We want to use an app engine flexible process to update our ElasticSearch index, which is on Google Kubernetes Engine. We need to connect to ElasticSearch via a http(s) address. What's the recommended way to do this? We don't want to expose the cluster to the external networks since we don't have authentication in front of it.
I've seen this SO post but both k8s and AE have changed a lot in the 2 years since the question/answer.
Thanks for your help!
The post you linked to was about App Engine Standard. App Engine Flex is built on top of the same Google Cloud networking that is used by Google Compute Engine virtual machines and Google Kubernetes Engine clusters. As long as you put the App Engine flex application into the same VPC as the Google Kubernetes Engine cluster you should be able to communicate between them using internal networking.
On the other hand, to expose a Kubernetes service to anything running outside of the cluster will require you to modify the service for Elastic search because by default Kubernetes services are only reachable from inside of the cluster (due to the way that the service IPs are allocated and reached via IPTables magic). You need to "expose" the service, but rather than exposing it to the internet via an external load balancer, you expose it to the VPC using an internal load balancer. See https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing.
in addition to Robert's answer, make sure that app engine and GKE are in the same region,
because Internal load balancers are not usable from other region.
check this https://issuetracker.google.com/issues/111021512
Related
I need some help about communication between GAE and GKE.
I have :
- a golang application deployed on GAE region europe-west2.
- a Elasticsearch cluster on GKE region europe-west1-d.
The GKE service has annotations:
cloud.google.com/load-balancer-type: Internal.
I would like to connect both. How do ? In fact that a GAE microservice able to request ES.
I create 2 VPC network and appair them.
Using flex GAE for specify network and sub.
What's wrong ? It's not possible ?
The internal load balancer you are using to expose the GKE service can only be accessed within the same region and network (peered network and VPNs are fine).
GAE normally does not get deployed within a network in your project.
However, based on your comment, it seems you are using App Engine Flex. Make sure the GAE Flex instance is created in the same region as your GKE cluster and that they are either in the same network or are using Peered networks.
I find it odd that it's common to host your DB miles away from your webserver, which makes little sense to me.
Also, the cost of serving data from your DBaaS to your PaaS web service and back, then from the web service to the end user, means you're paying more than double as much.
Ideally, I would want a PaaS that scales really well and can host my database and web in the same region at least, while also minimizing costs.
I see many articles on how to do this the AWS way, with VPC Peering. While GCP has VPC also, I have not figured out how I can enable Google App Engine to exist in the same private cloud as a GCP hosted MongoDB Atlas cluster.
Is it possible? If so, how?
If the answer is "just use AWS then", unfortunately AWS does not have the desired PaaS per say, other than another 3rd party like Heroku, that then won't do VPC Peering.
Edit:
VPC peering is now available for GCP and Azure as well.
Original post:
It is not possible to have Google App Engine and a GCP hosted MongoDB Atlas cluster in the same Virtual Private Cloud.
Since they are different projects each one is in a different Virtual Private Cloud. The only way for the two VPCs to communicate internally would be VPC Peering, which is not currently supported. So the only way for them to communicate is publicly, by adding the IP addresses of the GCP services in the whitelist of the Atlas project.
Atlas VPC Peering Documentation:
Atlas does not support VPC Peering for clusters deployed on Google
Cloud Platform. For Atlas clusters deployed on GCP add the IP addresses of your GCP services to Atlas project IP whitelist to grant those services access to the cluster.
Choose the region of your MongoDB Atlas cluster to be the same as your Google App Engine application. Having the services in the same region minimizes latency and network costs.
We want to access some services on Google Kubernetes Engine from a Google App Engine standard via http(s). We don't want to expose the services to external networks because of security.
app engine flexible can use private network with an internal loadbalancer or vpc(post). How about app engine standard?
2 years ago, we could not do it. (post)
We can set rules about IP addresses, but an IP address for an app engine standard is not static.
What is the best solution?
Thanks for your help.
app engine flexible can use private network with an internal loadbalancer or vpc(post). How about app engine standard?
