I created a VM instance in Googl Compute Engine and app in Google App Engine standard environment. I was planning to have my app in App Engine and my database server in Compute Engine. But, I can't connect between the both by internal IP. Is this possible? the app and db are in the same zone (us-east1) but the connection by IP don't work, only work with external IP. Apparently, the rules of firewall are correct.
As of April 9, 2019, you can use the serverless VPC
connector.
This will allow your App Engine application to connect to other internal resources in your VPC network on the Google Cloud Platform, such as Compute Engine VM instances, Cloud Memorystore instances, and any other resources with an internal IP address.
To create a connector:
$ gcloud services enable vpcaccess.googleapis.com
$ gcloud beta compute networks vpc-access connectors create CONNECTOR_NAME \
--network VPC_NETWORK --region REGION --range IP_RANGE
$ gcloud beta compute networks vpc-access connectors describe CONNECTOR_NAME --region REGION
Note: You can see which IP ranges are currently reserved in the Google Cloud Platform Console. You can choose any unused CIDR /28 IP range to use for your connector, for example, 10.8.0.0/28.
$ gcloud beta compute networks vpc-access connectors create my-vpc-connector \
--region=us-central1 --range=10.8.0.0/28
Create request issued for: [my-vpc-connector]
Waiting for operation [xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx] to complete...done.
Created connector [my-vpc-connector]
To connect your connector to a service add this to your service's app.yaml file:
vpc_access_connector:
name: "projects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME"
Deploy the service:
$ gcloud beta app deploy
Note: To use Serverless VPC Access, make sure you use gcloud beta to deploy your service. You can get access to beta commands by running gcloud components install beta.
After you deploy your service, it is able to send requests to Internal IP addresses or DNS Names in order to access resources in your VPC Networks. In case any trouble please allow about one hour or more to let the connectors are propagated completely in the GCP Global Networks.
For connecting through a private IP you need that the app and DB will be in the same network.
You can't achieve that with app engine standard, you need app engine flex for this (see here how to set the network of your app engine flex instances)
You will have to connect using the external IP address of the service running on your Compute Engine instance. App Engine standard environment is on a different network than the Compute Engine instances and don't have private IP access to each other currently. Switching to an application (or service of an application) on the flexible environment might work for you if the costs associated make sense.
Related
I have standard app engine which makes an api call to another app engine within same shared VPC and project but the response is 403 forbidden error. Also the standard app engine to which i am making api call as gcloud app services update service-name --ingress=internal-only but as soon as i updated the configuration of the appEngine as gcloud app services update service-name --ingress=all. All the API calls are successfull.
Note : as required by gcp a serverless connector as been created and it is being used.
Questions
1 . How to communicate between Standard AppEngine to another Standard AppEngine within shared VPC?
2 . How can i communicate between AppEngnies with gcloud app services update service-name --ingress=internal-only configuration.
When you set the ingress to internal, you tell to App Engine: accept the traffic only coming from the VPCs of this project.
Thus, you need to tell to your other App Engine services: Reach this (App Engine) service only through the VPC else you will be forbidden.
Firstly, when you deploy on serverless environment, App Engine, Cloud Run or Cloud Functions, you are on the Google Cloud VPC, not on your project VPC.
Therefore, you have to set the egress to your App Engine to use the VPC. You need to plug a VPC connector to make this bridge between the GOOGLE serverless VPC world and your VPC.
However, it won't work. Indeed, when you set that on App Engine, only the traffic to the private IP use the serverless VPC connector, but not the public IPs. You haven't the capacity to set the VPC egress to all to route all the traffic through the VPC, public and private (as you can do with Cloud Functions and Cloud Run)
Thus, the App Engine, with serverless VPC connector or not, will contact the internal App Engine service through internet and not through the VPC and you will get a 403 every time.
In conclusion, you can't do that with App Engine, have a look to Cloud Run or Cloud Functions for this type of set up. You can also review your security design and don't rely on the origine of the traffic (from the VPC) but on the authentication of the traffic (use identity token and IAM service to ensure the communication security).
This is now possible to reach other App Engine services (configured with internal traffics only) thanks to Serverless VPC.
