Earlier quoted context omitted.
No caching provided either. Full on egress charges. Surely that makes the comparison apples/oranges.
Caching is provided with GCP HTTPS load balancers, it’s just not specified here.
At Cloudflare like egress prices?
Google Cloud Armor
41–50 of 54 posts
Re: Google Cloud Armor
#42Wasn't it Google that uncovered Cloud Bleed? Think Google solution is going to be more secure then something from Cloudflare.
Re: Google Cloud Armor
#43Kubernetes doesn't support multi-region load balancing with GSLB yet.
How is that related to security policies? Also you can't run a GKE cluster across multiple regions, only multiple zones. If you have multiple clusters in different regions, you can use a NodePort service on each and manually setup a GSLB with a backend pointing to all of the GKE clusters. There is a solution being worked on though, called multi-cluster ingress: https://github.com/GoogleCloudPlatform/k8s-multicluster-…
Running a Kubernetes cluster across multiple regions is not a great idea. You can set up a federation of clusters, but GKE doesn't seem to support that yet, so you need to create and manage the federated control plane yourself. And there's no standard way at the moment to have generic cross-cluster networking, like you easily could with Borg. So you can load balance external requests to a number of clusters, as you explain, but currently it's easier if each cluster is self-sufficient and doesn't need to refer to internal services in other clusters.
Re: Google Cloud Armor
#44Not a huge fan of Google getting more control over the net. On the bright side, Cloudflare getting a serious competitor is good.
Agreed. I just wish it wasn't Google. They "extinguished" a lot of good projects...
Name one product in GCP (that had reached general release) that they have "extinguished".
Re: Google Cloud Armor
#45[deleted]
Re: Google Cloud Armor
#46Re: Google Cloud Armor
#47I'm trying to enable Cloud Armor to play around with it, but it just looks like a firewall. I don't see a simple way to just "turn it on" - it looks like you have to create an IP address-based policy. It's unclear to me whether there is any kind of adaptive DDOS protection.
Re: Google Cloud Armor
#48Earlier quoted context omitted.
How is that related to security policies? Also you can't run a GKE cluster across multiple regions, only multiple zones. If you have multiple clusters in different regions, you can use a NodePort service on each and manually setup a GSLB with a backend pointing to all of the GKE clusters. There is a solution being worked on though, called multi-cluster ingress: https://github.com/GoogleCloudPlatform/k8s-multicluster-…
Running a Kubernetes cluster across multiple regions is not a great idea. You can set up a federation of clusters, but GKE doesn't seem to support that yet, so you need to create and manage the federated control plane yourself. And there's no standard way at the moment to have generic cross-cluster networking, like you easily could with Borg. So you can load balance external requests to a number of clusters, as you e…
I didn't say anything about K8S across regions, it's fundamentally not designed for it anyway.
GKE doesn't support federation because it's not a final feature either, it was beta at best and is now being revised and renamed to "multi-cluster": https://github.com/kubernetes/community/tree/master/sig-mult...
If you need to reach services between clusters, that's completely different from ingress. Ingress is about external access to cluster services.
You can still use an authentication layer and expose everything through an ingress, or use internal IPs for the services/containers which are already routable in GCP's network across regions. A headless service to get the IPs and a cron job to sync these to a public DNS system will give you the same thing federation does for cross-cluster service discovery. There are also apps like ExternalDNS that'll do it for you: https://github.com/kubernetes-incubator/external-dns
Re: Google Cloud Armor
#49Is GCA able to cache responses with proper cache headers or does it pass through everything without caching?
Re: Google Cloud Armor
#50Earlier quoted context omitted.
> Cloudflare is way too expensive. Eh? DDoS protection on Cloudflare is free: https://blog.cloudflare.com/unmetered-mitigation/ Which features of Google Cloud Armor are "too expensive" with Cloudflare? (Disclosure: I'm an engineer at Cloudflare, but I'm genuinely curious what you mean here.)
Not comparing to Cloud Armor, but the $200/month minimum to bring one's own tls certificate. That alone puts Cloudflare squarely on the list of unusable options for any small project or business that is running their entire production infrastructure on less than $100/month. Also, the inability to specify cache expirations below... what was it... 30 minutes or 2 hours? Again, forced to pay too much for one of the core…
Hmm. Cloudflare provides free TLS certificates automatically. The feature you're describing is for if you want to upload your own certificate and private key to Cloudflare for it to use on the edge. Do a lot of small projects really need that?