Google Kubernetes Engine Integration With GCP SQL & GCP Load-Balancer Across Multiple VPCs
Tags: Vpc Peering, Gcp, Mysql Server, Load Balancer, Kubernetes

Hello Geeks, in this blog, I’ll explain how to integrate GCP Kubernetes Engine with GCP SQL Database and how to attach a Load-Balancer on a Kubernetes deployment and connect VPCs of two different locations. So let’s get started.

What is Google Kubernetes Engine?

Kubernetes is open-source software that permits you to send and oversee containerized applications at scale. Kubernetes manages clusters of Google Compute Instances(VMs) and runs containers on those instances with deployment, maintenance, and scaling processes.

What is Google Cloud SQL?

Google Cloud SQL is a fully-managed database service that helps you set up, maintain, manage, and administer your relational databases on Google Cloud. You can use Cloud SQL with MySQL, PostgreSQL, or SQL Server.

What is the GCP Load-Balancer (LB)?

GCP Load-Balancer is a program that distributes user traffic across multiple instances of your applications evenly. It reduces the risk that your applications become overburdened, slow, or nonfunctional and even prevents high latency by spreading the load.

What is VPC?

A Virtual Private Cloud (VPC) is an on-demand customizable group of shared computing resources allocated within a public cloud environment, providing a certain level of isolation between the different organizations using the resources.

So, now we got a little knowledge of the terminologies that we will be using in this blog. Let’s start from our first step.

First, we will be logging in to Google Cloud Console, and we will be creating two projects. For this task, I will be creating one project for the development team and another project for the production team from the dashboard.

We can also create a project from the cloud shell available on the cloud console, accessed from the top right navigation bar.

The command below can be used to create a project from the above-mentioned cloud shell.

mishanregmi@cloudshell:~ (devproject)$gcloud projects create [PROJECT_ID]

Fig1. Creating 2 Projects

NOTE: Enable billing for both the project by going to the dashboard and navigate to the billing section to use all APIs and services.

Let’s first work on the developer project. In the developer project, we will be creating a VPC. A VPC will help us to launch our resources in a virtual network, which we will configure.

Fig2. Creating VPC

Using the same way, we have to create a VPC on the production project, and the region should be different as we will be trying to connect these two VPCs located in two different regions.

Now, we need to create a link or connection between these two VPCs, and this can be done with the help of a service provided by GCP called VPC peering. VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances and service gets connected as if they both are in the same VPC.

At this point, we will create a VPC peering on the developer project. Go to the navigation menu on the left and go to the VPC network, peering under VPC Network. When setting up a VPC peering, choose your VPC name, and to connect to the other side, choose the VPC network name of the production side. And create a VPC Peer, and you can see the status is inactive.

Fig3. Creating VPC Peering

Fig4. VPC Peer Configuration

Fig5. VPC Peer with inactive status

In the same way, we will create a VPC Peer on the production project, and under the peered network, we use the project ID and VPC name of the developer project. As the two VPCs have peer connections, we can see that the status has been changed to an active state.

Fig6. An active VPC’s Peer

Now, we create a VM instance on both projects(any configuration of VM is fine) to test if both VPC is connected or not. More so, we need to add a firewall rule on both VPCs with ingress setting (ingress rule is a rule that governs the traffic entering the VPC) to allow other VPCs to connect. Hereafter, we attach the firewall rule to the network card (nic) of the same VPC.

Now we try to ping both VPC instances to each other and check if they are connected or not. In the image below, we can see that both send signals to each other. Hence, they are connected.

Fig7. A Successful Ping

Furthermore, we will create a Kubernetes Cluster in the developer project. We will launch our Cluster using the Regional Location type and set nodes on three availability zone. Also, we need to configure the nodes stating the machine type and image we wish to use as our nodes(choose how you want).

To Know More: What is ZONE and REGION in GCP?

Fig8 Kubernetes Cluster

FIg9. Cluster Configuration

Fig10. Node image and machine configuration

After creating a Kubernetes cluster on the developer side, we will create a Google SQL database server on the production side. We’ll then integrate our database with Kubernetes pods containing our front-end application (I’ll be using WordPress).

We will create a Cloud SQL instance; we will add network security that allows all IP address to access our database(not a secure move).

Fig11. SQL Instance

Fig12. Adding Network

Fig13. Allow Firewall

Fig14. Instance Created

Now we create a database called “WordPress” in this instance.

Fig15. Database Creation

The interesting part switches back to the developer project and goes to the navigation panel's cluster menu on the left. The cluster we created will appear there and click on the connect button, and we will get a popup with a command. Run the command in the cloud shell. I prefer to open a new tab in the browser and open the cloud shell there as we will be working a lot in the cloud shell.

