1 of 173

Genuine Parts Google Cloud Mini Certs

Sponsored by GPC WIT

2 of 173

Who am I?

  • Sales and Marketing team
  • Architect
  • 35 years in software – mostly in consultancy
  • Certified – AWS Solution Architect Professional and Google Cloud Professional Architect, also lots of Azure/Microsoft experience
  • Many talks, presentations and lunch and learns on Cloud general principles
  • Our team had first project into Google Cloud
  • We experienced all the “pain” and you can learn from our mistakes and issues!
  • Lessons Learned from moving to Google Cloud https://gpcprod.atlassian.net/wiki/spaces/SMP/blog/2022/07/15/163381268/Lessons+Learned+from+moving+to+Google+Cloud
  • WIT is internal group for supporting women in tech careers – open to everyone though – speak to Donna Walsh for more info

​

2

3 of 173

What are Genuine Parts Google Cloud Mini Certs?

  • There are 6 mini certifications.
  • If you pass all 6 mini certifications you will be "Genuine Parts WIT Cloud Certified Level 1"
  • Great to put into your goals for this year!
  • There will be 6 lunch and learns announced over the coming months - each dealing with one of the certifications.
  • Self study is encouraged – many videos and materials are provided
  • I can help on Friday lunchtimes for those who need extra help
  • Full details are here https://gpcprod.atlassian.net/wiki/spaces/WCC/overview
  • Do not take the cert tests until you feel very ready and will pass!

​

3

4 of 173

The Six Mini Certs

1 - Cloud Architectures (general cloud architectures plus how Genuine Parts carries out Cloud Architecture design and governance)

​

2 - Google Cloud best practices within Genuine Parts (Paved Path, etc. within Genuine Parts)

​

3 - Google Cloud pricing/costing (tools for pricing/costing, understanding how Google Cloud charges for components, etc.)

​

4 - Google Cloud for Genuine Parts SREs (tickets, Git/github, CI/CD, Terraform, modules etc.)

​

5 - Google Cloud Components used by Genuine Parts teams (CloudRun, BigQuery, Cloud Load Balancer, CloudArmor, etc.)

​

6 - Google Cloud for programmers (authentication/authorization, microservices, CloudRun etc.)

​

4

5 of 173

Today – Cloud Architectures

  • Introduce/revisit Cloud architectures - specifically Google Cloud architectures
    • Resource hierarchies
    • Regions/Availability Zones
    • Resource types
      • Network vs Compute vs Database
  • Introduce the main Google Cloud components in use at Genuine Parts for different purposes
  • Understand which to use for which purposes and why
  • Also recognize that things change A LOT and FAST!!
  • If I am going too fast or slow I am sorry – different levels of knowledge and ability here

​

​

5

6 of 173

General Cloud Architectures

  • Introduce/revisit general Cloud architecture concepts

​

    • Why the Cloud?
    • Regions and Availability Zones
    • Resource hierarchies
    • Firewalls and other network components
    • Containers and Compute
    • Decoupling applications
    • Data storage – SQL and NOSQL (including Cloud Storage/blobs), Data Lakes, Data Warehouses and Data Pipelines
    • Internet Of Things components (IOT)
    • Artificial Intelligence and Business Intelligence

6

7 of 173

Why the Cloud?

  • Someone else takes care of:
    • Ordering machines, of different sizes and capabilities so we can start up a machine with clickOps
    • Auto configuration and creation of infrastructure (Infrastructure As Code)
    • Physical security
    • Many compliance needs
    • Updating underlying hardware/OS
    • Redundancy
    • Scaling up and out (as well as back down – example if Marketing puts out a new ad on TV)
  • Reduced costs (opex not capex)
  • Big Data:
    • Volume
    • Velocity
    • Variety

​

​

7

8 of 173

How the Cloud?

  • IAAS (Infrastructure As A Service)
    • As a customer, I am unaware of the provisioning of infrastructure
    • Same architecture as on-premise, just in the cloud (Lift n Shift)
    • Flexibility of being able to add infrastructure, play with different configurations easily
    • Still have to install software on the servers, configure and maintain some things on the server
    • Control and flexibility over infrastructure
  • PAAS (Platform As A Service)
    • As a customer, I am unaware of the infrastructure (mostly)
    • Rearchitect apps to run on a platform in the cloud (Optimize for the cloud)
    • Do not even know there is a server there in most cases (Serverless)
    • No need to configure/maintain servers or install software
    • “Throw code at the cloud” and it just runs
    • Often container based model
    • Write the software only
  • SAAS (Software As A Service)
    • As a customer, I am unaware of the infrastructure AND the software
    • All I have to do is USE the software
    • Usually TENANT based
    • Example Salesforce or Microsoft 365

​

​

​

8

9 of 173

Regions and Availability Zones

Genuine Parts in the US uses us-east4 and us-central1 by default

9

10 of 173

Availability Zones

Think of an Availability Zone as a Data Center within a Region. Network components are all independent.

​

Try to use more than one availability zone for extra resilience of your application or data where you can

​

Cost vs Benefits

10

11 of 173

GCP Resource Hierarchy

11

12 of 173

Firewalls, NVAs, VPCs and other network components

Hub and spoke network architecture in GPC

Hub-and-spoke network architecture  |  Cloud Architecture Center  |  Google Cloud

​

Firewalls include CloudFlare (external WAF), Cloud Armor WAF – very important!!!

​

12

13 of 173

SMP

Cloud Armor WAF

CloudFlare WAF

13

14 of 173

Google Cloud Components

https://raw.githubusercontent.com/gregsramblings/google-cloud-4-words/master/DarkPoster-lowres.png

14

15 of 173

Compute

  • Cloud Run and Kubernetes (GKE) within Genuine Parts wherever possible.
  • Virtual Machines only where absolutely necessary – you will need an exception. Speak to Mohamed Nazeemudeen or Navin Anandaraj

15

16 of 173

Storage

Within GPC, Cloud Storage is used to store files (hot/warm/cold storage with lifecycles)

16

17 of 173

Data Analytics

GPC will primarily use BigQuery for analytics – and use PowerBI for Business Intelligence in place of Qlik in future state. Speak to Alycia McCarty and her team about this area. There is a huge Enterprise Data plan in place with Domain driven design at the heart of it see here

https://gpcprod.atlassian.net/wiki/spaces/EDP/overview

https://gpcprod.atlassian.net/wiki/spaces/EDP/pages/195526724/Enterprise+Data+Platform+Deep+Dive

Pub Sub is used to publish to BigQuery or to decouple layers of an application

​

​

17

18 of 173

Databases

GPC uses CloudSQL (Postgres version) for relational data and BigQuery for its Data Warehouse data and for Data Lakes

18

19 of 173

Hybrid/multi-cloud Options in Google Cloud

Genuine Parts will use ApigeeX and Anthos in future state. Speak to Navin Anandaraj about these options.

19

20 of 173

AI/ML

Genuine Parts is looking into some of these options - AutoML and TensorFlow etc.

20

21 of 173

Networking

Genuine Parts used Interconnect to connect to a hub that provided connectivity to on premise from the cloud and vice versa.

Cloud DNS, CDN and Cloud Armor are also used

21

22 of 173

Authentication/Authorization - IAM

Authentication

Are you who you say you are?

Currently using Active Directory in Azure

​

Authorization

Now I know who you are, what can you do/access?

