7 ms·

Coming from an AWS shop, I guess I don't understand the use case(s) for this. What this enable me to do that I couldn't accomplish by ssh'ing to any of the boxe

by Wonnk13 11y ago

Coming from an AWS shop, I guess I don't understand the use case(s) for this. What this enable me to do that I couldn't accomplish by ssh'ing to any of the boxes in my environment?

KirinDave 11y ago
I use AWS extensively as well, but really like this product plan. Ultimately what AWSClassic does is give you a lot of baremetal boxes to drop AMIs on. Google's changing that to the containerized model by offering direct services that are scheduled on hardware. As Kubernetes becomes more and more the primary method for deploying apps on Google's managed services, this approach will pay off more. But it's worth nothing that for many people this is what Amazon needs to do as well. As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation.
- yo-code-sucks 11y ago
  Even experienced AWS users have trouble getting VPCs right given the state of the current documentation. No, no we don't. It's quite easy, and usually it only takes us a few minutes.
  - KirinDave 11y ago
    It is great if you're not experiencing the problems we are. If you use AWS services besides S3 it can get very tricky to not overwhelm your egress and not suffer performance issues. Scaling this configuration in an elastic way is certainly not turnkey in the current VPC environment, and probably won't be until Amazon finishes something like the S3 gateway for them. And the documentation is in a sorry state.
- toomuchtodo 11y ago
  > As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation. Please. Even for an advanced VPC configuration, you're looking at 1-2 hours tops for setup. If you want point and click, go to Digital Ocean. Complex tools are always going to have a learning curve.
  - Corrado 11y ago
    Another option is to use something like my CFNBuilder[0] to generate AWS CloudFormation templates. It should allow you to create a VPC (with a Bastion box, DNS proxy, NAT instance, etc.) with just a couple of keystrokes. VPCs don't have to be scary. :) [0] https://github.com/rnhurt/CFNBuilder https://github.com/rnhurt/CFNBuilder
    - KirinDave 11y ago
      The NAT instances are so easy to overwhelm. You have to scale them along with the services you're using if you have significant use of other Amazon services. Also, it's not clear to me why I should have to do that part on my own. The fact I need to engineer a solution for high volume access to AWS Services (besides S3) in a VPC is stupid. Especially when I can just keep using EC2C and honestly have an easier time of it, while also not having to migrate and rewrite existing infrastructure to become VPC-aware.
      - toomuchtodo 11y ago
        You might have chosen the wrong platform for your needs.
        KirinDave 11y ago
        So you are now following me around these threads, defending the concept of AWS from all criticism? Even that which has been admitted and promised to be fixed by AWS's support staff? For someone with 'toomuchtodo' it seems like a very questionable use of time.
andreyf 11y ago
I think GCP's long term strategy is still to move all devops work into Google. They've stated this with GAE for awhile, and this is a logical extension move as part of that strategy for app devs who like to "SSH into their machines". Like a lot of "cloud services", this is indeed nothing you can't do on your own box, and I imagine tens of thousands of people have done it before and will do it again on AWS. Google has now done it in a way that generalizes for everyone. Aside from what it lists on the page (installing the GC SDK and setting up authentication), Google handles all of the opsy stuff you would need to do on your own. Running a Linux server and installing / authenticating an SDK is not really that hard, of course, but it's one less thing to worry about when developing an app. That's almost always always a good thing.
- KirinDave 11y ago
  I think their long term strategy is to move to a containerized world. The fact that there are managed Kubernetes instances is very telling, because that was a LOT of work.
pacala 11y ago
A few guesses: a. It just works. No need to download and configure the right version of the SDK. b. Does not timeout when you close your laptop [I hope!]. c. I works on a Chromebook. Possibly not something you care about, but a historical pain point for the consistency of Google offerings.
- KirinDave 11y ago
  For B, unless something is actively running it will presumably just freeze the instance and restart it when you return. GCE is pretty quick to do this and for shells that's not disruptive.
- imissmyjuno 11y ago
  a. Which SDK? You mean the ssh client? b. Any custom software is wiped from your account in about an hour, though. Also an SSH re-connect is not that big a deal, IMO. c. There are SSH client Chrome Apps I guess I still don't see the point but maybe I'm assuming that one is already running a *nix and can either jump into the terminal there or connect a VM in the cloud very easily. The convenience doesn't seem that large.
babo 11y ago
You can reach your full cloud infrastructure from any browser, all you need to remember is your google password. No need for a terminal or ssh, a regular windows, os x, linux, chromebook or tablet will do. Quite handy.
- developer1 11y ago
  Handy? That sounds like a security nightmare. Your instances are accessible by simply being able to gain access to the Google account? Even with 2-factor authentication, this is a serious no-no to basic security requirements. A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface.
  - aianus 11y ago
    > A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface. Maybe if you own the servers. Since they're Google's or Amazon's servers you have to be able to administer them with some set of Google or Amazon credentials. Otherwise what would you do if sshd crashed?
    - balls187 11y ago
      > Otherwise what would you do if sshd crashed? Kill that instance, and spin up a new one. A wise BOFH gave a preso that stuck with me "Treat EC2 instances like cattle. When one strays off the farm, put a bullet in it's head." Don't treat your cloud machines as special snowflakes. Build infrastructure via script.
      - aianus 11y ago
        How does that add any security? Anyone with access to your root AWS credentials still has your IP addresses and your EBS volumes/snapshots and can do whatever they want.
        11y ago
punteney 11y ago
Another benefit is it's great for doing tutorials or to use when teaching a class. Instead of having to get all the tools and libraries installed locally on everyone's laptops people can just login to the console, fire up the shell and everyone will have the same base environment configured and ready to go.

by Wonnk13 11y ago

Coming from an AWS shop, I guess I don't understand the use case(s) for this. What this enable me to do that I couldn't accomplish by ssh'ing to any of the boxes in my environment?

