Creating a DuploCloud GKE Service

1. In the DuploCloud Portal, navigate to Kubernetes -> Services.

2. Click Add. The Basic Options section of the Add Service page displays.

3. In the Service Name field, give the Service a name (without spaces).

4. From the Cloud list box, select Google.

5. From the Platform list box, select GKE Linux.

6. In the Docker Image field, enter the Docker image.

7. Optionally, enter any allocation tags in the Allocation Tag field.

8. From the Replica Strategy list box, select a replication strategy. Refer to the informational ToolTip ( ) for more information.

9. Specify the number of replicas in the Replicas field (for Static replica strategy). The number of replicas you define must be less than or equal to the number of Hosts in the fleet.

10. In the Replica Placement list box (for Static or Horizontal Pod Autoscaler replication strategies) select First Available, Place on Different Hosts, Spread Across Zones, or Different Hosts and Spread Across Zones. Refer to the informational ToolTip ( ) for more information.

11. Optionally, enter variables in the Environmental Variables field.

12. In the Force StatefulSets list box, select Yes or No (for Static or Horizontal Pod Autoscaler replication strategies).

13. Optionally, select Tolerate spot instances (for Static or Horizontal Pod Autoscaler replication strategies)

1. Click Next. The Add Service, Advanced Options page displays.

2. Configure advanced options as needed. For example, you can implement Kubernetes Lifecycle Hooks in the Other Container Config field (optional).

3. Click Create. The Service is created.

Viewing Services

1. From the DuploCloud Portal, navigate to Kubernetes -> Services. Select the Service from the NAME column. The Service details page displays.

Starting, Stopping, and Restarting Multiple DuploCloud Services

Using the Services page, you can start, stop, and restart multiple services simultaneously.

1. In the DuploCloud Portal, navigate to Kubernetes -> Services.

2. Use the checkbox column to select multiple services you want to start or stop at once.

3. From the Service Actions menu, select Start Service, Stop Service, or Restart Service. The selected Services are started, stopped, or restarted as you specified.

Managing Kubernetes Containers

In the DuploCloud Portal, you can display and manage the containers you have defined.

1. Select the Tenant from the Tenant list box in the upper left.

2. Navigate to Kubernetes -> Containers.

There are many ways to pass configurations to containers at run-time. Although simple to set up, using Environmental Variables can become complex if there are too many configurations, especially files and certificates.

Using Kubernetes, you can populate environment variables using Kubernetes Configs and Secrets.

DuploCloud Services and Containers

Containers and Services are critical elements of deploying GCP applications in the DuploCloud platform. Containers refer to Docker containers: lightweight, standalone packages that contain everything needed to run an application including the code, runtime, system tools, libraries, and settings. Services in DuploCloud are microservices defined by a name, Docker image, and a number of replicas. They can be configured with various optional parameters and are mapped to Kubernetes deployment sets or StatefulSets, depending on whether they have stateful volumes.

Container Orchestration

DuploCloud supports deploying containerized applications in GCP using GKE (Google Kubernetes Engine).

GKE

Google Kubernetes Engine (GKE) is a fully managed service that uses the open-source Kubernetes platform to orchestrate and manage containerized applications on Google Cloud. GKE offers deep integration with other Google Cloud services, making it highly optimized for workloads in the Google Cloud ecosystem. While GKE requires a bit more learning compared to simpler orchestration tools, it provides the flexibility, scalability, and portability that Kubernetes offers, allowing users to run complex workloads with fine-grained control over configurations and scaling.

Kubernetes

Adding a Service in the DuploCloud Platform is not the same as adding a Kubernetes service. When you deploy DuploCloud Services, the platform implicitly converts your DuploCloud Service into either a deployment set or a StatefulSet. The service is mapped to a deployment set if there are no volume mappings. Otherwise, it is mapped to a StatefulSet, which you can force creation of if needed. Most configuration values are self-explanatory, such as Images, Replicas, and Environmental Variables.

Kubernetes clusters are created during Infrastructure setup using the Administrator -> Infrastructure option in the DuploCloud Portal. The cluster is created in the same Virtual Private Cloud (VPC) as the Infrastructure. Building an Infrastructure with GKE cluster may take some time.

Next, you deploy an application within a Tenant in Kubernetes. The application contains a set of VMs, a Deployment set (Pods), and an application Load Balancer. Pods can be deployed either through the DuploCloud Portal or through kubectl,using HelmCharts.

DuploCloud supports the following databases for GCP.

• Cloud SQL (MySQL, PostgreSQL, SQL Server)

• Cloud Firestore

• Redis

DuploCloud provides several configurable components when running Google Cloud Provider's Google Kubernetes Engine (GKE).

Applications involve GCP Services such as Cloud Armour, Redis and SQL databases, Storage Buckets, Load Balancers, and so on.

