🗞️ Introducing Prediction Private Endpoints for fast and secure serving on Vertex AI [link]
「Vertex Prediction 支援 Private Endpoints，可以降低資料洩漏的風險 ~」
That’s why we’re excited to announce Private Endpoints on Vertex AI, a new feature in Vertex Predictions. Through VPC Peering, you can set up a private connection to talk to your endpoint without your data ever traversing the public internet, resulting in increased security and lower latency for online predictions
🤯 BigQuery Admin reference guide: Monitoring [link]
「這篇 blog 可以說是 BigQuery 監控大全了，提供很多實用的 query 和監控方式，必須收藏 👏 」
🗞️ Six new features in Dialogflow CX [link]
With these features, our customers will be able to improve the end-user conversational experience and manage security and deployment better
Here’s a selection of what’s new:
- Streaming partial response: Webhook 執行時間較久的時候可以讓 agent 先回應部分內容，以面 user 覺得困惑
- Private network access to Webhook targets: Webhook 可以是在 Private Service Connect 後面的 endpoint，便可以用上 IAM//VPC-SC 等安全機制
- Search in console: 如果建很多 intents/entities 要找的話可能很困難，可以直接用這個 search
- System functions support: 支援 common arithmetic (算術), string manipulation (字串處理), conditional (流程控制) and date/time (日期時間) operations，可以不用都依靠 webhook
- Continuous tests and deployment: Using this feature, one can automatically run a set of test cases configured for an environment to verify the intended behavior of the agent in that environment
- Change Diffs in Change History: 加入版控機制
🗞️ Save messages, money, and time with Pub/Sub topic retention [link]
「利用 Topic retention，那些在 messages 之後才出現的 subscriptions 也可以 replay messages，太神啦 👏 」
Starting today, there is a simpler, more useful way to save and replay messages that are published to Pub/Sub: topic retention. Prior to topic retention, you needed to individually configure and pay for message retention in each subscription. Now, when you enable topic retention, all messages sent to the topic within the chosen retention window are accessible to all the topic's subscriptions, without increasing your storage costs when you add subscriptions
Topic retention extends Pub/Sub's existing seek functionality—message replay is no longer constrained to the subscription's acknowledged messages. You can initialize new subscriptions with data retained by the topic, and any subscription can replay previously published messages
🗞️ A unified and proven Zero Trust system with BeyondCorp and BeyondProd [link]
「Zero trust 的重點不在於不相信任何事, 而是不要把雞蛋都放在同一個籃子裡。BeyondCorp 著重 user，BeyondProd 著重 service，這兩者都有別於傳統單純依賴 network 信任，更著重在 identity 以及 context 上面」
At the core of a Zero Trust approach is the idea that implicit trust in any single component of a complex, interconnected system can create significant security risks
Where BeyondCorp states that "user trust should be dependent on characteristics like the context-aware state of devices and not the ability to connect to the corp network", BeyondProd states that "service trust should be dependent on characteristics like code provenance and service identity, not the location in the production network, such as IP or hostname identity"
🗞️ Cloud Spanner federated queries [link]
「BigQuery 支援 Cloud Spanner 的 federated queries 囉 ~」
🗞️ What's the key to a more secure Cloud Function? It's a secret! [link]
「Cloud Functions 原生整合 Google Secret Manager 囉 ~ Cloud Run 也有支援」👏
🤯 Introduction to BigQuery Admin Resource Charts [link]
「BigQuery 終於有自己的 monitoring console 啦，不然之前都要在 log 和 INFORMATION_SCHEM 各種折騰」👏
BigQuery Admin Resource Charts let BigQuery administrators observe how their organization uses BigQuery slots and how their jobs perform over time. Primary use cases for Admin Resource Charts include root-cause analysis for capacity planning based on historical resource utilization and diagnosing performance changes
🤯 Estimate slot capacity requirements [link]
「幫你估算應該買多少 slot 拯救荷包君」
When you purchase reserved slots in BigQuery, you must estimate the right number of slots for your particular workload. The BigQuery slot estimator helps you to manage slot capacity based on historical performance metrics. It displays job performance data for the past seven days and models the possible impact of increasing or reducing your slot capacity.
