LinkedIn
Twitter
Modernized Lift-and-Shift to Managed GKE Architecture
| ||||||||||||||||
Problem Statement: We currently manage an on-premises website application that consists of three main screens: 1. Login Screen: Handles user authentication. 2. Applications Screen: Displays available services/applications to users. 3. Customer Contact & History Screen: Shows customer details and past interactions. 4. The system supports 100 users today, and user growth is expected to increase by 10% every fortnight. Business Expectation: o Migrate the existing on-premises website to Google Cloud Platform (GCP). o Ensures scalability to accommodate user growth seamlessly. o Enhance security throughout the migration and post-migration. o Maintain high availability and performance. o Utilize GCP-managed services to reduce operational overhead and ensure cost-effectiveness. ü Current State Assessment: o Challenges in managing authentication, application services, and customer history on-prem. o Scalability, security, and maintenance overhead. ü Target Cloud Solution Overview: o GKE (Google Kubernetes Engine) Standard or Autopilot mode to manage containerized workloads. o Managed Identity (Cloud Identity, Identity-Aware Proxy) for authentication. o Cloud SQL/Firestore for persistent backend storage (customer history & contact data). o Cloud Load Balancer for distributing traffic securely. ü Key Considerations: o Auto-scaling & Growth Handling: Use Kubernetes Horizontal Pod Autoscaler to manage 10% user growth quarterly. o Security: Implement Workload Identity, Private GKE Clusters, and secure database access. o CI/CD Pipeline: Automate deployments, ensuring smooth feature rollouts. ü Migration Strategy: o Lift-and-shift with containerization (Docker). o Database migration (Cloud SQL Migration Service). o Zero downtime switchover plan. ü Cost Optimization & Monitoring: o Enable GKE Autopilot to reduce node management overhead. o Leverage Cloud Monitoring & Cloud Logging. o Apply committed use discounts
Enhanced Architectural Overview
| ||||||||||||||||
|
Key Enhancement Added
1) Secret Management Strategy
- Utilize Google Secret Manager to store:
- Database credentials (Cloud SQL)
- API keys
Access securely in GKE using Workload Identity + KSA to GSA binding.
2) Secure Database Connectivity
- Implement Cloud SQL Auth Proxy as a sidecar container in Kubernetes Pods.
- Use private IP for Cloud SQL.
Authenticate securely using IAM roles (Cloud SQL Client).
3) Workload Identity Integration
- Create a Google Service Account (GSA) with limited IAM roles.
- Bind to Kubernetes Service Account (KSA) for seamless access.
4) Monitoring & Alerts Setup
- Create uptime checks for the website.
- Set up custom CPU, memory, and error rate alerts.
- Provision Cloud Monitoring Dashboards.
5) Cost Optimization Techniques
- Consider GKE Autopilot mode for ease and efficiency.
- Enable Preemptible Node Pools for stateless workloads.
- Apply resource quotas & budget alerts to control costs.
5.1) Optional Future Enhancements
- Enable Cloud Armor (WAF) in HTTPS Load Balancer for enhanced security.
- Configure Binary Authorization to enforce only trusted container images.
- Implement Canary Deployment or Rollback Strategies in the CI/CD pipeline.
7) Next Steps Apply Terraform to provision infrastructure.
- Use Secret Manager and Cloud SQL Auth Proxy for secure DB access.
- Deploy the web application to GKE.
- Monitor with Cloud Monitoring and set up alerts.
- Implement a CI/CD pipeline for continuous deployment and scaling.