Not really as per this:
"A VPC network, sometimes just called a “network,” is a virtual version of a physical network, like a data center network. It provides connectivity for your Compute Engine virtual machine (VM) instances, Kubernetes Engine clusters, App Engine Flex instances, and other resources in your project."
We can set rules about IP addresses, but an IP address for an app engine standard is not static.
Yes. They are always changing. The recommendation here is to their Static IP range combined with:
Instead, we suggest that you take a defense in depth approach using OAuth and Certs.
You could also look at things like Cloud Armor (in alpha as of this writing), or a Virtual WAF. Longer term it would make more sense to move your workloads from Google App engine into GKE.
Is there a way to deploy "internal facing" applications in Google App Engine. AWS offers this capability as explained here and so does Azure as explained here.
What is the GCP equivalent for this? It appears App Engine Flexible Environment could be the answer but I could not find a clear documentation on whether Flexible Environment is indeed the way to host intranet facing applications. Is there someone from GCP who can advise?
Update
I tested the solution recommended by Dan recently. Listed below are my observations:
App Engine Flex allows deploying to a VPC and this allows VPN scenarios. The VPN scenarios however is for connections (originating) from App Engine to GCP VPCs or to other networks outside GCP which can be on-prem or in another cloud.
Access (destined) to the app itself from a GCP or another network is always routed via the internet facing Public IPs. There is no option to access the app at a private IP at the moment.
If there's another update, I will update it here.
Update 28Oct2021
Google has now launched Serverless Network Endpoint Group(NEG)s. With this users can connect AppEngine, Cloud Run & Cloud Function endpoints to a LoadBalancer. However at the moment, you can only use Serverless NEGs with an external HTTP(S) load balancer. You cannot use serverless NEGs with regional external HTTP(S) load balancers or with any other load balancer types. Google documentation for Serverless NEGs is available here.
I'm not sure this meets your requirements, but it's possible to set up an App Engine Standard application (not certain about Flexible) such that it is only accessible to users logged into your G-Suite domain. This is the approach I've used for internal-facing applications in the past, but it only applies if your case involves an entity using G-Suite.
You can set this up under the App Engine application Settings, under Identity Aware Proxy.
In this scenario the application is still operating at a publicly accessible location, but only users logged into your G-Suite domain can access it.
It should be possible with the GAE flexible environment. From Advanced network configuration:
You can segment your Compute Engine network into subnetworks. This
allows you to enable VPN scenarios, such as accessing databases within
your corporate network.
To enable subnetworks for your App Engine application:
Create a custom subnet network.
Add the network name and subnetwork name to your app.yaml file, as specified above.
To establish a VPN, create a gateway and a tunnel for a custom subnet network.
The standard env GAE doesn't offer access to the networking layer to achieve such goal.
TLDR;
Are there any updates about this question?
Google App Engine communicate with Compute Engine over internal network
--
It is possibile to enable HTTP traffic between App Engine and Compute Engine instances that are in the same Cloud Project?
Obviously denying all HTTP traffic from other sources.
Between AWS EC2/RDS/Beanstalk this is possibile with "security groups".
I think the best you can currently do is managed VMs (https://developers.google.com/cloud/managed-vms, early access right now). It's essentially managed VMs running custom code in the app engine project. I did not check if the managed VMs will be able to run together with other gce VMs in the same network - if they did one could just connect to the internal addresses of the other instances. There does not appear to be a configuration option to define a network so I'm leaning to guess that they won't be able to see each other on the network like that.
But as an answer to the general question, I don't think there is any way of referencing app engine runtimes as sources in gce network ACLs currently.
As of now In 2016 as google cloud has launched google cloud flexible environment appengine/docs/flexible/. So yes it is possible now because now both app engine and compute engine are present in same network and therefore using app engine you can access compute engine by using their internal Ip, also remember to delete all external firewall rules for your compute engines if you only want to allow access from app engine.
there isn't way to reference App Engine resource within GCE. If you are trying to access GCE only from App Engine app, then you could define ACL in GCE to let traffic only from your AppEngine external IP.