The Technology Chronicle

 Google API Private Access Private Google Access is configured at the subnet level and allows subnetworks to access GCP services privately. The resources in the subnet can access Google services without an external IP, for eg: Cloud storage, Youtube, etc. It offers better security as the exposure to outside networks is reduced, thereby minimizing the possibilities of data interception and attacks. Google cloud service accounts  These accounts are used for service-to-service authentication. For eg: an application in compute engine can use a service account to access a storage account  Two types of service accounts - Google-managed service accounts & user-managed service accounts In Google-managed service accounts, the private and public keys are managed by Google. Each key can be used for a max of two weeks. Private keys of google managed keys are never directly accessible and the platform itself manages the key rotation process With user-managed keys, only public keys...

 In the third part of our tech basics series on Containers, Microservices & Kubernetes, we will talk about Pods, ReplicaSets, and Replication controllers. If you are new here, do check out  Part 1  and  Part 2  of this blog series first!! What are Pods? Pods are the smallest object you can create in Kubernetes that encapsulates containers. Imagine a single node K8s clusters running a single pod. When the application needs to scale, you create additional pods of the same application. The pods can also be distributed across multiple nodes in a cluster. Usually, the relationship between pods and containers is 1:1, but it is not mandatory. There is a case of a side car  container as well, which could be helping the main application and included in the same pod. Every time a new pod of the application is created, both the main container and sidecar container are created together. They share the same network and storage and can connect to each other as localh...

Part 2 : Container orchestration using Kubernetes In the second part of our tech basics series on Containers, Microservices & Kubernetes , we will talk about container orchestration and Kubernetes. If you are new here, do check out Part 1 of this blog series first!! Why do you need container orchestration? Running a single application in a container might look simple and straight forward. However in the real world, there will be multiple other services that the application needs to talk to. The application should scale based on the capacity requirements. There should be a control plane that is capable of orchestrating these connectivity requirements, scaling, scheduling and lifecycle management of containers. That is where container orchestration comes into picture. Container orchestration solutions like Docker swarm, Mesos and Kubernetes offer a centralized tool for managing containers, scheduling and scaling containers. Of the many container orchestration platform Kubernetes is ...

 I am starting a set of new blog series to help those who are new to cloud technology - junior engineers, tech aspirants & students etc. I will try to explain the basics in simple terms that will help you develop a good foundation of the latest and greatest in cloud technologies. If you are a seasoned cloud expert, this series will act as a good refresher course! We will kick off with a series on containers, Microservices  & Kubernetes. After covering the basics we will move on to move advanced topics on how you can build and deploy containerized applications on various cloud platforms Part 1 - Containers What are containers? Containers bundle the application code, its dependencies and configurations required to run the application in a single unit. There are different container technologies available - Docker, Containerd, rkt and LXD. The most popular container technology is Docker . Containers are a form of operating system virtualization, where multiple applications...

 Integrating existing identity management solution with Google Cloud Platform Given below are the  steps to integrate a third party identity management platform You should have a domain that is enabled for email. In case of a preexisting domain registered with Google or a non-existent domain you cannot proceed You should have permissions to verify domain ownership by creating txt or CNAME entry Implement SAML SSO if existing identity management system is to be used for authentication to GCP console Create the first cloud identity administration account and account for admin who will manage users in GCP Configure billing accounts- this can either be an online account or offline invoiced account linked to a Purchase Order. For applying for an invoiced billing account you would need to meet certain criteria , ie be a registered business for one year, have min billing of $2500/month for 3 months Create additional admin accounts like network admins or organization admins Use direct...

On January 28, 2023, I was given the opportunity to give a presentation at my alma mater, College of Engineering Poonjar , as a prelude of IHRD tech fest Tarang23. My manager at Google, Mr Sundar Pelapur , a veteran with two decades of experience in IT industry was my co-presenter . It was a great experience interacting with the next generation of Engineering talent , sharing with them our perspective of the topic " Disrupting the status quo: How Cloud and AI are shaping the future of our world ".   Sharing below an summary of the tech talk, and some useful reference materials, which I think will be helpful for young IT professionals and students who want to make a career in Cloud computing: We started off with  a brief history of cloud computing , on how the world has moved on from Mainframes in the 1970s to Server/client computing models and to the constructs of Public clouds today Let's define in simple terms what cloud computing is.. Its nothing but compute power an...

   This blog covers review notes for logging, DNS security & Google Cloud web Security Scanner Service 1. Aggregated sinks Sinks can be constructed with the "includeChildren" parameter set to "True" for cloud organisation / folders. The logs from these organizations , folders , projects or billing accounts can be routed to these sinks. 2. DNS security extension DNS Security Extensions (DNSSEC) is the security protocol that enables authentication of DNS data. It is a DNS protocol extension that adds an additional degree of security by enabling users to digitally sign their DNS records, making it more challenging for attackers to tamper with DNS data. Customers can enable DNSSEC on Google Cloud's Cloud DNS service to safeguard their domains from unauthorized alterations. 3. Google Cloud web Security Scanner Service To find common vulnerabilities in web applications, such as those listed in the OWASP Top 10, customers can use the Google cloud web security sca...

