Artifact Registry for language packages now generally available

Using a centralized, private repository to host your internal code as a package not only enables code reuse, but also simplifies and secures your existing software delivery pipeline. By using the same formats and tools as you would in the open-source ecosystem, you can leverage the same advantages, simplify your build, and keep your business logic and applications secure.Language repository formats, now generally availableAs of today, support for language repositories in Artifact Registry is now generally available, allowing you to store all your language-specific artifacts in one place. Supported package types include:Java packages  (using the Maven repository format)Node.js packages (using the npm repository format)Python packages (using the PyPI repository format)OS repository formats in previewAdditionally, support for new repository formats for Linux distributions is in public preview, allowing developers to create private internal-only packages and securely use them across multiple applications deployed to Linux environments. New supported artifact formats include:Debian packages (using the Apt repository format)RPM packages (using the Yum repository format)This is in addition to existing container images and Helm charts (using the Docker repository format). Your own secure supply chainStoring your packages in Artifact Registry not only enables code reuse, but also simplifies and secures your existing build pipeline. In addition to bringing your internal packages to a managed repository, using Artifact Registry also allows you to take additional steps to improve the security of your software delivery pipeline:Use Container Analysis to scan containers that use your private packages for vulnerabilitiesInclude your repositories in a Virtual Private Cloud to control accessMonitor repository usage with Cloud Audit LogsUse the binauthz-attestation builder with Cloud Build to create attestations that Binary Authorization verifies before allowing container deploymentUse  Cloud Identity and Access Management (IAM) for repository access controlSeamless authenticationWith credential helpers to authenticate access for installers based on Cloud Identity and Access Management (IAM) permissions, using Artifact Registry to host your packages makes authentication to private repositories easy. By managing IAM groups, administrators can control access to repositories via the same tools used across Google Cloud.Regional repositories lower cost and enable data complianceArtifact Registry provides regional support, enabling you to manage and host artifacts in the regions where your deployments occur, reducing latency and cost. By implementing regional repositories, you can also comply with your local data sovereignty and security requirements.Get started todayThese repository formats are now generally available to all Artifact Registry customers. Pricing for language repositories is the same as container pricing; see the pricing documentation for details. To get started using language and OS repositories, try the quickstarts in the Artifact Registry documentation.Node.js Quickstart GuidePython Quickstart GuideJava Quickstart GuideApt Quickstart GuideRPM Quickstart GuideRelated ArticleNode, Python and Java repositories now available in Artifact RegistryExpanded language support lets you store Java, Node and Python artifacts in Artifact Registry, for a more secure software supply chain.Read Article
Quelle: Google Cloud Platform

