Hybrid & Multicloud

Designing private network connectivity for RAG-capable gen AI apps

Mon, 02 Mar 2026 17:00:00 +0000

The flexibility of Google Cloud allows enterprises to build secure and reliable architecture for their AI workloads. In this blog we will look at a reference architecture for private connectivity for retrieval-augmented generation (RAG)-capable generative AI applications. This architecture is for scenarios where communications of the overall system must use private IP addresses and must not traverse the internet.

The power of RAG

RAG is a powerful technique used to optimize the output of large language models (LLMs) by grounding them in specific, authoritative knowledge bases outside of their original training data. RAG allows an application to retrieve relevant information from your documents, datasources, or databases in real time. This retrieved context is then provided to the model alongside the user’s query, helping to ensure that the AI’s responses are accurate, verifiable, and highly relevant to your business. This improves the quality of responses and reduces hallucinations.

This approach is helpful because it allows you to direct generative AI to use a designated source of truth, rather than relying solely on the model's pre-existing knowledge, and without needing to retrain or fine-tune the model itself.

Design pattern example

To understand how to think about setting up your network for private connectivity for a RAG application in a regional design, let's look at the design pattern.

The setup comprises an external network (on-prem and other clouds) and Google Cloud environments consisting of a routing project, a Shared VPC host project for RAG, and three specialized service projects: data ingestion, serving, and frontend.

This design utilizes the following services to provide an end-to-end solution:

Cloud Interconnect or Cloud VPN: To securely connect from your on-premises or other clouds to the routing VPC network
Network Connectivity Center: Used as an orchestration framework to manage connectivity between the routing VPC network and the RAG VPC network via VPC spokes and hybrid spokes
Cloud Router: In the routing project, facilitates dynamic BGP route exchange between the external network and Google Cloud
Private Service Connect: Provides a private endpoint in the routing VPC network to reach the Cloud Storage bucket for data ingestion without traversing the public internet
Shared VPC: Host project architecture that allows multiple service projects to use a common, centralized VPC network
Google Cloud Armor and Application Load Balancer: Placed in the frontend service project to provide security and traffic management for user interaction
VPC Service Controls: Creates a managed security perimeter around all resources to mitigate data exfiltration risks

The traffic flow

RAG population flow

In the diagram, the green dashed line shows the RAG population flow, which describes how data travels from data engineers to vector storage.

From the external network, data travels over Cloud Interconnect or Cloud VPN.
In the routing projects it uses the Private Service Connect endpoint to get to the Cloud Storage bucket.
From the Cloud Storage bucket in the Data Ingestion service project, the data ingestion subsystem processes the raw data.
The AI model creates vectors from the chunks, returns them to the data ingestion subsystem, which writes them to the RAG datastore in the serving service project.

Inference flow

In the diagram, the orange dashed line shows the inference flow, which describes customer or user requests.

The request travels over Cloud Interconnect or Cloud VPN to the routing VPC network and then over the VPC spoke to the RAG VPC network.
The request reaches the Application Load Balancer protected by Cloud Armor; once allowed, it passes it to the frontend subsystem.
The frontend subsystem forwards the request to the serving subsystem, which augments the prompt with data from the RAG datastore and generates a response via the AI model.
The system generates a response via the AI model, and the grounded response is returned along the same path to the requestor.

Management and routing

In the diagram, the blue dotted lines represent the Network Connectivity Center hybrid and VPC spokes that manage the control plane and route orchestration between the routing network and the RAG VPC network. This ensures that routes learned from the external network are appropriately propagated across the environment.

Please read the entire architecture document Private connectivity for RAG-capable generative AI applications to understand the specific including IAM permissions, VPC Service Controls, and deployment considerations.

Next steps

Take a deeper dive into the Cross-Cloud Network, and other guides about generative AI with RAG:

Document set: Generative AI with RAG
Document: Cross-Cloud Network for distributed applications
Blog: Build Your First ADK Agent Workforce

Want to ask a question, find out more or share a thought? Please connect with me on Linkedin.

Unlocking enterprise data to accelerate agentic AI: How Ab Initio does it

Wed, 18 Feb 2026 17:00:00 +0000

Your AI agents are only as good as the data behind them. For enterprise teams building agentic AI, that's both the opportunity and the core question: How do you give Gemini and other AI models access to accurate, well-documented data when that data lives across dozens of systems, from modern cloud services to legacy mainframes?

It's a question many organizations are actively working through. Gemini and other AI models depend on large volumes of AI-ready data to support agentic workflows.

Most enterprises now store data in many places: different cloud providers, on-premises servers, and legacy systems. Pulling together the data and metadata necessary for effective AI agents requires connecting all of it.

To address the data challenges of the AI era, Google Cloud and Ab Initio are announcing a suite of products, including new data connectors, metadata connectors, and agents. Taken together, these can help build agentic AI experiences that enable autonomous actions and accelerated human-in-the-loop decisions. Ab Initio’s data integration, governance, active metadata, and agentic AI capabilities integrate directly with Google Cloud platform, notably BigQuery, Dataplex Universal Catalog, and Gemini.

How Google's Data Cloud powers agentic AI

Google's Data Cloud is built to deliver the data and context needed to power agentic AI. BigQuery provides data storage within Google Cloud along with scalable analytics and processing. Dataplex organizes data and AI assets and metadata across Google Cloud, acting as your catalog for AI to provide a dynamic system of record delivering discoverability and essential business context, including definitions, constraints, and relationships, required for AI to reason and act at scale.

Many organizations, though, operate in multi-cloud environments where data is distributed. Even when external data is available, it might lack the metadata that describes its origin, reliability, and business meaning. The partnership with Ab Initio overcomes hurdles like these.

A unified hub for the hybrid enterprise

Ab Initio serves as a neutral hub that creates a multicloud enterprise data fabric. In particular, Ab Initio extends Dataplex with a bi-directional metadata exchange across more than 500 sources. That range matters — it covers everything from modern cloud services to legacy mainframes.

The integration provides field-level, end-to-end lineage from over 100 extractors, including native converters for technologies that are both contemporary and that have long, often complex legacy systems, like COBOL, DataStage, Informatica, and SAS.

For Google Cloud customers, Ab Initio federates data from across on-premise and multi-cloud environments into a single unified layer, enabling agentic applications.

Here's how the components work together:

Ab Initio unifies access to data and metadata across systems while providing lineage and transformation context. This lineage history allows you to travel back in time to any point and answer questions about the state of metadata, supporting auditability and compliance.
BigQuery stores data and executes large-scale analytics and modeling, including on external distributed data. This means your analytics can span data wherever it lives.
Dataplex Universal Catalog extends its automated governance foundation to deliver trusted semantic context required to ground AI agents and accelerate data insights. By integrating with the Ab Initio Metadata Hub, you can manage metadata across the entire multi-cloud environment.
Gemini consumes comprehensive data and metadata for grounded, explainable reasoning and agentic activity. The richer the context, the better the AI can reason about your data.

Figure 1. Ab Initio as the Hub for Hybrid and Multi Cloud Data and Metadata

Governance across the full data and AI lifecycle

In this model, data remains distributed and heterogeneous while metadata becomes unified and standardized. Ab Initio's architecture is proven in production in the world's largest enterprises.

Ab Initio comprehensively spans the full data engineering lifecycle: transformation, quality, lineage, governance, and orchestration all working together. This produces richer metadata that can support accurate and explainable Gemini reasoning.

Context as the foundation for agentic AI

Agentic AI requires trusted, AI-ready data and metadata. Understanding the origin, quality, and meaning of information matters as much as the data itself. Gemini serves as a key component of the agentic layer, using this context to make decisions that are explainable and auditable.

Ab Initio's integration with BigQuery, Dataplex, and Gemini helps create that understanding for multi-cloud enterprises. By using Ab Initio as a hub, you can deploy agents that work with distributed data while maintaining transparency and control. The hub supports explainability, compliance, and operational reliability.

Get started

As you expand your data capabilities and incorporate agentic AI into your workflows, maintaining connected context across data sources becomes essential. Ab Initio provides the data and context to enable Google Gemini agents to operate effectively across hybrid and multi-cloud environments.

To explore the integration, visit Ab Initio's Google Cloud partner page or contact your Google Cloud representative.

_{Ab Initio offers an agentic data platform for large-scale data processing and governance, trusted by the world's most demanding enterprises. It combines active metadata with transparent, high-performance data integration to support AI-driven analytics and automation — helping organizations modernize complex systems, reduce risk, and deliver trusted data products faster.}

Google Distributed Cloud brings public-cloud-like networking to air-gapped environments

Tue, 10 Feb 2026 17:00:00 +0000

Organizations in highly regulated industries often struggle to balance the rigid security of air-gapped environments with the need for the agility and flexibility that the cloud provides. To address this, Google Distributed Cloud (GDC) air-gapped 1.15 introduces new networking features in preview that give you more direct control and visibility without compromising your security posture, as well as a new IPAM feature in general availability that simplifies subnet management. These preview features are Cloud NAT, enhanced connectivity for standard clusters, and advanced HTTP and HTTPS health checks in load balancers. Together, they make it easier for you to manage complex workloads in a secure environment.

Manage outbound traffic with Cloud NAT

Cloud NAT for GDC air-gapped replaces previous egress solutions and gives you more control over how your instances communicate with other networks, on par with public cloud functionality. Cloud NAT provides several benefits:

Configurable egress IPs: You can assign and manage multiple egress IP addresses for your outbound traffic so you can identify exactly which workloads are communicating.
Customizable timeouts: Manage connection lifecycles by adjusting timeouts for different types of traffic.
Granular control: Administrators can create specific subnets for egress IPs, while application operators define how pods and VMs route their traffic.

Connect standard clusters directly to your organization

In a secure environment, isolation should not result in disconnected silos. With the latest release, standard clusters include networking updates that help you communicate across your organization while maintaining strict security boundaries, helping you manage your environment more effectively. The updates include:

Direct pod communication: Your standard cluster pods can now communicate directly with workloads in your organization’s Default VPC. This simplifies how you connect standard clusters and shared clusters.
Flexible firewall policies: You can use both Project Network Policy and Kubernetes Network Policy APIs to set granular rules for traffic entering and leaving your pods and nodes.
Managed load balancing: You can create internal and external load balancers using standard Kubernetes Service APIs, while GDC manages the underlying configuration for you.

Pods within a standard cluster can now connect to other pods directly or through a ClusterIP. While traffic to the Infra VPC remains blocked, you can send traffic to shared cluster workloads through GDC internal load balancers. This ensures your applications can reach necessary services quickly.

Improve reliability with Load Balancer HTTP and HTTPS health checks

Previously, L4 load balancing health checks only monitored basic TCP connectivity, only confirming if a port was open. GDC air-gapped load balancers now support HTTP and HTTPS health checks, which allow you to verify if an application is actually functioning correctly. By checking status codes and response content, you can:

Confirm application health: Verify that services are responding correctly, not just that the server is powered on.
Increase reliability: Automatically detect and route traffic away from applications experiencing internal errors.
Improve visibility: Access better data regarding the health of your VM-based workloads to manage performance before issues arise.

Make subnet management easier with subnet groups

Previously, a child subnet could only reference a single parent subnet. With the introduction of the subnet group, a child subnet can now reference a subnet group that may contain multiple parent subnets. This provides the following benefits:

Overcome the challenges of immutable subnet CIDR: While subnet CIDR range is immutable, subnet group simplifies scaling up IP resources by attaching a new subnet to a subnet group. You can reference a subnet group instead of a single parent subnet for easy scale-up.
Automatically identify a parent subnet: Now you can reference a subnet group as parent rather than as a single subnet. By using a subnet group in this way, you don't need to manually identify a parent subnet that has available IP resources: instead, GDC IPAM automatically finds a subnet in the subnet group with enough available IP space as its parent.
Start with smaller CIDRs for easier planning: Using subnet groups to scale IP resources also means that you can start with smaller and discontinuous CIDRs when creating new parent subnets, making IP resource utilization more efficient and the planning process easier.

Get started

To learn more about these features, please refer to our documentation or contact your Google Cloud account team.

AWS and Google Cloud collaborate to simplify multicloud networking

Sun, 30 Nov 2025 19:00:00 +0000

As organizations increasingly adopt multicloud architectures, the need for interoperability between cloud service providers has never been greater. Historically, however, connecting these environments has been a challenge, forcing customers to take a complex "do-it-yourself" approach to managing global multi-layered networks at scale.

To address these challenges and advance a more open cloud environment, Amazon Web Services (AWS) and Google Cloud collaborated to transform how cloud service providers could connect with one another in a simplified manner.

Today, AWS and Google Cloud are excited to announce a jointly engineered multicloud networking solution that uses both AWS Interconnect - multicloud and Google Cloud’s Cross-Cloud Interconnect. This collaboration also introduces a new open specification for network interoperability, enabling customers to establish private, high-speed connectivity between Google Cloud and AWS with high levels of automation and speed.