Active Directory in Azure with JWT tokens

Moving to Ping in near future

​

22

23 of 173

Operations and Monitoring

  • Now called Google Cloud Operations
  • We set up performance measurements, trigger alerts which send emails or text messages to key team members
  • Still evolving within Genuine Parts – will need to provide functionality of 1View at some point in future
  • Paved Path Enablement team evolving this

23

24 of 173

CI/CD

  • Cloud Build and Cloud Deploy
  • Jfrog Artifactory soon instead of Artifact Registry
  • Git/Github and Github actions
  • CI/CD pipeline work is fairly advanced – Ryan Wade and Paved Path team

24

25 of 173

Google Cloud Migration Tools

  • Save a lot of time moving from AWS S3 or Azure Blobs to Google Cloud using Storage Transfer Service
  • Lots of tools for migrating Virtual Machines/Servers
  • Lots of data transfer options

25

26 of 173

Questions and Issues

Feel free to ping me on Teams any time – Michelle Sollicito

Useful resources:

​

Mini Certs Url

https://gpcprod.atlassian.net/wiki/spaces/WCC/overview

​

Enterprise Data Urls

https://gpcprod.atlassian.net/wiki/spaces/EDP/overview

https://gpcprod.atlassian.net/wiki/spaces/EDP/pages/195526724/Enterprise+Data+Platform+Deep+Dive

​

Paved Path Enablement Url

https://gpcprod.atlassian.net/wiki/spaces/DE/pages/52199425/Paved+Path+Enablement

​

Cloud Team Url (Getting started)

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/270663826/Getting+Started+in+Google+Cloud

​

Lessons Learned from Moving to Google Cloud

https://gpcprod.atlassian.net/wiki/spaces/SMP/blog/2022/07/15/163381268/Lessons+Learned+from+moving+to+Google+Cloud

​

​

​

​

26

27 of 173

Mini Cert 2 – GPC Best Practices in the Cloud

1.Read Lessons Learned from Moving to Google Cloud https://gpcprod.atlassian.net/wiki/spaces/SMP/blog/2022/07/15/163381268/Lessons+Learned+from+moving+to+Google+Cloud

​

2.Watch this video "Lessons Learned from Moving to Google Cloud"

https://genparts-my.sharepoint.com/:p:/g/personal/457990_genpt_net/EdICahz0SblOlpfFC26i4w0ByySHruU2jOtbCdMFmY7EeA?e=wYodsC

​

3.Read the Google Cloud Foundations documentation https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/44793873/Google+Cloud+Foundations

And

How to start a new Google Cloud project etc.

https://gpcprod.atlassian.net/wiki/spaces/CPE/overview

​

4.Read the Google Cloud Tech Stack https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/43548721/Google+Cloud+Tech+Stack

​

5.Read Paved Path Enablement https://gpcprod.atlassian.net/wiki/spaces/DE/pages/52199425/Paved+Path+Enablement

​

6.Read Change Management for Google Cloud within Genuine Parts ServiceNow Application Knowledge - GPC Change Management Quick Reference (service-now.com)

​

7.Take the Google Cloud/Genuine Parts Best Practices Mini Certification

27

28 of 173

Technical Architecture Design

Inputs to Design

28

29 of 173

Migration

  • Migration type
    • Rehost, replatform, refactor, replace
      • Rehost (move existing vm to gcp vm, move existing sql server database to gcp hosted sql server)
      • Replatform – move applications to the code with little change to the application
      • Refactor – modify the application to run better in the cloud (containerize the code, microservices design for example)
      • Others – repurchase, retire, retain or relocate

​

​

29

30 of 173

Key Requirements – SLAs and Compliance

  • SLAs, SLOs and SLIs (Service Level Agreements, Objectives and Indicators)
  • Availability requirements - usually a number such as 99.99% or a number of hours per day (Redundancy in Zones or Regions as appropriate)
  • Load expected – patterns of load (will load increase suddenly every lunchtime? when an ad appears on tv?)
  • Compliance
    • Sensitive data handling (PII or PCI data for example)
    • Archives required (SOX may require financial transaction data to be kept for 7 years for example)

​

30

31 of 173

Key Requirements - Costs

  • Cost (a big one in GPC)
    • Cloud Storage is very cheap, especially if you use lifecycles to roll to archive storage class
    • Cloud Run is very cheap (Serverless), avoid VMs if you can
    • Databases/data stores are usually the most costly resource in most GCP systems
    • Use Cloud Run if possible. If not, consider pre-emptible VMs (or Spots) to save on costs if use case is good for their use.

​

    • Also see the next Lunch and Learn for more on Cost savings and Billing!!!

​

31

32 of 173

Key Requirements – Security

  • Security (a huge one)
    • Authentication
    • Authorization (AD groups) / Access controls / Service accounts
    • Firewalls / Load balancers
    • Ports
    • Security Policies
    • Pay attention to all the questions in the BAA Questionnaire as they will help ensure your security is good
    • Generally allow only ports that must be allowed through firewalls. Remember stateless firewalls require both ingress and egress traffic to be allowed so you may need two firewall policy entries.
    • Use least privilege principles when allowing permissions/access.
    • Apply permissions to roles and apply roles to groups. Then associate an identity with a group to allow that user to use those permissions.

​

​

32

33 of 173

Key Requirements – Disaster Recovery/Business Continuity

  • Disaster Recovery / Business Continuity requirements
    • Backups/replicas
    • RTO/RPO (Recovery Time Objective, Recovery Point Objective)
    • Procedures for restoring from backups or replicas
    • How to deal with a Zonal outage; How to deal with a Regional outage
  • The above is just a guide - your specific project may have many more

​

​

33

34 of 173

Key Requirements - Availability

  • Availability requirements
    • How badly would it affect the business if your system was inaccessible for 5 mins? An hour? A day? A week? A month? Longer?
    • What would you have to do if a Zone was inaccessible within GCP for a day, or for a week? What if it was inaccessible for a month?
    • What would you have to do if a Region was inaccessible within GCP for a day, or a week? What if it was inaccessible for a month?
    • Work out the cost/benefits of being able to handle these kinds of outages - is the business prepared to pay the amount it costs to be prepared for these kinds of outages? Take into account the likelihood of a Zone / Region going down for that long, and ensure you are aware of the SLAs Google Cloud provides for the components you use so that you can determine best mitigation options
    • What are the steps that should be taken if one of these outages happened? How much of it is automatic?

​

34

35 of 173

Key Requirements - Scalability

  • Handling Load/Scaling Up/Out and Back Down/In
  • Load increases
    • Load increases can be very expensive in traditional environments.
      • Opportunity cost is lost if the system stops responding because too many customers hit the website after a very popular ad appears once per month on tv
      • Latent costs of hardware that is only used once per month when demand is high due to a monthly ad
    • In the cloud (especially in serverless environments like CloudRun) these costs can be reduced, for example:
      • CloudRun will scale up to meet demand and then scale down as demand falls
      • You only pay when CloudRun is used - idle time costs you nothing!
      • No hardware costs or personnel costs for maintaining the hardware etc.!

​

35

36 of 173

Key Requirements – Data Sensitivity

  • Sensitive data
    • Know that all data in Google Cloud is encrypted AT REST and IN TRANSIT within Google Cloud
    • But once it is outside of Google Cloud it is YOUR RESPONSIBILITY
    • PII is Personally Identifiable data
      • PII includes any data that identifies an individual. Some data is less sensitive - such as email address, first name and last name, or username
      • PII Sensitive data (e.g. Social Security number or name, address and telephone number stored together) is data that has to be handled extremely carefully
      • Check with all compliance requirements - SOX (Sarbanes Oxley), GDPR, Hipaa etc.
      • Consult with Security Team if in doubt
      • DLP - Data Loss Prevention - may be needed if you have PII Sensitive data
      • In some cases, encryption or obfuscating data is sufficient
    • Key vault issues ongoing – currently we use Azure Vault or Google Vault but no global Vault

​

36

37 of 173

Domains (Domain driven design)

  • Customer
  • Finance
  • Supplier
  • Catalog
  • Pricing
  • Order Mgt
  • Etc..

https://gpcprod.atlassian.net/wiki/spaces/COMPLATFORM/pages/339542319/Bounded+Context

37

38 of 173

Enterprise Data Platform Future State

38

39 of 173

Future State Data Architecture

Domain System - Enterprise Data Platform Integration - Developer Enablement - Confluence (atlassian.net)

39

40 of 173

Sign Off Is Essential

  • Get sign off from:
    • Paved Path Enablement Committee (Navin Anandaraj)
    • Security Team (Stephen Kraus)
    • Cloud Team/SREs (Donovan Kruger)
    • Distinguished Engineer for your area
    • Enterprise Data Architecture team (Alycia McCarty)

​

​

​

​

Sample Production Readiness Checklist (SMP)

https://gpcprod.atlassian.net/wiki/spaces/SMP/pages/73105409

Template

https://gpcprod.atlassian.net/wiki/spaces/OWCA/pages/65961999

Get to know the Business Assessment requirements here too

Web-Application-BAA-Questionnaire.docx (sharepoint.com)

