Cost Savings for Enterprise IT
DOWNLOAD E-BOOK3801
Of your peers have already downloaded this article
6:30 Minutes
The most insightful time you'll spend today!
The dynamic and fast-moving business environments of today demands that technology leaders and teams deliver more at a lightning speed, all the while working within the constraints of shoe-string budgets and tight project timelines. Winning in today’s environment requires a more strategic approach to optimize utilization of resources, remove unnecessary spend and free more dollars for innovation.
In every organization there are several necessary and unnecessary costs distributed throughout a typical enterprise architecture. There are two main aspects to focus on in IT rationalization: cost avoidance and cost savings. Implementing an API tier can lead to operational efficiencies , faster development, and cost savings and avoidance.
Read this eBook to explore the less well-understood and sometimes harder to find opportunities for reducing spend like cost avoidance (not paying for something that you would have had to pay for otherwise) and cost savings (reducing or eliminating a current expense). Learn how strategically integrating APIs can help you counteract the complexity of organic technology accretion, enable both cost savings and cost avoidance and improve business efficiency.
Google Cloud is a Leader in Q1 2022’s Public Cloud Container Platform: Forrester
3234
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
We’re thrilled to share the news that leading global research and advisory firm Forrester Research has named Google Cloud a Leader in the recently published report The Forrester WaveTM: Public Cloud Container Platforms, Q1 2022. Forrester evaluated the container and cloud-native offerings of a select group of top public cloud container platform vendors across 29 comprehensive criteria.
We are proud that Forrester evaluated the strength and cohesion of our offerings, including Google Kubernetes Engine (GKE), Cloud Run, Anthos, Cloud Build, Cloud Deploy, Cloud Code and more, writing that, “Google Cloud is the best fit for firms that want extensive cutting-edge cloud-native capabilities for distributed workloads spanning public cloud, private cloud, and multicloud environments.”
Google Cloud received the highest possible scores in the criteria of service and application catalogs, microservice development support, service mesh support, serverless and FaaS support, DevOps automation, container image support, control plane configuration, hybrid cloud support, container networking, product vision, supporting products and services, market approach, revenue, and breadth of offering. We also achieved the highest score in the Strategy category of all the vendors evaluated.
Google Cloud is all-in on containers and cloud native
The cloud-native tools and technologies created by Google Cloud are already powering the most innovative, scalable and secure apps around the world, from the most exciting digital natives to the most important enterprise industry leaders. Why? Cloud native means building and running modern apps that intentionally take advantage of the global scale, pervasive automation, elastic infrastructure, and secure resiliency of the public cloud.
For enterprises, cloud native in practice means using containers, Kubernetes, serverless, and DevOps automation to build amazing customer-facing apps quickly, to modernize existing business-critical apps safely, and to operate them all on cost-efficient, powerful, and secure cloud infrastructure globally.Over the past decade, Google Cloud’s technology innovation has fueled various domains of the cloud native ecosystem, such as Kubernetes and Go languages as the foundation, Istio for service mesh, Kubeflow for machine learning, Knative for serverless, and Tekton for CI/CD. Long-term investment and practices in cloud-native power its superior product vision and excellent supporting products and services.
The Forrester Wave: Public Cloud Container Platforms, Q1 2022
Dedicated to simplicity, speed, and scale for your modern apps
Our mission is to create, integrate, scale, and secure the best open source and commercial cloud-native technologies – backed by a consistent cloud control plane – so you can spend more time dreaming of ways to delight your customers and less time building and operating platforms. We are committed to leading in cloud-native open source communities and making containers and Kubernetes accessible to everyone, from everywhere.
Here are a few recent highlights across our container services and tools, aimed at helping you build and modernize your most important apps with cloud native:
The most scalable fully managed Kubernetes service, Google Kubernetes Engine (GKE), achieved an overall solution score of 92 out of 100 in Gartner’s Solution Scorecard. In 2021, we introduced GKE Autopilot, a fully managed, security-hardened Kubernetes service optimized for production workloads. This unique mode of operation allows you to focus on your workloads while Google manages your cluster infrastructure. There’s nothing else like it. Then, we made GKE apps even faster with GKE image streaming. With proven scalability to 15K nodes in a single cluster and innovations such as four-way autoscaling, node auto-upgrades, integrated logging and metrics, cost optimization insights, native backup and restore, and multi-instance GPUs to accelerate machine learning workloads, GKE remains the best choice in managed Kubernetes services.