🗞️ Using a private repo on Artifact Registry in Google Cloud Functions [link]
「Artifact Registry 提供比 Container registry 更全面的 private dependencies 管理功能，這篇 blog 演示如何創建一個 private repo 然後佈署一個 Cloud Functions 使用該 private repo 裡面的 dependency」
🗞️ Getting to the cloud: Best practices for migrating from On-prem to Google Cloud using Storage Transfer Service [link]
「本篇講解使用 Storage Transfer Service 將檔案從地端搬遷上雲的 best practices，有幾個面向：1. Understanding the source files and filesystem 2. Optimizing Storage Transfer Service resources 3. Preparing your network for large-scale data transfer 4. Test twice, transfer once」
🗞️ Introducing security configuration for gRPC apps with Traffic Director [link]
「Traffic Director gRPC 支援 TLS 和 mTLS」
In a defense-in-depth model, organizations maintain their perimeter protection using firewalls and web application firewalls for the whole app. Today, on top of that, organizations want a “zero trust” architecture where additional security policy decisions are made and enforced as close to resources as possible
🗞️ Zero effort performance insights for popular serverless offerings [link]
「Serverless compute 自動整合 Cloud Trace, performance 追蹤更容易」
The difficulty of generating traces has prevented many users from accessing this useful troubleshooting resource. To make them more easily available to developers, we've started instrumenting our most popular serverless compute options, AppEngine, Cloud Run and Cloud Functions to generate traces by default
Once your code is deployed in any serverless compute like AppEngine, Cloud Run or Cloud Functions, any ingress or egress traffic through the compute automatically generates spans that are captured and stored in Cloud Trace. These spans are stored for 30 days at no additional cost
🗞️ BigQuery Admin reference guide: API landscape [link]
「這篇介紹了詳盡的各種 BigQuery 相關的 API 使用場景和方式，值得開發者收藏」
🆙 GKE update [link]
A simplified GKE API for configuring which logs and metrics are collected and sent to Cloud Logging and Cloud Monitoring is now available. The gcloud container clusters create, gcloud container clusters create-auto, and gcloud container clusters update commands now support the --logging and --monitoring flags
gcloud container clusters update --logging=NONE
gcloud container clusters update --logging=SYSTEM
gcloud container clusters update --logging=SYSTEM,WORKLOAD🗞️ Cloud Build support Approving builds [link]
「Cloud Build 支援需要審核的 build 啦，不用再自己實作 review 機制惹，開心 🎉」
🗞️ Understanding Cloud SQL Maintenance: why is it needed? [link]
「Cloud SQL Maintenance 真的是最多用戶問到的一個問題了，這篇有系統了講述了到底 Maintenance 做了什麼事情，接下來還會講怎麼讓 downtime 造成的 impact 降到最低」
Updates that users perform, which are called configuration updates and updates that Cloud SQL performs, which are called system updates.
In general, Cloud SQL system updates are divided into three categories: hardware updates, online updates, and maintenance.
Maintenance updates the operating system and the database engine. Since these updates require that the instance be restarted, they incur some downtime
To moderate application impacts, we bundle critical updates together into maintenance events that are scheduled once every few months
To make maintenance more manageable, we equip users with settings such as maintenance windows and deny periods
🗞️ Overview of reCAPTCHA Enterprise for WAF and Google Cloud Armor integration [link]
「Cloud Armor 整合 reCAPTCHA Enterprise 為 application 提供更好的防護」
🗞️ Verify GKE Service Availability with new dedicated uptime checks [link]
「Cloud Monitoring 的 uptime check 新增了對 Kubernetes Loadbalancer Service 的支持，check 的目標不是 IP 而是 service name，所以可以動態的調整，相當方便 」
With our new integration, the GKE LoadBalancer uptime check directly associates a service load balancer with an uptime check, helping to ensure the uptime check is managed dynamically
🗞️ Extend your Dataflow template with UDFs [link]
「Dataflow 支援夠過 UDF 的方式來擴展他的功能，這樣即使不會 Apache Beam 的 SDK 也可以利用既有的 Dataflow template 做到自己想要的客製化 ETL」
With user-defined functions (UDFs), customers can extend certain Dataflow templates with their custom logic to transform records on the fly
That means you do not have to be an Apache Beam developer or even have a developer environment setup in order to tweak the output of these Dataflow templates!
