LISA SHEN: Hi, my name is Lisa Shen,
and I'm a product manager in Google Cloud.
In this video, I'll talk a bit about Anthos and Anthos
multicloud.
Then I'll give you a demo of setting up
Anthos GKE cluster on AWS via the Terraform script.
I'll also show you how to view the logs
and deploy a simple application to the cluster
and examine the workload from the GCP Console.
More enterprise customers are either using
or look into leveraging multiple cloud providers.
The multicloud approach comes with added complexity
in the form of multiple management
interface, disparate policy enforcement,
and complex security implications.
Anthos provides a unified platform
for managing the clusters across different clouds,
as well as on prem.
The clusters can be running inside
of virtual machines and instances,
as well as on bare metal.
Anthos is a 100% [? software ?] product
that extends Google Cloud Services and engineering best
practices to your environments so you can modernize apps
faster, and establish operational consistence
across them.
Anthos configuration management provides a central place
to manage a configuration and security
policies across your fleet so you can get
a right governance at scale.
Anthos also features a managed service mesh offering
to connect, manage, and secure your VMs and containers.
Google Cloud logging and Cloud monitoring
provides integrated logging and monitoring service
for the containers, services, and applications.
And on top of everything, Anthos provides developers
with a rich set of tools, such as Google Cloud Build, Cloud
Deploy, for its most modern application development
experience.
Specific to multicloud, Anthos allows
you to manage clusters on Google Cloud, AWS, and Azure.
Anthos manages not only Anthos GKE clusters
on prem and in multiple clouds, it also
manages any standard CNCF-compliant Kubernetes
clusters.
Anthos is a great multicluster management tool
to manage, standardize, secure your clusters
across multiple environments and Kubernetes vendors.
Let's now dive a bit deeper into Anthos
multicloud architecture on AWS and Azure.
Anthos multicloud is a managed service
that helps you provision, operate,
and scale Kubernetes clusters in your AWS or Azure account.
Anthos clusters are full Kubernetes clusters
based on the AWS Azure infrastructure that
runs on EC2 or Azure VMs and are fully integrated
with cloud providers' native platform resources.
With Anthos clusters, you get same distribution bits,
same security patches, same networking technologies
as you get with the GCP GKE cluster.
The Anthos multicloud architecture
has a few key components.
For example, the multicloud cluster API
is a standard Google Cloud REST API, which
provide cluster create, read, update, delete operations.
Anthos cluster on AWS use AWS API to provision resources
needed by the cluster, including virtual machines,
managed disks, auto-scaling group, security groups,
and load balancers.
And the same goes with Azure.
In a Anthos service account, with the Anthos
multicloud API is enabled in your Google Cloud project,
a Google managed service account will be automatically created
with your project.
This service account will be the security principal
calling Azure or AWS API.
For the Connect API, when you register
a cluster outside a Google Cloud,
Google Cloud use a deployment called
Connect Agent in the cluster to establish a secure connection
with the Connect API between the cluster and your Google Cloud
project and to handle the Kubernetes requests.
This enables access to the cluster and then
to workload management features in Google Cloud,
so you have a unified user interface and Cloud Console
to manage the cluster.
The multicloud architecture gives customers
a hosted cloud-backed management control plan.
Google takes care of the provisioning,
upgrading, or backing up the management layer.
Rollouts can be done on a regular basis
by Google to deliver bug fixes and features.
When a change is rolled out, it becomes available automatically
for all customers without any action required on their part.
There are multiple ways to perform
lifecycle management of Anthos cluster on AWS or Azure.
One option is to use gCloud CLIs.
As you can see, the CLI example here in the slide,
you'll create a cluster control plane first,
followed by the nodepool creations with the CLI.
And Terraform is another option for provisioning
the Anthos multicloud clusters.
Now, let's jump right into the demo.
In this demo, we'll be using the Terraform to set up the Anthos
cluster on AWS.
There are some prerequisites you need to perform beforehand.
First, ensure your gCloud SDK version is 365 or greater.
If you don't have the right SDK version,
you can use the gCloud component update
to get the right version.
And also make sure that you have the AWS CLI installed
and set up with the AWS access key and [INAUDIBLE]..
We also need to configure the GCP Terraform authentication
with the gCloud auth command.
I have taken care of this prerequisite
prior to this video recording.
