Cloud Computing Köln

Next-generation serverless: three ways enterprises can benefit

As we reflect on the past year, Heraclitus’ phrase “The only constant in life is change” has never rang more true. With the pandemic, companies had to shift operations, launch new products and adapt to extreme demand patterns, sometimes within a matter of weeks.To respond to customer needs faster and more efficiently, many companies turned to serverless technology, designing applications with real-time signals and intelligence built in. From apps and sites for healthcare appointments and vaccinations, public-sector employment benefits, contact tracing, retail logistics, curbside delivery, hotel and travel booking—you name it, companies built it with serverless.Redefining serverlessThe world changed, the market changed, our lives changed and we here at Google Cloud also changed, introducing new products to meet our customers’ needs and grow with them.Serverless technology, in particular, has changed a lot since it was first introduced. Google first launched serverless compute in 2008 with the launch of App Engine, helping customers scale their applications faster and seamlessly. We then added the ability to run Functions as a Service with Cloud Functions, giving customers a simple developer experience with integrated telemetry and observability. In parallel, we also introduced innovations to the container market with Kubernetes. Pretty soon, customers started asking us if we could combine the awesome serverless attributes of auto-scaling and developer experience with the flexibility of containers. Enter Cloud Run, the next generation of serverless. Serverless is now no longer just about event-driven programming or microservices. It’s also about running complex workloads at scale while still preserving a delightful developer experience. In fact, serverless with Cloud Run is about having a true developer platform with the flexibility to run any language, any library, any binary.There are three capabilities that make Cloud Run the next-generation of serverless, and not the same ‘serverless’ you find elsewhere:A great developer-centric experienceVersatility: expanding to a broader set of containerized appsBuilt-in DevOps and securityLet’s take a look at the attributes in greater depth.A great developer experienceBeing developer-centric comes from having fully-managed self-operating infrastructure and a great developer experience. We want everyone to be able to develop smart applications and for that we have to make it easy. We also want to be sure we are bringing your technical talent closer to where you generate your business value. To make things easy, last year we introduced buildpacks, which creates container images directly from source code. No need to learn Docker or containers. Although there are containers underneath, they’re transparent to the developer.To simplify things further, we also introduced a single “gcloud run deploy” command to build and deploy code to Cloud Run. These types of features are some of the reasons why 98% of Cloud Run users deploy an application on their first try in less than 5 minutes. In fact, in the past year alone, we added over 25 new features and services to our serverless stack, making development of complex apps easier. One of our main launches was Workflows, which lets you combine Cloud Run with any Google Cloud product or any HTTP-based API service. As a developer, this is very useful when automating complex processes, or integrating GCP’s analytic services across a variety of systems. Taken together, all these new features make the Cloud Run developer experience far easier than its competitors’, according to a recent report by User Research International.VersatilityNext-generation serverless is also about versatility. It supports a wider variety of applications and caters to enterprise requirements. Functions and web apps of course, but also heavyweight applications, and in the fullness of time, also brownfield and third-party containerized apps. This versatility is enabled by the container primitive, which removes restrictions on languages, run times, and hardware. Being able to run a greater variety of apps on our serverless stack means you can optimize for predictable usage. Today, we announced new spend-based committed use discounts for Cloud Run. Enterprises with stable, steady-state, and predictable usage can now purchase committed use contracts directly in the billing UI. There are no upfront payments, so these discounts are a perfect way to reduce your spend by as much as 17%. Related ArticleMaximize your Cloud Run investments with new committed use discountsCommitted use discounts in Cloud Run enable predictable costs—and a substantial discount!Read ArticleAnother way we provide versatility is with support for WebSockets and gRPC in Cloud Run. With these new additions, you get the benefits of serverless infrastructure to build responsive, high-performance applications. We also added the use of min instances with Cloud Run. This feature allows you to cut cold-start times and run latency-sensitive applications on Cloud Run! At the same time, you can still scale to zero, or keep a minimum amount of compute available, for example when running brownfield Java applications.Built-in DevOpsServerless doesn’t just make it faster for developers to set up their apps—it also helps once the application is up and running, taking a big management load off of operations teams. Notably, serverless systems take care of “scaling” an application up or down. That means that if your application suddenly starts fielding a lot of traffic, the serverless platform automatically spins up more resources to handle the load. No more dreaded timeouts, wheels or hourglasses—or work for your operations team. Likewise, as soon as demand goes down, the platform takes care of decommissioning resources, i.e., scaling