“Integrating Salesforce Data 360 with the broader IT landscape requires robust, private connectivity. AWS Interconnect - multicloud allows us to establish these critical bridges to Google Cloud with the same ease as deploying internal AWS resources, utilizing pre-built capacity pools and the tools our teams already know and love. This native, streamlined experience — from provisioning through ongoing support — accelerates our customers' ability to ground their AI and analytics in trusted data, regardless of where it resides.” - Jim Ostrognai, SVP Software Engineering, Salesforce

Previously, to connect cloud service providers, customers had to manually set up complex networking components including physical connections and equipment; this approach required lengthy lead times and coordinating with multiple internal and external teams. This could take weeks or even months. AWS had a vision for developing this capability as a unified specification that could be adopted by any cloud service provider, and collaborated with Google Cloud to bring it to market.

Now, this new solution reimagines multicloud connectivity by moving away from physical infrastructure management toward a managed, cloud-native experience. By integrating AWS with Google Cloud’s Cross-Cloud Network architecture, we are abstracting the complexity of physical connectivity, network addressing, and routing policies. Customers no longer need to wait weeks for circuit provisioning: they can now provision dedicated bandwidth on demand and establish connectivity in minutes through their preferred cloud console or API.

Reliability and security are the cornerstone of this collaboration. We have collaborated on this solution to deliver high resiliency by leveraging quad-redundancy across physically redundant interconnect facilities and routers. Both providers engage in continuous monitoring to proactively detect and resolve issues. And this solution is built on a foundation of trust, utilizing MACsec encryption between the Google Cloud and AWS edge routers.

“This collaboration between AWS and Google Cloud represents a fundamental shift in multicloud connectivity. By defining and publishing a standard that removes the complexity of any physical components for customers, with high availability and security fused into that standard, customers no longer need to worry about any heavy lifting to create their desired connectivity. When they need multicloud connectivity, it's ready to activate in minutes with a simple point and click.” - Robert Kennedy, VP of Network Services, AWS

“We are excited about this collaboration which enables our customers to move their data and applications between clouds with simplified global connectivity and enhanced operational effectiveness. Today's announcement further delivers on Google Cloud’s Cross-Cloud Network solution focused on delivering an open and unified multicloud experience for customers.” - Rob Enns, VP/GM of Cloud Networking, Google Cloud

This collaboration between AWS and Google Cloud is more than a multicloud solution: it’s a step toward a more open cloud environment. The API specifications developed for this product are open for other providers and partners to adopt, as we aim to simplify global connectivity for everyone. We invite you to explore this new capability today. To learn more about how to streamline your multicloud operations please visit the in-depth Google Cloud Cross-Cloud Interconnect blog and the AWS Interconnect - multicloud website to get started.

Expanding Google Cloud’s Cross-Cloud Network with a groundbreaking AWS collaboration

Sun, 30 Nov 2025 19:00:00 +0000

Today, we announced a significant collaboration with Amazon Web Services (AWS) to offer a managed, private and secure, on-demand, solution for cross-cloud connectivity. This solution is designed to enable customers to easily build enterprise-grade applications that span both Google Cloud and AWS environments. This collaboration is particularly timely, as the adoption of multicloud applications is rapidly accelerating, driven in part by the rise of AI. A Forbes survey highlighted that 82% of respondents anticipate that the arrival of AI services will increase the demand for multicloud networking due to the scarcity of specialized accelerator resources and the availability of diverse AI agents across different vendors. The surge in multicloud adoption is a strategic imperative for organizations looking to build agentic AI applications, optimize workloads, access best-of-breed services, meet data residency requirements, and ensure the necessary resiliency for modern hybrid and multicloud applications.

To address the inherent network infrastructure challenges introduced by multicloud deployments, we designed the Cross-Cloud Network to simplify and optimize networking between Google Cloud and other providers.This commitment to multicloud integration has led to over 50% of the Fortune 500 currently using the Cross-Cloud Network, and this collaboration provides a significant boost. Importantly, this new jointly engineered solution with AWS is being published under an open specification, creating an opportunity to expand the reach, allowing other providers to contribute and implement this solution in their own environments, further benefiting mutual customers.

Introducing the Cross-Cloud Interconnect for AWS

Today marks a major step in simplifying and securing the multicloud journey. We are thrilled to announce a first of its kind open specification that fundamentally streamlines private network connections between customers' environments across different cloud providers. This groundbreaking joint specification has culminated in the preview of partner Cross-Cloud Interconnect for AWS, a powerful expansion of our Cloud Interconnect portfolio. This innovation allows you to build on-demand connections in minutes between your Google Cloud and AWS VPCs, transforming multicloud networking from a complex build into a simple, managed service.

This is more than just a connection — it's a complete shift in how you adopt multicloud solutions. We are delivering substantial value to our mutual customers:

Simplicity and speed: Say goodbye to complex networking builds. This is a fully managed, cloud-native experience where a cross-cloud connection is as easy as peering two VPCs. We're cutting end-to-end setup time from days to mere minutes, with flexible, on-demand bandwidth starting at 1 Gbps during preview and scaling up to 100 Gbps at general availability.
Secure by default: Your data's security is paramount. All connections between the two clouds' edge routers are MACsec-encrypted — providing line-rate performance with always-on encryption — for a more secure foundation.
Inherently resilient: Benefit from an inherently resilient architecture that provides layers of protection against facility, network, and software failures, ensuring your critical applications remain online.
Open and optimized: The foundation is an open specification for seamless adoption across the industry. You can also benefit from an optimized total cost of ownership through vendor consolidation and an on-demand service model that lets you provision exactly what you need, when you need it.

This service is launching with availability in key locations like N. Virginia, Oregon, London, and Frankfurt, with rapid expansion planned to more locations globally.

Simplifying cross-cloud connectivity

Before today's jointly engineered solution, building applications that spanned multiple cloud environments was a significant undertaking, often becoming a barrier to multicloud adoption. Customers faced a complex, multi-layered process that involved cross-functional teams and substantial lead times.

A typical deployment required several intricate steps:

Procurement: Acquiring physical connections, whether dedicated or through a shared partner offering, and then building and managing the necessary infrastructure to ensure network availability and separation of fate.
Logical configuration: Establishing basic connectivity by meticulously assigning and negotiating non-overlapping link-local IP addresses and setting up VLANs.
Routing setup: Configuring BGP sessions, assigning Autonomous System (AS) numbers, and creating complex routing policies to meet specific performance and reliability requirements.
Security implementation: Conducting thorough security reviews and implementing custom solutions to encrypt traffic between the distinct cloud environments.

The integrated partner Cross-Cloud Interconnect offering completely abstracts away this complexity. Customers can now bypass all the manual steps and instantly leverage pre-built physical connections with built-in security and resiliency, achieving streamlined, on-demand connectivity between their Google Cloud VPCs and AWS.

Building this powerful cross-cloud connection is now remarkably simple. Customers configure a single "transport" resource in Google Cloud and accept it in AWS. This transport is an innovative, managed construct that completely abstracts and provisions the underlying physical interconnects, VLAN attachments, and Cloud Router instances. This profound simplification enables end-to-end connectivity in minutes, transforming multicloud deployment from a days-long engineering project into a simple, rapid configuration task.

Under the hood: a secure and resilient foundation

We co-designed our solution to deliver a secure and resilient foundation for cross-cloud applications, with a simple new service that doesn’t compromise on core enterprise availability tenets.

Privacy and security: All peering relationships are built between link local addresses, facilitating connectivity between IPv4 and IPv6 private address spaces across both environments. All underlying physical connections between Google Cloud and AWS edge routers are MACsec-encrypted, and both providers manage key rotation to meet enterprise security requirements.
Quad-redundancy: To enable connectivity between a Google Cloud and an AWS cloud region, quad-redundant connections are leveraged, ensuring facility redundancy, as well as edge-router redundancy. This design helps protect from multiple simultaneous failure scenarios and provides high resiliency levels for joint customers.
Managed operations are key to enabling integrated solutions. The newly introduced solution not only streamlines the physical and logical builds on behalf of joint customers, it also leverages a robust underlying proactive monitoring system that detects and reacts to failures before customers suffer from their consequences. The system relies on coordinated maintenance to avoid overlaps that may impact end-to-end service availability, and streamlines support operations to address potential issues on behalf of customers.

A variety of multicloud workloads

These new streamlined network connections between Google Cloud and AWS enable application teams to automate network builds for a variety of interesting applications. Consider the following scenarios:

Infrastructure and AI deployments supporting active-active or active-standby disaster recovery strategies. With basic connectivity between two peer services — e.g., agentic AI applications or database replicas — applications can synchronize state across the cloud boundary as if they are co-located, supporting maximum application resilience and operational consistency.
AWS customers issuing inbound requests into Google Cloud to allow a service running in AWS to securely and privately access a Google Cloud API. Examples include custom applications running on Compute Engine or a critical data warehouse hosted in BigQuery that bypasses the public internet for enhanced security and performance.
Google Cloud customers issuing outbound requests towards AWS, where a data pipeline orchestrating in Google Cloud can privately pull large datasets from an AWS datastore like S3 or an RDS instance.

Build applications across Google Cloud and AWS today

Regardless of your use case, if your organization would benefit from simple, secure, and robust on-demand connectivity between your Google Cloud and AWS environments, we invite you to start building your applications across clouds and let us manage your network connectivity infrastructure for you.

This collaboration is not restricted to Google Cloud and AWS. We invite other cloud and service providers to offer their customers this streamlined private peering capability with Google Cloud. To learn more, check out the open specification, and contact us at cross-cloud@google.com. We are truly excited to grow this ecosystem for the benefit of our joint customers.

Run Gemini anywhere, including on-premises, with Google Distributed Cloud

Thu, 28 Aug 2025 05:00:00 +0000

Earlier this year, we announced our commitment to bring Gemini to on-premises environments with Google Distributed Cloud (GDC). Today, we are excited to announce that Gemini on GDC is now available to customers.

For years, enterprises and governments with the strictest data security and sovereignty requirements have faced a difficult choice: adopt modern AI or protect their data. Today, that compromise ends. We are announcing the general availability of Gemini on GDC air-gapped and preview of Gemini on GDC connected, bringing Google's most advanced models directly into your data center.

We are inspired by initial feedback from customers, including Singapore’s Centre for Strategic Infocomm Technologies (CSIT), Government Technology Agency of Singapore (GovTech Singapore), Home Team Science and Technology Agency (HTX), KDDI, and Liquid C2, who are excited to gain the advantages of generative AI with Gemini on GDC.

Transformative AI capabilities, on-premises

Gemini models offer groundbreaking capabilities, from processing extensive context to native multimodal understanding of text, images, audio, and video. This unlocks a wide array of high-impact use cases on secure infrastructure:

Unlock new markets and global collaboration: Instantly break down language barriers across your international operations, creating a more connected and efficient global workforce.
Accelerate decision-making: Make faster, data-driven decisions by using AI to automatically summarize documents, analyze sentiment, and extract insights from your proprietary datasets.
Improve employee efficiency and customer satisfaction: Deliver instant, 24/7 support and enhance user satisfaction by developing intelligent chatbots and virtual assistants for customers and employees.
Increase development velocity: Ship higher-quality software faster by using Gemini for automated code generation, intelligent code completion, and proactive bug detection.
Strengthen safety & compliance: Protect your users with AI-powered safety tools that automatically filter harmful content and ensure adherence to industry policies.

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7fd9b3bf52b0>), ('btn_text', ''), ('href', ''), ('image', None)])]>

Secure AI infrastructure where you need it

It takes more than just a model to drive business value with generative AI; you need a complete platform that includes scalable AI infrastructure, a library with the latest foundational models, high-performance inferencing services, and pre-built AI agents like Agentspace search. GDC provides all that and more with an end-to-end AI stack combining our latest-generation AI infrastructure with the power of Gemini models to accelerate and enhance all your AI workloads.

Delivering these transformative capabilities securely requires a complete, end-to-end platform that only Google is providing today :

Performance at scale: GDC utilizes the latest NVIDIA GPU accelerators, including the NVIDIA Hopper and Blackwell GPUs. A fully managed Gemini endpoint is available within a customer or partner data center, featuring a seamless, zero-touch update experience. High performance and availability are maintained through automatic load balancing and auto-scaling of the Gemini endpoint, which is handled by our L7 load balancer and advanced fleet management capabilities.
Foundation of security and control: Security is a core component of our solution, with audit logging and access control capabilities that provide full transparency for customers. This allows them to monitor all data traffic in and out of their on-premises AI environment and meet strict compliance requirements. The platform also features Confidential Computing support for both CPUs (with Intel TDX) and GPUs (with NVIDIA's confidential computing) to secure sensitive data and prevent tampering or exfiltration.
Flexibility and speed for your AI strategy: the platform supports a variety of industry-leading models including Gemini 2.5 Flash and Pro, Vertex AI task-specific models (translation, optical character recognition, speech-to-text, and embeddings generation), and Google’s open-source Gemma models. GDC also provides managed VM shapes (A3 & A4 VMs) and Kubernetes clusters giving customers the ability to deploy any open-source or custom AI model, and custom AI workloads of their choice. This is complemented by Vertex AI services that provide an end-to-end AI platform including a managed serving engine, data connectors, and pre-built agents like Agentspace search (in preview) for a unified search experience across on-premises data.