With Cloud Run, we expanded the range of users who benefit from containers to those who don’t know much about them. Introduced in 2019, Cloud Run combines the serverless attributes of autoscaling and developer experience with the flexibility of containers. Developers can use any language, runtime or binary, and deploy code using buildpacks to automatically build container images from source without worrying about provisioning machines and clusters. Cloud Run goes beyond FaaS and beyond earlier generations of serverless computing. Cloud Run runs more legacy workloads, integrates with Cloud Build for secure and compliant builds, offers deeper cost controls and billing flexibility, and encourages portability. We added support for social feeds, collaborative editing, and multiplayer games that use bidirectional streaming. Minimum instances reduce cold-start delays so you can run more latency-sensitive applications. And recently, we launched support for network file systems, allowing developers to share and persist data between multiple containers and services.
Anthos is at the heart of the Google Distributed Cloud, a portfolio of software and hardware solutions announced in 2021 that extend Google’s container platform services to the data center and the edge. Anthos is how we extend GKE to wherever you need cloud-native apps. Manage clusters on-premises on bare metal and VMware-virtualized servers, on AWS and Azure, and at the edge – all with a Google Cloud-backed control plane for consistent, automated operations at scale. We added a hosted service for configuration management to keep all your clusters in sync, and trimmed our installation footprint and streamlined cluster management with a new multi-cloud API that enables you to use a single API for full lifecycle management of Anthos Kubernetes clusters in AWS or Azure.
Finally, since no public cloud container platform is complete without powerful DevOps tools, we expanded our CI/CD offerings to make your developers even more productive, wherever they build and deploy cloud native apps. Use Cloud Code and Cloud Shell as your go-to cloud-native IDEs. Cloud Build is a fully managed serverless DevOps automation platform for use cases spanning CI/CD, Infrastructure-as-Code, AI/MLOps, and more, across infrastructure GKE, Cloud Run, Cloud Functions and more. Google Cloud Deploy is a fully managed continuous delivery service that provides one-click release promotion and roll-backs, built-in metrics, and out-of-the-box security. Artifact Registry and Container Analysis provide managed artifact repositories, vulnerability scanning, and help secure the software supply chain.Google Cloud has a solid cloud-native innovation roadmap, targeting simplicity at scale for enterprise clients.
The Forrester Wave: Public Cloud Container Platforms, Q1 2022
We are delighted and humbled to be recognized as a Leader in public cloud container platforms by Forrester. Grab your copy of The Forrester WaveTM: Public Cloud Container Platforms, Q1 2022 today and let us know how we can help you build and modernize your most important apps how you want and where you want.
More Relevant Stories for Your Company
APIs Help ING to Go from App Ideation to Production in 48 Hours
After undergoing an agile transformation, ING realized it needed a standardized platform to support the work their developers were doing. "Our DevOps teams got empowered to be autonomous," says Thijs Ebbers, Infrastructure Architect. "It has benefits, you get all kinds of ideas. But a lot of teams are going to devise the
Held Back by Database Scalability, This Financial Services Company Switches to Google Cloud and Cloud Spanner
Azimut Group operates an international network of companies handling investment and asset management, mutual funds, hedge funds, and insurance. Founded in Milan, Italy in 1988, Azimut Group today has branches in fifteen countries, including Brazil, China, and the USA. “We have subsidiaries and manage funds all over the world,” explains Simone
How Google Anthos Can Help Modernize Application Security
Anthos is a modern app management platform from Google Cloud that aims to deliver a consistent development, operations, and security experience across cloud environments. Anthos is designed for enterprise organizations that want to accelerate the development and deployment of dynamic apps and who value service automation, cost governance, and security
How APIs Help Financial Services Firms Enhance Digital CX and Increase Revenue
Faced with changing customer behaviors and demands, tightening margins, and increasing threat from digital competitors, financial services institutions (FSIs) will need to meet customers where they are, open up their services, and establish new ways to monetize their products. Doing so will also enable them to build a better profile