down, so that you’re not paying for resources that you no longer need. Want to run your service globally with low latency, without an operations team, and zero stranded costs? Cloud Run takes care of global load balancing and autoscaling to zero for you in every Google Cloud region.Further, features like support for gradual rollouts and rollbacks allow developers to experiment and test ideas quickly, as well as sophisticated traffic management in Cloud Run. Likewise, Cloud Run provides access to distributed tracing with no setup or configuration, allowing developers to find performance bottlenecks in production.Next up: serverless securityAs part of DevOps best practices, we build in security for your serverless applications at every layer: deployment time, runtime and networking. For example, built-in vulnerability scanning ensures you only deploy artifacts you trust. Today, we are announcing Cloud Run support for Google Secret Manager and customer-managed encryption keys (CMEK), making it easy to protect data at rest and store sensitive data. We’re also integrating Cloud Run with Binary Authorization, which lets you enforce specific policies to make sure only verified images make it to production. And finally, we added a new integration with Identity-Aware Proxy, support for VPC-SC, and egress controls that you can use to enforce a security perimeter, limiting both who can access specific services and what resources can be accessed when these services run in production. You can read more about these security enhancements here. Related Article4 new features to secure your Cloud Run servicesWe’re improving the security of your Cloud Run environment with things like support for Secret Manager and Binary Authorization.Read ArticleIn summary, the next generation of serverless combines the best of serverless with containers to run a broad spectrum of apps, with no language, networking or regional restrictions. The next generation of serverless will help developers build the modern applications of tomorrow—applications that adapt easily to change, scale as needed, respond to the needs of their customers faster and more efficiently, all while giving developers the best developer experience. Learn more by attending The Power of Serverless, a two-hour virtual event where we’ll lay out our vision for serverless compute, and where serverless subject matter experts will present on in-depth serverless development topics. Hope to see you there!Want to learn even more about serverless and cloud-native application development? Check out the upcoming Modern App Dev & Delivery workshop, and our Ask the Experts roundtable.
Quelle: Google Cloud Platform

4 new features to secure your Cloud Run services

Cloud Run makes developing and deploying containerized applications easier for developers. At the same time, Cloud Run services need to be secure. Today, we’re announcing several new ways for you to secure your Cloud Run environments:Mount secrets from Google Secret Manager Use Binary Authorization to ensure you only deploy trusted container imagesUse your own encryptions keysGet recommendations based on the principle of least privilegeLet’s take a closer look at each of these new features. 1. Mount secrets from Google Secret ManagerYou might have previously stored API keys, passwords, certificates, and other sensitive data in environment variables. This is not considered a best practice. More security-conscious customers store sensitive data in Secret Manager, Google Cloud’s secure system for storing API keys, passwords, certificates, and other sensitive data. However, accessing these secrets from a Cloud Run service traditionally requires developers to use client libraries.Now, you can mount secrets from Secret Manager as environment variables or file system volumes in your Cloud Run services, from the command line:gcloud beta run services update my-service –update-secrets API_KEY=api-key:1 or from the Google Cloud Console:Secret Manager features fine-grained IAM permissions: By default, Cloud Run services do not have the permission to access Secret Manager secrets; access must be specifically granted. Integration with Secret Manager also allows you to encrypt secrets with your own encryption keys.Learn more about Cloud Run integration with Secret Manager in this video:2. Binary Authorization for Cloud RunContainers are the industry-standard way to package and run software. Cloud Run enables developers to deploy and scale containers in a fully-managed environment. Today, we’re introducing Cloud Run integration with Binary Authorization.With Binary Authorization, security administrators can now define and enforce policies about the containers that are being deployed to Cloud Run. For example, organization administrators can enforce that Binary Authorization be used on Cloud Run services in a certain project. This process is transparent to developers, who can deploy to Cloud Run as usual, being sure that the container will meet any defined policies.With Binary Authorization and Cloud Run, you can enforce that a container:was created using an approved build systemwas approved by the QA teamwas analyzed for vulnerabilitiesMike Helmick, Principal Software Engineer, COVID-19 Exposure Notifications, uses Binary Authorization alongside Cloud Run, which he credits for improving their compliance posture:“As part of our efforts to combat COVID-19, Google built the exposure notifications key and verification servers. We leverage Binary Authorization for Cloud Run to ensure that the servers are always built with our trusted Cloud Build builders, give us an audit trail, and ensure that the code that is running is what we intend.”3. Customer-managed encryption keysBy default, container images deployed to Cloud Run are encrypted at rest with Google-managed encryption keys. Customers with higher security needs might want more control over the