LOVOO’s love affair with Spanner

Editor’s note: In this blog, we look at how German dating app LOVOO broke up with its monolith system for a microservices architecture, powered in part by the fully managed, scalable Cloud Spanner. Founded in 2011, LOVOO is one of Europe’s leading dating apps, available in 15 languages. We currently employ approximately 170 employees from more than 25 nations, with offices in Dresden and Berlin. LOVOO changes people’s lives by changing how they meet. We do this through innovative location-based algorithms, an app radar feature, and live streaming that helps people find successful matches through chat and real-time video. Three years ago, we started to encounter growing pains. Our user base was growing at a steady clip, and their activity within the app was growing as well. We had built the app on an on-premises monolith architecture. As we grew, the old system was unable to keep up with the speed and scale we needed to serve our users. After assessing the options available to us in 2018, Google’s open source driven approach and cutting edge technology were key drivers for our decision to migrate to Google Cloud and its managed services, including Cloud Spanner. Spanner now hosts more than 20 databases for us, powers 40 microservices and integrates perfectly with our other Google Cloud services. With Spanner’s open source auto-scaler, we can seamlessly scale from 14 to 16 nodes during busier hours in which we perform 20,000 queries per second. One of our databases handles 25 million queries per day and collects 100GB of new data every month. We feel confident in the platform’s ability to scale for our future needs and address our growing customer base while supporting new services and capabilities.Breaking up with the monolithBefore migrating to Google Cloud, our infrastructure lived on-premises and used open-source PostgreSQL as a database. However, we encountered challenges with bottlenecks in performance, difficulty scaling during peak times, and constantly needing to add new hardware. The cloud promised to give our engineers and product teams a faster, smoother development process, which was a big selling point for us. We performed a lift-and-shift migration of our architecture, but used the migration as a catalyst to modernize and make important changes. We separated some responsibilities from the monolith into microservices, moving them directly onto Google Kubernetes Engine (GKE). We started out by converting about a dozen functions from the monolith into microservices, and we’re now up to over 40 microservices that we’ve separated from the prior monolith.We performed the migration smoothly within a six month timeline, as we wanted to finish within the time remaining on our on-premises contracts. We have plans to eventually move entirely to a microservices-based architecture, but we are taking it one step at a time. Our billing database and logic is complex, and was built on PostgreSQL, our original database solution. In this specific case,  we chose to lift and shift the workload to Cloud SQL for PostgreSQL, Google’s fully managed database service. Falling in love with SpannerSpanner was our first level of support on Google Cloud, and our preferred solution for large distributed databases. Spanner is a fully managed relational database service with unlimited scale and up to 99.999% availability, which means our prior scale and speed problems are effectively solved. Our developers love managed services like Spanner because routine headaches like infrastructure management, updates, and maintenance are taken care of for us, and we can devote our energy to building new features for LOVOO. We have roughly 20 databases in one Spanner instance, with a mix of production and development databases. It’s a kind of multi-tenancy architecture, and most of our services are connected one-to-one with a database. We have 20 TB and 14 nodes (16 at peak) on one regional deployment at the moment.Among our use cases for Spanner are a notifications database, which is our largest database. This database is where we save data needed to send out notifications to our app’s users when other users take an action on their profiles, such as a view or a match. So when you indicate you are interested in a person and they have already shown interest in you, that translates to a row in the notification table. When the other person logs in, we query the new notifications they have and they will see that they matched with you.We also have a database on Spanner for our user messaging. Users have conversations in our real-time chats, and messages within those conversations may include various media types they can send to each other, such as photos, audio, and gifs. The microservice that powers this real-time chat feature has a web socket connection to the clients, and it stores the text and contents in Spanner. We have a table for conversations and a table for individual messages (where each message has a conversation id).A third use case for Spanner is with our in-app credit transaction service, where users can gift each other credits. You can think about it almost like a virtual currency payments system. So that means that we have a table with all our users and for each one we have their credit balance. And when you send out a gift, we decrease the credit number in your row and increase theirs. We also have a “payments ” ledger table that has a row for every credit gifting ever made. This capability is where Spanner’s transactional consistency shines, because we can perform all these operations automatically in one transaction.Planning a future with Google CloudWe’ve also been pleased with the Spanner Emulator, which has made our development process a lot easier.  Without needing direct access to Spanner,  an engineer can debug their code on their machine by running the emulator locally. As part of our build process, we launch an emulator so we can have our software tests run against it. Our engineers also use it to run integration tests on-demand on their machines. This ensures that the same API calls we use when we build the code will work when we deploy the code.Our plans are to build all of our new features on top of Spanner, and to continue pulling services out of our monolith. We’re currently migrating our user device representation database, which tracks all of a user’s various devices. We also want to continue moving away from PHP for future use cases, and we’d like to use Google’s gRPC, an open source communication protocol, to directly connect the clients with the microservices, instead of via PHP. With Spanner and other Google Cloud-managed services saving us time and delivering on speed and scalability, we’ll be charting our future roadmap with them on our side. Google Cloud is the right match for us.Read more about LOVOO and Cloud Spanner. Or read out how Spanner helped Merpay, a fintech enterprise, scale to millions of users.Related ArticleHow ShareChat built scalable data-driven social media with Google CloudSee how India-based social media company ShareChat migrated to Google Cloud databases and more to serve 160 million monthly active users …Read Article
Quelle: Google Cloud Platform

Service Mesh for Mere Mortals: Chapters 1-3

We are thrilled to launch our inaugural book from Mirantis Press, Service Mesh for Mere Mortals, by Bruce Basil Mathews. Below we’ve shared the first three chapters of the book, where you can learn about the history of service mesh, and how service mesh fits in versus container orchestrators like Kubernetes. Download the full 100+ … Continued
Quelle: Mirantis