KirinDave 11y ago

I use AWS extensively as well, but really like this product plan. Ultimately what AWSClassic does is give you a lot of baremetal boxes to drop AMIs on. Google's changing that to the containerized model by offering direct services that are scheduled on hardware. As Kubernetes becomes more and more the primary method for deploying apps on Google's managed services, this approach will pay off more. But it's worth nothing that for many people this is what Amazon needs to do as well. As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation.

yo-code-sucks 11y ago
Even experienced AWS users have trouble getting VPCs right given the state of the current documentation. No, no we don't. It's quite easy, and usually it only takes us a few minutes.
- KirinDave 11y ago
  It is great if you're not experiencing the problems we are. If you use AWS services besides S3 it can get very tricky to not overwhelm your egress and not suffer performance issues. Scaling this configuration in an elastic way is certainly not turnkey in the current VPC environment, and probably won't be until Amazon finishes something like the S3 gateway for them. And the documentation is in a sorry state.
toomuchtodo 11y ago
> As VPCs become the mandatory methodology for AWS, it's increasingly annoying just to set up the bare minimum you need to get a capable shell inside your environment. Even experienced AWS users have trouble getting VPCs right given the state of the current documentation. Please. Even for an advanced VPC configuration, you're looking at 1-2 hours tops for setup. If you want point and click, go to Digital Ocean. Complex tools are always going to have a learning curve.
- Corrado 11y ago
  Another option is to use something like my CFNBuilder[0] to generate AWS CloudFormation templates. It should allow you to create a VPC (with a Bastion box, DNS proxy, NAT instance, etc.) with just a couple of keystrokes. VPCs don't have to be scary. :) [0] https://github.com/rnhurt/CFNBuilder https://github.com/rnhurt/CFNBuilder
  - KirinDave 11y ago
    The NAT instances are so easy to overwhelm. You have to scale them along with the services you're using if you have significant use of other Amazon services. Also, it's not clear to me why I should have to do that part on my own. The fact I need to engineer a solution for high volume access to AWS Services (besides S3) in a VPC is stupid. Especially when I can just keep using EC2C and honestly have an easier time of it, while also not having to migrate and rewrite existing infrastructure to become VPC-aware.
    - toomuchtodo 11y ago
      You might have chosen the wrong platform for your needs.
      - KirinDave 11y ago
        So you are now following me around these threads, defending the concept of AWS from all criticism? Even that which has been admitted and promised to be fixed by AWS's support staff? For someone with 'toomuchtodo' it seems like a very questionable use of time.

andreyf 11y ago

I think GCP's long term strategy is still to move all devops work into Google. They've stated this with GAE for awhile, and this is a logical extension move as part of that strategy for app devs who like to "SSH into their machines". Like a lot of "cloud services", this is indeed nothing you can't do on your own box, and I imagine tens of thousands of people have done it before and will do it again on AWS. Google has now done it in a way that generalizes for everyone. Aside from what it lists on the page (installing the GC SDK and setting up authentication), Google handles all of the opsy stuff you would need to do on your own. Running a Linux server and installing / authenticating an SDK is not really that hard, of course, but it's one less thing to worry about when developing an app. That's almost always always a good thing.

KirinDave 11y ago
I think their long term strategy is to move to a containerized world. The fact that there are managed Kubernetes instances is very telling, because that was a LOT of work.

pacala 11y ago

A few guesses: a. It just works. No need to download and configure the right version of the SDK. b. Does not timeout when you close your laptop [I hope!]. c. I works on a Chromebook. Possibly not something you care about, but a historical pain point for the consistency of Google offerings.

KirinDave 11y ago
For B, unless something is actively running it will presumably just freeze the instance and restart it when you return. GCE is pretty quick to do this and for shells that's not disruptive.
imissmyjuno 11y ago
a. Which SDK? You mean the ssh client? b. Any custom software is wiped from your account in about an hour, though. Also an SSH re-connect is not that big a deal, IMO. c. There are SSH client Chrome Apps I guess I still don't see the point but maybe I'm assuming that one is already running a *nix and can either jump into the terminal there or connect a VM in the cloud very easily. The convenience doesn't seem that large.

babo 11y ago

You can reach your full cloud infrastructure from any browser, all you need to remember is your google password. No need for a terminal or ssh, a regular windows, os x, linux, chromebook or tablet will do. Quite handy.

developer1 11y ago
Handy? That sounds like a security nightmare. Your instances are accessible by simply being able to gain access to the Google account? Even with 2-factor authentication, this is a serious no-no to basic security requirements. A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface.
- aianus 11y ago
  > A remote server should be only accessible from specific IPs using ssh keys. No passwords, no world-accessible browser interface. Maybe if you own the servers. Since they're Google's or Amazon's servers you have to be able to administer them with some set of Google or Amazon credentials. Otherwise what would you do if sshd crashed?
  - balls187 11y ago
    > Otherwise what would you do if sshd crashed? Kill that instance, and spin up a new one. A wise BOFH gave a preso that stuck with me "Treat EC2 instances like cattle. When one strays off the farm, put a bullet in it's head." Don't treat your cloud machines as special snowflakes. Build infrastructure via script.
    - aianus 11y ago
      How does that add any security? Anyone with access to your root AWS credentials still has your IP addresses and your EBS volumes/snapshots and can do whatever they want.
      - 11y ago

punteney 11y ago

Another benefit is it's great for doing tutorials or to use when teaching a class. Instead of having to get all the tools and libraries installed locally on everyone's laptops people can just login to the console, fire up the shell and everyone will have the same base environment configured and ready to go.