Author Archives: anuj - Page 3
GKE Control Plane and Public IPs and Private Service Connect
By default, when you create a public cluster, GKE assigns an external IP address (external endpoint) to the control plane and provisions public nodes. This means that any VM with…
Pass Through (Network) Load balancers and GKE Ingress Firewall Rule
Overview If you created a GKE service that allows external access, you will be surprised to see a few firewall rules (at the VPC level) created automatically for you. Some…
Cloud CDN to deal with unauthenticated users
Use Case - serve content to users who are not authenticated Cloud CDN can cache content that doesn't require authenticated users.
Routing Logs outside of GCP
Use Case - To Route GCP Logs to external sinks ( Splunk) The only sink you can use here is pub sub. Install the logging agent to capture your application…
GCP – Failed SSH Attempts
Use Case - monitor for failed SSH attempts and alert based on failures Log based alerts would be needed - there is no built in metric for failed SSH attempts.…
Retention Policies and Cloud Storage
Use Case - Disallow deletion of bucket objects, regardless of IAM access Retention policy will lock the bucket (or object in a bucket) and not allow deletion, regardless of access…
Service accounts- at Org, Folder Levels – and at Resource Levels
High level service accounts (Folders, projects and Org level) should be few SAs. No keys allowed. The AD groups (containing human users) should be defined for these with all the…
Short lived access tokens in GCP – Service account impersonation
Service account keys provide long lived access. One often has to provide short term access to GCP resources. That's what Service account impersonation does. Service account impersonation requires two service…
Firewall rules and GCP Cloud Storage
Firewall rules only apply at a VPC Network Level. They have nothing to do with preventing traffic to and from cloud storage. To do that, you have to either use…
Using only Trusted Images in GCP Projects
Step 1 - Create a separate project - and store all hardened images in it. Step 2 - Enforce the Org Policy - Define trusted image project. This will ensure…