DINA GRAVES PORTMAN: Hi, Martin.
What's up?
MARTIN OMANDER: Hi, Dina.
I heard you have made one of our company's internal web apps
serverless up on Google Cloud platform.
Pete in the ops team said that it's
much easier to manage that app now that it's serverless?
DINA GRAVES PORTMAN: Oh, yeah.
And it was pretty easy to move it.
And because it's serverless now, it requires less ops work
to keep it going.
MARTIN OMANDER: Oh, good.
So our company's web app for gathering user feedback
is starting to get more traffic now
that life is returning to normal.
And the app went down yesterday.
And I'm starting to feel overwhelmed
by the ops work required to keep it running, and restarting
it, and everything.
Could you help me make it serverless?
DINA GRAVES PORTMAN: I would love to.
Let's do it.
[MUSIC PLAYING]
All right.
I remember hearing about the user feedback web app.
We use it to ask our customers questions, right?
MARTIN OMANDER: Yep, and let's see.
Here it is.
Here's a sample question.
Ask your customers what lollipop flavor we should release next?
DINA GRAVES PORTMAN: Oh, gosh.
Who's voting for kale?
Ugh.
Anyway, how does the app work?
MARTIN OMANDER: So it's a container
that runs on a virtual machine, which is backed by a MongoDB
database instance in the Cloud.
DINA GRAVES PORTMAN: Oh, yeah.
I remember moving that MongoDB instance
to the Cloud a couple of years ago.
MARTIN OMANDER: Right.
And back in 2019, the app got a lot more traffic
after our new product hit the stores.
So it crashed, and no one was around to restart
the virtual machine.
So it remained down for a few days.
And we can't have that happen again.
DINA GRAVES PORTMAN: Oh, my gosh.
I remember that.
Ugh.
Also, aren't you paying for that virtual machine 24/7?
MARTIN OMANDER: Yeah, that's the other thing.
Sometimes, we get a lot of traffic.
And the app needs more than one virtual machine.
But sometimes, no one is using it for days at a time.
And we run many virtual machines for this app--
one for production, one for staging, a few for development.
And it's expensive to pay for all those idle servers
or to assign someone to turn them on and off when
they aren't needed.
DINA GRAVES PORTMAN: Oh, I completely agree.
OK, let's start by determining whether or not
your app is a good fit for serverless hosting.
And I have a checklist.
MARTIN OMANDER: Oh, that sounds great.
DINA GRAVES PORTMAN: OK, item number one,
is your application a web app?
MARTIN OMANDER: Yes, it is.
DINA GRAVES PORTMAN: Ah, excellent.
OK, item number two, is your application containerized?
MARTIN OMANDER: Yes, it sure is.
DINA GRAVES PORTMAN: Oh, great.
OK, item number three, is the container stateless?
That is, it doesn't store user sessions and RAM
between requests or anything like that?
MARTIN OMANDER: Yeah, there are no user sessions,
or all the user sessions are stored in the database.
All the data is in the database, nothing in temporary variables
or anything like that.
DINA GRAVES PORTMAN: Perfect.
OK, this sounds like a good fit for Cloud Run
because it is a stateless web app in a container.
App Engine is a great fit for web apps,
but it doesn't use containers.
And honestly, this sounds a little too complex
for Cloud Functions.
MARTIN OMANDER: Oh, OK.
Let's deploy it on Cloud Run then.
DINA GRAVES PORTMAN: Yes, though one moment, one note.
To be clear--
I just want to be clear--
the application doesn't have to be in a stateless container
right now to move it to Cloud Run,
but it would require more steps if it weren't.
On the other hand, your use case is very straightforward.
So let's do it.
Let's deploy your existing container to Cloud Run.
MARTIN OMANDER: OK, let's see.
I'm going to Cloud Run here in the console.
I click here to create a new service.
I give it a name and region.
I pick my existing container from the Container Registry.
OK, so far, so good.
But Dina, doesn't the container need
to be adapted somehow for Cloud Run?
DINA GRAVES PORTMAN: It does.
Great question.
I've moved a few web apps from virtual machines to Cloud Run.