What our customers are saying

“As a key GDC collaboration partner in shaping the GDC air-gapped product roadmap and validating the deployment solutions, we’re delighted that this pioneering role has helped us grow our cutting-edge capabilities and establish a proven deployment blueprint that will benefit other agencies with similar requirements. This is only possible with the deep, strategic collaboration between CSIT and Google Cloud. We’re also excited about the availability of Gemini on GDC, and we look forward to building on our partnership to develop and deploy agentic AI applications for our national security mission.” - Loh Chee Kin, Deputy Chief Executive, Centre for Strategic Infocomm Technologies (CSIT)

“One of our priorities is to harness the potential of AI while ensuring that our systems and the services citizens and businesses rely on remain secure. Google Cloud has demonstrated a strong commitment to supporting the public sector with initiatives that enable the agile and responsible adoption of AI. We look forward to working more closely with Google Cloud to deliver technology for the public good.” - Goh Wei Boon, Chief Executive, Government Technology Agency of Singapore

“The ability to deploy Gemini on Google Distributed Cloud will allow us to bridge the gap between our on-premises data and the latest advancements in AI. Google Distributed Cloud gives us a secure, managed platform to innovate with AI, without compromising our strict data residency and compliance requirements.” - Ang Chee Wee, Chief AI Officer, Home Team Science & Technology Agency (HTX)

“The partnership with Google Cloud and the integration of Google's leading Gemini models will bring cutting-edge AI capabilities, meet specific performance requirements, address data locality and regulatory needs of Japanese businesses and consumers.” - Toru Maruta, Executive Officer, Head of Advancing Business Platform Division, KDDI

"Data security and sovereignty are paramount for our customers. With Gemini on Google Distributed Cloud, our Liquid Cloud and Cyber Security solution would deliver strategic value to ensure our customers in highly regulated industries can harness the power of AI while keeping their most valuable data under their control." - Oswald Jumira, CEO Liquid C2

Gemini everywhere is here

The era of on-premises AI without compromise is here. To bring the power of Gemini to your on-premises environment, request a strategy session with our experts.

Powering public sector innovation: New networking features in GDC air-gapped

Wed, 02 Jul 2025 16:00:00 +0000

For organizations with stringent sovereignty and regulatory requirements, Google Distributed Cloud (GDC) air-gapped delivers a fully-managed experience with critical advanced networking capabilities. But operating in a completely isolated environment presents some unique networking challenges. Routine tasks become significantly more complex and manual, demanding more planning and bespoke solutions than on a connected network.

Today, we're helping to solve these challenges with three major advancements in networking for GDC air-gapped: native IP address management (IPAM), multi-zone load balancing, and workload-level firewall policies — all powerful new capabilities designed to give you more control over your air-gapped environment.

Let’s take a look at these new capabilities.

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7fd9ac056bb0>), ('btn_text', 'Get started for free'), ('href', 'https://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', None)])]>

Streamlined IP management for GDC

With GDC IP address management, you can now plan, track, and monitor IP addresses for all your workloads and infrastructure. IPAM for GDC is a valuable tool, since many air-gapped deployments consume IP addresses from your organization's existing private IP address space, which can be difficult to manage, not very scalable, lacking in security, and finite. IPAM for GDC provides the following capabilities:

Automated and streamlined IP management: Minimize manual errors and speed up deployments with capabilities that include Per-Org BYO-External IP and Internal-only VPC subnets.
Scalable IP management: Expand your network for Day-2 IP growth, free from duplicate IP address conflicts, and with support for non-contiguous subnets.
Enhanced security and compliance: Strengthen your posture and meet strict compliance requirements with robust IPAM controls, including subnet delegation and private IPs for zonal infrastructure.
Optimized IP resource utilization: Reduce IP sprawl and maximize your finite IP resources.

IPAM for GDC provides the intelligent automation and centralized oversight essential for managing your complete IP lifecycle in secure, air-gapped environments, helping to ensure both operational excellence and adherence to critical regulations.

High availability with multi-zone load balancers

For critical applications, downtime is not an option. Now, you can help your workloads remain resilient and accessible, even in the event of a zone failure.

Our new multi-zone load balancing capability allows you to distribute traffic across multiple availability zones within your GDC environment. Both internal and external load balancers now support this multi-zone functionality, simplifying operations while maximizing uptime. This provides:

Continuous availability: Applications remain accessible even during a complete zone failure.
Operational simplification: There’s a single Anycast IP address for the application (regardless of where backends are located).
Optimized performance: Traffic is routed to the nearest available instance based on network topology and routing metrics.

The load balancing system operates by creating load balancer (LB) objects, which are then handled by new LB API controllers. These controllers manage object conditions, including cross-references and virtual IP address (VIP) auto-reservations, and create Kubernetes services across all clusters.

Workload-level network firewall policies

To secure an environment, you need to control traffic not just at the edge, but between every component inside. That's why we're launching workload-level firewall policies as part of the GDC air-gapped product. This feature provides fine-grained control over communication between individual workloads, such as VMs and pods, within a project. This feature helps:

Strengthen your security posture: Isolate workloads and limit communication between them.
Easily apply policies: Define and apply policies to specific workloads or groups of workloads.
Meet regulatory standards: Help adhere to regulatory requirements and internal standards.

GDC air-gapped implements default base network policies to create a secure architecture. In order to allow intra-project or cross-project traffic at the workload level, you can update these default policies as you wish. Policies are multi-zone by default. This means they affect all zones where your labeled workloads are present. You can enforce policies at the workload level using labels and workload selectors.

A new era of network control

These new capabilities — GDC IPAM, multi-zone load balancing, and workload-level firewall policies — represent a significant step forward in providing a robust, resilient, and secure networking experience for the air-gapped cloud. They work together to simplify your operations, strengthen your security posture, and empower you to run your most sensitive applications with confidence.

To learn more about these features, please refer to our documentation or contact your Google Cloud account team.

Simplify your multi-cloud strategy with Cloud Location Finder, now in preview

Mon, 16 Jun 2025 16:00:00 +0000

As cloud environments expand beyond traditional architectures to include multiple clouds, managing your infrastructure effectively becomes more complex. Imagine easily accessing consistent and up-to-date location information across different cloud providers, so your multi-cloud applications are designed and optimized with performance, security, and regulatory compliance in mind.

Today, we are making this a reality with Cloud Location Finder, a new Google Cloud service which provides up-to-date location data across Google Cloud, Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI). Now, you can strategically deploy workloads across different cloud providers with confidence and control.

aside_block: <ListValue: [StructValue([('title', '$300 in free credit to try Google Cloud infrastructure'), ('body', <wagtail.rich_text.RichText object at 0x7fd9b2292820>), ('btn_text', 'Start building for free'), ('href', 'http://console.cloud.google.com/freetrial?redirectPath=/compute'), ('image', None)])]>

Why use Cloud Location Finder?

Unified location data: Cloud Location Finder makes it easy for you to access the latest location information, providing a single source of truth for cloud location data for Google Cloud, AWS, Azure, and OCI.
Rich location attributes: Data includes public cloud region and zone information, and location metadata like proximity¹, territory code, and carbon footprint.
Up-to-date information: Cloud Location Finder provides 24-hour data freshness for active regions, removing outdated information promptly when locations are turned down. This eliminates inconsistencies from hard-coded lists and ensures your information is current without manual monitoring.
Programmatically accessible: Especially for organizations with diverse cloud and location requirements, Cloud Location Finder eliminates the need to manually manage and choose new locations. And because it is an API, it is easy to integrate into your applications.

How can Cloud Location Finder help you?

Whether you're a partner or customer, a Cloud Architect or application developer designing a hybrid setup or a platform admin ensuring governance, Cloud Location Finder offers valuable insights:

Optimize deployments: Easily identify the nearest Google Cloud region or zone to an existing AWS/Azure/OCI deployment, to help you optimize your multi-cloud application for performance and latency.
Meet sustainability goals: As your business grows, choose nearby cloud locations that are also sustainable.
Help ensure compliance: Find a list of regions and zones in a specified territory to help you ensure compliant log storage or data processing across multiple clouds.
Improve reliability: Rely on a consistent source of truth for location data, which can be integrated directly into your applications.

Getting started

Cloud Location Finder is accessible via REST APIs and gcloud CLI, and available at no cost. You can easily list locations, get specific location details, find nearby locations, and filter these based on criteria such as cloud provider, location type, territory, or carbon footprint.

Ready to streamline your multi-cloud location strategy? Explore the Cloud Location Finder documentation to learn more and start building with consistent, accurate location data today!

^{1. Currently, for GCP regions only}

Emulating the air-gapped experience: GDC Sandbox is now generally available

Tue, 03 Jun 2025 16:00:00 +0000

Many organizations in regulated industries and the public sector that want to start using generative AI face significant challenges in adopting cloud-based AI solutions due to stringent regulatory mandates, sovereignty requirements, the need for low-latency processing, and the sheer scale of their on-premises data. Together, these can all present institutional blockers to AI adoption, and force difficult choices between using advanced AI capabilities and adhering to operational and compliance frameworks.

We are announcing Google Distributed Cloud (GDC) Sandbox - AI Optimized, which offers a virtualized platform that mirrors the GDC air-gapped racks and appliance experience, allowing developers to innovate on new apps with gen AI capabilities, and it is now generally available.

GDC Sandbox can help organizations harness Google's gen AI technologies while maintaining control over data, meeting rigorous regulatory obligations, and unlocking a new era of on-premises AI-driven innovation. With flexible deployment models, a robust security architecture, and transformative AI applications like Google Agentspace search, GDC Sandbox enables organizations to accelerate innovation, enhance security, and realize the full potential of AI.

Secure development in isolated environments

For sovereign entities and regulated industries, a secure Zero Trust architecture via platforms like GDC Sandbox is a prerequisite for leveraging advanced AI. GDC Sandbox lets organizations implement powerful use cases — from agentic automation and secure data analysis to compliant interactions — while upholding sovereign Zero Trust mandates for security and compliance.

"GDC Sandbox provides Elastic with a unique opportunity to enable air-gapped gen AI app development with Elasticsearch, as well as enable customers to rapidly deploy our Security Incident & Event Management (SIEM) capabilities.” - Ken Exner, Chief Product Officer, Elastic

“Accenture is excited to offer Google Distributed Cloud air-gapped to customers worldwide as a unique solution for highly secure workloads. By using GDC Sandbox, an emulator for air-gapped workloads, we can expedite technical reviews, enabling end-customers to see their workloads running in GDC without the need for lengthy proofs of concept on dedicated hardware.” - Praveen Gorur, Managing Director, Accenture

Air-gapped environments are challenging

Public sector agencies, financial institutions, and other organizations that handle sensitive, secret, and top-secret data are intentionally isolated (air-gapped) from the public internet to enhance security. This physical separation prevents cyberattacks and unauthorized data access from external networks, helping to create a secure environment for critical operations and highly confidential information. However, this isolation significantly hinders the development and testing of cutting-edge technologies. Traditional air-gapped development often requires complex hardware setups, lengthy procurement cycles, and limits access to the latest tools and frameworks. These limitations hinder the rapid iteration cycles essential to development.

Video Analysis Application Built on GDC Sandbox

According to Gartner® analyst Michael Brown in the recent report U.S. Federal Government Context: Magic Quadrant for Strategic Cloud Platform Services, where Google Cloud is evaluated as a Notable Vendor, “Federal CIOs will need to consider cost and feature availability in selecting a GCC [government community cloud] provider. Careful review of available services within the compliance scope is necessary. A common pitfall is the use of commercially available services in early solution development and subsequently finding that some of those services are not available in the target government community environment. This creates technical debt requiring refactoring, which results in delays and additional expense.”

GDC Sandbox: A virtualized air-gapped environment

GDC Sandbox addresses these challenges head-on. This virtual environment emulates the experience of GDC air-gapped, allowing you to build, test, and deploy gen AI applications using popular development tools and CI/CD pipelines. With it, you don’t need to procure hardware or set up air-gapped infrastructure to test applications with stringent security requirements before moving them to production. Customers can leverage Vertex AI APIs for key integrations with GDC Sandbox - AI Optimized including:

Google AI Studio: Access Vertex APIs
Optical character recognition (OCR): Extract text from images and documents
Speech-to-text: Convert spoken language into written text
Translation: Break down language barriers for multilingual applications
Containerized model hosting: Deploy and manage custom gen AI models within containers
GPUs: Dedicate user-space GPUs for gen AI development

Interacting with GDC Sandbox

One of the things that sets GDC Sandbox apart is its consistent user interface. As seen above, developers familiar with Google Cloud will find themselves in a comfortable and familiar environment, which helps streamline the development process and reduces the learning curve. This means you can jump right into building and testing your gen AI applications without missing a beat.