Key points to review before the exam about firewalls, container best practices and DDoS protection 1. Firewall default rules: Following rules are created with lowest priority and will be applicable if not overridden by a higher priority rule All default outbound traffic is allowed (Refer the following document for exceptions: https://cloud.google.com/vpc/docs/firewalls#blockedtraffic) All ingress traffic is blocked 3. Container best practices: Package single app or piece of software as a container. An application with unique parent process but different possible child processes qualifies for this Run a PID1 and register Signal handlers Enable process namespace sharing in Kubernetes Use a specialized init system Optimize for Docker build cache Remove unnecessary tools Build the smallest image possible using the smallest base image, creating images with common layers and reducing clutter Enable image scanning for vulnerability Tag images using options like semantic versioning and Git c...

Do checkout some of  my blogs that I published in Medium.com in 2022 in Google Cloud Community Google Cloud DevOps Series : Google Cloud compute options for Kubernetes This is a blog series on Google Cloud DevOps , and how Devops is done the Google way. I have authored Part 2 of the blog series that talks about Compute options for Kubernetes Google Cloud Anthos Series : Anthos Multi-Cluster Ingress This is a blog series on Google Cloud Anthos and how it can help scale your applications transcending geographic and cloud boundaries. I have authored Part 6 of this blog series that explains how Multi-Cluster Ingress can be enabled for Anthos SAP on Google Cloud Series : The fundamentals This is a blog series that focusses on the constructs of hosting SAP workloads on Google cloud. I have authored Part 1 of the  blog series that covers the fundamentals of SAP on Google cloud

All leading cloud providers have a well defined Cloud Adoption Framework that will help you shape up your cloud migration strategy. Customers would eventually end up with one of the 5 'R's of rationalization - Rehost(Lift&shift) , Refactor, Rearchitect, Rebuild or Replace.  Once you have identified the approach , next steps would be planning and execution. However the best  plans laid out by  a professional services team can be driven off the track by  customer specific environment challenges. If you are helping customers with cloud migration, here are few things that you might want to think through again and prepare for before you go all in . 1.Start with stakeholder buy in The first step called out in Azure Cloud Adoption Framework is Strategy  or rather the motivation of the organization to move to cloud. Though this would usually be done in the presales phase and might have the buy in of the C-Suite, it is very important that this acceptance trickles do...

Multi and Hybrid cloud deployments have become more of a norm than exception and how seamlessly you can manage resources deployed across multiple environments would determine the success of your digital transformation. Azure Arc enables this by providing a solution that enables consistent management of workloads across environments. It helps onboard resources from  heterogeneous deployments  and manage them using familiar premises of Azure Resource Manager. Azure Arc currently supports VM, Kubernetes clusters(preview) and databases(preview) , and you can monitor and manage them from Azure irrespective of where it is deployed. Azure Arc can  be used for centralized monitoring and management of k8s clusters deployed across different cloud environments or on-premises. This service is currently in preview. As part of my weekend tinkering , I explored Azure Arc enabled Kubernetes cluster. The process for setting it up for a lab is pretty straight forward, and you will get most...

AKS is evolving at a dizzying pace and there have been quite  a number of changes since I wrote about AKS namespace isolation and AAD integration . The major update is in terms of creating and Azure AD integrated AKS cluster. You no longer need to create and manage the server and client application, it is handled by the AKS resource provider.  There are few limitations with this approach though before you get started   - You cannot disable the AKS-managed Azure AD integration once it is enabled   - Process is supported only for RBAC enabled clusters   - Azure AD tenant once integrated cannot be switched to a different one Lets start with creating an Azure AD group. You can also use an existing one if you want to. Note that creating an Azure AD group would need Global administrator rights I am executing these steps from Azure cloud shell , where all the required tools like Azure CLI and Kubectl are preinstalled 1. Create the Azure AD group for your cluster admin...

When your workloads are in the cloud the constructs of deployment, configuration and operations are strikingly different from what you would have used on-premises. Adopting the right architecture, without doubt, is the key to host an application successfully in the cloud. Azure helps you with this every step of the process through Azure Well Architected framework. Consider this as a blueprint for excellence in Azure cloud. It consist of five main pillars - Cost optimization, Operational excellence, Performance efficiency, Reliability and Security Cost Optimization :  The basic principle is to start small and scale as you go. Instead of making a  huge investment upfront, it is recommended to follow the approach of "Build-Measure-Learn" , aligned with Azure Cloud Adoption Framework (CAF). It focusses on building a minimum viable product(MVP), measuring the feedback and then use a  fail fast approach  to optimize your cost. Azure cost calculator can help to get you the ...