Author Archives: anuj - Page 2
Sample GKE constraints for common use cases
Sample GKE constraints for common use cases The following sections provide the syntax of some custom constraints that you might find useful: Description Constraint syntax Do not disable node auto-upgrade…
Check when a GKE Cluster was created
Apply this filter to the logs (under operations from the cluster management screen). Default audit logs go back 180 days. "gke_cluster" "" "your-cluster-name" Default audit logs go back 180…
Editor Role in GCP – Beware of Service Account Privileges
While only an OWNER can create service accounts, an EDITOR too can manipulate existing service accounts. If a project contains service accounts , the Editor roles grant permission to create…
GKE Control Plane and Public IPs and Private Service Connect
By default, when you create a public cluster, GKE assigns an external IP address (external endpoint) to the control plane and provisions public nodes. This means that any VM with…
Pass Through (Network) Load balancers and GKE Ingress Firewall Rule
Overview If you created a GKE service that allows external access, you will be surprised to see a few firewall rules (at the VPC level) created automatically for you. Some…
Cloud CDN to deal with unauthenticated users
Use Case - serve content to users who are not authenticated Cloud CDN can cache content that doesn't require authenticated users.
Routing Logs outside of GCP
Use Case - To Route GCP Logs to external sinks ( Splunk) The only sink you can use here is pub sub. Install the logging agent to capture your application…
GCP – Failed SSH Attempts
Use Case - monitor for failed SSH attempts and alert based on failures Log based alerts would be needed - there is no built in metric for failed SSH attempts.…
Retention Policies and Cloud Storage
Use Case - Disallow deletion of bucket objects, regardless of IAM access Retention policy will lock the bucket (or object in a bucket) and not allow deletion, regardless of access…
Service accounts- at Org, Folder Levels – and at Resource Levels
High level service accounts (Folders, projects and Org level) should be few SAs. No keys allowed. The AD groups (containing human users) should be defined for these with all the…