Fig16. Kubernetes Connect

Fig17. Connection Command

Fig18. Launched Kubernetes

We’ll use the command below to check the status of the 3 nodes we created for our Kubernetes cluster.

mishanregmi@cloudshell:~ kubectl get nodes

We can also use the following commands to check whether we have running pods or deployments in our cluster.

mishanregmi@cloudshell:~ kubectl get pods

mishanregmi@cloudshell:~ kubectl get deployment

The output doesn’t show us any pods or deployment, so we have created a deployment with pods (these pods will contain WordPress). As docker is the default container engine in Kubernetes, we are going to deploy docker containers. For the containers, we will use a WordPress image from the docker hub.

To get the WordPress image, follow the link.

// to create a deployment

mishanregmi@cloudshell:~ kubectl create deploy <name of deployment> --image=wordpress

Now when we check the deployment and the pods, we’ll get the information about them.

Kubernetes deployment resource will help us monitor our pods, and in case a pod fails or gets deleted, it will immediately launch another pod. You can see in the image below how a new pod is created with a different pod id when the old pod is deleted.

Fig19. Pod and Nodes

We can also scale our deployment and create multiple replicas (replicas are copies of an object). Scaling helps us create more pods of similar configuration and distribute it among all the cluster nodes.

// to create replica

mishanregmi@cloudshell:~ kubectl scale deployment <deployment name> --replicas = 5

Fig20. Scaling Deployment

As we have created 5 replicas and distributed among all three nodes, we need to balance the incoming traffic in all the nodes.

For balancing the incoming traffic in our server, we require a Load Balancer. Kubernetes has its Load-Balancer service, but as we are using GCP’s Kubernetes services, Kubernetes will automatically use GCP Load Balancer as an External Load Balancer. To show how a load balancer works, I am going to add one more deployment and then create 3 replicas of it.

Fig21. Test Deployment

After that, we are going to expose the deployment through a Load-Balancer. We will allow all HTTP traffic(port:80) through that Load-Balancer, which distributes the traffic to all nodes.

Fig22. External IP

Now when we copy the IP address and open it in a new tab, we can see some specs of the NIC of the present pod on which our LB has directed us. When we refresh the page, due to the Load-Balancer, we might land in another replica server. The images below show different IP addresses as a result of multiple page refresh.

Fig23. Server IP

Fig24. Server IP2

Above was the example of how a Load-Balancer works. Now, we will use our LoadBalancer (webdepo) to connect to our WordPress deployment.

Fig25. External IP

Now when we copy that IP address and then open it in a new browser, we get a starting page of WordPress, and we need to follow the steps mentioned below:

We have to choose our language.

Fig26. Language Selection

We have to fill in the database name we had launched on our MySQL server on the production project and the username, which will be “root,” and you can set your password.

Fig27. Connection Details

For the database host, we have to copy my database's IP address from the GCP console in the MySQL section.

Fig28. Database IP

Fig29. Host IP

After we submit, we will have to provide our information for configuring our WordPress.

When we install WordPress, we get redirected to the login page to log in with the same username and password.

Fig30. WordPress Login

So, after all the steps, we are finally in the WordPress dashboard. So with this, we have completed the integration of the GCP SQL Database with Kubernetes. Below you can see my WordPress accessed through my Load-Balancer (webdepo) external IP address in the address bar.

Fig31. WordPress URL

Now let me introduce a powerful and important service of GCP called IAM.

What is IAM?

Identity and Access Management (IAM) is a feature in GCP which lets you grant granular access to specific GCP resources and prevents unwanted access to other resources. It lets you adopt the least privilege security principle, so you grant only the necessary access to your resources.

Now, I’ll give you some information about IAM. I am going to provide edit access to the production project to my other mail id.

First, you have to go to IAM from the navigation menu. Then you have to add a member and provide the new user's credentials, set his/her role(owner, editor, view only) for the project, and you can also state the time and resources he/she can access, then click add.

Fig32. IAM Role

Fig33. IAM Member

Note that the user added above is only for the production project; thus, he cannot access other projects' resources. This can be clearly seen in the image below taken from the developer project from the main user and production project from the newly added user.

Fig34. Developer Member

Fig35. Project List

So, finally, we have seen how to create VPCs in GCP, how-to peer them, and we saw the SQL database creation in GCP. We also learned about Kubernetes and its cluster, nodes, pods, and we also learned how to distribute incoming traffic to several pods using a Load-Balancer. Finally, we ended with IAM roles in GCP.

Thank you for reading the blog, and please do suggest to me some ideas for improvement. Your suggestions will really motivate me.

Thank You Note

To conclude this blog, I would like to thank Mr. Vimal Daga for providing me the right knowledge and motivating me to write this blog. Thank you, Sir.