📺 Google Cloud Asset Inventory 101 [link]
「Asset Inventory 我相信對於 enterprise 的用戶來說會是非常重要的一個功能之一，值得期待」👏
🗞️ Troubleshoot GKE apps faster with monitoring data in Cloud Logging [link]
To make it easier to troubleshoot GKE apps, we’ve added contextual Cloud Monitoring data accessible right from Cloud Logging
For example, if you’re troubleshooting a GKE app error in Cloud Logging and looking at the app logs, you can now view the metric charts for container restarts, uptime, memory, CPU and storage without leaving the log entry
🗞️ Data Validation for Oracle to Cloud Spanner Migration [link]
「GCP 的 Data Validation Tool (DVT) 新增支援 Oracle to Cloud Spanner」
Migration of Oracle to Spanner can be addressed using many approaches but one of the most important stages of the migration is Data Validation. One tool that helps simplify the data validation process is the Data Validation Tool (DVT)
DVT can connect to different types of source and target databases and create validation reports based on the criteria defined
🗞️ Use log buckets for data governance, now supported in 23 regions [link]
「Log buckets 現在支援 23 個 regions，有資安/合規需求的話，可以將 _Default bucket 取代成自己創建的 log bucket」👷
🗞️ Cloud Build: Building repositories from GitHub Enterprise [link]
🗞️ Cloud Monitoring: When you create a line chart on a dashboard, you can now specify whether the selected metric is charted against the left Y-axis or the right Y-axis. This feature lets you display different metrics with different scales on the same chart
「Cloud Monitoring 的 line chart 可以指定 metrics 要對左邊 or 右邊的 y 軸」
📺 How to run and debug your functions locally with the Functions Framework [link]
Cloud Functions supports several methods of running your functions outside of Cloud Functions itself. This is particularly useful for iterative development, and for situations where you want to test your function before deploying
🗞️ Introducing Unattended Project Recommender: discover, reclaim, or deprecate abandoned projects under your organization [link]
「Recommender 推出閒置 project 的刪除建議，透過 AI 的方式找出組織下那些閒置的 projects，可以選擇刪除省下經費，並且也可以將資料匯出至 BigQuery 分析」💰
To help you prune your idle cloud resources, we’re excited to introduce Unattended Project Recommender. It’s a new feature of Active Assist that provides you with a one-stop shop for discovering, reclaiming, and shutting down unattended projects
This feature is available via the Recommender API today, making it easy for you to integrate with your company’s existing workflow management and communication tools, or export results to a BigQuery table for custom analysis
🗞️ The Observability tab on Compute Engine's VM instance details page includes a category for process metrics [link]
「Cloud Console 在單台 VM 的 UI 當中多了 Observability tab，可以觀察 VM 中運行的 processes 狀況」
🗞️ MySQL major version upgrade using Database Migration Service [link]
「DMS 不僅可以用來搬遷地端的資料庫至 Cloud SQL，還可以用來升級 Cloud SQL version，這篇 blog 介紹了升級需要注意的事項，以及 source 和 destination 之間的連線問題，以及搬遷之後的驗證和 client 端的調整，是一篇蠻完整的 DMS 介紹」
📺 BigQuery Admin reference guide: Query optimization [link], [video]
「這個 BigQuery Admin 系列都蠻優質的，尤其是有一個很有活力的妹紙，這篇講查詢最佳化，非常值得好好閱讀」🤓
🗞️ Integrating Service Directory with GKE: one registry for all your services [link]