So I will put a note here.
Next step is to ensure you are in the correct Google Project,
and then enable the GCP services in this project.
In this demo, we're going to use a quickstart Terraform
script in the GitHub repo to provision the Anthos
clusters on AWS.
I will share the link at the end of this video for the repo.
Since I've already cloned Anthos multicloud Terraform
repo beforehand, I will directly go to the AWS folder
in my local disk.
After copying the repo to the local disk,
you may need to update the Terraform tfvar
files with the specific environment variables.
As you can see, I've already put in my project ID and email
address in this file.
You can find a project number in the GCP Console
on the left side of the Dashboard page,
or with the gCloud CLI command.
The admin user will be the GCP account email address
that can log into the cluster once it's created
via the connect gateway.
In addition, you can put a cluster prefix name here,
and then define the type of EC2 instances and regions
you'd like to use with the cluster creation.
And that's it.
So now let's go ahead, initialize,
and create a Terraform plan.
Once started, the installation process
will take about 12 minutes.
After the script completes, it will install all relevant IS
prerequisites in AWS including VPC, subnets, internet gateway,
net gateway, iam roles, route tables, and so on.
The Anthos GKE cluster on AWS will
be provisioned with three control plan nodes with one
in each availability zone and a single node pool
with two tier 3 [? medium ?] nodes in the auto-scaling group
to a maximum of five nodes.
Now let's fast forward to the end of the cluster creation.
The Anthos cluster on AWS is created successfully,
as you can see here.
Now that we have the AWS cluster set up,
we can use the kubectl to interact with the cluster.
But before that, we need to set up the context
by using the gCloud container get-credentials command.
So let's get credentials for the AWS cluster.
This command sets up the context for kubectl
that uses GKE Connect gateway as the endpoint
and authenticates the caller using the Google identity
provided by gCloud.
The command works out of the box for private clusters
even if you don't have outside internet access.
Once we have the kubectl set up, we
can start to use the kubectl to explore the clusters and deploy
workloads on the node pools.
Now let's navigate to the Google Cloud Console,
where we can interact with the cluster we've just created.
There are two clusters here in the GKE cluster page.
One is the GKE cluster that I provisioned before this video.
The other cluster is the AWS cluster
that we've just created with Terraform.
The clusters appear on the GKE and Anthos cluster page
in the Google Cloud Console.
However to see more details, such as the nodes and workloads
for any cluster outside the Google Cloud,
you need to log in and authenticate to the cluster.
There are a few options provided to you.
Let's log in with the Google identity option.
Now we'll be able to see the similar cluster
information as we have observed with kubectl CLI command
earlier.
Remember, we have enabled a system container
logging via the gCloud command a moment ago in the terminal.
Let's explore the system logs related to this cluster.
You can see your logs directly from the Log Explorer
by using the logging filters to select the Kubernetes
resources such as cluster, node, namespace, or the container
logs.
And let's type in a query here.
There are a few resource types, such as the control plan
component logs, or the node pool logs.
The Kubernetes container resource type
that I put in here refers to the system apps log.
Now you can see all the AWS cluster logs
related to the system apps under the namespace of GKE
Connect, GKE System, and kube system in the GCP Console.
Now, let's go back to the terminal
and we'll create a new, simple deployment
and run a hello app from the Anthos cluster on AWS
that we've just created.
And to do that, we're going to use the kubectl command here.
Next step is to create a Kubernetes service, which
is a Kubernetes resource that lets
you expose your application to the external traffic.
And let's run the following kubectl expose command.
To inspect hello-server service, let's run the kubectl
get service command.
Now we can view the application from the web
browser using the external IP address shown here.
Let's do that from the Google Cloud Console.
On the GCP Console, there is our AWS cluster
listed in the Kubernetes Engine cluster page.
Let's take a look at the workload we've just created.
Here is the hello-server deployment.
And let's click on it to view the details of the deployment.
Remember, we have exposed a service
with kubectl command earlier.
And now let's actually click on the external IP
address listed up here.
A new browser window is opened with our app up and running.
That concludes the demo for setting up the Anthos cluster
on AWS.
You can check out the step-by-step guide
and the Terraform script for running
a demo in the GitHub side here.
To learn more about Anthos multicloud solution,
please visit Anthos multicloud website.
Thank you for watching our video.