MAHESH NARAYANAN: Like many developers interested
in microservices, you start off dabbling with Google Kubernetes
engine or a powerful cluster manager and orchestration
system for running your Docker containers.
First, you accept all the defaults
and then slowly start modifying a few parameters
to support your application.
BOWEI DU: As you spend more time,
your confidence increases.
More traffic and mission-critical applications
move to GKE, which is great.
You will be able to benefit from GKE's advanced cluster
management features.
MAHESH NARAYANAN: Soon enough, your cluster size gradually
starts increasing.
Things seem to be going fine until one day,
when you start hitting scalability and manageability
issues that can often be avoided by implementing
some key best practices during cluster creation.
Over the next few sections, we'll
be covering some of the best practices
features and designs in GKE networking that
can help you scale and manage your GKE footprint
as your business grows.
BOWEI DU: First, let's talk about VPC-native clusters.
As you know, Kubernetes mandates direct pod-to-pod connectivity.
But there is more than one way to achieve this.
By default, Kubernetes uses static routes
for pod networking, which requires
Kubernetes nodes control plane to maintain
these routes to each node.
This comes at a scaling cost.
In GKE, we give you the option to create clusters
in VPC native mode, which provides
container-native networking.
VPC native mode is enabled with a single click,
and it enables connectivity between all the pods
in your VPC without the overhead of route scaling.
The VPC control panel automatically
manages routing setup for pods.
And the native integration of container networking in the VPC
Fabric improves scalability and integration between Kubernetes
and other VPC features.
MAHESH NARAYANAN: Kubernetes also
makes very liberal use of IP addresses,
which simplifies the system and makes it easier to use
and comprehend.
But, on the flip side, this makes IP management a challenge
for Kubernetes deployment.
This is exacerbated in a hybrid deployment
or where IPs are fragmented, making IPs a scarce resource.
VPC-native sources better providing
flexibility in defining your cluster scale requirements
upfront or resources like pods, nodes, and services.
So instead of having 100 resources and thousands of IPs,
you can not have 100 resources and 128 IPs.
This allows for Kubernetes to reduce its IP footprint,
thereby improving the overall IP utilization.
BOWEI DU: VPC-- native clusters also enable other enterprise
grade features, for example, sharing VPCs between projects,
IM and role separation, providing
anti-spoofing security in our SDN stack, and also private
clusters for cluster isolation.
MAHESH NARAYANAN: Apart from scaling, security's
another criteria that needs to be considered in best practice.
Enterprise users require a deployment
in which your services and networks
are isolated and accessible only within trusted boundaries.
GKE provides this through private clusters.
Private clusters makes the local node and the cluster master
accessible only within the trusted boundaries.
Any unauthorized access your control plane is set to default
deny.
For the road warrior use case in enterprise,
private cluster also provides a walled-garden access
to control plane through private data points, which
is provisioned by the customer.
BOWEI DU: Another best practice to be
aware of for applications at scale
is how you expose your services to the internet.
When you need to deploy your applications,
you may start off using a cluster-based ingress
controller, such as Nginx or HAProxy.
This is really familiar for a lot of us.
It's just a standard proxy that you would run on your laptop.
You would then expose your application
to the internet using a layer-4 Kubernetes service load
balancer.
However, when your application scales up,
you will want to use the Google ingress implementation in GKE.
The GKE container-native ingress is a globally scalable,
low-latency, distributed proxy layer
that supports many of the built-in features,
such as caching, authentication, and DDoS protection.
You won't want to fiddle with how many
instances of your proxies to scale up to or worry
about how to absorb an attack.
MAHESH NARAYANAN: In addition, the Google ingress
has built-in support for container-native load balancing
using network endpoint groups.
This means that the network traffic
will be balanced directly to the container in your VPC,
skipping the order of bouncing through the Kubernetes
kube-proxy layer.
You'll also be able to easily debug your traffic,
as your connections no longer need address translation
to get to their destination.
There are also other certain advantages
of using Google ingress instead of cluster-based controllers,
such as connection imbalance, an accurate end-to-end health
checks for your back ends.
BOWEI DU: GKE makes the job of deploying a scalable Kubernetes
much less daunting and offers many features
that allow you to future proof your deployment.
MAHESH NARAYANAN: We have only scratched the surface here.
And there are many other techniques
that helps in scalability and manageability of your cluster.
Please attend the HYB 314 session at Next 2019 SF
to learn more about these tools and tips.
[MUSIC PLAYING]