Using DuploCloud, you can create unlimited Services within each Tenant, using application-centric inputs. At the same time, the platform ensures that the lower-level nuances are programmed to best practices for security and compliance.

Supported Services for DuploCloud GCP

In addition to GKE standard and auto-pilot, the following services are supported. Supported Services are listed in alphabetical order.

Core Services

• Containers and Services

• Load Balancers

Additional Services

• Cloud Armour

• Cloud Credentials

• Cloud Functions

• Cloud Scheduler

• Cloud SQL

• Cloud Storage

• Firestore Database

• Managed Redis

• Node Pools

• Pub/Sub

Creating a Cloud SQL database

Use this procedure to create:

• MySQL databases

• SQL databases with PostGres engines

• SQL databases with SQLServer engines

1. In the DuploCloud Portal, navigate to Cloud Services -> Cloud SQL.

2. Click Add. The Add SQL DB page displays.
3. Complete the fields (Name, Disk Size, SQL Version, Tier, Root Password) as required.

4. Click Create.

Viewing a Cloud SQL database

You can view database details and configure other options by navigating to Cloud Services -> Cloud SQL and selecting the Cloud SQL database from the NAME column.

Additional Supported Actions

1. Navigate to Cloud Services -> Cloud SQL.

All containers run inside a private network and cannot be accessed from an external network. To make them accessible from an external network, create a Load Balancer.

Creating a GKE Ingress

If you need to create an Ingress Load Balancer, refer to the page in the DuploCloud Kubernetes User Guide.

Adding a Load Balancer Listener

1. In the DuploCloud Portal, navigate to Kubernetes -> Services.

2. On the Services page, select the Service name in the Name column.

3. Click the Load Balancers tab.

4. If no Load Balancers exist, click the Configure Load Balancer link. If other Load Balancers exist, click Add in the LB listeners card. The Add Load Balancer Listener pane displays.

5. From the Select Type list box, select a Load Balancer Listener type based on your Load Balancer.

6. Complete other fields as required and click Add to add the Load Balancer Listener.

Adding a certificate for an internal Load Balancer in GCP

For internal Load Balancers, you cannot use Google Managed Certificates. You can import a certificate from somewhere else or use a self-signed certificate. We recommend using the self-signed certificate option for internal Load Balancers because you control authentication at the IP level.

Here's an example Terraform code snippet to create a self-signed certificate for an internal Load Balancer in DuploCloud:

Restricting Open Access to Public Load Balancers

Restrict open access to your public Load Balancers by enforcing controlled access policies.

1. From the DuploCloud Portal, navigate to Administrator -> System Settings.

2. Select the System Config tab, and click Add. The Add Config pane displays.

1. From the Config Type list box, select Flags.

2. From the Key list box, select Deny Open Access To Public LB.

3. In the Value list box, select True.

4. Click Submit. Open access to public Load Balancers is restricted.

Firestore is a flexible, scalable database for mobile, web, and server development from Google Cloud Platform. It's part of Firebase, a platform for developing mobile and web applications. Firestore is a NoSQL document database that simplifies storing, syncing, and querying data across multiple platforms and devices.

There are two Firestore Database modes to choose from:

• Firestore Native Mode is the default mode for Firestore. It provides a richer feature set and supports more advanced querying capabilities, such as compound queries and real-time updates. Use Firestore Native for new projects and applications that require real-time updates and advanced querying features.

• Datastore Mode provides a subset of Firestore's features and capabilities, supports a simpler data model, and lacks support for nested subcollections. Use Datastore Mode for migrating existing applications from Google Cloud Datastore to Firestore or for applications that do not require real-time updates or complex querying capabilities.

Creating a Firestore Database

1. From the Tenant list box in the upper left, select your Tenant name.

2. From the DuploCloud portal, navigate to Cloud Services -> Firestore Database.

3. Click Add. The Add Firestore DB page displays.
4. In the Name field, enter a name for your database.

5. From the Type list box, select FIRESTORE_NATIVE or DATASTORE_MODE.

6. Select your location from the Location list box.

7. From the Point in Time Recovery Enablement list box, enable or disable point in time recovery, or lock your resources pessimistically.

8. From the Delete Protection State list box, enable or disable delete protection.

9. Click Create. Your Firestore Database is created.

DuploCloud supports Redis database instances. Redis stands for Remote Dictionary Server and is a fast, open-source, in-memory, key-value data store. Redis can function as a database, cache, message broker, and queue.

Redis delivers sub-millisecond response times, enabling millions of requests per second for real-time applications.

Adding a Redis database instance

1. In the DuploCloud Portal, navigate to Cloud Services -> Redis.

2. Click Add. The Add Redis Instance page displays.

1. Enter the database Name.

2. In the Display Name field, enter a useful database name for reference.

3. From the Tier list box, select Basic for a Tier0 standalone instance; select Standard for a Tier1 High Availability primary/replica instance.