encryption of their resources at rest to improve their confidence in using the public cloud. A container image is such a resource. Today, we are introducing a preview of customer-managed encryption keys for Cloud Run. This capability allows you to protect container images using encryption keys that you manage within Cloud Key Management Service, or KMS. The keys in Cloud KMS are called customer-managed encryption keys (CMEK). When you protect data in Cloud Run with CMEK, the CMEK key is within your control, not controlled by Google. This means that when these keys are disabled or destroyed, no one (including Google) can access the data protected by these encryption keys, putting protection in your control.Support for CMEK in Cloud Run is particularly important for regulated industries such as financial services. Just as Artifact Registry uses CMEK to protect the storage of container images, Cloud Run’s support of CMEK extends this protection to container images that are deployed into production, protecting the container across the build, deploy and run process.You can get started with Binary Authorization or customer-managed encryption keys from the command line or the Cloud Console:Further, you can enforce the use of Binary Authorization or Customer-managed encryption keys on all Cloud Run services in your projects using an Organization Policy constraint.4. Get recommended best practicesBy default, Cloud Run services run with the same identity as Compute Engine VMs: the default Compute Service Account. This is a great way to get started quickly and without bothering with permissions. At the same time, it’s a best practice to only give to your Cloud Run service the permissions it needs to operate.Starting today, you will see recommendations in Recommendation Hub to create dedicated service accounts for your Cloud Run services with minimal sets of permissions. Look for a blue light bulb icon in the Cloud Run user interface. Or, you can find recommendations to improve the security of your Cloud Run services in the Recommendations tab of the Cloud Console home page:Get started todayThese new security capabilities for Cloud Run join a long list of other security-related features such as making services internal by restricting their ingress, or integrations with Identity Aware Proxy or Cloud Armor. We hope that these new features will help you adopt Cloud Run without compromising on security best practices. You can start to  secure your Cloud Run services today by following recommendations, enabling Binary Authorization or moving sensitive data to Secret Manager.Related ArticleMaximize your Cloud Run investments with new committed use discountsCommitted use discounts in Cloud Run enable predictable costs—and a substantial discount!Read Article
Quelle: Google Cloud Platform

The cloud developer’s guide to Google I/O 2021

Google I/O 2021 may look a little different this year, but don’t worry, you’ll still get the same first-hand look at the newest launches and projects coming from Google. Best of all – it’s free and available to all (virtually) on May 18-20! You probably already know that Google I/O is where the world first finds out about the latest releases for Google Assistant, Maps, Android, and Workspace. Google Cloud entered the stage over the last several years to do our own show-and-tell before our own annual conference, Next, each year. Our teams love I/O as a way to connect with developer communities, whether you’re new to the platform or need to secure your apps and data on Google Cloud. This year, there’s a lot to look forward to during I/O from Cloud, and I’m here to guide you through the most inspiring sessions and events happening. Many of my teammates in Developer Relations and Product Management are leading these sessions, and I can tell from the work I’ve seen, you won’t be disappointed with what they have in store for I/O. To start I/O off, there are two keynotes that will give you a key overview of the themes and most notable launches Google and Google Cloud have this year: Sundar Pichai’s I/O Keynote and Jason Titus’ Developer Keynote. *Pro tip: Add them to your calendar by clicking the calendar icon on each event card. In the schedule, you’ll also find dozens of sessions spanning Google Maps, Firebase, Flutter, and more. To find sessions related to Cloud, use the filter in the top right.A central theme this year is around machine learning and artificial intelligence, so let’s start with some of those sessions:AIWhat’s new in machine learningI won’t spoil exactly what will be covered in this session, but you are not going to want to miss it! Our product and engineering directors will cover some exciting announcements around ML, including developer tooling for creating, understanding, and deploying models for a variety of applications. From responsible AI to TensorFlow 2.5, mobile devices, microcontrollers and beyond, you’ll be the first to learn about our latest releases. You’ll also hear about how to enable an end-to-end ML pipeline. AI/ML demo derbyDemo derbies are rich product demos in quick succession. This is your chance to see our newest products in action. Our demo champions are Zack Akil, Markku Lepisto, and Kaz Sato, who have done incredible work creating imaginative demos using ML. In the past, they’ve created ML models to analyze live soccer kicks, give you better athletic form, read PDF files as audiobooks, and even create a rock-paper-scissors machine. In this session, they’ll show you three quick and fun demos showing what’s possible for Developers to accomplish with Cloud AI.Build end-to-end AI solutions with Google CloudIf you’ve been paying attention to ML at Google Cloud, you might recognize Developer Advocate, Sara Robinson, from her work creating brand new baking recipes using ML and live coding an ML model from scratch. In this session, you’ll learn how to use Google Cloud to build, train, and deploy scalable AI applications. From raw data to deployed model, Sara will cover each step in the ML process. You’ll leave this session ready to accelerate your own ML projects with Cloud AI.Spotting and solving everyday problems with machine learningWhether you’re new to ML or well-seasoned, a common sticking point is early in the process — deciding when to use ML and figuring out the quickest way to integrate it into your app. Dale Markowitz, another accomplished Developer Advocate at Google Cloud, has integrated ML in everyday happenings to augment her life, like helping her choose an outfit, turn PDFs into audiobooks, and create a video archive for Father’s Day.  