40

41 of 173

Organization, Bus, Folders and Projects

41

42 of 173

Network Architecture (Hub and Spoke)

Within GPC each project by default has ONE VPC with many subnets (one for each region is typical)

​

Projects share resources in a central VPC (hub)

​

The hub is used to access the on prem network

42

43 of 173

Networking and Google Cloud at GPC

43

44 of 173

Global Load Balancer, DNS CloudFlare and Certificates

  • Global load balancer pre-requisites - Cloud Platform Engineering - Confluence (atlassian.net)
  • you will need a public STATIC ip address from google cloud load balancer
  • you will need two DNSs setup also - A Records / CName
    • DNS team (Chuan Dang) expose both internally and externally
  • ip address and DNS to the Cloudflare team too (Jared Digby)
    • they will give us back some records for Cloudflare to give back to the DNS team
    • DNS team put into DNS
  • Terraform available above at url

​

​

NOTE that at some point you may have to clear cache on CloudFlare so you need access to that - Jared D will give access

​

SSL Certificates – now changed!!! Use KeyFactor!!!

https://gpcprod.atlassian.net/wiki/spaces/CIPA/pages/404291616/Request+a+Certificate+Using+SNOW

​

44

45 of 173

Firewall / NVA port Requests

  • Speak to Anna Abbot / Kirwyn Cambridge and the Cloud Security team with questions

​

45

46 of 173

Getting Cloud Environment Set up

  • To get access to Google Cloud for developers etc.

​

46

47 of 173

Monitoring/Operations

  • MELT
    • Metrics (what do you need to measure?)
      • Availability, uptime
      • Performance/response time
      • CPU levels, Memory levels, Disk space, Disk utilization
    • Events (when we reach a threshold, or something bad happens, what needs to happen?)
      • Alerts =>Emails
      • Alerts =>SMS messages
    • Logs (application logs and audit logs) Cloud Logging
      • How do we know what happened?
      • How do we know what went wrong, when?
      • How do we prove who did it and what they did (Audit logs)
    • Traces Cloud Trace
      • How do we trace through the process to find out where things go wrong?
      • Debugging
    • 1View versus Google Operations

​

47

48 of 173

CI/CD (Continuous Integration/Continuous Delivery/Deployment)

  • Github is used to store source code
  • Github Actions
  • Gradle (and others?) CI/CD pipeline created for you
  • Jfrog Artifactory (used to be Google Artifacts)
  • Image hosting – GCR (Google Container Registry)
  • Snyk for Security vulnerability checking/scanning code
  • Sonaqube / Sonalint for code quality checking
  • Secrets management, environment variable/yaml files
  • Unit testing (fail to deploy if unit tests fail)
  • Testing tools (performance testing, end to end testing etc.)
  • Ryan Wade has done a lot of work on this

​

48

49 of 173

Testing

49

50 of 173

Resources

​

DON’T FORGET!!! APRIL 28th EXTRA LUNCH AND LEARN!!!!

50

51 of 173

Mini Cert 2a – GPC Best Practices in the Cloud In Depth

1.Read Lessons Learned from Moving to Google Cloud https://gpcprod.atlassian.net/wiki/spaces/SMP/blog/2022/07/15/163381268/Lessons+Learned+from+moving+to+Google+Cloud

​

2.Watch this video "Lessons Learned from Moving to Google Cloud"

https://genparts-my.sharepoint.com/:p:/g/personal/457990_genpt_net/EdICahz0SblOlpfFC26i4w0ByySHruU2jOtbCdMFmY7EeA?e=wYodsC

​

3.Read the Google Cloud Foundations documentation https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/44793873/Google+Cloud+Foundations

And

How to start a new Google Cloud project etc.

https://gpcprod.atlassian.net/wiki/spaces/CPE/overview

​

4.Read the Google Cloud Tech Stack https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/43548721/Google+Cloud+Tech+Stack

​

5.Read Paved Path Enablement https://gpcprod.atlassian.net/wiki/spaces/DE/pages/52199425/Paved+Path+Enablement

​

6.Read Change Management for Google Cloud within Genuine Parts ServiceNow Application Knowledge - GPC Change Management Quick Reference (service-now.com)

​

7.Take the Google Cloud/Genuine Parts Best Practices Mini Certification

51

52 of 173

In depth

​

52

53 of 173

SMP Architecture

CLOUD ARMOR

CLOUD FLARE

  • 1 project per domain
  • 1 VPC per project usually
  • Potentially many subnets (one per region?)
  • One subnet is probably for regional failover
  • CloudSQL replication to BigQuery is now SUPERCEDED by pub sub to BigQuery

PubSub

Authentication will use Ping; Authorization will use Ping/Workday

53

54 of 173

API Standards https://gpcprod.atlassian.net/wiki/spaces/DE/pages/528056497/API+standards+and+governance

Specification

  • Use swagger https://swagger.io/specification/

Protection

  • Use ApigeeX SOON!! Coming next month??

Naming

  • Common apis � https://<domain>.api.genpt.com/<version>/<resource>/� Example - https://catalog.api.genpt.com/v1/item/
  • BU specific apis � https://<domain>.api.<bu>.com/<version>/<resource>/� Example - https://pricing.api.motion.com/v1/price/

Authorization

  • JWT tokens

Contract testing

  • Use PACT

​

54

55 of 173

CI/CD Pipelines, Source code control etc. https://gpcprod.atlassian.net/wiki/spaces/DE/pages/161677348/GitHub+Actions+CI+CD

Contact Ryan Wade or Satish Reddy for this part – also see the SRE MiniCert at the beginning of June!

55

56 of 173

Testing

​

56

57 of 173

Testing Tools

Black Lantern

57

58 of 173

Future State – key facts

  • One Google project PER DOMAIN
  • Authentication/Authorization – currently Azure AD / Google Oauth; in future state, Ping/Workday is set replace Authorization and eventually Authentication
  • Global Load Balancer MUST have Cloud Armor running on it – and it must ONLY allow ip addresses of CloudFlare external WAF
  • Workday will replace PeopleSoft HR (not PeopleSoft Finance though!)
  • NVA is now in place (Hub/spoke network architecture)
  • CloudRun with ReactJs for front end (protected by Global Load Balancer with CloudArmor WAF and CloudFlare external WAF, AD authentication)
  • CloudRun with Java for APIs/microservices/backend (protected by JWT tokens)
  • Jfrog Artifactory for artifacts https://genuineparts.jfrog.io/artifactory
  • CloudSQL (Postgres) for transactional data
  • PubSub to BigQuery (instead of sending files to EDW in current state)
  • BigQuery for data lakes / PowerBi (instead of Qlik in current state)
  • Param will take us through the future data architecture in a little more depth

58

59 of 173

Domains (Domain driven design)

  • Customer
  • Finance
  • Supplier
  • Catalog
  • Pricing
  • Order Mgt
  • Etc..

https://gpcprod.atlassian.net/wiki/spaces/COMPLATFORM/pages/339542319/Bounded+Context

59

60 of 173

Enterprise Data Platform Future State

60

61 of 173

Future State Data Architecture

Domain System - Enterprise Data Platform Integration - Developer Enablement - Confluence (atlassian.net)

61

62 of 173

Mini Cert 3 – Billing and Costs in Google Cloud

62

63 of 173

Pricing

  • Initial $300 free credits to use on 20+ products – great for beginners learning how to use google cloud (use personal email)
  • Deep discount for Genuine Parts
  • Free tiers on many products
  • GCP is VERY much cheaper than other Cloud providers generally
  • Pay as you go is the primary model for most products
  • Pre-pay model brings extra savings on top (committed use discounts)
  • BUT costs are going up!