“GDC Sandbox has proven to be an invaluable tool to develop and test our solutions for highly regulated customers who are looking to bring their air-gapped infrastructures into the cloud age.” - David Olivier, Defense and Homeland Security Director, Sopra Steria Group

"GDC Sandbox provides a secure playground for public sector customers and other regulated industries to prototype and test how Google Cloud and AI can solve their unique challenges. By ensuring consistency with other forms of compute, we simplify development and deployment, making it easier for our customers to bring their ideas to life. We're excited to see how our customers use the GDC Sandbox to push the boundaries of what's possible." - Will Grannis, VP & CTO, Google Cloud

The GDC Sandbox architecture and experience

GDC Sandbox offers developers a familiar and intuitive environment by mirroring the API, UI, and CLI experience of GDC air-gapped and GDC air-gapped appliance. It offers a comprehensive suite of services, including virtual machines, Kubernetes clusters, storage, observability, and identity management. This allows developers to build and deploy a wide range of gen AI applications, and leverage the power of Google's AI and machine learning expertise within a secure, dedicated environment.

GDC Sandbox - Product Architecture

Use cases for GDC Sandbox

GDC Sandbox offers numerous benefits for organizations with air-gapped environments. Let's explore some compelling use cases:

Gen AI development: Develop and test Vertex and gen AI applications via GPUs to cost-effectively validate them in secure production environments.
Partner enablement: Empower partners to build applications, host GDC Marketplace offerings, train personnel, and prepare services for production.
Training and proof of concepts: Provide hands-on training for developers and engineers on GDC air-gapped technologies and best practices. Deliver ground-breaking new capabilities and showcase the art of the possible for customers and partners.

Building applications in GDC Sandbox

GDC Sandbox leverages containers and Kubernetes to host your applications. To get your application up and running, follow these steps:

Build and push: Build your application image locally using Docker and ensure your Dockerfile includes all necessary dependencies. Tag your image in your source repository then sync with the Harbor instance URI and push it to the provided Harbor repository.
Deploy with Kubernetes: Create a Kubernetes deployment YAML file that defines your application's specifications, including the Harbor image URI and the necessary credentials to access the image. Apply this file using the kubectl command-line tool to deploy your application to the Kubernetes cluster within the Sandbox.
Expose and access: Create a Kubernetes service to expose your application within the air-gap. Retrieve the service's external IP using kubectl get svc to access your application.
Migrate and port: Move your solutions from GDC Sandbox to GDC air-gapped and appliance deployments.

Ready to try GDC Sandbox?

Watch our on-demand video and getting started demo to learn more about GDC Sandbox capabilities and benefits. If you would like to discuss how to get access to GDC Sandbox please complete this form, and a member of our team will be in touch.

^{U.S. Federal Government Context: Magic Quadrant for Strategic Cloud Platform Services, By Michael Brown, 3 February 2025}

^{GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.}

Advancing sovereignty, choice, and security in the cloud for our customers

Wed, 21 May 2025 08:00:00 +0000

Like most organizations, Google Cloud is continually engaging with customers, partners, and policymakers to deliver technology capabilities that reflect their needs. When it comes to digital sovereignty solutions, Google Cloud has worked with customers for nearly a decade.

Today, we’re pleased to announce significant technical and commercial updates on our sovereign cloud solutions for customers, and details on how we’re helping them achieve greater control, choice, and security in the cloud — without compromising functionality.

Building on the first sovereign solutions we introduced years ago, we’ve massively scaled our infrastructure footprint globally, now consisting of more than 42 cloud regions, 127 zones, 202 network edge locations, and 33 subsea cable investments.

We have also forged key partnerships in Asia, Europe, the Middle East, and the United States to help deliver these sovereign solutions, including Schwarz Group and T-Systems (Germany), S3NS (France), Minsait (Spain), Telecom Italia (Italy), Clarence (Belgium and Luxembourg), CNTXT (Saudi Arabia), KDDI (Japan), and World Wide Technology (United States).

A commitment to customer choice

Digital sovereignty is about more than just controlling encryption keys. At its core, it’s about giving customers the flexibility their global businesses require. It’s about enabling them to operate on multiple clouds. And it’s about securing data with the most advanced technologies.

We’ve long been committed to enabling customers to choose the cloud provider and solution that best fit their needs, and not locking them into a single option. Sovereignty in the cloud is not one-size-fits-all. We offer customers a portfolio of solutions that align with their business needs, regulatory requirements, and risk profiles.

Our strong contractual commitments to our customers are backed by robust sovereign controls and solutions that are all available today. Our updated sovereign cloud solution portfolio includes:

Google Cloud Data Boundary gives customers the ability to deploy a sovereign data boundary and control where their content is stored and processed. This boundary also allows customers to store and manage their encryption keys outside Google’s infrastructure, which can help customers meet their specific data access and control requirements no matter what market.

Google Cloud Data Boundary customers have access to a large set of Google Cloud products, including AI services, and can enable capabilities, including Confidential Computing and External Key Management with Key Access Justifications to control access to their data and deny access for any reason.

In addition, Google Workspace customers can take advantage of Google Cloud Data Boundary’s sovereign controls to limit the processing of their content to the United States or EU, choose a country to locally store data, and use client-side encryption to prevent unauthorized access (even by Google) to their most critical content.

Today, we are also announcing User Data Shield, a solution that adds Mandiant services to validate the security of customer applications built on top of Google Cloud Data Boundary. User Data Shield provides recurring security testing of customer applications to validate sovereignty postures.

Google Cloud Dedicated delivers a solution designed to meet local sovereignty requirements, enabled by independent local and regional partners. As an example, Google Cloud has partnered with Thales since 2021 to build a first-of-its-kind Trusted Cloud by S3NS for Europe.

This offering with Thales is designed to offer a rich set of Google Cloud services with GPUs to support AI workloads and is operated by S3NS, a standalone French entity. Currently in preview, S3NS’ solution is designed to meet the rigorous security and operational resilience requirements of France’s SecNumCloud standards. We are expanding our Google Cloud Dedicated footprint globally, launching next in Germany.

“For France to truly embrace digital sovereignty, it is essential to have a cloud solution that marries the immense power of hyperscale technology with the strictest local security and operational controls. S3NS is committed to providing French organizations with access to advanced cloud services, including critical AI capabilities, all operated within France by a European operator to meet and exceed the rigorous SecNumCloud standards,” said Christophe Salomon, EVP, Information Systems and Secured Communication, at Thales.

Google Cloud Air-Gapped offers a fully standalone and air-gapped solution that does not require connectivity to an external network. This solution is tailored for customers in the intelligence, defense, and other sectors with strict data security and residency requirements. The air-gapped solution can be deployed and operated by Google, the customer, or a Google partner.

It is built with open-source components and comes with a targeted set of AI, database, and infrastructure services. Because air-gapped solutions run on open-source components, they are designed to provide business continuity and survivability in the event of service disruptions. Google Cloud Air-Gapped received authorization in 2024 to host U.S. government Top Secret and Secret-level data.

“Working with Google Cloud to introduce sovereign offerings can give our joint clients greater control, choice, and security in the cloud, without compromising the functionality of their underlying cloud architectures,” said Scott Alfieri, Senior Managing Director and Google Business Group Lead at Accenture. “Google Cloud's extensive global infrastructure, coupled with Accenture’s transformation and industry expertise, helps organizations build an agile and scalable foundation, unlocking opportunities for growth and continuous innovation.”

Local control, global security

Security and sovereignty are two sides of the same coin. Local control of data and operations can provide customers a greater level of confidence in their security, but it’s also true that no organization can be considered sovereign if dependencies on legacy infrastructure leave its data vulnerable to loss or theft.

Analysis from the Google Threat Intelligence Group and Google Cloud’s Office of the CISO suggests that the global cyber threat landscape will only become more complex as malicious actors tap into AI-powered tools and techniques to prey on older software products, platforms, and outdated infrastructures.

With Google Cloud, customers not only get sovereign solutions, but also gain access to our leading security capabilities. This includes our rigorous focus on secure by design technology and deep expertise from Google Threat Intelligence Group and Mandiant Consulting, who operate on the frontlines of cyber conflicts worldwide and maintain trusted partnerships with more than 80 governments around the world.

In addition, Google Cloud CyberShield provides AI and intelligence-driven cyber defense to help governments defend against threats at national scale. And Mandiant Managed Defense services make it easy for customers worldwide to extend their security teams with our security team.

Google Sovereign Cloud solutions ultimately enable customers to leverage the secure foundation of Google Cloud, while gaining access to advanced security features — such as Confidential Computing, Zero Trust, post-quantum cryptography, and AI-powered platform defenses — faster and more cost-effectively than they could achieve on their own.

Sovereign solutions for any organization

We remain dedicated to fostering an environment of trust and control for our customers, empowering organizations globally to navigate the complex landscape of digital sovereignty with confidence. We continue to work with customers, partners, and policymakers around the world to refine our sovereign cloud offerings and deliver technologies that address their needs.

To learn more about how we are enabling our customers’ digital sovereignty capabilities, visit our web page or contact your account manager.

Bringing Gemini and Google Agentspace to you on-premises

Wed, 09 Apr 2025 12:00:00 +0000

Today we are announcing that Gemini will be available on Google Distributed Cloud (GDC), bringing Google’s most capable models to on-premises environments, with public preview starting in Q3 2025. To do so, we’ve partnered with NVIDIA to bring our Gemini models to NVIDIA Blackwell systems that you can purchase through Google or your preferred channels.

GDC is a fully managed on-prem and edge cloud solution that is offered in both connected and air-gapped options, scaling from a single server to hundreds of racks. It offers infrastructure-as-a-service, security, data, and AI services, and is extensible with a rich ISV ecosystem. GDC takes care of infrastructure management, making it easy for your developers to focus on leveraging the best that AI has to offer and build applications, assistants, and agents.

“NVIDIA and Google Distributed Cloud provide a secure AI platform, bringing Gemini models to enterprise datacenters and regulated industries. With NVIDIA Blackwell infrastructure and confidential computing, Google Distributed Cloud enhances privacy and security, and delivers industry-leading performance on DGX B200 and HGX B200 systems, available from Dell.” – Justin Boitano, VP, Enterprise AI Software, NVIDIA.

Historically, organizations that face strict regulatory, sovereignty, latency, or data volume issues have been unable to access the latest AI technology since they must keep their data on-premises. Their only options have been open-source models and tools. And, in most cases, they have to put together the software and hardware themselves, which increases operational burden and complexity. With Gemini on GDC, you don’t have to compromise between the best of AI and the need to keep your data on-premises.

Our GDC air-gapped product, which is now authorized for US Government Secret and Top Secret missions, and on which Gemini is available, provides the highest levels of security and compliance.

aside_block: <ListValue: [StructValue([('title', '$300 in free credit to try Google Cloud AI and ML'), ('body', <wagtail.rich_text.RichText object at 0x7fd9b43a5e50>), ('btn_text', 'Start building for free'), ('href', 'http://console.cloud.google.com/freetrial?redirectPath=/vertex-ai/'), ('image', None)])]>

Gemini on GDC: unlocking generative AI anywhere

Gemini models deliver breakthrough AI performance: they can analyze million-token contexts; are multimodal, i.e., can process diverse data formats such as text, image, audio and video; and operate globally across 100+ languages.

Further, the Gemini API offers AI inferencing without having to worry about infrastructure, OS management, or model lifecycle management. This enables you to:

Add your own business context: Use Retrieval Augment Generation (RAG) to personalize and augment the AI model’s output, eliminating the need for fine tuning or retraining the models.
Automate information processing and knowledge extraction: Improve employee efficiency by using gen AI to quickly summarize long documents, analyze sentiment in reports or feedback, or add captions to image, audio, and video content.
Create interactive conversational experiences: Build deeper customer relationships by enabling Gemini-powered customer support agents, chatbots via natural language, and employee assistants.
Tailor agents for your industry’s use case: Unlock highly specialized capabilities and workflows by developing tailored agents for everyone from financial advisors, to security assistants, to robotics.

“Gemini on Google Distributed Cloud will empower ServiceNow to augment powerful agentic AI capabilities such as reasoning in our existing systems via robust APIs. This strategic deployment allows us to explore and implement cutting-edge advancements while upholding our commitment to customer trust and data protection.” - Pat Casey, Chief Technology Officer & EVP of DevOps, ServiceNow

Vertex AI: one platform for cloud and on-prem

In addition to bringing Gemini to Google Distributed Cloud, customers today already benefit from the Vertex AI platform on GDC, which lets them accelerate the development, deployment, and management of agentic applications.

