​

Chapter 16: Beyond a Single Cloud - Hybrid and Multi-Cloud

​

1. Anthos: The Unified Control Plane

​

Connect Gateway

​

Anthos Clusters (GKE Multi-Cloud)

• Anthos on VMware: Runs GKE clusters on your existing vSphere infrastructure.
• Anthos on Bare Metal: Runs GKE directly on physical Linux servers, eliminating the overhead of a hypervisor—ideal for edge computing and high-performance workloads.
• Anthos on AWS/Azure: Google manages the lifecycle of Kubernetes clusters running on EC2 or Azure VMs.

​

2. Anthos Service Mesh (ASM)

• Managed Control Plane: Google manages the Istio control plane (pilot, citadels), so you only worry about the sidecar proxies.
• mTLS by Default: ASM automatically encrypts all service-to-service communication using Mutual TLS (mTLS), ensuring that even if the network is compromised, the data is safe.
• Service Graph: A visual representation of how your services communicate, including latency, error rates, and throughput for every link.

​

2.1 The ASM Ingress Gateway: TLS Termination

1. Client Request: User hits the Global Load Balancer (or a static IP).
2. TLS Termination: The Ingress Gateway terminates the external TLS using a Kubernetes Secret (containing the cert/key).
3. mTLS Origination: The Gateway then starts a new mTLS connection to the backend sidecar proxy inside the mesh.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: prod-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway # Use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE # Standard TLS termination
      credentialName: "frontend-certs" # K8s secret name
    hosts:
    - "api.mycompany.com"

• Security: Keeps sensitive SSL keys in a restricted namespace (istio-system).
• Offloading: Backend microservices don’t need to manage certificates; they only see mTLS.
• Policy Enforcement: You can apply global Rate Limiting or JWT validation at the Gateway before traffic reaches any pod.

​

3. Anthos Config Management (ACM)

• Config Sync: Periodically pulls manifests (YAML) from Git and applies them to the fleet.
• Policy Controller: Built on the Open Policy Agent (OPA), it allows you to enforce guardrails. For example, you can prevent any developer from creating a “LoadBalancer” service that has a public IP in a specific namespace.
• Hierarchy Controller: Allows you to create parent-child relationships between namespaces, making it easier to manage permissions and quotas in large multi-tenant clusters.

​

4. Connecting the Clouds: Interconnect and VPN

​

Dedicated vs. Partner Interconnect

• Dedicated Interconnect: A physical fiber connection between your router and a Google edge PoP. Provides 10 Gbps or 100 Gbps of bandwidth.
• Partner Interconnect: You connect to a supported service provider (like Equinix or AT&T) who already has a high-speed link to Google. Ideal if you are not in a Google peering location.

​

Cross-Cloud Interconnect

• No Internet: Traffic between GCP and AWS never touches the public internet.
• Performance: Sub-10ms latency between clouds, enabling real-time data synchronization.

​

5. Advanced Anthos Ops: Service Mesh and Policy Controller

​

5.1 ASM Traffic Management

• VirtualService: Defines where the traffic goes (e.g., “Send 90% to v1 and 10% to v2”).
• DestinationRule: Defines how the traffic is handled at the destination (e.g., “Use random load balancing” or “Set a circuit breaker if 5xx errors > 5%”).
• Circuit Breakers: Prevents a single failing service from taking down the entire system by failing fast and allowing the service to recover.

​

5.2 Policy Controller Guardrails

• Constraints: Declarative rules (e.g., “All namespaces must have a ‘cost-center’ label”).
• Audit Mode: See which resources are currently violating a policy without actually blocking them—ideal for onboarding legacy clusters.

​

6. Google Cloud VMware Engine (GCVE)

• Native VMware Stack: You get a full VMware environment (vSphere, vCenter, vSAN, NSX-T) running on Google’s bare-metal infrastructure.
• Seamless Migration: Use HCX to “Live Migrate” (vMotion) VMs from your data center to GCP with zero downtime.

​

6. Interview Preparation: Architectural Deep Dive

1. A developer commits a YAML manifest to Git.
2. The Config Sync agent running in the Anthos clusters detects the change.
3. The agent pulls and applies the manifest to the cluster. This ensures that all clusters in the fleet stay in sync and allows for “infrastructure versioning” and easy rollbacks.

• Dedicated: You have a physical fiber connection between your router and a Google Edge Point of Presence (PoP). Supports 10G/100G. Best for high bandwidth and security.
• Partner: You connect to a service provider (like Equinix) who already has a link to Google. Better for smaller bandwidth (50Mbps to 10G) or if your data center is not in a Google PoP city.

• mTLS: Automatically encrypts all service-to-service traffic.
• Observability: Provides a “Service Graph” and Golden Signals (Latency/Errors) out of the box.
• Resiliency: Handles retries, circuit breakers, and canary rollouts at the infrastructure layer.

​

Implementation: The “Hybrid Architect” Lab

​

Setting up a GitOps Pipeline with ACM

# 1. Enable the Anthos API
gcloud services enable anthos.googleapis.com

# 2. Register a cluster to the Anthos Fleet
gcloud container fleet memberships register my-cluster \
    --gke-cluster=us-central1-a/my-cluster \
    --enable-workload-identity

# 3. Configure Config Sync (apply-spec.yaml)
# spec:
#   git:
#     repo: https://github.com/my-org/anthos-config
#     branch: main
#     dir: "cluster-configs"
#     auth: token

# 4. Apply the configuration
gcloud beta container fleet config-management apply \
    --membership=my-cluster \
    --config-yaml=apply-spec.yaml

​

Pro-Tip: Anthos Service Mesh Dashboards