Model training as a CI/CD system: Part I

In software engineering, Continuous Integration (CI) and Continuous Delivery (CD) are two very important concepts. CI is when you integrate changes (new features, approved code commits, etc.) into your system reliably and continuously. CD is when you deploy these changes reliably and continuously. CI and CD both can be performed in isolation as well as they can be coupled. A machine learning (ML) system is essentially a software system. So, to operate with such systems scalably we need CI/CD practices in place to facilitate rapid experimentation, integration, and deployment. Here are some scenarios:As an ML Engineer, you are likely to experiment with new model architectures to improve performance. How do you reliably integrate them into the system without breaking anything? Upon availability of new data, how do you automatically trigger new training runs so that your system can adapt to the recency of the data? How do you deploy the newly trained models to different environments such as staging, pre-production, and production? Integrating a new model into the system is like adding a new feature. When operating at a large scale, the number of these new models can grow rapidly within a short period of time. This is why manual processes to deal with CI/CD are atypical. You can learn more about why having a resilient CI/CD system for your ML application is crucial for success from this excellent post.In this two-part series blog post, we will present two different scenarios of CI/CD particularly from the perspectives of model training. In this first part, we will explore how to build a complete TFX project with prebuilt components, and how to run the pipeline on Vertex AI automatically in response to the changes of the codebase.We will build on top of what we will learn in this post and extend that to automatically trigger runs based on different triggers. We will use Pub/Sub, Cloud Functions, and Cloud Scheduler along with TensorFlow Extended (TFX) and Vertex AI.To comfortably understand this series of posts, we expect that you are already familiar with the basic MLOps terminologies, TFX, Vertex AI, and GitHub Actions. ApproachIn this section, we will introduce schematics of two workflows we want to develop so that we can develop a mental image of what’s to come. In the first workflow, we want to do the following:Create a complete TFX pipeline project from TFX CLI. Modify some configurations to leverage Vertex AI, and set up a GitHub Action workflow to be triggered by detecting any changes in the tfx-pipeline directory which contains all the codebase for this project.When the GitHub Action gets executed, it will initiate a Cloud Build process.The initiated Cloud Build process clones the entire repository, builds a new docker image based on the changed codebase, pushes the docker image to the Google Container Registry(GCR), and submits the TFX pipeline to Vertex AI. For managing the build process, we will use Cloud Build which is a serverless fully managed CI/CD system provided by Google Cloud Platform (GCP). Other alternatives include CircleCI, Jenkins, etc. We will also have the GitHub Action workflow monitor certain changes in the codebase so that it can initiate the above workflow automatically.Figure 1: CI/CD for the whole pipelineTFX pipeline consists of an array of components from ExampleGen to Pusher, and each component is run based on the same docker image. The first workflow shows how to build such docker images whenever the codebase changes. This is demonstrated in the main branch of this repository.In the second workflow, we will shift gears slightly and incorporate the following changes:Separate the data preprocessing and modeling codes for TFX Transform and Trainer components respectively from the TFX pipeline project to an individual directory, modules. These modules will be stored in a GCS bucket as in the Cloud Build process. Modify the pipeline source code so that TFX Transform and Trainer components can refer to the modules in the GCS bucket. In this way, we don’t need to build a new docker image based on changes in the two modules. Set up another GitHub Action workflow to be triggered by detecting any changes in the modules directory.When the GitHub Action gets fired, it will initiate the other Cloud Build process.The initiated Cloud Build process clones the entire repository, copies the only files in the modules directory to the GCS bucket, and submits the TFX pipeline to Vertex AI.Figure 2: CI/CD for the data preprocessing and modeling modulesThe second workflow is demonstrated in the experiment-decoupling branch of this repository.Implementation detailsTFX based MLOps project consists of a number of components from ExampleGen for taking care of the input dataset to Pusher for storing or serving trained models for the production. It is non-trivial to understand how these components are interconnected and to see which configurations are available for each component.In this section, we will show you how to use the TFX CLI tool that lets you start from a complete TFX based MLOps project template instead of building one from scratch by yourself. Initial TFX project with TFX CLIThere are two template projects, taxi and penguin at the moment. We will use the taxi template for this post. The following TFX CLI shows how to generate a new TFX project based on the taxi template. You can specify which template to use in –model, the name of pipeline in –pipeline-name, and the path where to store the generated project in –destination-path.After the CLI creates a template for us we can investigate its directory structure(Some minor files like caching, testing, __init__.py are omitted to save some space, but the most important files for understanding TFX pipeline are listed): Giving full descriptions for each file and directory is out of scope of this post, but let’s quickly discuss the most important ones for the purpose of this post. kubeflow_v2_runner.py explicitly says that we want to run the pipeline on Kubeflow 2.x environment, and it has to be used to leverage Vertex AI as a backend orchestrator. The models directory provides a set of predefined modules for data preprocessing, modeling, and there are testing templates for each module as well. The pipeline.py defines how the TFX pipeline is constructed, and the configs.py is there for configuring all the parameters passed down to the TFX component.  