This complete AI platform offers:

Pre-trained APIs: Ready-to-use, task-optimized, pre-trained APIs based on advanced Google models for translation, speech-to-text, and optical character recognition (OCR). These APIs offer advanced features such as customizable glossaries and in-place document translation
Gen AI building tools: Open-source and third-party models with optimized inferencing on GKE, delivering fast startup and auto-scaling
Retrieval Augmented Generation (RAG): Grounding using Google Agentspace search and LLM API management and governance using Apigee on-prem
Built-in embeddings API and AlloyDB vector database: Powerful applications for personalization and recommendations, enabling improved user experiences

“With Google Distributed Cloud, Vertex AI, and Agentspace search, we will empower our Home Team innovators with a secure AI/ML platform and unified search, enabling the use of AI to enhance productivity and transform public safety for a safer and more secure future.” - Chee Wee Ang, Chief AI Officer, HTX

Google Agentspace: out-of-box access to on-prem data

Enterprises are eager to deploy gen AI, but they also struggle to connect large volumes of siloed information across various repositories and formats such as images, PDFs, and text. This hinders productivity and innovation. At the same time, building an in-house search solution is costly and requires access to scarce AI expertise.

We are excited to announce Google Agentspace search will be available on GDC, with public preview starting in Q3 2025. Google Agentspace search provides all enterprise knowledge workers with out-of-the-box capabilities that unify access to all your data in a secure, permissions-aware way.

Agentspace gives you access to:

Company-branded, multimodal search agent: A conversational search interface that can answer complex questions based on your company’s unique information, acting as a central source of enterprise truth for your entire organization
Pre-built enterprise data connectors: Connectors to index data from the most common on-prem enterprise systems (such as Confluence, Jira, ServiceNow, and Sharepoint)
Permissions-aware search results: Robust access control list (ACL) enforcement that help ensure that search results are permission-aware, maintaining security and compliance for all your on-prem data
Agentspace agents: Vertex AI is integrated out-of-the-box with Agentspace, starting with search agents, with more pre-built agents coming soon, and the ability to build your own

Get started with gen AI on GDC

We're constantly innovating on GDC to be the leading gen AI and modern application development that you can deploy anywhere. To bring Gemini and gen AI to your premises, please contact Google Cloud sales or reach out to any of our accredited global partners.

Find sensitive data faster (but safely) with Google Distributed Cloud’s gen AI search solution

Thu, 19 Dec 2024 17:00:00 +0000

Today, generative AI is giving organizations new ways to process and analyze data, discover hidden insights, increase productivity and build new applications. However, data sovereignty, regulatory compliance, and low-latency requirements can be a challenge. The need to keep sensitive data in certain locations, adhere to strict regulations, and respond swiftly can make it difficult to capitalize on the cloud's innovation, scalability, and cost-efficiency advantages.

Google Distributed Cloud (GDC) brings Google's AI services anywhere you need them — in your own data center or at the edge. Designed with AI and data-intensive workloads in mind, GDC is a fully managed hardware and software solution featuring a rich set of services. It comes in a range of extensible hardware form factors, with leading industry independent software vendor (ISV) solutions integrated via GDC Marketplace, and your choice of whether to run it connected to Google Cloud's systems or air-gapped from the public internet.

In this blog post, we dive into the details of how GDC’s new AI-optimized servers with NVIDIA H100 Tensor Core GPUs and our gen AI search packaged solution — now available in preview — allow you to bring increasingly popular retrieval-augmented generation (RAG) to your on-premises environment, and unlock multimodal and multilingual natural-language search experiences across your text, image, voice, and video data.

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7fd98a76f310>), ('btn_text', 'Get started for free'), ('href', 'https://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', None)])]>

Gen AI-optimized infrastructure

GDC air-gapped now incorporates new servers with NVIDIA H100 GPUs, powered by the advanced NVIDIA Hopper architecture and the 5th Gen Intel Xeon Scalable processors. The new servers introduce the new GPU-optimized A3 VM family optimized for NVIDIA NVLink interconnect to GDC, enabling faster shared compute and memory for AI workloads using large language models (LLMs) with up to 100 billion parameters. It also extends the set of NVIDIA Multi-Instance GPU (MIG) profiles, supporting a variety of new GPU slicing schemes (both uniform and mixed-mode) and dynamic allocation of GPU resources to serve the needs of AI services with better ownership costs.

Ready-to-deploy on-prem conversational search

With GDC’s new gen AI Search solution, you get a ready-to-deploy, on-prem conversational search solution based on the Gemma 2 LLM with 9 billion parameters. You can easily ingest your sensitive on-prem data into the search solution and quickly find the most relevant information and content via natural language search, boosting employee productivity and knowledge sharing, while helping ensure that the search queries and data remain on-prem.

Responses also include citation links to your original documents so you can easily verify all answers to reduce hallucinations. Watch the demo below to see the solution in action:

For more accurate responses, the GDC gen AI search solution relies on a RAG architecture to combine the benefits of traditional search and generative AI, and user queries are augmented with relevant on-prem data before they’re sent to the LLM to generate responses. Other core integrations available out-of-box include Vertex AI pre-trained APIs (translation for 105 languages, speech-to-text for 13 languages, and optical character recognition for 46 supported and 24 experimental languages) for multimodal and multilingual data ingestion across text, images, and audio. It also includes the AlloyDB Omni database service for embeddings storage and semantic search across ingested data.

GDC’s open cloud approach also allows you to customize this solution according to your needs and swap any components as you see fit, including for other database services like Elasticsearch, other open-source models and LLMs, or your own proprietary models.

Get started on your GDC development journey

To join GDC’s gen AI search solution preview and experience how on-prem gen AI search can transform how your organization retrieves information, contact your Google account representative. Note that you will need a GDC deployment where you can deploy and run the preview.

Toyota shifts into overdrive: Developing an AI platform for enhanced manufacturing efficiency

Mon, 09 Dec 2024 17:00:00 +0000

The automotive industry is facing a profound transformation, driven by the rise of CASE, — connected cars, autonomous and automated driving, shared mobility, and electrification. Simultaneously, manufacturers face the imperative to further increase efficiency, automate manufacturing, and improve quality. AI has emerged as a critical enabler of this evolution. In this dynamic landscape, Toyota turned to Google Cloud's AI Infrastructure to build an innovative AI Platform that empowers factory workers to develop and deploy machine learning models across key use cases.

Toyota's renowned production system, Toyota Production System, rooted in the principles of "Jidoka" (automation with a human touch) and "Just-in-Time" inventory management, has long been the gold standard in manufacturing efficiency. However, certain parts of this system are resistant to conventional automation.

We started experimenting with using AI internally in 2018. However, a shortage of employees with the expertise required for AI development created a bottleneck in promoting its wider use. Seeking to overcome these limitations, Toyota's Production Digital Transformation Office embarked on a mission to democratize AI development within its factories in 2022.

Our goal was to build an AI Platform that enabled factory floor employees, regardless of their AI expertise, to create machine learning models with ease. This would facilitate the automation of manual, labor-intensive tasks, freeing up human workers to focus on higher-value activities such as process optimization, AI implementation in other production areas, and data-driven decision-making.

AI Platform is the collective term for the AI technologies we have developed, including web applications that enable easy creation of learning models on the manufacturing floor, compatible equipment on the manufacturing line, and the systems that support these technologies.

By the time we completed implementing the AI platform earlier this year, we found it would be able to save us as many as 10,000 hours of mundane work annually through manufacturing efficiency and process optimization.

For this company-wide initiative, we brought the development in-house to accumulate know-how. It was also important to stay up-to-date with the latest technologies so we could accelerate development and broaden opportunities to deploy AI. Finally, it was crucial to democratize our AI technology into a truly easy-to-use platform. We knew we needed to be led by those working on the manufacturing floor if we wanted them to use the AI more proactively; while at the same time, we wanted to improve the development experience for our software engineers.

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7fd9b42db9d0>), ('btn_text', 'Get started for free'), ('href', 'https://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', None)])]>

Hybrid Architecture Brings Us Numerous Advantages

To power our AI Platform, we opted for a hybrid architecture that combines our on-premises infrastructure and cloud computing.

The first objective was to promote agile development. The hybrid cloud environment, coupled with a microservices-based architecture and agile development methodologies, allowed us to rapidly iterate and deploy new features while maintaining robust security. The path for a microservices architecture arose from the need to flexibly respond to changes in services and libraries, and as part of this shift, our team also adopted a development method called "SCRUM" where we release features incrementally in short cycles of a few weeks, ultimately resulting in streamlined workflows.

If we had developed machine learning systems solely on-premises with the aim to ensure security, we would need to perform security checks on a large amount of middleware, including dependencies, whenever we add a new feature or library. On the other hand, with the hybrid cloud, we can quickly build complex, high-volume container images while maintaining a high level of security.

The second objective is to use resources effectively. The manufacturing floor, where AI models are created, is now also facing strict cost efficiency requirements.

With a hybrid cloud approach, we can use on-premises resources during normal operations and scale to the cloud during peak demand, thus reducing GPU usage costs and optimizing performance. This allows us to flexibly adapt to an expected increase in the number of users of AI Platform in the future, as well.

Furthermore, adapting a hybrid cloud helps us to achieve cost savings on facility investments. By leveraging the cloud for scaling capacity, we minimized the need for extensive on-premises hardware investments. In a traditional on-premises environment, we would need to set up high-performance servers with GPUs in every factory. With a hybrid cloud, we can reduce the number of on-premises servers to one and use the cloud to cover the additional processing capacity whenever needed. The hybrid cloud’s concept of "using resources when and only as needed" aligns well with our "Just-in-Time" method.

The Reasons We Chose Google Cloud AI Hypercomputer

Several factors influenced our decision when choosing a cloud partner for the development of the Toyota AI Platform’s hybrid architecture and ultimately, we chose Google Cloud.

The first is the flexibility of using GPUs. In addition to the availability of using high-performance GPUs from one unit, we could use A2 VMs with Google Cloud's unique features like multi-instance GPUs and time-sharing GPUs. This flexibility reduces idle compute resources and optimizes costs, leading to increased business value over a given time by allowing scarce GPUs to perform more machine learning trainings. Plus Dynamic Workload Scheduler helps us efficiently manage and schedule GPU resources to help us optimize running costs.

Next is ease of use. We anticipate that we will be required to secure more GPU resources across multiple regions in the future. With Google Cloud, we can manage GPU resources through a single VPC, avoiding network complexity. When considering the system to deploy, only Google Cloud had this capability.

The speed of build and processing was also a big appeal for us . In particular, Google Kubernetes Engine (GKE), its Autopilot and Image Streaming provide flexibility and speed, thereby allowing us to improve cost-effectiveness in terms of operational burden. We measured the communication speed of containerization during the system evaluation process, and found that Google Cloud was four times faster scaling from zero than other existing services. The speed of communication and processing is extremely important, as we use up to 10,000 images when creating the learning model. When we first started developing AI technology in-house, we struggled with flexible system scaling and operations. In this regard, too, using Google Cloud was the ideal choice.

Completed Large-scale Development in 1.5 Years with 6 Members

With Google Cloud's support, a small team of six developers achieved a remarkable feat by successfully building and deploying the AI Platform in about half the time it would take for a standard system development project at Toyota. This rapid development was facilitated by Google Cloud's user-friendly tools, collaborative approach, and alignment with Toyota's automation-focused culture.

After choosing Google Cloud, we began discussing the architecture with the Google Cloud team. We then worked on modifying the web app architecture for the cloud lift, building the hybrid cloud, developing human resources within the company, while learning skills for the "internalization of technology (acquisition and accumulation of new know-how)".During the implementation process, we divided the workloads into on-premises and cloud architectures, and implemented best practices to monitor communications and resources. This process also involved migrating CI/CD pipelines and image data to the cloud. By performing builds in the cloud and caching images on-premises, we ensured quick start-up and flexible operations.

In addition to the ease of development of Google Cloud products, cultural factors also contributed greatly to the success of this project. Our objective of making the manufacturing process automated as much as possible, is in line with Google's concept of SRE (Site Reliability Engineering). So, we shared the same sense of purpose.

Currently, in the hybrid cloud, we deploy a GKE Enterprise cluster on-premises and link it to the GKE cluster on Google Cloud. When we develop our AI Platform and web apps, we run Cloud Build with Git CI triggers, verify container image vulnerabilities with Artifact Registry and Container Analysis, and ensure a secure environment with Binary Authorization. At the manufacturing floor, structural data such as numerical data and unstructured data such as images are deployed on GKE via a web app, and learning models are created on N1 VMs with NVIDIA T4 GPUs and A2 VMs which include NVIDIA A100 GPUs.

Remarkable Results Achieved Through Operating AI Platform

We have achieved remarkable results with this operational structure.

Enhanced Developer Experience: First, with regard to the development experience, waiting time for tasks have been reduced, and operational and security burdens have been lifted, allowing us to focus even more on development.