In this session, she’ll teach you how to spot the most common ML use cases—analyzing multimedia, building smart search, and transforming data—and how to quickly build them into your app with user-friendly tools. She’ll use ML to intelligently search through videos and articles, analyze your tennis serve, translate and dub videos, and more, using tools like Google Cloud, Firebase, and TensorFlow.ServerlessServerless has become the next-generation cloud offering defined by both its operational model (no infrastructure management, managed security, pay for usage) and its programming model (service-based, event-driven, uses open source). This year, it’s taken center stage as Google Cloud redefines the space through developer centric design and versatility. Here are my top picks for Serverless:Go full-stack with Kotlin or Dart on Google CloudDevelopers using Kotlin or Dart to create mobile, desktop, or web apps can take a full-stack approach to building backends that run on Google Cloud. My colleagues, Tony Pujals, Grant Timmerman, and James Ward, will show you how to take advantage of Cloud Run with Kotlin or Dart to create high performance, autoscaling, event-driven services without creating servers or managing infrastructure.Serverless demo derbyJoin Abby Carey, Sara Ford, and Katie McLaughlin for three rapid demos showcasing the art of the possible with our serverless computing solutions. They’ve each been working on their own original demos recently, like using Cloud Code to maximize developer productivity or running stress tests against Cloud Run. In this session, they’ll be demonstrating how to use Buildpacks to create containers, how to use Cloud Code to deploy Cloud Run services, and how to use Visual Studio Code to debug Cloud Functions.Dev to prod in 3 easy steps with Google Cloud RunIn this Workshop, my teammate Marc Cohen will run a simple web app in three ways: locally, in a Docker container, and in the Google Cloud. You’ll see how easy it is to cross those boundaries without changing your code.Cross ProductDeveloping AppSheet with Workspace AMP for Gmail and Apps Script appsIf you’ve been following my work lately, I’ve written about automation in the application development space. AppSheet is our platform to decrease development hours through a no-code workflow to create bots and integrations. It now supports seamless integration with Workspace technologies including AMP for Email and Apps Script. Developer Advocate, Christian Schalk, will demo how to use the AppSheet AMP to send out emails with form controls, so recipients can then submit responses back to the AppSheet app without having to leave their email context (no app required). The second demo will show how to connect an AppSheet app with existing Apps Script functions, allowing for sophisticated Workspace automations.Exposure notifications: Building infrastructure to serve 1M usersThe Exposure Notifications project is a joint effort by Google and Apple to help governments and global communities fight the pandemic through digital contact tracing using iOS and Android devices. Seth Vargo will give you a guided tour of the backend code and infrastructure systems that support this global program, all of which is open source on GitHub. You’ll learn how they engineered a secure, rapidly-deployable, and globally-available system with a team of six, using only Google Cloud services.While there are many more sessions to check out, don’t forget you can explore content by topic and level (beginner, intermediate, and advanced) on the I/O Discover page.Workshops and AMA’sBe sure to also take a look at the Workshops and AMA’s page, and filter by Cloud (top right). There you’ll find workshops for AI, building chatbots with Dialogflow, and AMAs for full-stack Flutter and more. Codelabs and learningYou can grow your knowledge with hands-on codelabs and learning pathways. These are self-guided learning experiences that help you adopt our products. Plus, you can earn Google Developer profile badges for completing these lessons. AdventureI/O will have a virtual Shoreline where you can “walk around” and explore each product area’s sandbox dome. Here you’ll be able to see additional content, like videos, codelabs, round tables, and our Rainbow Rumpus competition. In this competition, get to know Google Cloud by deploying a microservice on Cloud Run and join a virtual rumpus where your microservice will throw “rainbows” at other microservices, competing to win some swag. You will get hands on deploying Kotlin, Java, Go, Python, or Node.js microservices, learning about containers and Cloud Run along the way.Community loungeThere are also a handful of events at the Community Lounge where you can connect with other Cloud developers in meetups for Women Techmakers, Google Cloud certifications, regional developers (in various languages), career development, open source, and more.Keep in touch with me during I/O online at @stephr_wong. See you there!Related ArticleA handy new Google Cloud, AWS, and Azure product mapTo help developers translate their prior experience with other cloud providers to Google Cloud, we have created a table showing how gener…Read Article
Quelle: Google Cloud Platform