4. In the Memory Size field, enter memory size in gigabytes (GB).

5. In the Redis Config field, specify the Redis configuration.

6. In the Labels field, specify key/value pairs.

7. Select Enable Auth and Security to enable OSS Redis AUTH for the Redis instance.

8. Select Enable Encryption-in-Transit to select the TLS mode of the Redis instance.

9. Click Create. The Redis database Details tab displays on the Redis tab with Connectivity, General, and Security cards.

GCP Cloud Armour helps protect your applications and websites against denial of service, web breaches, and cyber-attacks.

Use DuploCloud to activate your GCP Cloud Armour software and monitor your cloud infrastructures and deployed services and applications.

Adding a Security Policy in the DuploCloud Plan

Before you can use DuploCloud with Cloud Armour, define a Security Policy in the DuploCloud Plan that supports your DuploCloud Infrastructure.

1. In the DuploCloud Portal, navigate to Administrator -> Plan. The Plans page displays.

2. From the Name column, select the Plan that corresponds to your Infrastructure. When you create a DuploCloud Infrastructure, a Plan is created with the same name.

3. Click the Security Policy tab.

4. Click Add. The Add Security Policy pane displays.
5. In the Name field, enter an appropriate name for the Security Policy. This is the name used in the DuploCloud portal. It is convenient to keep it the same as the Security Policy ID, but not required.

6. In the Security Policy ID field, enter the name of your GCP Cloud Armour Security Policy. This is the name used in the GCP console.

7. Click Create. The Security Policy that you specified is displayed in the Security Policy tab.

Adding the Cloud Armour Security Policy to a Load Balancer

Now that the Cloud Armour Security Policy has been defined in your DuploCloud Plan, add the policy to a Load Balancer so that it can monitor network traffic.

1. In the DuploCloud Portal, navigate to Kubernetes -> Services or Docker -> Services.

2. Select the Service to which your Load Balancer is attached.

3. Click the Load Balancer tab.

4. In the Other Settings card, click Edit. The Other Load Balancer Settings pane displays.
6. Select the Enable HTTP to HTTPS Redirect option.

7. Select Enable Access Logs to view rule evaluations.

8. In the Idle Timeout field, enter the number of minutes for timeout, in seconds.

9. Click Save.

The Security Policy displays in the Load Balancer's Other Settings card.

Modifying a Cloud Armour Configuration Security Policy

1. In the DuploCloud Portal, navigate to Administrator -> Plans. The Plans page displays.

2. From the Name column, select the Plan that corresponds to your Infrastructure.

3. Click the Security Policy tab.

5. Modify the Security Policy Name and the Security Policy ID as appropriate.

6. Click Update. The changes are saved and displayed in the Security Policy tab.

Viewing Security Policy logs

Logs will only be visible if you Enable Access Logs in the Load Balancer's Other Settings card.

To view Cloud Armor Security Policy logs:

1. Locate the Security Policy in the GCP Console.

2. Click the Logs tab.

3. Click the View policy logs link on the Logs tab to view logs of the policy's rule evaluations.

The DuploCloud rules-based expert system requires GCP Subscription details to manage cloud resources effectively. By adding Cloud Credentials in the DuploCloud Portal, you provide the necessary subscription details for this management.

Adding Cloud Credentials for GCP Subscriptions

To integrate GCP project cloud credentials into DuploCloud, follow these steps:

1. In the DuploCloud Portal, navigate to Administrator -> Cloud Credentials. The Cloud Credentials page displays.

2. Click Add to initiate the creation of new cloud credentials.

3. Ensure Google is selected from the Cloud list box as your cloud provider.

4. Enter your Google Project ID in the Project ID field. This ID uniquely identifies your GCP project.

5. Provide the Service Account email in the Service Account Email field. Service accounts are crucial for applications or compute workloads to interact with GCP services, managed through Identity and Access Management (IAM).

6. Paste the private key associated with your service account in the Service Account Private Key field. To extract and copy the private key from a JSON file, you can use the command: jq -r .private_key < filename.json | pbcopy.

7. Click Submit to save your credentials, which will be displayed on the Cloud Credentials page.

In GCP, Cloud Functions are for serverless execution of code.

Creating a GCP Cloud Functions

1. In the DuploCloud Portal, navigate to Cloud Services -> Storage. The Buckets page displays. Create a bucket and upload the code package.

2. Navigate to Cloud Services -> Functions, and click Add. The Add Function page displays. Fill out the appropriate fields and click Create.

Google Cloud Scheduler is a fully managed cron job service that allows you to schedule jobs to automate the execution of tasks at regular intervals without manual intervention. You can create a Cloud Scheduler job to trigger from a Pub/Sub topic, an HTTP endpoint, or an App Engine.

The following table describes each target type's function and common use cases.