​

​

63

64 of 173

Cost Optimization

  • Truly understand the billing and cost management tools
  • Are we being charged for resources that could be “turned off” or deleted?
  • Biggest costs are typically in data storage
    • Files – lifecycles in cloud storage can save money
    • Databases
      • Do you need Spanner or could you make do with CloudSQL?
      • Do you need replication or can you make do with backups and restores?
        • How many backups do you need? 7 days enough?
        • How many replicates do you need?
      • Can you archive some of the data?
      • Big data is expensive
        • Store files/data in Cloud Storage data lakes if you can
        • Big Query is our standard for “Domain” data lakes in GPC though
        • Big Query querying is costly
  • Scalability
    • Scaling up to meet demand is great but make sure your system scales back down
  • Quotas
    • Are you really using them? You may be paying more for these and not using them?

​

64

65 of 173

Pricing Calculator

  • Estimate your costs using the Pricing Calculator https://cloud.google.com/products/calculator
    • Play around with different options to see how you can save money
    • For compute engine, you can work out savings if you reduce cpu/memory etc. or if you reduce number of virtual machines; also cost of spot instances, Committed use/Sustained use discounts

​

​

65

66 of 173

Pricing Calculator

Comparing the cost of using kubernetes to the cost of using CloudRun

Comparing the cost of using a Debian Virtual Machine to the cost of using a Windows Virtual Machine

Estimating the total cost of your project/application

Compare Pay as you go costs to Committed Use costs

Determine costs of extra memory or cpu

Determine the difference in cost of using a different database

Determine the difference in cost of a regional failover strategy compared to a zonal failover strategy for a database

66

67 of 173

Pricing Calculator

68 of 173

Instances Pricing

  • Do you need an instance/VM? Can you use Cloud Run or GKE?

​

  • Use FREE OS if it makes sense for your use case

​

  • Can you use less memory or CPU/GPU?

​

  • Do you have specialist needs for lots of memory or CPU/GPU?

​

68

69 of 173

GKE Kubernetes https://cloud.google.com/blog/products/containers-kubernetes/4-ways-to-optimize-your-gke-costs

  • Use FREE OS if possible!
  • Windows Servers cost money!
  • Scaling – can you use AutoScaler? Number of nodes needed to meet demand only – scaled up and down
  • Reduce the number of nodes by default
  • Shut down any idle clusters

​

69

70 of 173

Cloud Run Cost Savings

  • Some regions are cheaper than others
  • Be aware of GPC rules about regions
  • If you can, use cheaper regions
  • Cloud Run can run in many regions
  • Note that some regions may not have features available in other regions
  • Service is always running – do you need that?
  • Job only runs when triggered (time scheduler usually)
  • Can you go down to 0 instances running for your use case? Slow spin up?
  • Can you use Committed Use Discounts?

​

​

​

  • Also remember: When setting concurrency higher than one request at a time, multiple requests can share the allocated CPU and memory of a container instance
  • Remember Cloud Run pricing depends upon number of requests, amount of CPU and amount of memory

​

70

71 of 173

Data/Storage Useful Info

BigQuery

  • Free tier https://cloud.google.com/bigquery/pricing#free-tier (first 10gb storage free, 1TB of query data)
  • 2 types of costs – storage costs and processing costs (compute costs)
  • Inserts and Queries cost a lot of money in BigQuery
  • Treat BigQuery data as a data lake and only retrieve data you actually need (don’t take all columns in a table for example, only the columns you need)

​

CloudSQL

  • Zonal CloudSQL has failover within one Region
  • Regional CloudSQL has failover to another Region if this one fails
  • Unless you need very high uptime/availability Zonal CloudSQL with backups stored in another region may be enough and a lot cheaper

71

72 of 173

File Storage Costs https://cloud.google.com/storage/docs/storage-classes

  • Low cost retrieval
  • High cost storage

​

​

​

​

​

​

​

​

​

​

​

  • High cost retrieval
  • Low cost storage

USE LIFECYCLES!!!

72

73 of 173

How GCP Charges for File Costs

Upload to Google Cloud Storage using Storage Transfer Service is FREE

Transfer within the same region to Google Cloud Storage is FREE

​

Comparable with AWS and Azure costs https://www.msp360.com/resources/blog/requests-and-data-transfer-prices-in-azure-google-and-aws-compared/

73

74 of 173

File Storage Costs https://cloud.google.com/storage/pricing-examples

Example Standard storage vs Coldline storage

Class A operations are bucket creates/object creates (Storage) Class B operations are retrievals (GETs)

74

75 of 173

Free Tiers / Services

Free tiers https://cloud.google.com/free/docs/free-cloud-features

​

  • Know the free tiers for the services you use:
    • BigQuery first 10gb storage free, 1TB of query data
    • Cloud Storage 5Gb per month (Standard storage)
    • Compute Engine 1 e2 micro instance per month
    • GKE 1 Autopilot or Zonal cluster per month
    • CloudRun 2 million requests per month
    • CloudBuild 120 mins per day
    • PubSub 10 GB messages per month

​

  • If you are bringing data into Google Cloud it is often free
    • Storage Transfer service - when transferring data from other cloud providers, Storage Transfer Service is free of charge
    • Database Migration Service (including replication) is often free, check details
    • The Migrate to Virtual Machines 5. x service is provided at no charge for migrating VMs to Google Cloud.

​

​

  • NOTE These Free services may change at ANY time!

​

75

76 of 173

The Rules of Reducing Costs

​

  • Other ways to save costs including choosing cheaper infrastructure or compute options (but do cost benefit analysis):
    • Use serverless options where possible
    • Use cheaper data storage where possible (e.g. use Cloud Storage rather than BigQuery)
    • Use storage lifecycles where possible (e.g. use Hot Cloud Storage only for files you will use frequently, and Cold Storage for files you have to store/archive for compliance reasons – do not forget to delete data you no longer need!)
    • No regional failover/resilience/redundancy? Cost/Benefit?
    • No zonal failover/resilience/redundancy? Cost/Benefit?
    • Use spot instances where good for the use case (interruptible/preemptible)
      • Do you just need extra compute to handle extra load during peak times? If yes, you may be able to use spots
      • Can your workload be interrupted? Is it fault tolerant? If yes, you can use spots
      • Is there a deadline for the results? If yes, don’t use spots

​

76

77 of 173

Scaling costs

  • Handling Load/Scaling Up/Out and Back Down/In
  • Load increases
    • Load increases can be very expensive in traditional environments.
      • Opportunity cost is lost if the system stops responding because too many customers hit the website after a very popular ad appears once per month on tv
      • Latent costs of hardware that is only used once per month when demand is high due to a monthly ad
    • In the cloud (especially in serverless environments like CloudRun) these costs can be reduced, for example:
      • CloudRun will scale up to meet demand and then scale down as demand falls
      • You only pay when CloudRun is used - idle time costs you nothing!
      • No hardware costs or personnel costs for maintaining the hardware etc.!

​

77

78 of 173

Networking Costs All networking pricing  |  Virtual Private Cloud  |  Google Cloud

  • All ingress is FREE but you will be charged for processing of that ingress traffic
  • Most egress costs money – esp to other regions or outside of Google Cloud
  • Egress that is internal to the same zone using internal ip addresses is free though
  • Egress to Youtube, Gmail, Google Maps and Google Drive is free
  • Network pricing is “premium tier” by default – but you get your free tier included in that
  • To use “standard tier” network pricing you must explicitly select it and you miss out on free tier but it may be cheaper for larger loads
  • Costs change a lot so check it out

​

​

  • NOTE!!!! If you reserve a static external IP address and do not assign it to a resource such as a VM instance or a forwarding rule, you are charged at a higher rate than for static and ephemeral external IP addresses that are in use.

​

​

​

​

​

78

79 of 173

Watch Points

  • Data storage is often the most costly element of projects in Genuine Parts Google Cloud
  • Watch for extra unexpected costs:
  • Audit cloud projects every month:
    • Are there projects no one is using any more? (example sandbox projects)
    • Are there resources you no longer need running? (example api v1 is no longer supported so cloudrun instance can be deleted leaving api v2 or v3)
    • Are there files you no longer need to store? (example compliance storage for 1 year – once that year passes, delete files from archive/cold storage)

​

79

80 of 173

Spend Management

  • Budgets and reports https://cloud.google.com/billing/docs/how-to/reports
  • Quotas/quota limits
  • Alerts (send emails when you are close to a budget limit or quota limit etc.)
  • Each project has a linked Billing Account (usually dictated by your domain – example one for Customer, one for Pricing, one for Sales and Marketing)
  • Billing support https://cloud.google.com/support/billing/
    • Check your bills because they DO make mistakes!!