Increased User Adoption: Additionally, the use of our AI Platform on the manufacturing floor is also growing. Creating a learning model can typically take 10 to 15 minutes in the shortest, and up to 10 hours in the longest. GKE's Image Streaming streamlined pod initialization and accelerated learning, resulting in a 20% reduction in learning model creation time. This improvement has enhanced the user experience (UX) on the manufacturing floor, leading to a surge in the number of users. Consequently, the number of models created in manufacturing has steadily increased, rising from 8,000 in 2023 to 10,000 in 2024. The widespread adoption of this technology has allowed for a substantial reduction of over 10,000 man-hours per year in the actual manufacturing process, optimizing efficiency, and productivity.

Expanding Impact: AI Platform is already in use at all of our car and unit manufacturing factories (total 10 factories), and its range of applications is expanding. At the Takaoka factory, the platform is used not only to inspect finished parts, but also in the manufacturing process; inspect the application of adhesives used to attach glass to back doors, and to detect abnormalities in injection molding machines used for manufacturing bumpers and other parts. Meanwhile, the number of active users in the company has increased to nearly 1,200, and more than 400 employees participate in in-house training programs each year.

Recently, there have been cases where people who were developing in other departments became interested in Google Cloud and joined our development team. Furthermore, this project has sparked an unprecedented shift within the company: the resistance to the cloud technology itself diminishing and other departments beginning to consider adopting it.

Utilizing Cloud Workstations for Further Productivity With an Eye on Generative AI

For the AI Platform, we plan to develop an AI model that can set more detailed criteria for detection, implement it in an automated picking process, and use it for maintenance and predictive management of the entire production line. We are also developing original infrastructure models based on the big data collected on the platform, and expect to use the AI Platform more proactively in the future.Currently, the development team compiles work logs and feedback from the manufacturing floor, and we believe that the day will soon come when we will start utilizing generative AI. For example, the team is considering using AI to create images for testing machine learning during the production preparation stage, which has been challenging due to a lack of data. In addition, we are considering using Gemini Code Assist to improve the developer experience, or using Gemini to convert past knowledge into RAG and implement a recommendation feature.In March 2024, we joined Google Cloud's Tech Acceleration Program (TAP) and implemented Cloud Workstations. This also aims to achieve the goals we have been pursuing: to improve efficiency, reduce workload, and create a more comfortable work environment by using managed services.

Through this project, led by the manufacturing floor, we have established a "new way of manufacturing" where anyone can easily create and utilize AI learning models, and significantly increase the business impact for our company. This was enabled by the cutting-edge technology and services provided by Google Cloud.

Like "Jidoka (auto’no’mation)" of production lines and "Just-in-Time" method, the AI Platform has now become an indispensable part of our manufacturing operations. Leveraging Google Cloud, we will continue our efforts to make ever-better cars.

Introducing an industry first: application awareness on Cloud Interconnect

Wed, 30 Oct 2024 16:00:00 +0000

Multicloud architectures are becoming commonplace as more business-critical applications are moving to the cloud. Last year, we introduced the Cross-Cloud Network to transform and simplify hybrid and multicloud connectivity, and enable organizations to easily build distributed applications. As organizations modernize their infrastructure, leveraging AI/ML and other managed services, they have adopted Cross-Cloud Network to reduce operational complexity and lower the total cost of ownership (TCO).

We are seeing increased demand for delivering better application experiences with guaranteed SLAs, as well as ensuring spend predictability for accurate budgeting and risk mitigation. Today, we’re excited to announce new innovations for Cross-Cloud Network that address these evolving needs and help deliver the best network experience for your distributed applications. These new innovations include:

Prioritizing traffic with an industry first: application awareness on Cloud Interconnect
Lowering TCO with predictable pricing for Cloud Interconnect
Unifying observability for Cloud Interconnect with VPC Flow Logs
Other Innovations that enhance service networking with programmability and new producers

aside_block: <ListValue: [StructValue([('title', '$300 to try Google Cloud networking'), ('body', <wagtail.rich_text.RichText object at 0x7fd9b4647280>), ('btn_text', 'Start building for free'), ('href', 'http://console.cloud.google.com/freetrial?redirectpath=/products?#networking'), ('image', None)])]>

Prioritizing traffic with an industry first: application awareness on Cloud Interconnect

Cloud Interconnect enables robust, high-bandwidth, SLA-backed connectivity to Google Cloud. With Cross-Cloud Interconnect we enable dedicated and private connectivity from Google to another cloud provider. Together, they form the foundation for building hybrid and multicloud distributed applications.

Customers have traditionally lacked the capability to prioritize traffic over Cloud Interconnect, forcing them to substantially overprovision bandwidth or risk subpar performance during periods of congestion. This can result in increased costs, inefficient resource utilization, and potential disruption to business operations.

To address this need for traffic prioritization, we are introducing application awareness on Cloud Interconnect in preview. Google Cloud is the first major cloud service provider to offer a managed traffic differentiation solution that empowers you to solve the critical challenge of traffic prioritization over Cloud Interconnect. Application awareness enables flexibility with a choice of two policies: strict priority across traffic classes and bandwidth share per traffic class.

Traffic handling over Cloud Interconnect with application awareness

Application awareness on Cloud Interconnect provides multiple business benefits, including:

Prioritization of business critical traffic: Ensures that lower-priority traffic egressing Google Cloud does not adversely impact higher-priority traffic during congestion periods on Cloud Interconnect connections.
Lower total cost of ownership (TCO): Enables efficient utilization of Cloud Interconnect bandwidth, and avoids excessive overprovisioning of links when used with proper capacity planning.
Fully managed, SLA-backed solution: Provides peace of mind with a Google-managed solution backed by the Cloud Interconnect SLA. Compares favorably to expensive, self-managed workarounds including network appliances that add complexity, manual overhead, and high operational cost.

You can learn all the details on application awareness on Cloud Interconnect in this solution brief.

"As hybrid and multicloud architectures become commonplace, enterprises are seeking intelligent connectivity solutions to optimize data flows and application performance across their digital infrastructure. Google Cloud's application awareness on Cloud Interconnect, with its packet classification and prioritization capabilities, can optimize critical business exchanges. This will have a broad applicability across various data traffic types, providing enterprises with greater control while boosting infrastructure resiliency and cost savings." - Taranvir Singh, research manager, Cloud Networking Services, IDC

Lowering TCO with predictable pricing for Cloud Interconnect

When migrating to the cloud, organizations value predictable data transfer costs. Customers starting their cloud adoption journey, or those embracing distributed applications across multiple environments, can struggle to estimate costs associated with data transfers between hybrid and multicloud environments. Variable prices based on metered utilization contribute to this unpredictability.

We are pleased to announce a fixed pricing option for Dedicated Interconnect and Cross-Cloud Interconnect. Customers that choose fixed pricing are charged a fixed hourly price per port rather than on the amount of traffic transferred, eliminating data transfer variability in billing. With predictable monthly costs, organizations can more easily implement showback and/or chargeback to improve operational efficiency.

Unifying observability for Cloud Interconnect with VPC Flow Logs

VPC Flow Logs provide flow level visibility into network traffic within Google Cloud. By recording packets sent and received by virtual machines, VPC Flow Logs let you analyze network traffic not only for performance monitoring and troubleshooting, but also for network forensics, security and compliance, and cost optimization.

In order to provide a consistent and easy-to-use observability experience, we’ve expanded VPC Flow Logs coverage to include visibility into network traffic over Dedicated Interconnect, Partner Interconnect, Cross-Cloud Interconnect, and Cloud VPN. You can now generate flow logs not just for subnets, but also for your VLAN attachment and VPN tunnels, and receive the same 5-tuple (source IP, destination IP, source port, destination port, and protocol) granularity as you do for traffic within Google Cloud. If you’ve already enabled VPC Flow Logs on your subnets, all of the traffic between those subnets and your on-prem and/or cross-cloud environments will also be annotated with the corresponding hybrid connectivity metadata.

VPC Flow Logs also make it easier to identify specific traffic types for prioritization when configuring or fine-tuning application awareness policies on Cloud Interconnect, and provide on-going insights into traffic patterns, bandwidth utilization, and traffic class performance.

Flow Analyzer visualization of VPC Flow Logs for Cloud Interconnect

Flow Analyzer is available for all VPC Flow Logs customers and allows you to easily identify and visualize your network traffic flows, including top talkers, without having to write complex SQL queries. All VPC Flow Logs can also be integrated and analyzed with services from the observability partner of your choice, or with Google Cloud services such as Cloud Logging and BigQuery.

VPC Flow Logs for hybrid connectivity and Flow Analyzer are both available in preview.

Enhancing service networking with programmability and new producers

A key tenet of Cross-Cloud Network is to enable DevOps, NetOps, and SecOps teams to deliver applications efficiently, without having to open tickets with other teams. Applications often need specific and custom capabilities for security, monitoring, logging, and more, which are not available out-of-the-box, and it can be operationally complex to integrate best-of-breed services, whether SaaS, third-party, or customer-managed, across environments. Today, we are expanding innovations and partnerships to enhance that service-centric approach, and help drive business agility.

Introducing Service Extensions plugins for Cloud Load Balancing

We are announcing the preview of Service Extensions plugins for Application Load Balancers, enabling you to add rich customizations to the networking request/response using WebAssembly (Wasm). Service Extensions provide an open programmable data-plane that allows you to insert SaaS solutions, or even your own customizations, into a workload’s datapath.

Service Extensions plugins for load balancers enable a wide set of use cases such as securing your applications with custom logic, optimizing traffic to your backend by rewriting http headers or URLs, custom logging to help monitor traffic, audit logging for compliance use cases, and more. We have also released a broad set of example plugins for many of these operations here.

Accelerating the service-centric journey with new producers for Private Service Connect

As you modernize your applications with managed services, Private Service Connect makes it easy to create private and secure connections from your VPCs to Google, your own services, or a large portfolio of third-party partner services.

We are announcing new data and AI producers for Private Service Connect endpoints and interfaces including:

With these new producers for AI and analytics services, now you can simplify network connectivity while applying consistent security policies to the application.

“As the leader in digital payments, PayPal is revolutionizing commerce globally in over 200 markets around the world. To best serve the hundreds of millions of customers and merchants who use PayPal services, our network must provide high reliability, security, and performance.

PayPal leverages Private Service Connect, part of the Cross-Cloud Network solution, which connects our data analytics and AI services securely so that we can focus on delivering novel and innovative PayPal services to our customers.” - Saikrishna Kotha, Senior Director, Head of Infrastructure Platforms, PayPal

Learn more

With Cross-Cloud Network, we’re empowering you to simplify and secure your workloads, data, and users across hybrid and multicloud networks. You can learn all about Cross-Cloud Network here, and be sure to join us at the Google Cloud App Dev and Infrastructure Summit to hear more about these innovations.

Deliver sovereign cloud solutions with the new Google Distributed Cloud initiative

Tue, 13 Aug 2024 16:00:00 +0000

Digital sovereignty remains top-of-mind for organizations across the public, finance, and manufacturing sectors. As they adopt cloud technologies, they face the challenge of balancing innovation while adhering to stringent regulatory requirements. To achieve this, they seek cloud solutions that not only offer the flexibility and scalability they need, but also prioritize compliance with local and industry-specific regulations.

Google Sovereign Cloud provides comprehensive and flexible solutions to confidently meet data, operational, and software sovereignty requirements. These solutions include Google Distributed Cloud (GDC), which brings Google Cloud capabilities closer to where data is generated and used, helping customers overcome challenges related to data location, latency, and connectivity. GDC lets organizations deploy and manage cloud services across various environments — on-premises, at the edge, or in remote locations — while helping to provide optimal performance and adherence to regulatory compliance mandates.

Introducing the Managed Google Distributed Cloud Provider initiative

Deploying applications at the edge or on-premises can be a complex process, requiring specialized skills and technologies that many organizations lack. At Google Cloud, we recognize this challenge and are collaborating with leading industry partners to provide them expertise and create customized solutions for their specific industries and clients. Today, we are pleased to introduce the Managed GDC Provider (MGP) initiative. This program simplifies the deployment of solutions in various environments by authorizing and empowering select partners to deploy, operate, and manage Google Distributed Cloud services as a fully managed offering. This reduces the technical complexity of deploying cloud services for customers with high sovereignty needs, accelerating adoption. Current partners operating GDC air-gapped include Clarence (a joint venture between Luxembourg state-owned company LuxConnect, and Proximus Luxembourg) operating from Luxembourg, Gulf Energy operating from Thailand, T-Systems operating from Germany, and World Wide Technology (WWT) operating from North America. As members of the Managed GDC Provider initiative, these partners are already delivering AI-enabled sovereign cloud solutions to their customers. We look forward to adding more partners to the initiative in the coming months.

