I have the following use case:
Application is deployed on App Engine Flex environment.
Application fetches data from an FTP server on API request.
FTP server can only be accessed through a custom VPN.
Can I access the FTP server from an App Engine Flex environment? If so, what would I need?
Apologies if this is not clear, I am not a network/devOps person.
As a solution, you can connect your on-premises network and application deployed to App Engine Flex via Google Cloud VPN:
Cloud VPN securely connects your peer network to your Google
Cloud (GCP) Virtual Private Cloud (VPC) network through an
IPsec VPN connection. Traffic traveling between the two
networks is encrypted by one VPN gateway, then decrypted by the other
VPN gateway. This protects your data as it travels over the internet.
You can also connect two instances of Cloud VPN to each other.
App Engine Flexible Environment is based on Google Compute Engine and consequently can connect to your remote network via Cloud VPNs. As described in the documentation Configuring your App with app.yaml, you can specify network settings in your app.yaml configuration file:
... app in App Engine is configured using an app.yaml file, that
contains CPU, memory, network and disk resources, scaling, and other
general settings including environment variables.
Related
Use case: I am managing both GCP infrastructure and local infrastructure and am looking for a way for an app on Google App Engine to send data to/from a MySQL database on the local infrastructure, which is behind a VPN. I've set up and tested a Cloud VPN Gateway and VPC Connector that allows a Google Compute Engine instance to connect to the MySQL database and send and retrieve data.
Per this thread, and my own experimentation, the Google App Engine standard environment cannot currently connect to a local network via Google Cloud VPN directly. I've also been testing Cloud Function and Cloud Run to see if they can connect with the Cloud VPN, and it seems that they also have this limitation.
What I'd like to confirm is that only the Google App Engine flex environment OR a Google Compute Engine instance can connect through Cloud VPN. Google's documentation across all these resources doesn't ever outright say whether any of them can connect to Cloud VPN through a VPC Connector (just that they can connect to GCP networks via VPC Connector), so I'm hoping someone here can corroborate my testing. Additionally, is there any other GCP resource that can make use of this functionality that I've missed?
I'm not an expert in networking so excuse the bad wording.
I have a Google App Engine service running in Google cloud (Standard environment). I need this service to access a VPN (i.e. ip-addresses in that VPN setup). How can I set this up with an IPSEC tunnel? I've looked a bit at Google VPN but it most seems how to setup a VPN Server, I want to be the client to an external VPN network so my App Engine service can access computers on that VPN.
Thanks
As other members have pointed out, there is no a direct way to connect GAE Standard service to a resource inside an external, on-premise, VPN. However, there some approaches.
There is a feature called Serverless VPC Access that allows GAE Standard to connect to other Google Cloud resources through an internal IP, but here is the interesting part:
Serverless VPC Access supports communication to VPC networks connected via Cloud VPN
Looking at the tutorial on Connecting to a VPC network, it is mentioned something similar to what I understood you are trying to achieve:
Your app needs to access data from your on-premises database through Cloud VPN.
The first step I would say is to connect your VPN to Cloud VPN. Since I'm not expert in those matters I'd suggest you take at its documentation.
We have this discussion in our office and can not come to a conclusion. So I am reaching out here for some advice.
We have a Google Cloud SQL running with no public IP. Google App engine from different App Engine project connect to this single cloud SQL by authorizing their service account.
There are no VPC setup between the projects. The apps are on google app engine standard environment. The instance's private IP is not used in the app projects.
The connections between the projects are made using the tutorial found here
https://cloud.google.com/sql/docs/mysql/connect-app-engine
creating an connection string as
mysql+pymysql://<db_user>:<db_pass>#/<db_name>?unix_socket=/cloudsql/<cloud_sql_instance_name>
The question is how does the traffic flow from other App Engine projects to this Cloud SQL instance?
Does the connect handshake go via the internet (ie outside Google's Network) or does google handles the traffic and routes it internally without the request ever going to the internet?
It would be a great help if any one can help answer these questions.
The answer to this actually varies depending on which version of App Engine you are using.
On older versions of App Engine Standard, the /cloudsql/ unix socket connected over an internal network directly to your instance.
On more recent versions of App Engine Standard, it uses a version of the Cloud SQL proxy to authenticate your connection to the instance via it's public IP. This is why the Connecting from App Engine page states your Cloud SQL instance must have a public IP.
If you have configured your Cloud SQL to use a Private IP address then connectivity occurs using VPC Network Peering and your communication from your Google App Engine (running inside Google and VPC connected) to your managed Cloud SQL (running on a separated VPC Network) is all internal within Google using VPC.
Details on this can be found in the article here:
Introducing private networking connection for Cloud SQL
Private IP (MySql)
Configuring private IP connectivity (PostgreSQL)
The connection from the App Engine Standard to the Cloud SQL instance it is made over the internet. There are more internal services between the App Engine and the Cloud SQL, but the calls are not made to the private IP of the instance, by default.
If you look in the readme of the connector's repository you can see that you can use almost the same method to connect to the Cloud SQL instance from your local env. That might be a clue that things happen on the internet.
I have a Google Cloud project with an app and a Cloud SQL Instance. SQL requests from the app time out. Private IP connectivity is enabled. If I explicitly add the app instances' IPs to the SQL Instance's public authorized networks, it works. This is obviously a bad solution since these IPs change on every deployment. How do I permanently grant access to the app?
Private IP's are only accessible by other services on the same Virtual Private Cloud (VPC). App Engine apps don't currently have access to VPC networks.
Edit: App Engine has recently released Serverless VPC Access, meaning that the can now be configured to connect via Private IP.
App Engine Standard does provide a unix domain socket to interface with Cloud SQL instances. Just tell your app to use the socket at /cloudsql/<INSTANCE_CONNECTION_NAME>; (with your instance's connection name), and it should be able to connect. If you are using a cross product or cross regional setup, there are more instructions here.
We plan to use Appengine for our Node.JS REST-API which will serve content for our customers. The data will come from a MOngoDB Cluster (or Replicaset), which will also be hosted on Google Cloud Services. Some of the contents might be cached using the Memcache of AppEngine.
Now my question. Is it neccessary to setup a kind of VLAN or similar, to connect to the DB server? How can we assure that the DB server is connected with a good bandwidth / latency to the AppEngine instances? Or is this no matter of concern at all?
Another question, does Google Cloud have a kind of internal DNS, which can be used? So for example that we have a domainname like "ourmongodb.internal" which can be used in connection string of our REST API? Or how is the most recent approach to connect to our DB server instance?
If you use app engine flex you can setup your nodejs app engine server and the GCE VMs that run the mogoDB cluster in the same network and than connect them both in the internal IP space.