​

80

81 of 173

Cloud Billing in GPC

Cloud Billing - Cloud Platform Engineering - Confluence (atlassian.net)

​

Chargebacks

  • Cloud resource costs are billed to a single corporate account however, the monthly spend by any of our corporate entities (UAP, MotionAP, etc.), domain, or platform is charged back to those entities by the finance organization.
  • Chargeback is typically done at the domain or platform level since there is usually a single VP for each domain.

​

Billing Dashboard

  • This dashboard is updated daily. If you need access to this privileged information, email qlik@genpt.com and ask for access. At this time, only directors and above are provided with access.

​

International Corporate Billing

  • Different finance groups manage their own P&L budgets and chargebacks. So There would be multiple finance teams needed for executing chargebacks. This includes, UAP, MotionAP, InencoAP, AAG (Europe), Motion Birmingham, etc.
  • Chargebacks to other BUs beyond GPC are filtered by the first three characters of the project name. (eg. uap-d-cat)

​

Data Billing

  • The Enterprise Data Team hosts data projects for multiple domains, platforms and corporate entities. Those entities will be charged back for their usage in those projects. Reach out to @Alycia McCarty and @Vishal Patel for more information

81

82 of 173

Use Filters to see breakdown of costs

82

83 of 173

Quotas

  • Check quotas
  • If you go over your quotas/limits it can be costly
  • If you raised your quota but do not use it that can be costly also

​

84 of 173

Quota costs

85 of 173

Genuine Parts Billing and Alerts

  • Billing is (generally speaking) at Domain level/Platform level
  • Multiple projects are billed to the Domain for example
  • Alerts can be set up by Cloud Team/SREs
  • ServiceNow ticket required to set up
  • Alerts at 50% 75% and 90% of monthly budget

​

Details here https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/460558284/Cloud+Billing

​

86 of 173

Useful billing/pricing resources

Training labs – do using your home google cloud account, not the company one (due to restrictions in your permissions etc. within the company)

​

Video accompanying this Mini Cert

https://genparts.sharepoint.com/:v:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/5_Video_Google%20Cloud%20Pricing%20and%20Costing%20video%205.mp4?csf=1&web=1&e=6JCb9R

​

Genuine Parts Billing and Alerts

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/460558284/Cloud+Billing

​

​

86

87 of 173

4. Google Cloud for Genuine Parts SREs Mini Certification

1. Read the "Getting started in Google Cloud" documentation

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/270663826/Getting+Started+in+Google+Cloud

2. Read the "Naming Standards in Google Cloud" documentation

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/172064846/Naming+Standards+in+GCP

3. Read the GCP SRE Assignments documentation

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/171475049/New+Projects+in+GCP+SRE+Assignments

4. Read the CI/CD Pipelines and Workflows documentation

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/337543551/CI+CD+Pipelines+and+Workflows

5. Read the "Creating Cloud Resources in GCP" documentation (Terraform)

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/171475042/Creating+Cloud+Resources+in+GCP

6. Watch the videos on this page re CI/CD pipelines

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/350782231/Video+tutorials+for+Gradle+CI+CD+pipeline

7. Read about CI/CD Pipelines:

Node js

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/385810607/CI+CD+Pipeline+for+Node.js+NPM+Yarn+application+Code

Gradle

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/307855361/CI+CD+Pipeline+for+Java+Gradle+application+Code

8. Read about modules

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/257851857/Modules+Info+Guides

​

87

88 of 173

4. Google Cloud for Genuine Parts SREs Mini Certification

9. Watch these videos about modules

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/364905160/Video+Tutorials+for+Modules

10. Read about Monitoring and Alerting Cloud Monitoring & Alerting - Cloud Platform Engineering - Confluence https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/422150171/Cloud+Monitoring+Alerting

11. BigQuery setup (from Enterprise Data team) https://gpcprod.atlassian.net/wiki/spaces/EDP/pages/270565395/How-to+Deploy+Google+Cloud+and+IICS+Code

12. Read BigQuery setup (from SMP team)

https://genparts.sharepoint.com/:w:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/Steps%20to%20replicate%20to%20BQ.docx?d=w2bf07cb3d21f4fad84e58eecdf89d415&csf=1&web=1&e=717EqO

14. Read How to Engage the Enterprise Data Team

https://genparts.sharepoint.com/sites/GPCDataAndAnalytics/SitePages/Engagement%20Process.aspx

Especially take note of the Pod information at the bottom of the page.

15. Watch the Cloud Team DevOps videos

https://genparts-my.sharepoint.com/personal/436899_genpt_net/_layouts/15/onedrive.aspx?id=%2Fpersonal%2F436899%5Fgenpt%5Fnet%2FDocuments%2FRecordings&FolderCTID=0x012000A676CE48192EF148B1474017BC7C0EDB

16. Read how to setup a VM using CI/CD pipeline and terraform

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/574325330/Container+Optimized+VM+Pipeline

Take the SRE Certification TBA

​

​

Guest starring Satish Reddy and Lakshmi Sekharan Vaka

​

88

89 of 173

Getting Started as an SRE..

All you need to get started in Google Cloud are three things!

  1. An approved Paved Path design (see tech stack below)
  2. A Google project
  3. Access to build and run your workloads

​

​

  • PRO TIP: To move at the speed of your business, each domain team should onboard an SRE with Google Cloud experience and knowledge on how to use Terraform to build cloud resources, manage repos in GitHub, and apply configurations in your cloud project.

​

​

​

89

90 of 173

Responsibilities of an SRE

  • Working with the Security Team to set up Cloudflare configuration
  • Cloud Armor configuration
  • Cloud Run deployment and configuration
  • Global Load Balancer configuration
  • Internal/External Certificate deployment and renewal
  • Observability of applications (MELT – Monitoring, Errors, Logging, Traceability)
  • CI/CD pipeline 
  • Capacity Planning
  • Some incident response
  • Some Disaster Recovery
  • Working with terraform modules provided by the Cloud Team to deploy resources
  • Application reliability

90

91 of 173

Organization, Folders, Projects

91

92 of 173

Networking and Google Cloud at GPC

92

93 of 173

4 Projects per Domain is Standard Practice at GPC

93

94 of 173

ALL CLOUD PURSUITS SHOULD START HERE!!!

​

94

95 of 173

New Projects

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/171475049/New+Projects+in+GCP+SRE+Assignments

95

96 of 173

Things to know as an SRE..

  • Terraform – very well!!!
    • Terraform init, plan and apply
    • terraform.tfvars file contains the parameters (usually have one for each env – non-prod and prod)
    • Know your modules!!

​

  • ONLY change things through Terraform – not through the console or command line (changes will be overwritten)
  • Know your naming standards:
  • Who to contact for issues:

​

96

97 of 173

Who to contact..

97

98 of 173

One Team, One GPC

98

99 of 173

Other useful contacts

  • Jeremy Swafford/Calen Bedford/Truong – Active Directory or AD App registrations
  • Other
    • Jeremy Saeger - Platform Automation and Development (IT Mgr Corp)
    • Keith Luken /Marcus - Platform Engineering & VDI
    • Michael Whited - Networking
    • Brett Brubaker - Server Operations
    • Ping Zhang - Database Operations
    • Richard Cullom Product owner TAMS, John Groover, Scott German (boss of TAMS team)

​

​

99

100 of 173

Who Does What?

100

101 of 173

Deployments

101

102 of 173

What is the SRE responsible for?

102

103 of 173

What is the SRE responsible for?

103

104 of 173

Terraform tips for SREs

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/171475042/Creating+Cloud+Resources+in+GCP

104

105 of 173

Service Accounts Terraform Module

​

  • Terraform Plan

​

105

106 of 173

GKE Terraform Module (Autopilot)

​

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/577634305/Setting+up+of+GKE+cluster+for+GKE-+Standard (GKE standard)

106

107 of 173

Load Balancing and Networking

107

108 of 173

A Word about Docker Desktop

108

109 of 173

Resources

(practice exam)

109

110 of 173

5. Google Cloud Components used by Genuine Parts Mini Certification�

  1. Watch Cloud Architectures (focus on Google Cloud)

https://genparts-my.sharepoint.com/:p:/g/personal/457990_genpt_net/ERLbuHUgwI1Ahi2u_rc6-ZYBgu6WZ6pxyuHtHA9yG2SZjA?e=PtTnxt

  • note you may have already watched this for an earlier cert!

