GCP TASK
Richard Nadar
Cyber Security Enthusiast | SOC Analyst | Threat Hunting & Threat Intelligence Enthusiast | Learner
Google Cloud Platform:
Google Cloud Platform (GCP), offered by Google, is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products, such as Google search, Gmail, file storage, and YouTube. Alongside a set of management tools, it provides a series of modular cloud services including computing, data storage, data analytics and machine learning.
Task Details:
1. Create multiple projects namely developer and production
2. Create VPC network for both the projects
3. Create a link between both the VPC networks using *VPC Peering*
4. Create a Kubernetes Cluster in *developer* project and launch any web application with the Load balancer
5. Create a SQL server in the *production* project and create a database
6. Connect the SQL database to the web application launched in the Kubernetes cluster
Before doing the task there are some pre-requisites:
a. We should have a google cloud account, which can be created using our google account.
b. After account is created and we have to set up our billing account in order to get $300 free credit to our new account. While setting up billing account we have use credit card (only few debit cards are supported), after submitting the details we have to pay Rs. 1 which will be refunded soon.
c. A verify mail will come and once all steps are done your billing account will be activated.
Now we can start our task.
STEP-1:
First we have to create two projects. Without project we cannot use any service of GCP. I have created two projects namely GCP DEV TASK and GCP PROD TASK. We can set quotas for each project and they have independent billing.
STEP-2:
Now, we will create two VPCs, one in each project. I created VPC by name dev-vpc in GCP DEV TASK and prod-vpc in GCP PROD TASK, both in different regions. In each VPC, one subnet is also created which is like a private lab. Subnet can be created in any region.
Also, before using any service it's respective API has to be enabled. By default, all API's are disabled for new account. Here we have to enable DNS server policy.
STEP-3:
Now, after creating VPCs in two different projects we have to create a link between them. A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. We can create a VPC peering connection between our own VPCs. The VPCs can be in different regions (also known as an inter-region VPC peering connection).
First we will establish connection from VPC (i.e dev-vpc) in GCP DEV TASK and give it name devpeering, to VPC (i.e prod-vpc) in other project. We have to give correct project ID in which peered VPC is present. Example: here project ID of GCP PROD TASK will come.
Similarly, we have complete the connection from VPC (i.e prod-vpc) in GCP PROD TASK and give it name prodpeering, to VPC (i.e dev-vpc) in other project. Here also we have to be careful of project ID.
STEP-4:
Let's create a Kubernetes cluster in GCP DEV TASK project. We can give name to our cluster and this cluster will be regional and nodes which will launched will be present in all zones present in that region.
In Node pool, we will set number of nodes in each zone as 1 meaning if three zones are there then three nodes each per zone will be launched.
In networking, our cluster has to be made public so that outside world/Internet can connect to our cluster as Kubernetes clients. VPC and subnet has to chosen correctly in which we want our cluster to be.
Cluster successfully created.
STEP-5:
We can connect to our cluster via cloud shell just by clicking connect button near the cluster. We will get a new terminal where we can use cluster. Following command can be used to connect to our cluster. In this command we have to mention region, project ID and we have to retrieve credentials.
Kubectl: The Kubernetes command-line tool, kubectl, allows you to run commands against Kubernetes clusters. You can use kubectl to deploy applications, inspect and manage cluster resources, and view logs.
Command "kubectl config view" will display merged kubeconfig settings or a specified kubeconfig file. We can also see number of nodes present via console using "kubectl get nodes" command.
Command "kubectl create deployment wordos --image=wordpress" will create a deployment by name "wordos" using wordpress image. Basically a POD by name wordos will be launched using wordpress image with deployment. We use deployment resource to launch POD as it gives us more facilities than simply launching the POD.
A Kubernetes deployment is a resource object in Kubernetes that provides declarative updates to applications. Deployment is a program which will keep on monitoring our POD, for example: if our POD gets terminated suddenly then rather launching one more manually, deployment will do that for us. Deployment allows you to describe an application's life cycle, such as which images to use for the app, the number of pods there should be, and the way in which they should be updated.
After creating deployment we have to expose service to the outside world so that they can access our wordpress application also we have to balance the load on our server. For this purpose we have to create LoadBalancer, in Kubernetes LoadBalancer is service which exposes the service externally using a cloud provider's load balancer (External Load Balancer).
Command "kubectl expose deployment wordos --type=Loadbalancer --port=80" will expose our deployment using LoadBalancer service type at port number 80. Clients will connect to wordpress via port 80.
To see more details of our POD like public IP, status, which node is belongs to, etc. we can use "kubctl get pods -o wide" command.
STEP-6:
Next step is to create a database in which all our data which we enter in wordpress will be stored. For this, in GCP PROD TASK project in prod-vpc we have to launch a SQL instance.
STEP-7:
After launching instance, we have to create user and database as follows:
STEP-8:
We will now access our wordpress site and internally connect to database. Here, we have to be careful it might happen that error occurs while connecting database because of firewall. So in connections, we have a add network which will allow only wordpress instance so that connection between both is successful (in my case I have allowed all for testing).
To obtain Public IP of wordpress instance, in cloud shell we can run "kubectl get services" command.
Let's do wordpress installation:
STEP-9:
FINAL OUTPUT
Finally, after completing your work don't forget to delete your project as it may surpass the limit and also keep an eye on billing.