In app.yaml add to all the services which need to talk to each others (in and/or out connection):
vpc_access_connector:
name: projects/PROJECT_ID/locations/LOCATION/connectors/CONNECTOR
egress_setting: all-traffic
The doc : https://cloud.google.com/appengine/docs/standard/go/connecting-vpc.
On google cloud I have created an app engine on one project and have some auto scaled(server spinup/spindown according to traffic) compute engines on different project. I have a task for allowing traffic to app engine only from those auto scaled compute engines.
Problem with the auto scaled environment we can't guess the server public IP, where as we can get private subnet IP's.
Please let me know how can I solve this issue.
For connecting through a private IP, you need your app engine and compute engine instances to be in the same network. App Engine standard environment is on a different network than the Compute Engine instances and don't have private IP access to each other currently.
You can't achieve that with app engine standard, you will need to consider app engine flex for this (see here how to set the network of your app engine flex instances).
You will have to connect using the external IP address of the service running on your Compute Engine instance by setting up your firewalls.
I achieved this by doing as follow:
Let's say you have Project A and Project B, and a service running in Project A that wants to connect to a compute engine running in Project B.
You need two VPC in A and B with no IP collision.
Create a VPC Network peering From A to B and from B to A.
Create a VPC serverless access connector in project A.
Config your service to use the new connector.
vpc_access_connector:
name: "projects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME"
We have an application running on Google App Engine. This application needs to connect to either Kubernetes or Compute Engine.
We can't allow this traffic through public Internet. How could we access to Kubernetes, or Compute Engine networks from App Engine, as safe as possible?
This can be achieved using App Engine Flexible [1] as the environment for the service.
Configure the service's app.yaml file network settings [2] so it has the same network and subnetwork as the Compute Engine instance or Kubernetes cluster. Use the private IP for the communication.
I want to transfer some of my applications to app engine from compute engine .
They still have to communicate as usaual .
Can I setup a vpn to enable that with as little to none code changes ?
You can use app-engine flexible environment and put your VM in the same network as your existing instances (see here), or put them in new network and use cloud VPN (see here) to connect the 2 networks.
example code :
network:
name: shared-network
The documentation from Google is not really clear about it.
Here ( https://cloud.google.com/compute/docs/vpn/overview ) it says
Google Cloud VPN securely connects your existing network to your Google Cloud Platform (GCP) network through an IPsec VPN connection
Considering that Both Google App Engine (GAE) and Google Compute Engine (GCE) are part of Google Cloud Platform (GCP), it would mean that Google Cloud VPN works for both GAE and GCE.
Also, the section for Cloud VNP is at the same level than GAE and GCE in the project console :
But the documentation is located in /compute/docs which should not obviously be compatible with /appengine/docs
And here is a graph describing the tunnel, which talks only about GCE, which could exclude GAE :
So, is GAE compatible with Cloud VPN or is it restricted to GCE only ?
Google Cloud VPN securely connects your existing network to your Google Cloud Platform (GCP) network through an IPsec VPN connection. Therefore, only resources that are connected to GCP networks can communicate through Cloud VPN tunnels.
App Engine Flexible Environment is based on Google Compute Engine and consequently can connect to your remote network via Cloud VPNs. As described in this article, you can specify network settings in your app.yaml configuration file of your GAE Flexible application.
EDIT Rodrigo Torres has pointed out that this is NOW possible.
(Leaving up the old post below. It is now WRONG!!!)
OLD POST:
Google App Engine standard CAN'T use VPN directly, however the new Flexible Google App Engine (now officially released, no longer in beta) CAN use it directly. Just set up google cloud VPN and your network from the console and make sure to include the network in your app.yaml file.
Flexible App Engine is be the easiest way for new applications to utilize VPN connections since there won't be any migration headaches.
For a standard app engine application that can't be ported over to flexible for whatever reason, you CAN still use a VPN connection - however, it requires a service to be running on flexible app engine (or compute engine), and your app will need to interface with it somehow. This may be the simplest method, as migrating from standard to flexible is not the simplest of tasks. I know - I've done it.