2. Read GCP cloud dictionary

https://genparts.sharepoint.com/:b:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/GCP_Cloud_Dictionary_A_Cloud_Guru%20(3).pdf?csf=1&web=1&e=ZXnJ8l

3. Learn the following cheat sheets: VMWare

https://genparts.sharepoint.com/:i:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/Cheat_Sheet_GCPVmWare.png?csf=1&web=1&e=Yz2O4Q

4. Read Google cheatsheets

https://googlecloudcheatsheet.withgoogle.com

5. Learn how to choose Database components for cloud projects

Genuine Parts document

https://gpcprod.atlassian.net/wiki/spaces/DE/pages/273613077/DB+options+and+evaluation+chart

Google Cloud document

https://genparts.sharepoint.com/:i:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/Cheat_Sheet_Data_sqlnosqlotherstorageallclouds.JPG?csf=1&web=1&e=PTGiE5

6. Take the Google Cloud Components Certification https://forms.office.com/Pages/ResponsePage.aspx?id=ZNc5tMvy6kOsBS43PIMEPhTdr_TbepBJiRW83UklJolUMlk2UEg2RVdOTUNEV0dNVlIzOFRQNlZWViQlQCN0PWcu

110

111 of 173

Architectural Components – the WHY?

111

112 of 173

Google Architectural Components – the What?

112

113 of 173

Security Components

    • IAM – Identity and Access Management (users, roles, permissions, policies – think Active Directory)
    • Keys and Secrets (Secret Manager / Vaults)
    • Firewalls (Hierarchical Firewall Policies, Cloud Armor(WAF))
    • Security Center
    • Policy Intelligence (automated policy controls) also
      • Policy Analysis
      • Policy Troubleshooter
      • Policy Simulator
      • IAM Recommender
      • See https://cloud.google.com/policy-intelligence

​

    • Threat detection/hunting Mandiant https://chronicle.security/ SIEM (Security Info and Event Mgt) and SOAR tool (security orchestration, automation & response )
    • Full SECOPS (automated security)

​

​

113

114 of 173

Components in Identity and Access Management

  • POLICIES : A set of rules that governs who can do one or more tasks with specific resources. We can decide who can do what on which resources.
    • Properties: Organization Policy Administrator role, Organization policy service, resource hierarchy
    • Constraints, limit IAM service account usage, limit resource sharing, restrict physical location of resources, inheritance
    • Note: Policies can be applied at the folder level for example and cascade down to all projects in those folders
    • Policies LIMIT / RESTRICT usually
  • ROLES : A collection of permissions assigned to identities or members.
    • Basic roles (thousands, do not use)
    • Predefined roles (google’s collection of permissions into predefined roles)
    • Custom roles (if google’s predefined roles do not work for you create your own)
    • Roles PERMIT / ALLOW usually

​

  • RESOURCES : can be your projects, folders, cloud services, or parts of those services like instances or buckets

​

  • CloudIdentity: Identities, Users, (Service)Accounts
  • IAM: Access Control (Roles, groups, permissions), SSO, MFA, Devices

​

114

115 of 173

Identity in GCP

​

​

​

​

​

​

​

​

​

​

​

Service accounts: These are robo accounts - and typically represent an application identity (as opposed to a HUMAN user).

​

​

​

115

116 of 173

Group, Roles, Permissions

Group: (Developers)

User: Michelle Sollicito

Identity: x457990@genpt.net

Member

Roles: (roles/run.developer)

Granted

roles/run.developer permissions

116

117 of 173

Components in Networking

  • Load balancers
    • WAF (CloudArmor)
  • Firewalls
    • NVA in GPC
  • Hub and Spoke network
  • Private IP versus Public IP (example CloudSQL)
  • VPCs
  • Subnets
  • Regions
  • Zones

​

117

118 of 173

compute

https://cloud.google.com/blog/topics/developers-practitioners/where-should-i-run-my-stuff-choosing-google-cloud-compute-option

119 of 173

GCP Compute engine

  • Committed resources
  • Use if you have existing systems/virtual machines to migrate to cloud
  • Use if you have licensing requirements
  • Complex requirements/specific protocols

120 of 173

GKE

  • Use for hybrid/multi cloud
  • Portability
  • Benefits of containers (see later)
  • Committed resource costing

​

121 of 173

Cloud Run

  • Fully managed, reduce costs
  • Rapid auto scaling
  • Supports longer request timeouts and sockets
  • Usage based costing

122 of 173

Cloud functions

  • Use CloudRun instead of Cloud Functions now generally
  • Small pieces of code in response to events
  • Usage based costing

123 of 173

When to use VMWare?

124 of 173

Google Compute

  • VMs
    • Shielded – verified integrity/security – no malware no changes via secure boot etc.
    • Bare metal – single tenant, you have full access right down to the hardware level
    • Pre-emptible (including spot VMs) – interruptible, cheap, fault-tolerant applications only
    • Properties such as: Operating system, disk size, CPUs/GPUs/TPUs, memory, etc.
  • CloudRun
    • Serverless GPC preferred way of deploying applications, uses containers (docker)
    • Properties such as: services or jobs; unique endpoint (*.run.app), custom domains, autoscaling, traffic management (for deployment/percentages), authentication policy (allow unauthenticated or require authentication)
    • Use instead of functions unless the functionality is VERY small and event driven – then use Functions
  • GKE (Kubernetes)
    • Serverless but managed
    • Properties: autopilot, autoscaling, autorepair, pods/nodes/clusters, Anthos for management (large scale), healthchecks

​

​

124

125 of 173

Components in Storage

  • Cloud Storage
    • Buckets, files, blobs
    • Standard(hot), nearline, coldline, archive
    • Properties: Region/dual-region/multi-region, lifecycle
    • Often used for cheap, fast storage of incoming files (Data lakes)
    • Often used for data streaming (small packets of data coming very fast, huge volume)
    • Often data files are stored in folders/directories within the bucket
    • Often filenames start something like YYYYMMDDHHMMSS..

125

126 of 173

Load Balancer Choices

Choose a load balancer  |  Load Balancing  |  Google Cloud

126

127 of 173

Network layers (OSI Model)

  • Application (load balancer https/http – APDU))
  • Presentation (tls - translate/encrypt data - PPDU)
  • Session (sessions – SPDU)
  • Transport (gateway / tcp - TPDU)
  • Network (load balancer / ip / router - packets)
  • Data (hubs, switches, bridges / MAC – frames)
  • Physical (ethernet - repeaters - bits)

127

128 of 173

Components in Applications

  • Microservices
  • APIs
    • ApigeeX is coming soon
    • API performance, security, caching, resilience/ha etc.
  • Containers
    • Docker – but DON’T use Docker desktop!!
    • Jfrog Artifactory
    • Deploy to CloudRun or to GKE Kubernetes

128

129 of 173

Containers

  • Containerize code
    • Think of code as like a shipping container
    • More secure
      • Nothing can get in/out
    • Transport easily
      • As a whole package
      • No changes internally
    • Contains anything
      • Different languages
      • Different applications
      • Large or small etc
    • No bleed/spillover
      • One container cannot affect another container

​

129

130 of 173

Microservices

  • Small components containing code
  • In GPC, we use CloudRun or GKE (Kubernetes) for these
  • Usually self-contained
  • Usually own a small piece of data (e.g. Orders data)
  • Often REST API based (GET, POST, PUT, DELETE and sometimes PATCH)
  • Resilient/Self healing
    • Often use healthchecks/heartbeats for monitoring to ensure they are running ok
  • Redundancy
    • Another instance of a microservice can take over if one goes down (load balancing/failover)
    • May have many instances in different locations (e.g. Orders microservice may exist in various regions – some in the US and some in the EU)

​

  • NOTE ApigeeX is coming soon but not yet ready
  • Next session we will go into this in more depth – or read Chandra’s book or my articles! See end of presentation

130

131 of 173

Healthchecks and heartbeats

Healthcheck

  • Healthcheck is used to check a microservice/REST API instance to discover how reliable it is
  • /health endpoint for each api (example: https://myurl.com/myapiname/health )
  • Response packet (typically json):
    • Overall http status (200, 401, 403, 500 etc.)
    • Status for each sub component (optional)
      • 1 for database accessed
      • 1 for external api used
      • 1 for file accessed

​

​

  • Typically if the overall http status is other than 200, the load balancer or the client will stop using the microservice/REST API instance and will “failover” to another. If the overall http status is 200 but one of the sub components is other than 200 different actions may be taken – example an external api may have an alternative url that can be used; a database may have an alternative region/connection string that can be used to access a replica.

