Limit access to the control plane

To improve your security posture, allow only an authorized network andGoogle Cloud console and Cloud Shell to access your cluster'scontrol plane.

Configure an authorized network

1. In the Google Cloud console, go to theGKEClusters page.

   Go to Clusters

2. In theName column, click the name of your cluster,hello-world-cluster.

3. In theControl plane authorized networksrow of the Networking table, clickeditEdit.

4. In the Edit control plane authorized networks dialog, selectEnable control plane authorized networks.

5. SelectAllow access through Google Cloud public IP addresses.

   This lets you manage the cluster from Google Cloud console andCloud Shell

6. ClickAdd authorized network.

7. Enter a name, such asMy example on-prem network.

8. InNetwork, enter the range of IP addresses that you want to grantaccess to your cluster's control plane. Use CIDR notation.

   For example, enter the following range:

   198.51.100.0/24

9. ClickDone.

10. ClickSave changes.

    This operation takes a few minutes to complete.

11. Click theNotifications button and wait until you see a greencheck mark next toUpdate control plane authorized networks setting in Kubernetes Engine cluster "hello-world-cluster".

You have configured a cluster control plane that is accessible onlyfrom your authorized network and from Google Cloud public IPaddresses (which lets you manage the cluster fromGoogle Cloud console and Cloud Shell).

To see the IP address of your cluster's control plane and confirm the addressesof the authorized network, clickNext.

View IP addresses

1. Go to the GKEClusters page.

   Go to Clusters

2. In theName column, click the name of your cluster,hello-world-cluster.

3. In theCluster basics table, theExternal endpoint row shows theIP address of the cluster's control plane.

4. In theNetworking table, theControl plane authorized networks rowshows the IP addresses of your authorized network.

Your cluster's control plane can now only be accessed from an authorized network,Google Cloud console, and Cloud Shell.

Specify a compute class

By default, GKE Autopilot Pods use compute resourcesthat are optimized for general-purpose workloads. For workloads that need toscale optimally or that have other unique requirements, you can specify adifferent compute class.

Update the Deployment specification

1. In the Google Cloud console, go to the GKEWorkloads page.

   Go to Workloads

2. In theName column, click the name of the app you deployed,hello-world-app.

3. ClickEditto edit the deployment specification.

4. In theYAML tab, find the line that starts withcontainers:

5. Just above this line, add the following lines:

   nodeSelector:  cloud.google.com/compute-class: "Scale-Out"

   Make sure your file matches the indentation in the following example:

   apiVersion: apps/v1 kind: Deployment ... spec: ...   template:   ...     spec:       nodeSelector:         cloud.google.com/compute-class: "Scale-Out"       containers:       - name: hello-app         image: us-docker.pkg.dev/google-samples/containers/gke/hello-app:1.0

6. To download this file and use it as the basis for other workloadconfigurations, clickDownload.

7. ClickSave.

Any Pod replicas that are created to run your workload will use the computeclass you specified.

Test autoscaling

Now that you have a workload that can scale efficiently, update autoscalingsettings to more easily cause your workload to scale up. Then generate load totrigger autoscaling.

Update Pod autoscaling settings

1. Go to the GKEWorkloads page.

   Go to Workloads

2. In theName column, click the name of your deployment,hello-world-app.

3. ClickActions.

4. SelectAutoscale and clickHorizontal pod autoscaling.

5. In theConfigure Horizontal Pod Autoscaler dialog, underAutoscaling metrics, clickCPU.

6. Change the value ofTarget to 2, which automatically scales up your Podswhen they use at least 2% of their configured CPU resources. This low targetvalue ensures that you can easily trigger autoscaling in the next step.

7. ClickSave.

To trigger autoscaling, clickNext.

Generate load to trigger autoscaling

1. Open Cloud Shell by clickingCloudShell.

2. Paste the following command into Cloud Shell:

     for i in $(seq -s' ' 1 10000); do wget -q -O- <var>external-IP-address</var>; done

   Replaceexternal-IP-address with the IP address that appearsin theEndpointscolumn.

3. Press Enter to run the command and send 10,000 requests to hello-world-app.

4. Wait for thewget command to finish running and the command-line prompt toreappear.

5. You can close Cloud Shell when thewget command finishes.

To watch your workload scale to accommodate the increased traffic, clickNext.

Watch your workload scale

1. On theDeployment details page for your workload, look in theCPUchart for a spike in CPU usage.

   You might need to wait up to 5 minutes to see the spike.

2. ClickrefreshRefreshto make sure theDeployment details page shows the latest data.

3. Look in theManaged Pods table to see that three replicas of your workloadare now running.

   You might initially see errors about unschedulable Pods, but these messagesare transient as the replicas start up.

4. You can wait for about 10 minutes, clickrefreshRefresh,and see that CPU usage has dropped and so the number of Pods inManaged Pods returns to one.

You have tested autoscaling and watched your workload scale.

Adjust logs retention

By default, Cloud Logging ingests all logs from your GKEclusters. Ingesting large amounts of logs data could result in a fee. To ensurethat you're only ingesting the logs data that you need for the staging environment,adjust logs retention.

Create a logs filter

1. In the Google Cloud console, go to theLogs Explorer page:

   Go toLogs Explorer

   If you use the search bar to find this page, then select the result whose subheading isLogging.

   Notice that theQuery resultspane shows logs from all resources in your project.

2. Above the query results:

   1. ClickResource.

   2. Search forKubernetes cluster, then click it.

   3. Clickus-central-1.

   4. Clickhello-world-cluster.

   5. ClickApply.

3. ClickSeverity andselectInfo (which changes toInfo and higher on hover).

4. ClickRun query.

5. Note thatQuery results now only contains INFO messages from yourstaging cluster.

6. Copy the query from the query editor. You'll paste this query when youcreate a filter for your log sink.

To create a log sink and storage bucket, clickNext.

Create a log sink and storage bucket

1. Go to the LoggingLog router page.

   Go to Log router

2. ClickCreate sink.

3. InName, enter the following name:

   hello-world-cluster-sink

4. ClickNext.

5. InSelect sink service, selectLogging bucket.

6. InSelect a log bucket, selectCreate new log bucket.

7. InBucket details, enter a unique name, such as:

   hello-world-bucket-<var>user-id</var>

8. ClickCreate bucket.

9. UnderSink destination, clickNext.

10. InBuild inclusion filter, paste the query you created in the Logs Explorer.

11. ClickCreate sink.

To view your cluster's logs, which are stored in the log bucket youcreated, clickNext.

View your cluster's logs

1. In the Google Cloud console, go to theLogs Explorer page:

   Go toLogs Explorer

   If you use the search bar to find this page, then select the result whose subheading isLogging.

2. ClickRefine scope.

3. SelectLog View.

4. Select the_AllLogs view for your log bucket.

5. ClickApply.

   Query results shows only the logs that are stored in your log bucket.

You have adjusted the logs retention so your staging cluster doesn't storeDEBUG messages. You canset permissionsso that only certain users can view the logs in your cluster's bucket.

Enable the security posture dashboard

The security posture dashboard scans your GKEclusters and workloads to provide you with opinionated, actionablerecommendations to improve your security posture.

Explore any concerns

1. Go to the GKESecurity posture page.

   Go to Security posture

2. If you are asked to enable the Container Security API, clickEnable.

3. TheDashboards tab summarizes concerns for your project's clusters andworkloads.

4. Click theConcerns tab.

5. If any concerns appear on the tab, click the concern for more information.

You have completed some of the basic tasks for configuring a cluster for staging andtesting your app.