DINA PORTMAN: Hi, Martin.
Are you busy?
MARTIN OMANDER: I'm free.
DINA PORTMAN: I was wondering if it's
possible to call a private Cloud Function from a Google Compute
Engine instance.
MARTIN OMANDER: Yes, it is.
I'll show you how.
[MUSIC PLAYING]
So Dina, out of curiosity, why do you
want to know about calling a private Cloud Function?
DINA PORTMAN: OK.
After the big HR outage we had last week,
our manager wants us to move the on-prem HR application
to the cloud, and she wants us to re-architect it using
service-oriented architecture.
I'm a little overwhelmed over where to start.
I have a feeling we'll have to use private Cloud Functions.
MARTIN OMANDER: OK, let's think about it.
We have two main challenges.
How do we move the app to the Cloud,
and then how do we migrate to a service-oriented architecture?
DINA PORTMAN: Right.
But remember, our HR application is written in COBOL.
It's not exactly a runtime that cloud providers usually cover.
MARTIN OMANDER: Ah, good point.
I know.
Give me some Mountain Dew and six weeks,
and I'll rewrite the whole thing in Python.
DINA PORTMAN: [LAUGHS] I'm not sure that's a good idea.
We know from the DORA research that applications
are more stable and have fewer incidents
if we roll out small changes frequently.
Six weeks of refactoring and one big push
sounds like a recipe for a crash.
With that many lines of code, how are you
even going to isolate the bugs?
And the system won't stand still in the meantime.
MARTIN OMANDER: Ah, good point.
Cooler heads prevail.
Oh, here's another idea.
What if we load the app as-is into a virtual machine,
and then we peel off services over time that we can put
into Google Cloud Functions?
For instance, we could start with the vacation requester.
DINA PORTMAN: I love that idea.
I think it'll work, but we'll have
to use private Cloud Functions, because we
don't want just anyone messing with our vacation requests.
MARTIN OMANDER: OK.
So now I see why you want to know
how to get a virtual machine to talk to a private Cloud
Function.
All right.
So our plan is to migrate the app to a virtual machine
and then break out one service to a Cloud Function.
But first, we need to validate that the virtual machine is
able to call a private Cloud Function.
DINA PORTMAN: I say let's test it out with a default
hello, world function, and I can do a curl to the Cloud Function
URL from the virtual machine.
MARTIN OMANDER: Sounds good to me.
DINA PORTMAN: OK.
I will start by making the Cloud Function.
Here we go--
Create.
And to be extra special sure, I'm
going to set it to Require Authentication.
I'll save that.
And to internal traffic only.
I want to use internal traffic only
to block any external requests, and I
want to require authentication to ensure
no unauthorized internal apps have access to my service.
MARTIN OMANDER: All right, sounds good.
Looks like your function deployed.
And now click it and let's check the Trigger link to make sure
that it denies our request.
DINA PORTMAN: Ah, yes.
It's blocking my request, so we know
that our settings are working.
MARTIN OMANDER: An error message we wanted to see-- excellent.
So now, let's send it some internal traffic
from a virtual machine.
DINA PORTMAN: OK.
I'll create a new virtual machine.
Here we go--
Create instance.
Just leave all these defaults on, scroll to the bottom,
and I'm going to use the default service account.
MARTIN OMANDER: Why does it matter
which service account you use?
DINA PORTMAN: Oh, good question.
For the authentication, we need to use
a service account that has permission
to invoke our function.
The default compute service account has this by default
if you're also using the default settings on the Google Cloud
Function side.
Of course, these permissions are all configurable,
but we can talk about that another time.
MARTIN OMANDER: Got it.
DINA PORTMAN: OK.
I'm going to SSH into it and try pinging my function.
First, I need my URL.
Let's copy this.
Copy Link.
And we're just going to do a curl call here.
curl.
Oh, it's saying forbidden, 403 error.
MARTIN OMANDER: Ah, right.
Don't forget the Authorization header.
DINA PORTMAN: Oh, yeah.
I forgot.
OK, so I'm going to run this again.
Just going to add my Authorization header.
It worked.
MARTIN OMANDER: So now you're able to call
from a virtual machine in the same project
if you have the Authorization header.
Just to be sure, let's try the same command
from your desktop machine.
DINA PORTMAN: 403.
Awesome.
We can access the function from inside the virtual machine,
but not from the public internet.
MARTIN OMANDER: Wonderful.
How would we do this from inside an application,
instead of using curl?
DINA PORTMAN: That's a great question.
For service-to-service requests, we can either
write a direct call to the metadata server
or we can use one of the Google Auth Client
libraries, which will construct this call for you.
The client libraries cover C#, Go, Java, Node.js, PHP, Python,
and Ruby.
MARTIN OMANDER: Amazing.
I think we have enough information
to make our project proposal.
DINA PORTMAN: Oh, man, I completely
forgot about the COBOL.
MARTIN OMANDER: Ugh.
We better get working on that vacation requester.
We're going to need it after this.
[MUSIC PLAYING]