Create a Cloud Scheduler job

1. From the DuploCloud Portal, navigate to Cloud Services -> Cloud Scheduler, and click Add. The Cloud Scheduler Add Job pane displays.
2. Enter a Name, a Schedule (in cron format), and a Description, if needed.

3. From the Target Type list box, select Pub Sub, App Engine, or HTTP. Complete the fields associated with the selected target type:

• Pub/Sub: Select a Topic Name, and add Attributes and Data, if needed.

• App Engine: Enter a Service and Version. Select an HTTP Method. Enter a Relative URI and HTTP Headers, if required.

• HTTP: Select an HTTP Method. Enter a Target URI. Select an Authentication method. Enter HTTP Headers, if needed.

1. Click Create. The Cloud Scheduler job is created.

Creation of a pub sub topic is quite self explanatory with just a couple fields.

In GCP, Cloud Storage Buckets are containers that hold your data. Everything in Google Cloud Storage resides in a bucket. Learn more about GCP Cloud Storage and Cloud Storage Buckets.

Creating a GCP Cloud Storage Bucket

1. In the DuploCloud Portal, navigate to Cloud Services -> Storage. The Buckets page displays.

1. In the Buckets tab, click Add. The Create a Bucket pane displays.

1. In the Name field, enter a bucket name.

2. Optionally, select Enable Versioning or Allow Public Access; enter a label string for your bucket in the Labels field.

3. Optionally, select the Multi Region or Region (single region) location type for your data storage. In the Multi Region Options or Region Options list box, select your region(s).

4. Click Create.

GCP Node Pools are useful when you need to schedule Pods requiring more resources than others, such as more memory or local disk space. Node Pools can be created for the DuploCloud Infrastructure with GKE Standard Cluster only.

Prerequisites

Add a Tenant, specifying the DuploCloud Plan corresponding to a GKE Standard Cluster.

Adding a Node Pool

1. In the DuploCloud Portal, navigate to Kubernetes -> Nodes.

2. Click the Node Pool tab.

3. Click Add. The Add Node Pools page displays.

4. Provide Name, Availability Zone, Instance Type, and Node Counts.

5. Click Submit.

Adding a Node Pool with Advanced Options

DuploCloud Portal provides additional options when configuring a Node Pool, as depicted below. To use Advanced Options select Advanced Options in the Add Node Pool page.

Adding a Node Pool with Accelerator Type

You can add Accelerator types for GPUs while creating a NodePool. From the Add Node Pool page, click Add Accelerator.

Configure a Service to use an Accelerator Type

1. Add a Service.

2. In the Add Service page, click Next for Advanced Options.

3. Enter command, args, and resources in the Other Container Config field.

4. Click Create.

For additional details, refer to the documentation from Google Cloud here .

Adding a Taint to a Node Pool

1. Add a Node Pool.

2. Select the Node Pool to which you want to add taints.

3. Click Actions and select Add Taint. The Add Taint pane displays.

4. Enter the Key/Value pair and select the Effect from the list box.

5. Click Add Taint.

For example, the following screen applies a taint to a Node Pool that has a Key/Value of dedicated=experimentalwith a NoSchedule effect.

Configure a Service to use Taints

You need to configure the correct tolerations in the Service to schedule the Pod in a Node Pool.

To continue the examples above, create a Service with tolerations using the Other Container Config field, as depicted below.

tolerations:
  - key: dedicated
    operator: Equal
    value: experimental
    effect: NoSchedule

You can Edit or Delete a Taint by selecting the Node Pool Name, clicking the Actions menu, and selecting Edit or Delete. You edit the Node Pool using the Edit Node Pool page.

View Node Pool

View Node Pools by clicking the Node Pool tab and selecting the Node Pool Name.

Nodes created as part of a Node Pool, are displayed in the GCE VM tab.

Taints configured to a Node Pool are displayed with a Tainted Status. Click the Tainted icon to display a window with a Taint List.

Setting Docker Registry Credentials

1. In the DuploCloud Portal, navigate to Docker -> Services. Docker registry credentials are passed to the Kubernetes cluster as kubernetes.io/dockerconfigjson.

2. Click the Docker list box in the upper right, and select Docker Credentials. The Set Docker registry Creds pane displays.

3. Supply the credentials and click Submit.

4. Enable the Docker Shell Service by clicking Enable Docker Shell.

Adding multiple Docker Registry Credentials

You can pull images from multiple Docker registries by adding multiple Docker Registry Credentials.

1. In the DuploCloud Portal, click Administrator -> Plan. The Plans page displays.

2. Select the Plan in the Name column.

3. Click the Config tab.

4. Click Add. The Add Config pane displays.

Passing Docker Credentials using Environment Variables

You can pass Docker Credentials using the Environment Variables config field in the Add Service Basic Options page. See the Kubernetes Configs and Secrets section.