And I've created a short checklist for it.
MARTIN OMANDER: Oh, you really do like checklists,
don't you, Dina?
DINA GRAVES PORTMAN: Guilty as charged.
I love them.
OK, here it is.
Variables & secrets, connections, security,
and trigger, let's start with the first item.
Click Advanced Settings and then Variables & Secrets.
Click Add Variable, and then you just
add all the environment variables
that your container expects.
MARTIN OMANDER: Got it.
So the virtual machine has five environmental variables
that are used by the container.
DINA GRAVES PORTMAN: Yeah, you're
just going to copy all of those to Cloud Run,
but not the port variable because Cloud Run does
that for you.
MARTIN OMANDER: OK, give me a minute.
All right.
OK, so what's this Secret sections here?
DINA GRAVES PORTMAN: If there are some environment variables
that are extra sensitive like passwords,
you can put them in Google Cloud's Secret Manager.
That way, you get fine-grained permissions per secret,
audit logs of who reads and writes the secrets,
and versioning of the secrets.
It's pretty useful.
MARTIN OMANDER: Yeah, that does sound pretty useful.
But I don't want to update the code in my container,
and retest the container, and rebuild the container.
DINA GRAVES PORTMAN: Oh, that's OK, you don't have to.
If you've already defined these as environment variables
in your container, you can use the Cloud Run configuration
to expose the secrets from Secret Manager as environment
variables.
MARTIN OMANDER: Oh, that sounds great.
I will check that out later.
For now, let's just keep it simple.
I will use these normal environment
variables I have here.
DINA GRAVES PORTMAN: Sounds good.
The next item on my checklist is connections.
Does your container connect to any virtual machines
in a Virtual Private Cloud, or VPC?
MARTIN OMANDER: Yes, it does connect to that MongoDB
virtual machine.
And that one only has an internal IP address.
It's not visible on the external public internet.
DINA GRAVES PORTMAN: Got it.
OK, so that MongoDB virtual machine
sits in a virtual private cloud.
When your container was also running on a virtual machine,
it was in the VPC, and it could connect to the MongoDB
by default. For Cloud Run, we need
to add that VPC connection.
So you're going to click Connections,
then create a Serverless VPC Connector,
then Create connector.
Go ahead and give it a name.
Under Subnet, pick Custom IP Range,
and then enter that default that they're
showing there, 10.8.0.0.
Click Create, and the new connector
will be available in a minute or two.
MARTIN OMANDER: OK, I did all of that.
OK, let's wait for it.
DINA GRAVES PORTMAN: OK, once the connector has been created,
go back to the Cloud Run page, and refresh
that list of VPC connectors.
Now pick the one that you just created.
MARTIN OMANDER: All right, very good.
Done.
OK, so that was number two on your four-item checklist.
What's the next one?
DINA GRAVES PORTMAN: Ah, the next one is security.
MARTIN OMANDER: OK, well as you know,
Dina, security is important to our company.
How should I set up strong security?
DINA GRAVES PORTMAN: You should always
use the principle of least privilege.
This container should only have the minimum privileges needed
to do its job and no more.
You could run this container as the default compute engine
service account, but that account has more permissions
than your container needs.
So go to the Security tab, and click Create New Service
Account.
MARTIN OMANDER: OK, I see that the system here
suggested a name for this new service account.
It looks like it's based on the name of the Cloud Run service.
That's nice.
That will make it easy to keep track of things.
I'm clicking Create here.
Oh, should I grant it any additional permissions here?
DINA GRAVES PORTMAN: Does your container
access any other Google Cloud products?
MARTIN OMANDER: No, it only accesses that MongoDB instance.
DINA GRAVES PORTMAN: OK, then there's
no need to grant additional permissions.
And that's good.
This is a good thing.
If a coworker of ours accidentally
adds code to the container that tries
to access any other resource in this project, it will fail.
And that is safer for everybody.
MARTIN OMANDER: Yeah, that does feel good.
OK, so far, so good.
What's the fourth item on your checklist?
DINA GRAVES PORTMAN: It's trigger.
So we need to configure how the service is triggered.