If you want more details about the TFX CLI and what’s included in the template project, please refer to the official document of TFX CLI and the codelabs that we are working on.Compile and build TFX projectThere are two ways to run a TFX pipeline. The first option is to use the Python API directly from the source code. The method will be covered in the second blog post. In this blog post, we will explore the second option, using TFX CLI. The tfx pipeline create command creates a new pipeline in the given orchestrator, and the underlying orchestrator can be selected via –engine. It is set to vertex since we want to run the pipeline in the Vertex AI platform, but you can choose other options such as kubeflow, local, airflow, and beam.There are two more important flags, –pipeline-path and –build-image. The value for the first flag should be set to kubeflow_v2_runner.py provided by the template if your orchestrator is vertex or Kubeflow 2.x. If you plan to run the pipeline on Kubeflow 1.x or local environment, there are kubeflow_runner.py and local_runner.py as well. The –build-image is an optional flag, and it has to be set when you want to build/update the custom TFX docker image. The image name can be modified via PIPELINE_IMAGE variable in pipeline/configs.py which manages all the configurations across the pipeline.After the tfx pipeline create command, you can run the pipeline on Vertex AI platform with the other CLI command tfx run create. The value for the –pipeline_name should match to the pipeline name used in tfx template copy. You can change the name afterward via the PIPELINE_NAME variable in pipeline/configs.py, but you have to re-run the tfx pipeline create command in this case.The base of the Vertex AI Platform is Kubeflow 2.x, but one of the main differences is that it is hosted in GCP as a serverless platform. That means we don’t have to manage the underlying GKE and Kubeflow infrastructure anymore. It is managed by Google entirely. Before Vertex AI, we needed to create and manage GKE clusters and install the Kubeflow platform on top of it ourselves. The –project and –region flags clearly show how these changes are reflected. Without Vertex AI we had to set –endpoint where the Kubeflow is running, but we only let the TFX know where to run the pipeline without caring how.Figure 3: Complete TFX pipeline hosted on Vertex AIAfter the tfx run create command, if you visit the Vertex AI pipeline in the GCP console, you will see something similar to Figure 3. You can see that the template project provides a nice starting point with all the standard TFX components interconnected to deliver the MLOps pipeline without writing any code. Setup GitHub Action and Cloud Build for the first workflowThe below YAML file defines a GitHub Action triggered by push event on the main branch:The dorny/paths-filter GitHub Action lets us detect if there were any changes on a given path for the push. In this example, that path is specified as tfx-pipeline which means any changes of the code base defining the pipeline should set steps.tfx-pipeline-change.outputs.src to true.If the steps.tfx-pipeline-change.outputs.src is true, the next step for submitting the Cloud Build can proceed. The Cloud Build specification is defined as below, and the environmental values beginning with $ symbol are injected via –substitutions. It is somewhat hard to read at first, but if you read the Cloud Build spec carefully, you will notice that there are four steps, which are to clone the repository, run the unit tests based on the three *_test.py files under the models directory, run the tfx pipeline create command, and run the tfx run create command in sequential manner. The last two steps were described in the earlier section, Compile and build TFX project.You might wonder why the docker image, ‘gcr.io/gcp-ml-172005/cb-tfx’ is used instead of the standard python image with the name: python instruction. The reason is the version of the Python provided by the standard python image is 3.9, and the latest TFX version only supports Python 3.8. Below is the Dockerfile to build cb-tfx docker file to enable the version of TFX above 1.0, kfp, and pytest which are required to run TFX CLI and unit tests.If you make any changes under the tfx-pipeline directory, you will see the Cloud Build process gets launched, and you can see the status from the Cloud Build dashboard in GCP console as in Figure 4.Figure 4: Cloud Build process displayed on GCP consoleWe have built a whole CI/CD pipeline for MLOps projects with TFX. However, we can make an additional improvement. Since building a docker image every time could let the system spend more time and cost, avoiding this step is ideal whenever possible. Let’s see what we can do about this in the next section.Decouple modules from the existing TFX projectIn order to run the two standard TFX components, Transform and Trainer, we have to provide codes in separate files containing how to pre-process raw data and how to build and run the model. There are two options to do this. The first option is to use run_fn and preprocessing_fn parameters for Trainer and Transform respectively, and the second option is to use module_file parameters for both components. The first option can be used when the files are included in the docker image, and we specify which function to trigger