​

​

Heartbeat

  • Heartbeats check that the “server” component still exists so the client knows its messages are getting to the other side
  • Used for failover or monitoring usually
  • RPC call or REST API call to the server from the client just to check a response is still received
  • Simpler than a healthcheck

​

131

132 of 173

Database Components

132

133 of 173

Database Components

​

133

134 of 173

Database Components

134

135 of 173

Big Table vs Big Query

135

136 of 173

Apache Hadoop

136

137 of 173

Big Data Architecture Components

137

138 of 173

IOT

138

139 of 173

Gaming Analytics Architecture

139

140 of 173

Big Data Streaming/ML/AI Components

140

141 of 173

6. Google Cloud for Programmers

  1. Read Lessons Learned from Moving to Google Cloud

https://gpcprod.atlassian.net/wiki/spaces/SMP/blog/2022/07/15/163381268/Lessons+Learned+from+moving+to+Google+Cloud

2. Watch this video "Lessons Learned from Moving to Google Cloud"

https://genparts-my.sharepoint.com/:p:/g/personal/457990_genpt_net/EdICahz0SblOlpfFC26i4w0ByySHruU2jOtbCdMFmY7EeA?e=wYodsC

3. Read the Google Cloud Tech Stack

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/43548721/Google+Cloud+Tech+Stack

4. Read Paved Path Enablement

https://gpcprod.atlassian.net/wiki/spaces/DE/pages/52199425/Paved+Path+Enablement

5. Authentication

SSO with Azure AD https://gpcprod.atlassian.net/wiki/spaces/PET/pages/491423022/Project+Cookbook+for+SSO+with+azure+AD

Authentication is on my "lessons learned blog" https://gpcprod.atlassian.net/wiki/spaces/SMP/pages/438075654/4.+Technical+Implementation+-+Software+original

Also here is the OAUTH part of authentication we did with AD https://gpcprod.atlassian.net/wiki/spaces/SMP/pages/591659688/Back+End+Authentication+OAuth

Here is the Google OAUTH diagram that Param did https://gpcprod.atlassian.net/wiki/spaces/DE/pages/177635527/End+User+Browser+Based+Authentication

6. Learn the principles of REST API Design

https://genparts-my.sharepoint.com/:i:/g/personal/457990_genpt_net/Ec4Bo1ZUTstFrU_UFHkNfAAB0VPmWTGmFJd7Nei85zMlLg?e=ACklZb

7. Watch / read this presentation on Microservices in the cloud

https://genparts.sharepoint.com/:p:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/Microservices-WithOrchestration_LunchandLearn.pptx?d=w3f604b8e7152419db6877ab4f4c7483b&csf=1&web=1&e=OvnhCl

8. Learn Python cheat sheet

https://genparts.sharepoint.com/:b:/r/sites/WIT/Shared%20Documents/WIT%20Cloud%20Certification/Cheat_Sheet_Python_Cheat_Sheet.pdf?csf=1&web=1&e=jnve0U

9. Spring Cloud samples for Java developers

https://github.com/GoogleCloudPlatform/spring-cloud-gcp

10. MongoDb classes

https://learn.mongodb.com/catalog

141

142 of 173

6. Google Cloud for Programmers

11. Read the following links:

Setting up a GKE Cluster for GKE Standard

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/577634305/Setting+up+of+GKE+cluster+for+GKE-+Standard

Performance testing with K6 (Grafana) https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/542835617/Cloud+Performance+Testing+K6

Version control of CloudSQL (Postgres) via CI/CD pipeline

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/472548034/Liquibase+CICD+Pipeline+for+CloudSQL+PostgreSQL

Multi-Region Failover for Cloud Run instances with Global Load Balancer

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/546275329/Multi-Region+failover+Manual+through+TF

Understand the CI/CD pipeline for Gradle

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/307855361/CI+CD+Pipeline+for+Java+Gradle+application+Code

More on CI/CD and Common Workflows

https://1drv.ms/w/s!Agz-G_kd_11BgZYYlv97UjGWCtpDLQ?e=8nHdRM

Cloud Functions Gen 2

https://gpcprod.atlassian.net/l/cp/Ubti969Y

Liquibase for Cloud SQL

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/472548034/Liquibase+CICD+Pipeline+for+CloudSQL+PostgreSQL

Terraform Modules

https://gpcprod.atlassian.net/wiki/spaces/CPE/pages/257851857/Modules+Info+Guides

Do some of the Google QwikLabs

https://googlecloud.qwiklabs.com/

12. Take the Google Cloud for Programmers Certification

https://forms.office.com/Pages/ResponsePage.aspx?id=ZNc5tMvy6kOsBS43PIMEPhTdr_TbepBJiRW83UklJolUQVFNNEdWMTNVM01XVUxLUUJWSjhPUDlLVCQlQCN0PWcu

​

EXTRAS

Google Analytics training (Business side)

https://1drv.ms/v/s!Agz-G_kd_11BgZVO4kESQp7Ct37ASw?e=liOd2e

​

​

142

143 of 173

Cloud Developer Skillsets

Paved Path Enablement https://gpcprod.atlassian.net/wiki/spaces/DE/pages/52199425/Paved+Path+Enablement

143

144 of 173

Environment in which CLOUD development is happening

Manual >> DEVOPS >> DEVSECOPS

Build secure optimized code

Build secure containers

IAM (Authentication/Authorization)

Api gateways

Security built into IAC (terraform)

Automated Security policies

Automated Vulnerability scans

Automated Vulnerability remediation

Security As A Service

​

Tech Garage (speak to Ryan Wade)

How to create github repo for GCP terraform code using Backstage/Tech Garage - Cloud Platform Engineering - Confluence (atlassian.net)

144

145 of 173

Architecting/Designing for Software

145

146 of 173

Software Design Principles

  • DRY – Don’t Repeat Yourself
    • Reusable objects
    • Functional programming
    • Reusable functions (whenever you write a function think – might this be needed elsewhere in our system, in other systems?)
    • Reusable components (factory pattern to create, then set properties of components)
    • Package based development (create an sdk and use it as a package – nuget or maven/npm)
    • Reusable containers (pass params in for the difference)
  • Maintenance is 80% of development
    • Naming standards are crucial
    • Think about variable names, property names, component names
  • Move issues as far left as you can
    • Finding problems during architecture/design is best
    • Finding problems during coding is next best (quality scanning – Sonarqube or Sonarlint or similar)
    • Finding problems during unit testing
    • Finding problems during integration/system testing
    • Finding problems during security scanning

146

147 of 173

Containers

  • Containerize code
    • Think of code as like a shipping container
    • More secure
      • Nothing can get in/out
    • Transport easily
      • As a whole package
      • No changes internally
    • Contains anything
      • Different languages
      • Different applications
      • Large or small etc
    • No bleed/spillover
      • One container cannot affect another container

​

147

148 of 173

Architecting for Services at the Back end / Middleware

  • Authentication
  • Authorization
  • REST APIs
  • Microservices/containers
  • ApigeeX is coming

148

149 of 173

Build Secure Containers

  • Secure Container registries (GCS)
  • Container scanning (snyk)
  • Builds/build packs (jfrog artifactory)
  • Secure application catalogs (Paved Path preferred applications)
  • Service Meshes (Anthos, mesos, Istio) – for observability, security and reliability