“Clarence is meeting a growing demand for true digital sovereignty, stimulated by today’s complex geopolitical context, combined with ever-increasing cyber threats and cyber terrorism risks, and AI needs.” says Pascal Rogiest, General Manager of Clarence S.A. "Clarence represents a unique and cutting-edge bundled solution, leveraging Google's exceptional portfolio of cloud-based applications from GDC air-gapped.” "

"We chose Google Distributed Cloud (GDC) based on its unique ability to isolate operations from the public internet while providing powerful AI capabilities. The successful delivery of GDC in Thailand, with Gulf as Google Cloud's Managed GDC Provider (MGP), is a strategic imperative, as its adoption across regulated industries will not only boost our country's digital competitiveness but also create new revenue opportunities for our company.” – Sarath Ratanavadi, CEO, Gulf Energy Development

“At T-Systems, we are very pleased to be a provider of Google Distributed Cloud in Germany. This valuable addition to our cloud portfolio lets us deliver Google Cloud’s powerful cloud solutions to our customers, combined with the very highest security and data-residency requirements. This underscores our commitment to providing truly hybrid cloud landscapes, tailored to the individual needs of each customer.” - Greg Hyttenrauch, Senior Vice President for Cloud Services at T-Systems

"At WWT, we are privileged to partner with Google Distributed Cloud. Through this MGP initiative, we have tailored a cloud solution specifically for the unique requirements of our public sector customers This solution ensures the security of sensitive data and upholds their digital sovereignty. This collaboration is a testament to our commitment to delivering innovative solutions that empower our customers in the public sector." - Scot Gagnon, VP of Federal Sales at WWT

The Managed GDC Provider initiative program helps customers harness the power of Google Cloud technology within a private, secure, and isolated environment operated by trusted local partners. This approach provides numerous advantages, including full control over data residency and adherence to local regulations, helping to ensure data sovereignty and compliance. Additionally, by running workloads closer to users and applications, customers experience reduced latency and improved performance. These trusted partners’ air-gapped configurations and expert management enhance security and control, while the flexibility of the program allows for tailored solutions to meet specific needs and requirements. Furthermore, customers gain access to the latest Google Cloud technologies and services within a sovereign environment, so they remain at the forefront of innovation.

Becoming a Managed GDC Provider unlocks a world of opportunities for partners. They can expand their service offerings and tap into new revenue streams by becoming cloud service providers with GDC. Partners take control and customize the commercial and customer experience of GDC, tailoring solutions to meet specific market needs. And by leveraging Google's cutting-edge AI-ready infrastructure, partners position themselves as trusted cloud service providers in their region, with expertise in deploying and managing sovereign cloud solutions. They gain access to Google Cloud's latest innovations and robust infrastructure, so they can deliver superior cloud services. Finally, Managed GDC Providers are part of a thriving ecosystem of partners, fostering collaboration and knowledge-sharing.

Join the Managed GDC Provider initiative

We invite partners to explore the Managed GDC Provider initiative, and show that you are a trusted expert in operating air-gapped and connected instances of GDC. To express your interest and begin the qualification process, please contact your account team or email gdc-partners@google.com.

VMware Cloud Foundation on Google Cloud VMware Engine: 20% lower price and up to 40% in migration incentives

Thu, 18 Jul 2024 16:00:00 +0000

VMware Cloud Foundation on Google Cloud VMware Engine (GCVE) is now generally available, and there has never been a better time to move your VMware workloads to Google Cloud, so you can bring down your costs and benefit from a modern cloud experience. Today, in partnership with Broadcom, we’re pleased to announce:

Support for VMware Cloud Foundation (VCF) is now available with ~20% lower commitment pricing
License portability entitlement support for VCF will allow you to preserve your VMware investments by flexibly porting your on-premises VCF licenses to GCVE. This will enable you to get a VE1 node which supports portability at up to a 35% lower price¹ on a three-year prepaid commitment, compared to previous pricing which included VMware licenses.
Multiple new GCVE node types to cost-effectively align with your workload requirements; in fact, GCVE (with VCF) can be up to 30% less expensive than Azure VMware Solution.
Commercial incentives up to 40% of GCVE first-year spend as additional migration and consumption incentives, along with no-fee proof of concepts and trials
Convertible commitments supporting movement mid-term between different GCVE node types and other compute platforms like Compute Engine and Google Kubernetes Engine (GKE).

Customers are already benefiting from VCF licensing support in GCVE.

"Google has helped us navigate the VMware licensing changes every step of the way and we are excited about the future with Google Cloud VMware Engine providing us a fast path to transform our VMware workloads in Google Cloud." - Everett Chesley, Director of IT Infrastructure, Granite Telecommunications

Let’s take a look at these announcements in greater depth.

Support for VMware Cloud Foundation

In partnership with Broadcom, GCVE now fully supports VMware Cloud Foundation. VCF is a comprehensive platform that integrates VMware's compute, storage, and network virtualization capabilities with its management and application infrastructure capabilities. In addition to the cloud infrastructure components such as vSphere, vSAN, NSX and HCX that already existed in GCVE, VCF includes many new capabilities, such as the Aria Suite Enterprise and Aria Operations for Networks Enterprise. These Aria capabilities provide comprehensive monitoring, analytics, and insights to optimize application performance and resource utilization, resulting in improved application health, enhanced performance, and efficient capacity management.

VMware Cloud Foundation license portability

We often hear from customers looking to bring the value of their existing or future VMware Cloud Foundation license investments to Google Cloud. In collaboration with Broadcom, we are pleased to announce support for VCF license portability entitlement in GCVE. Simply put, with GCVE commitment types that support portability, you only pay Google for the VMware Engine service and infrastructure, and can apply previously purchased VCF licenses. By bringing your own VCF subscriptions to GCVE, you can avoid the cost of purchasing new licenses, resulting in potential savings compared to previous pricing models. For example, compared to previous pricing which included VMware licenses, you will be able to get a VE1 node that supports portability at up to a 35% lower price on a three-year prepaid commitment.

Google Cloud is the first cloud provider to offer a distinct VCF-integrated solution that supports VCF license portability. With Google Cloud, you can maximize the value of your VMware investments while benefiting from the scalability, security, and innovation of Google’s infrastructure.

“The partnership between Broadcom and Google Cloud continues to deliver significant value to our customers. Support for VMware Cloud Foundation and license portability entitlement with Google Cloud VMware Engine empowers on-premises customers to leverage their existing investments in VMware software to both cost effectively and seamlessly migrate to Google Cloud. This innovation not only unlocks substantial cost savings and TCO benefits but also accelerates customers’ digital transformation journey.” - Abhay Kumar, Global Head of Hyperscalers, Broadcom

Increased choice of node types

Over the years, customers have shared the need to support a range of VMware workloads with better capacity shaping to optimize their costs. Earlier this year, we introduced our first node type on the VE2 node platform, the ve2-standard-128.

Today, we’re excited to introduce our ve2-mega shape family. ve2-mega shapes come with 51.2 TB raw data storage (~2.7X compared to ve1) in addition to 3.2TB of cache capacity. We are now offering two new hyperconverged node types in the family:

ve2-mega-96, with 96 hyperthreads (~1.3X compared to ve1-standard-72).
ve2-mega-128, with 128 hyperthreads (~1.7X compared to ve1-standard-72).

We’re also now offering ve2-standard-96, with 48 cores/96 hyperthreaded cores. ve2-standard shapes come with 25.6 TB raw data storage.

For workloads with high storage needs, we are now offering two new storage-only node types: ve2-standard-so with 25.6 TB raw data storage, and ve2-mega-so with 51.2 TB raw data storage. GCVE storage-only node types come with the same NVMe storage offered in our hyperconverged node types, but are offered at lower price points. You can easily and cost-effectively expand your storage capacity by adding storage-only node types to your existing GCVE clusters. You get the same blazing fast performance with ease of management — no need to manage any external connectivity or mounts.

Please contact your Google Cloud sales representative for more information.

New cost savings with commitments

GCVE now offers enhanced discounting for its VE1 and VE2 license-included node platforms with new one- and three-year term commitments:

VE1 nodes: 22% lower rates compared to previous pricing¹
VE2 nodes:

37% discount for one-year prepaid commitments (previously 30% for VE1)
55% discount for three-year prepaid commitments (previously 50% for VE1)

These changes result in substantial savings, For example, for ve1-standard-72, a three-year prepaid commitment in us-central1 (Iowa) is priced at $3.60/hour compared to $5.17/hour for Azure's AV36P three-year reserved instance in the “Central US” location (~30% savings)*.

Please contact your Google Cloud sales representative for more information.

Significant incentives to reduce TCO

Customers evaluating GCVE as a destination for their VMware workloads want a significant reduction in financial and technical friction. We worked closely with several of our key services partners to enable us to deliver on this requirement, and are pleased to announce:

No-fee assessments and POCs for customers, delivered by our partners and funded by Google Cloud
For new customers entering a Google Cloud Enterprise Agreement or Flex Agreement:

Migration services incentives: up to 25% of incremental year-one net spend to support migration services. A number of partners are certified to deliver migration services.
Incremental consumption incentives: up to 15% in additional credits for incremental net consumption of GCVE in year one, reducing TCO for customers as they migrate their VMware workloads.

Please contact your Google Cloud sales representative for more information.

Convertible commitments

As customers bring their workloads to GCVE, they often evolve their workload architectures to take advantage of various options available in Google Cloud. However, so far, they were unable to reuse their existing GCVE commitments for such use cases. To support this flexibility, we are excited to announce new convertible three-year GCVE commitments that, for an additional cost, will allow you to convert part of your commitments to other services such as Compute Engine or GKE, or other options in GCVE. For example:

You can extend VMware environments using dynamically scaling web-facing servers on Compute Engine or GKE.
With the flexible VE2 node platform in GCVE, you can move between different GCVE node types, thus optimizing resource utilization by matching workloads to the most suitable infrastructure as your architecture evolves.

For pricing and regional availability details, please contact your Google Cloud sales representative.

Please stay tuned for more and be sure to bookmark the GCVE release notes for updates. You can also learn even more at our Google Cloud VMware Engine website, and if you’re looking to explore what a migration might look like for you, sign up for our free discovery & assessment offer.

^{*As of July 2024, based on list prices
1. Google Cloud Internal Data, May 2024}

Bringing cloud and AI capabilities to the tactical edge: Google Distributed Cloud air-gapped appliance is generally available

Wed, 17 Jul 2024 10:00:00 +0000

In harsh, disconnected, or mobile environments like disaster zones, remote research stations, or long-haul trucking operations, organizations face significant challenges in providing computing capabilities. Previously, organizations with mission-critical workloads lacked access to important cloud and AI capabilities when in demanding edge environments, including those that present unique challenges and requirements.

Today, we are excited to announce the general availability of Google Distributed Cloud air-gapped appliance, a new configuration of Google Distributed Cloud that brings Google’s cloud and AI capabilities to tactical edge environments. The integrated hardware and software solution unlocks real-time local data processing for AI use cases such as object detection, medical imaging analysis, and predictive maintenance for critical infrastructure. The appliance can be conveniently transported in a rugged case or mounted in a rack within customer-specific local operating environments.

Google Distributed Cloud air-gapped appliance offers:

Department of Defense (DoD) Impact Level 5 (IL5) accreditation: The appliance has achieved Impact Level 5 accreditation, the highest level of security controls and protection required for unclassified, but sensitive information. The appliance is also designed to meet Impact Level 6 and higher accreditations, and is actively working towards achieving these certifications.
Advanced AI capabilities: Customers can enhance the performance of their mission-critical applications by utilizing built-in AI solutions from the Google Distributed Cloud air-gapped appliance like translation, speech, and optical character recognition (OCR). For instance, they can use OCR and translation features to scan and translate documents written in different languages, making them accessible and understandable for their end users.
Rugged and portable design: Built to withstand harsh environmental conditions, including extreme temperatures, shock, and vibration, Google Distributed Cloud air-gapped appliance has a rugged and portable design that meets stringent accreditation requirements like MIL-STD-810H, ensuring reliable operation even in challenging scenarios. Weighing approximately 100lbs, it's human-portable, making it easy to transport and deploy in various locations.
Full isolation: Google Distributed Cloud air-gapped appliance is designed to operate without any connectivity to Google Cloud or the public internet. The appliance remains fully functional in disconnected environments, preserving the security and isolation of the infrastructure, services, and the APIs that it manages. This makes it ideal for processing sensitive data, while meeting strict regulatory, compliance, and sovereignty requirements.
Integrated cloud services: Google Distributed Cloud air-gapped appliance offers both infrastructure-as-a-services (IaaS) features like compute, networking, and storage, and Google Cloud services like data transfer and data analytics technologies.

Data security: Google Distributed Cloud air-gapped appliance includes robust security features like encryption, data isolation, firewalls, and secure boot to protect sensitive information.

The Google Distributed Cloud air-gapped appliance enables a wide array of use cases for organizations with stringent security requirements, including:

Disaster response: In the aftermath of a disaster, timely and accurate information is crucial for coordinating relief efforts and saving lives. However, disaster-stricken areas often lack the necessary infrastructure to support traditional communication and data processing systems. As a self-contained, ruggedized device, the Google Distributed Cloud air-gapped appliance can be rapidly deployed to disaster-affected areas, even in the absence of internet connectivity. It comes pre-loaded with essential software and tools for data collection and analysis, enabling immediate response to emergencies. By leveraging the Google Distributed Cloud air-gapped appliance, aid organizations can enhance their disaster response capabilities, improve coordination, and save lives in times of crisis.