the action. For example, in the generated template project, run_fn is set as run_fn=models.run_fn. The second option also can be used when the files are included in the docker image as well, but the file should have a designated function name, run_fn and preprocessing_fn, and it will be recognized by the component. However, one of the most important differences is that the files can be injected from the GCS bucket directly. In this case, we don’t have to include the files in the docker image but simply specify the GCS path to the modeul_file parameter.In order to do that, we change the PREPROCESSING_FN and RUN_FN variables in configs.py like above. As you see we specify the GCS path where the files reside instead of the function name in the module. Also, we have to include every function and variable in a single file since the GCS bucket is just a storage system that doesn’t know anything about the Python filesystem. Then we store the two files in separate directory modules. One drawback of this way is that we have to pack everything inside a single file. For example, you can not have separate files for defining a model, training steps, signatures for serving, and so on. This harms some code management and readability, but you can avoid building a new docker image whenever these files are changed. So there is a trade-off.Setup GitHub Action and Cloud Build for the second workflowThe original GitHub Action script should be modified to adapt this change like below. As you see, one more filter is defined on modules directory, and one more step to trigger the Cloud Build process when steps.change.outputs.modules is true is defined. The original workflow to build a new docker image and launch the pipeline on Vertex AI When the pipeline itself gets modified is still handled. We added one more workflow that triggers the different Cloud Build process defined in separate file partial-pipeline-deployment.yamlif any changes are detected under the modules directory.Below shows how partial-pipeline-deployment.yaml is defined:We added one additional step in between Clone Repository andCreate Pipeline steps to copy files in modules directory to the designated GCS bucket. Also, as you might have noticed, the –build-image option flag in the tfx pipeline create command is removed since we don’t have to build a new docker image anymore.CostVertex AI Training is a separate service from Pipeline. We need to pay for the Vertex AI Pipeline individually, and it costs about $0.03 per pipeline run. The type of compute instance for each TFX component was e2-standard-4, and it costs about $0.134 per hour. Since the whole pipeline took less than an hour to be finished, we can estimate that the total cost was about $0.164 for a Vertex AI Pipeline run.The cost of custom model training depends on the type of machine and the number of hours. Also, you have to consider that you pay for the server and the accelerator separately. For this project, we chose n1-standard-4machine type whose price is $0.19 per hour and NVIDIA_TESLA_K80 accelerator type whose price is $0.45 per hour. The training for each model was done in less than an hour, so it cost about $1.28 in total.The cost of Cloud Build also depends on the type of machine and the number of hours to run. We have used the n1-highcpu-8 instance, and the job was done in an hour. In that case, the total cost for a Cloud Build run is about $0.016 per hour.If we sum them up, the total cost for this project is approximately $1.46. Please refer to the official documents on the price: Vertex AI price reference, Cloud Build price reference.ConclusionSo far we have demonstrated three workflows. As the first step, we have shown how to use TFX CLI to create a complete TFX MLOps project, build a new docker image, and launch the pipeline on Vertex AI platform. In the second step, we have covered how to integrate GitHub Action and Cloud Build to build CI/CD systems to adapt to any changes in the codebase. Lastly, we have demonstrated how to decouple data preprocessing and modeling modules from the pipeline to avoid building a new docker image whenever possible. This is good. But What if we wanted to maintain a schedule (which is usually dependent on the use-case) to trigger the pipeline runs on Vertex AI? What if we wanted a system such that during the experimentation phase whenever a new architecture is published as a Pub/Sub topic the same pipeline needs to be executed (but with different hyperparameters)? Note that this is different from committing your code changes to GitHub and then triggering the execution from there. A developer might want to first experiment and commit the changes (model architecture, hyperparameters, etc.) that yielded the best results. In the second part of this blog post, we will tackle these scenarios and discuss relevant solutions.   AcknowledgementsWe are grateful to the ML-GDE program that provided GCP credits for supporting our experiments. We sincerely thank Karl Weinmeister of Google for his help with the review.Related ArticleNew to ML: Learning path on Vertex AIIf you’re new to ML, or new to Vertex AI, this post will walk through a few example ML scenarios to help you understand when to use which…Read Article
Quelle: Google Cloud Platform

AWS License Manager unterstützt jetzt delegierte Administratoren für verwaltete Berechtigungen

AWS License Manager kündigt Support für delegierte Administratoren für verwaltete Berechtigungen an. Mit dieser Funktion können Lizenzadministratoren Lizenzen über ihre AWS-Konten von einem delegierten Konto außerhalb des Verwaltungskontos verwalten und verteilen. Mit dem delegierten Administrator können Sie Lizenzen von AWS Marketplace und unabhängigen Softwareanbietern in Ihrer gesamten Organisation erteilen und von den Verwaltungsfunktionen profitieren, die zuvor nur dem Verwaltungskonto zur Verfügung standen.
Quelle: aws.amazon.com