Simplifying GKE Multi-Cluster for Disaster Recovery and Failover

Transcript

1. Simplifying GKE Multi-Cluster for Disaster Recovery and Failover
2. Hello World! Ananda Dwi Rahmawati • Cloud Engineer @ Activate Interactive Pte Ltd | 2023 - present • 4 years+ experiences • GDE Cloud Modernization Apps • Tech background: System, Networking, IaaS & PaaS Cloud, DevOps, a bit of Programming • https://linktr.ee/misskecupbung
3. Today’s Agenda Challenges Multi-Cluster Solutions in Google Cloud Demo
4. Challenges
5. Challenges There are a number of challenges that we may face when using a standalone GKE cluster, including: • Scalability: A standalone GKE cluster can only scale to a limited number of nodes. • Availability: A standalone GKE cluster is susceptible to outages. If there is an outage in the region or zone where your cluster is deployed, your application will be unavailable. • Security: A standalone GKE cluster is a single point of failure. If your cluster is compromised, your entire application could be at risk. • Compliance: If you have data sovereignty requirements, you may need to deploy your application in specific regions or zones.
6. “Multiple clusters to address state management, privacy, scalability, availability, and data sovereignty requirements”
7. Multi-Cluster Solutions in Google Cloud
8. 2014 2018 2021 2022 2022 Network Endpoint Groups (NEGs) Multi Cluster Gateway (MCG) Multi Container Services (MCS) Multi Cluster Ingress (MCI) Anthos Service Mesh (ASM) Multi-Cluster Solutions Offered for GKE
9. NEGs MCI MCG ASM MCS Maturity Production Production Production Production Production Ease of use Easy Easy Medium Hard Hard Features Basic load balancing Basic load balancing and ingress Advanced traffic management Advanced traffic management, security, and observability Advanced traffic management, stateful services, and traffic routing Integration with other GKE features Good Good Limited Limited Limited Best use cases Exposing applications to external clients Exposing applications to external clients Applications that require a high level of reliability and availability Applications that require a high level of reliability, availability, and security Highly available applications that need to be accessible to external clients and exposed to multiple clusters
10. Network Endpoint Groups (NEGs)
11. Network Endpoint Groups (NEGs) Network Endpoint Groups (NEGs) are a basic load balancing feature in Google Cloud Platform that allows you to distribute traffic across multiple resources of a service. NEGs are relatively easy to set up and use, but they do not support all of the features of a full-fledged service mesh, such as traffic splitting and fault tolerance.
12. Network Endpoint Group (NEGs) Forwarding Rule Target HTTP Proxy URL Map Health Check backend-service-1 Health Check backend-service-2 NEGs for cluster 1 Cluster-1-neg (zone1) Cluster-1-neg (zone2) NEGs for cluster 2 Cluster-2-neg (zone1) Cluster-2-neg (zone2) annotations: cloud.google.com/neg: '{"exposed_ports": {"80":{"name": "NEG_NAME"}}}' A Kubernetes Service can be exposed as a NEG in GKE using a simple annotation
13. Multi-Container Ingress (MCI)
14. Multi Cluster Ingress MCI is a native GKE feature that allows you to expose services deployed in multiple clusters using a single external IP address and load balancer. MCI is a good choice for applications that need to be accessible to external clients, such as web applications and APIs. MCI is relatively easy to set up and use, and it is well-integrated with other GKE features. However, MCI does not support all of the features of a full-fledged service mesh, such as traffic splitting and fault tolerance.
15. How Multi Cluster Ingress works
16. Multi Cluster Ingress architecture
17. MCI Configuration
18. Multi-Cluster Gateway
19. Multi-Cluster Gateway Multi Cluster Gateway (MCG) is a Google Kubernetes Engine (GKE) feature that allows you to manage traffic across multiple Kubernetes clusters. It is a global service that can be used to expose services deployed in multiple clusters to external clients. MCG is based on the GKE Gateway controller, but it provides additional features for managing traffic across multiple clusters.
20. https://cloud.google.com/blog/products/containers-kubernetes/multi-cluster-gat eway-controller-for-gke-is-now-ga
21. Multi-Cluster Gateway Example
22. Enable the required APIs (example) HTTPRoute resource to forward traffic to a group of backend Pods that run across one or more clusters Example architecture
23. Anthos Service Mesh
24. Antos Service Mesh Anthos Service Mesh (ASM) is a managed service mesh built on top of Istio that helps you manage, monitor, and secure microservices architectures. ASM is available in two deployment options: • Managed Anthos Service Mesh: This is the simplest and most recommended deployment option. ASM provisions and manages a dedicated control plane for your mesh. You only need to install the ASM agent on your workloads. • In-cluster Anthos Service Mesh: This deployment option allows you to run ASM on your own Kubernetes clusters. This gives you more control over the deployment and management of ASM, but it also requires more effort to set up and maintain.
25. Managed Anthos Service Mesh
26. In-cluster Control Plane
27. ASM Features • Service discovery and load balancing: ASM automatically discovers all services in your mesh and load balances traffic between them. • Traffic management: ASM allows you to route traffic between your services in a variety of ways, including based on path, header, or load balancing policy. • Security: ASM provides a number of security features, including mutual TLS encryption, service identity, and traffic authorization. • Observability: ASM provides a rich set of observability features, including tracing, monitoring, and logging.
28. Apply a default PeerAuthentication policy for the mesh Create an operator manifest for the egress gateway Enable the Anthos Service Mesh fleet feature
29. Multi-Container Services (MCS)
30. Multi-Container Services (MCS) MCS is a feature of GKE that allows you to expose services deployed in multiple clusters to external clients using a single external IP address and load balancer. MCS is similar to MCI, but it provides some additional features, such as the ability to expose stateful services and the ability to route traffic to specific clusters based on various factors, such as user location or service version.
31. Enable the MCS, fleet (hub), Resource Manager, Traffic Director, and Cloud DNS APIs Enabling MCS on your GKE cluster Registering a Service for export Consuming cross-cluster Services
32. Demo Antosh Service Mesh: https://s.id/anthosmeshguide01
33. References
34. References 1. https://cloud.google.com/load-balancing/docs/negs/ 2. https://cloud.google.com/kubernetes-engine/docs/concepts/multi-cluster-ingress 3. https://cloud.google.com/kubernetes-engine/docs/how-to/enabling-multi-cluster-gateways 4. https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-multi-cluster-gateways 5. https://cloud.google.com/kubernetes-engine/docs/how-to/multi-cluster-services 6. https://cloud.google.com/blog/products/containers-kubernetes/multi-cluster-gateway-controller-for-gke-is -now-ga
35. Thank you!