​

​

For more on containers and microservices see

149

150 of 173

Microservices

  • Small components containing code . Usually SERVER side
  • In GPC, we use CloudRun or GKE (Kubernetes) for these
  • Usually self-contained, can be deployed and tested as a whole
  • Usually own a small piece of data (e.g. Orders data)
  • Loosely coupled services
  • Often REST API based (GET, POST, PUT, DELETE and sometimes PATCH)
  • Scalable/Available
  • Diverse technologies CAN be used
  • Resilient/Self healing
    • Often use healthchecks/heartbeats for monitoring to ensure they are running ok
  • Redundancy
    • Another instance of a microservice can take over if one goes down (load balancing/failover)
    • May have many instances in different locations (e.g. Orders microservice may exist in various regions – some in the US and some in the EU)

​

​

​

150

151 of 173

Microservices

​

151

152 of 173

More on Microservices

Pros and Cons of Microservices by Michelle Sollicito​

Do’s and Don’ts of Microservices by Michelle Sollicito​

​

​

152

153 of 173

Architecting for Authentication and Authorization

  • Authentication (are you who you say you are?)
    • Something you know (user name and password, security questions, etc.)
    • Something you have (cellphone – send a code, email address – send a code, laptop ip address etc.)
    • Something you are (fingerprint, faceprint, iris scan etc.)
  • Multi Factor Authentication
    • Combine any of the above
  • Authorization (now I know who you are, what are you allowed to do?)
    • GPC often uses job title to determine authorization
      • Example, Division Manager can do certain things a DC Manager cannot
    • IAM/IDP users/groups/roles/permissions (RBAC – role based access controls)
    • Can use JWT tokens or OAuth
    • Technically:
      • Map the user’s job title/role or group to a web page or
      • Map the user’s role or group to an api path (plus a HTTP Verb – get or post or put etc.)

​

​

​

​

153

154 of 173

Authentication/Authorization

  • Current state
    • Authentication - Active Directory in Azure or Google Oauth
    • Multi Factor Authentication – AD SSO (Single Sign On)
    • Authorization – Azure AD Graph Api or Custom
    • API Authorization – JWT Tokens
  • Future state
    • Authentication - Ping (may replace Active Directory, may replace Google Oauth)
    • Multi Factor Authentication – Ping SSO (Single Sign On)
    • Authorization – Workday
    • API Authorization – Apigee(x) via three legged auth

​

154

155 of 173

3 legged authentication – future state

  • Ping plus ApigeeX

​

155

156 of 173

Development/architecture for Cloud Performance

  • Functional programming/streams in Java
  • Containers
    • Great for scaling up and down only a small part of the architecture
  • Separation of concerns/isolation of layers
    • Loose coupling
    • Pub Sub
    • Data Pipeline tools (Informatica for GPC, Dataflow etc.)
  • Multi threading / async

​

156

157 of 173

Functional Programming (Java 8 onwards)

157

158 of 173

SQL like

repository database table

Person row “shape”/table schema/object schema

List<Person> persons table

​

persons.stream() = FROM all rows in the persons table

.filter(person -> person.getAge() >= 18) WHERE Age >-18

.map(person -> person.getName()) Name (select only the column Name)

.toList() Select

158

159 of 173

Front End and UI/UX

  • DRAFT Front End Framework - Developer Enablement - Confluence (atlassian.net) (Ryan Wade)
  • Responsive front end for cross platform apps (desktop, mobile, etc)
    • Viewport tag for different screen sizes
    • Flex will move the objects on screen around nicely as the screen size changes
    • Load a different css file according to screen size?
    • No OS tie in (android/apple)

​

  • UI/UX – KC Wolff Ingham is leading the way here
    • Standardizing across GPC on UI/UX principles where possible

​

  • Jessica Fuller has some more to add here

​

​

159

160 of 173

Back end / Data

  • Programmers must play their parts in the 5 Rs of Data:
    • The Five R’s as I refer to them are as follows:
      1. the right data
      2. From the right sources
      3. delivered at the right time
      4. interpreted in the right way and
      5. utilised for the right purposes
  • Are you using the right data? The right endpoints?
  • Are you getting data from the right sources? Esp now with Domains owning data
  • Are you getting the data at the right TIME – is it a full dump, a daily dump, a real time API call? A pub sub piece of data? If it is in BigQuery are you selecting only the data that is relevant and timely?
  • Are you interpreting the data correctly – communicate with Product!! Terminology is a big issue in GPC!
  • Are you utilizing the data for the right purpose?

​

​

160

161 of 173

BigQuery within GPC

​

161

162 of 173

CI/CD (Continuous Integration/Continuous Delivery/Deployment)

  • Github is used to store source code
  • Github Actions for pipeline/actions
  • Gradle (and others?) CI/CD pipeline created for you
  • Jfrog Artifactory (used to be Google Artifacts)
  • Image hosting – GCR (Google Container Registry)
  • Snyk for Security vulnerability checking/scanning code
  • Sonaqube / Sonalint for code quality checking
  • Secrets management, environment variable/yaml files
  • Unit testing (fail to deploy if unit tests fail)
  • Testing tools (performance testing, end to end testing etc.)
  • Ryan Wade has done a lot of work on this

​

162

163 of 173

CI/CD Pipelines/Workflows

​

​

  • Ryan Wade and Satish Reddy are the key contacts

163

164 of 173

​

​

​

​

​

​

​

​

​

​

​

​

​

See my presentation on A Unified Approach to Testing

Unified Approach to Testing

  • Quality Assurance
    • Self improving system
    • Prevent problems as early in the process as possible (leftmost)
  • Good architectural design - Before you even think about testing
    • Security built in from the start
    • Isolation of layers/services, decoupling
      • Microservices approach
    • SOLID DRY principles – REUSE!!!
      • Don’t repeat yourself (anything!!)
      • Single responsibility
      • Use interfaces where possible (esp useful for testing!) -- Dependency Injection

164

165 of 173

Testing in Genuine Parts

  • Unit testing (Jest on Front End, Junit on Back End)
    • 80% coverage

​

  • Integration testing (end to end)
  • Contract testing (PACT)
  • System testing
  • Smoke testing
  • Security testing (snyk)

165

166 of 173

Monitoring and Metrics

  • MELT (Monitoring, Errors, Logs and Traces) – how you gather data
  • VALET (Volume, Availability, Latency, Errors and Tickets) – what you are measuring
  • Open Telemetry to Google Cloud Monitoring (see M Shaik)

​

166

167 of 173

Healthchecks and heartbeats

Healthcheck

  • Healthcheck is used to check a microservice/REST API instance to discover how reliable it is
  • /health endpoint for each api (example: https://myurl.com/myapiname/health )
  • Response packet (typically json):
    • Overall http status (200, 401, 403, 500 etc.)
    • Status for each sub component (optional)
      • 1 for database accessed
      • 1 for external api used
      • 1 for file accessed

​

​

  • Typically if the overall http status is other than 200, the load balancer or the client will stop using the microservice/REST API instance and will “failover” to another. If the overall http status is 200 but one of the sub components is other than 200 different actions may be taken – example an external api may have an alternative url that can be used; a database may have an alternative region/connection string that can be used to access a replica.

​

​

Heartbeat

  • Heartbeats check that the “server” component still exists so the client knows its messages are getting to the other side
  • Used for failover or monitoring usually
  • RPC call or REST API call to the server from the client just to check a response is still received
  • Simpler than a healthcheck

​

167

168 of 173

Sidecar pattern for metrics/logs etc.

OTEL sidecar - Open Telemetry to Google Cloud Monitoring (see M Shaik)

See code here Custom metrics and traces using an OpenTelemetry sidecar - Commerce_Platforms - Confluence (atlassian.net)

168

169 of 173

Alerts to 1View

169

170 of 173

Ops Bridge integration

Integrating AlertOps with GCP - Developer Enablement - Confluence (atlassian.net)

https://www.microfocus.com/en-us/products/operations-bridge-manager/overview

170

171 of 173

Database Tools

  • Liquibase for version control

​

171

172 of 173

Resources for Cloud Programmers

  • Free conference on performance in programming
    • P99 CONF

172

173 of 173

Cloud Team Connections

​

173