So go ahead and click that section,
and we'll walk through it.
MARTIN OMANDER: OK, done.
DINA GRAVES PORTMAN: First, you need
to set which networks can access the service.
If it's a public web app, you want to pick Allow All Traffic.
MARTIN OMANDER: OK, so I'm leaving that as it is.
What are the two other radio buttons for, Dina?
DINA GRAVES PORTMAN: The second radio button, Allow Internal
Traffic and Traffic From Cloud Load Balancing,
is for apps that get their traffic
from another internal application or via a load
balancer.
You need to put a load balancer in front of your service
to use Cloud Armor for protection
or Identity-Aware Proxy for authentication.
MARTIN OMANDER: Got it, and the third radio button?
DINA GRAVES PORTMAN: Oh, that one's
useful if your service is an internal microservice that
should only be reachable by other services in your project.
If you pick that option, your service
will not be visible to the public internet.
MARTIN OMANDER: Ah, got it.
Let's see.
The next section here says Authentication.
What should I pick there?
DINA GRAVES PORTMAN: Well, this app is public,
so you should stick to the first radio button.
MARTIN OMANDER: Ah, OK, I'll do that.
But what would happen if I picked the second radio button?
DINA GRAVES PORTMAN: Well, then only service accounts
which have the Cloud Run Invoker permission
would be able to trigger your service.
And the public wouldn't be able to use it at all.
MARTIN OMANDER: Ah, got it.
Is that it?
DINA GRAVES PORTMAN: Yes.
Click the Create button.
MARTIN OMANDER: Ooh, all right.
Clicking it now.
DINA GRAVES PORTMAN: OK, let's wait
for the deployment to finish.
MARTIN OMANDER: All right.
It looks like the deployment is done.
That was quick.
And what now?
DINA GRAVES PORTMAN: Cloud Run has given your new service
a URL.
Do you see it there in the Cloud Console?
MARTIN OMANDER: Oh, there it is.
I'm clicking it.
DINA GRAVES PORTMAN: And there it
is, your existing container running serverlessly
in Cloud Run.
As a side note, if you wanted a different URL for your service,
you could set that up by clicking Custom Domain.
MARTIN OMANDER: Nice, and the application is working.
So to recap, what was your checklist
for moving an existing container serverlessly to Cloud Run?
DINA GRAVES PORTMAN: OK, first, check
what environment variables your container is using,
and enter them in the Cloud Run user interface.
You can also set them from the command
line with the gcloud command.
For sensitive data, consider putting them
in Secret Manager for added security and auditing.
And you can still access these values
as environment variables.
So you won't have to edit the code inside your container.
MARTIN OMANDER: OK.
DINA GRAVES PORTMAN: Then if your container accesses servers
within a virtual private cloud, like a database, for instance,
set up a serverless VPC connector to the VPC
where your server lives.
MARTIN OMANDER: Got it.
DINA GRAVES PORTMAN: After that is security.
Create a new service account that
has the minimum privileges needed to let
the container do its job.
Configure Cloud Run to use that new service account.
MARTIN OMANDER: Ah, yeah, I remember doing that.
DINA GRAVES PORTMAN: And finally, we
need to configure how the service is triggered.
If it's a public web app, pick Allow All Traffic.
If your app gets traffic from the Google Cloud load balancer,
you'd pick that option.
And if your service is an internal-only service that
should not be reachable from the public internet,
pick the option for that.
MARTIN OMANDER: Excellent.
This checklist will make it a lot easier
to move other containers to Cloud Run
so I don't have to maintain those pesky servers.
DINA GRAVES PORTMAN: And you get autoscaling with Cloud Run.
So if the thousands of customers want to vote on our next candy
flavor, the container will automatically
be deployed to more instances.
And bonus, you're not paying for it when it's not in use.
MARTIN OMANDER: That sounds like the best kind of flavor to me.
Thank you, everyone, for watching.
If you have questions for me or Dina about moving containers
to Cloud Run, please let us know in the comments.
Also, if you have suggestions for future videos,
please enter them below.
Bye.
[MUSIC PLAYING]