「Service centric network 讓 client 更容易使用你的服務而不用記住/維護一串 IP 位址，現在 GKE 可以透過 YAML 裡面的 annotation 自動將 k8s service 發佈成 Service Directory 當中的 service，並且直接整合 Cloud DNS，不管對地端或雲端的 client 都更友好」👏
Service Directory is a managed product that allows you to maintain an inventory of all these services in one place, so that services from different platforms can discover and connect to one another
We’re now excited to announce that GKE services can automatically register to Service Directory. In this preview release, GKE services can register and unregister in Service Directory without having to write orchestration code
You can access services in Service Directory over DNS, HTTP, and gRPC. Service Directory is integrated with Cloud DNS, and can automatically populate DNS records as services are added to it
🗞️ Cloud Monitoring: A new UI for creating alerting policies is available in Preview [link]
「Cloue Monitoring 的 alerting UI 有改版，的確是有比較清楚好用一下，try it」👏
🗞️ GKE: Multi Cluster Ingress is now available through "standalone per-Pod pricing" in addition to Anthos licensing for all GKE release channels [link]
「原本要用 Multi Cluster Ingress 就得有 Anthos license 現在不用啦」👏
🗞️ New histogram features in Cloud Logging to troubleshoot faster [link]
「Cloud Logging 的 histogram 推出了好幾個方便的工具更好發揮 histogram 的價值：1. error log 會以紅色標注 2. 可以左右移動時間軸 3. 可以 zoom in/out 4. 點擊某個 histogram bar 會顯示出該區間 log」👏
🗞️ Private Service Connect now in GA [link]
「Private Service Connect 可以讓跨 VPC network 的 services 彼此用 private 的方式溝通，包含那些位在 Google managed VPC 的 services，像是 Cloud Storage, Cloud Bigtable, 3rd-party MongoDB 等等...，好處是有明確的 IP 可以作管控也可以設定額外的 policy 來過濾存取。現已 GA 可以放心使用啦」👏
🗞️ Get in sync: Consistent Kubernetes with new Anthos Config Management features [link]
「Config Controller 其實就是之前的 Config Connector 的概念，可以用宣告式的 YAML 檔案來佈署相關的 GCP resources，然後在搭配上 Config Sync 做到版控和跨環境的佈署一致性」
We are introducing Config Controller, a hosted service to provision and orchestrate Google Cloud resources
we’re also announcing that, in addition to using it for hybrid and multicloud use cases, Anthos Config Management is now available for Google Kubernetes Engine (GKE) as a standalone service
The hosted service, Config Controller, which runs Config Connector, Config Sync, and Policy Controller for you, is available in Preview. Config Controller leverages Config Connector, which lets you manage Google Cloud resources the same way you manage other Kubernetes resources, with continuous monitoring and self-healing
🗞️ Elevate your security with new Secret Manager features and integrations [link]
「Secret Manager 有 free tier 了，可以免費體驗。另外，在安全性上新增了 auto-expiring secrets，時間到 secrets 就會自動被刪除，最後還有一篇 best practices，展示如何更好的將 Secret Manager 與其他 GCP 服務整合」
Secret Manager now has a tier that is free of charge! In addition to the free tier and increased SLA, Secret Manager is now available in all public Google Cloud regions!
While it was previously possible to expire access to a secret using IAM conditions, the underlying secret would continue to exist. Secret Manager now supports auto-expiring secrets which permanently deletes a secret at a specified timestamp or TTL
The Secret Manager best practices guide ensures customers get the maximum security benefits from Secret Manager
🗞️ Cloud NAT rules [link]
「Cloud NAT 支援設定 egrees rules 啦！」👏
🗞️ View recent usage for service accounts and keys [link]
「可以稽核 service account 和 keys 的使用啦！」👏