Industrial automation: Google Distributed Cloud air-gapped appliance offers an innovative solution for remote equipment monitoring, predictive maintenance, and process optimization in challenging environments at the edge. For instance, in the manufacturing sector, the appliance can be leveraged to track and optimize equipment performance in remote plants, leading to enhanced productivity and minimized downtime.

Transportation and logistics: Google Distributed Cloud air-gapped appliance supports the unique demands of fleet management, autonomous vehicles, and real-time logistics optimization. For example, the appliance can facilitate the deployment and operation of autonomous vehicles by enabling the real-time collection, processing, and decision-making, helping autonomous vehicles safely and efficiently navigate complex environments.

Restricted workloads for federal and defense: Google Distributed Cloud's air-gapped appliance is designed to meet the demands of restricted workloads, such as sensitive data analysis, AI inference and simulations, and intelligence translation, while adhering to security and supporting compliance regulations.

“Google Distributed Cloud air-gapped appliance will enable the Air Force Rapid Sustainment Office (RSO) to bring the maintenance digital ecosystem to Airmen in austere and forward deployed locations, supporting the Air Force's agile objectives while prioritizing security and reliability,” said Michael Roquemore, Director of the RSO’s Rapid, Agile, Integrated Capabilities Team. “By delivering a secure and compliant edge compute platform, the RSO can leverage already developed Google-based technologies in both connected cloud and disconnected edge to bring digital innovation to the Service Members wherever they operate.”

To learn more, visit the Google Distributed Cloud air-gapped appliance website. If you would like to discuss your air-gapped cloud requirements, please complete this form, and a member of our team will be in touch.

Cross-Cloud Network: Design global distributed applications at scale

Tue, 16 Jul 2024 16:00:00 +0000

Interested in learning how to simplify your distributed application architecture with Cross-Cloud Network, for connecting, securing, and delivering applications across on-premises, Google Cloud, and third-party cloud environments? The newly published Cross-Cloud Networking for distributed applications section of the Cloud Architecture Center offers a comprehensive guide to designing and implementing a robust cross-cloud environment. In this blog we will look at some of the benefits of the Cross-Cloud Network and take a peek into the architecture documents.

Use case recap

In the blog Cross-Cloud Network: Private, customizable and flexible networking we touched briefly on three common use cases of this platform. These were:

Building distributed applications
Internet facing application and content delivery
Hybrid workforce

Architecture guides

To help you along your journey the “Cross-Cloud Networking for distributed applications” design guide provides in depth knowledge. This guide was written by several Google experts and is broken down into four documents. Each of these dive into different patterns and designs based on various use cases. The documents are as follows:

The design guide is meant to serve as your main reference to assist you in evaluating all pertinent considerations and point you to reference architectures that describe how to deploy recommended patterns. You can utilize these recommendations as a guide, samples or building blocks for designing, researching or planning your network. As with all things architecture, you have a varying degree of flexibility in what the final design will look like.

Example pattern

Let's take a quick look at one of the designs highlighted in the document Network segmentation and connectivity.

This shows a key feature called reachability between on-prem and other cloud environments with a transit VPC being used. In this transit VPC all the connections to on-prem and other clouds are terminated. Other VPCs can connect via Cloud VPN, Network Connectivity Center, or VPC network peering to the centralized transit VPC. Cloud Routers are placed in different regions and facilitate the exchange of routes between connected sources.

Learn more today

Dive deeper into the Cross-Cloud Network for distributed application architecture guides today. You can also learn more about Cross-Cloud Network with the following resources:

Solution page: Cross-Cloud Network
IDC whitepaper: Accelerating the Enterprise AI Journey with Cross-Cloud Network
Next’24 presentation video: How to design a cloud network for apps and services in multi- or hybrid clouds
Demo video: Service-Centric Cross-Cloud Network

Want to ask a question, find out more or share a thought? Please connect with me on Linkedin.

Build a hybrid data processing footprint using Dataproc on Google Distributed Cloud

Fri, 31 May 2024 16:00:00 +0000

Google Cloud customers interested in building or modernizing their data lake infrastructure often need to maintain at least part of their workloads and data on-premises, because of regulatory or operational requirements.

Thanks to Dataproc on Google Distributed Cloud, introduced in preview at Google Cloud Next ‘24, you can now fully modernize your data lake with cloud-based technology, while building hybrid data processing footprints that allow you to store and process on-prem data that you can’t move to the cloud.

Dataproc on Google Distributed Cloud lets you run Apache Spark processing workloads on-prem, using Google-provided hardware located within your data center, while maintaining consistency between the technology you use in the cloud and locally.

For example, a large telecommunications company in Europe is modernizing their data lake on Google Cloud, while keeping Personally Identifiable Information (PII) data on-prem, on Google Distributed Cloud, to satisfy regulatory requirements.

In this blog, we will show how to use Dataproc on Google Distributed Cloud to read on-prem PII data, calculate aggregate metrics, and upload the resulting dataset to the data lake on the cloud using Google Cloud Storage.

Aggregate and anonymize sensitive data on-prem

In our demo scenario, the customer is a telecommunications company storing event logs that record users’ calls:

customer_id	customer_name	call_duration	call_type	signal_strength	device_type	location
1	<redacted>	141	Voice	379	LG Q6	Tammieview, PA
2	<redacted>	26	Video	947	Kyocera Hydro Elite	New Angela, FL
3	<redacted>	117	Voice	625	Huawei Y5	Toddville, MO
4	<redacted>	36	Video	382	iPhone X	Richmondview, NV
5	<redacted>	110	Video	461	HTC 10 evo	Cowanchester, KS
6	<redacted>	0	Video	326	Galaxy S7	Nicholsside, NV
7	<redacted>	200	Data	448	Kyocera Hydro Elite	New Taramouth, AR
8	<redacted>	178	Data	475	Galaxy S7	South Heather, CT
9	<redacted>	200	Voice	538	Oppo Reno6 Pro+ 5G	Gregoryburgh, ID
10	<redacted>	113	Voice	878	ZTE Axon 30 Ultra 5G	Karaview, NV
11	<redacted>	200	Data	722	Huawei P10 Lite	Petersonstad, IA
12	<redacted>	200	Voice	1	HTC 10 evo	West Danielport, CO
13	<redacted>	169	Voice	230	Samsung Galaxy S10+	North Jose, SD
14	<redacted>	198	Voice	1	Kyocera DuraForce	East Matthewmouth, AS
15	<redacted>	155	Data	757	Oppo Find X	Tuckerchester, MD
16	<redacted>	0	Data	1	ZTE Axon 30 Ultra 5G	New Tammy, NC
17	<redacted>	200	Data	656	Galaxy Note 7	East Jeanside, NJ
18	<redacted>	15	Data	567	Huawei Y5	Lake Patrickburgh, OH

This dataset contains PII. For regulatory compliance, PII must remain on-prem in their own data center. To satisfy this requirement, the customer S3-compatible object storage on-premise to store this data. However, now the customer would like to use their broader data lake in Google Cloud to analyze signal_strength by location and identify the best areas for new infrastructure investments.

To integrate with Google Cloud Data Analytics while still satisfying compliance requirements, Dataproc on Google Distributed Cloud supports full local execution of Spark jobs that can perform an aggregation on signal_quality. Consider this sample Spark code:

code_block: <ListValue: [StructValue([('code', 'import argparse\r\n\r\nfrom pyspark.sql import SparkSession\r\nimport pyspark.sql.functions as F\r\n\r\nparser = argparse.ArgumentParser()\r\n\r\nparser.add_argument("--input", default="s3a://event-logs/gdc-demo/dataset.tsv")\r\nparser.add_argument("--output", default="")\r\n\r\nargs = parser.parse_args()\r\n\r\n# Create SparkSession\r\nspark = SparkSession.builder.appName("demo-query").getOrCreate()\r\n\r\n# Read data\r\nprint("Reading data from %s" % args.input)\r\ndf = spark.read.csv(args.input, sep=r"\\t", header=True)\r\n\r\n# Find weighted average signal strength by location\r\nout = df.select("call_duration", "signal_strength", "location").withColumn(\r\n "adj_duration", F.col("call_duration") + 1\r\n).withColumn(\r\n "signal_x_duration", F.col("adj_duration") * F.col("signal_strength")\r\n).groupBy(\r\n "location"\r\n).agg(\r\n F.sum("adj_duration").alias("total_call_duration"),\r\n F.sum("signal_x_duration").alias("total_signal_x_duration"),\r\n).withColumn(\r\n "weighted_avg_signal_strength",\r\n F.col("total_signal_x_duration") / F.col("total_call_duration"),\r\n).select(\r\n "location", "weighted_avg_signal_strength"\r\n).orderBy(\r\n F.asc("weighted_avg_signal_strength")\r\n)\r\n\r\nout.show()\r\n\r\nif args.output:\r\n print("Saving output to %s" % args.output)\r\n out.coalesce(1).write.option("delimiter", "\\t").csv(args.output)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fd98a69ee80>)])]>

Dataproc on GDC exposes custom resources in the Kubernetes Resource Manager API to support Spark application submission. First, users obtain credentials to the GDC cluster:

code_block: <ListValue: [StructValue([('code', 'gcloud container hub memberships get-credentials event-logs-gdce-cluster'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fd98a69e340>)])]>

Then, users can run the job shown above by creating a SparkApplication custom resource and specifying the input location from local object storage and the output location to Cloud Storage:

code_block: <ListValue: [StructValue([('code', 'kubectl apply -f - <<EOF\r\napiVersion: "dataprocgdc.cloud.google.com/v1alpha1"\r\nkind: SparkApplication\r\nmetadata:\r\n name: demo-spark-app-local\r\n namespace: demo-ns\r\nspec:\r\n applicationEnvironmentRef: demo-app-env\r\n pySparkApplicationConfig:\r\n mainPythonFileUri: "s3a://bucket-10/demo/demo-script.py"\r\n args:\r\n - "--input=s3a://event-logs/gdc-demo/dataset.tsv"\r\n - "--output=gs://telecom-datalake/gdc-demo/output/"\r\nEOF'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fd98a69e910>)])]>

The resulting output in Cloud Storage identifies several areas of low signal quality:

Location	Value
Georgefurt, MS	1.0
Scottside, MA	1.0
Monroemouth, FL	1.0
Lake Robert, OH	1.0
East Lauren, VA	1.0
Shelleyburgh, CT	1.0
Buckville, ID	1.0
Garzaton, WI	3.32
North Danielle, NY	3.99
Port Natalie, ID	5.43

This data set is now available in Cloud Storage, with PII removed, as part of the customer’s broader GCP data lake strategy. This opens the possibility of additional analysis, such as trending over time, or using multiple data analytics products such as BigQuery and Dataproc Serverless.

Learn more

In this blog, we saw how you can leverage Dataproc on Google Distributed Cloud to create hybrid data processing footprints, processing on-prem sensitive data that needs to remain in your datacenter, and moving the rest of your data to the cloud. Dataproc on Google Distributed Cloud lets you modernize your data lake while respecting regulatory and operational data residency requirements. To learn more about Dataproc and Google Distributed Cloud, please visit:

Easily stream data from AWS Kinesis to Google Cloud with Pub/Sub import topics

Thu, 30 May 2024 16:00:00 +0000

Many companies use a multi-cloud model to support their business, whether it’s to avoid being tied to one provider, to increase redundancy, or to take advantage of differentiated products from different cloud providers.

One of Google Cloud’s most beloved and differentiated products is BigQuery, which offers a fully managed, AI-ready multi-cloud data analytics platform. BigQuery Omni provides a unified management interface where you can use BigQuery to query data in AWS or Azure, and see the results displayed in the Google Cloud console. Then, if you want to combine and move data between clouds in real-time, Pub/Sub offers a new capability that allows one-click streaming ingestion into Pub/Sub from external sources: import topics. The first supported external source is Amazon Kinesis Data Streams. Let's explore how you can leverage these new import topics, along with Pub/Sub's BigQuery subscriptions, to make your streaming data in AWS available in BigQuery with only a few clicks.

Getting to know import topics

Pub/Sub is a scalable asynchronous messaging service that lets you decouple services that produce messages from services processing those messages. Pub/Sub can be used to stream data from any source to any sink with its client libraries, and is well-integrated within the Google Cloud ecosystem. Pub/Sub supports export subscriptions that automatically stream data to BigQuery and Cloud Storage. Pub/Sub is also natively integrated with Cloud Functions, and Cloud Run, and can deliver messages to any arbitrary publicly reachable endpoint, for example on Google Kubernetes Engine (GKE), Google Compute Engine, or even on-premises.

What export subscriptions provide for writing data to BigQuery and Cloud Storage, import topics provide for reading data from Amazon Kinesis Data Streams: a fully managed, streamlined way to ingest data from Amazon Kinesis Data Streams directly into Pub/Sub. As a result, the complexity of setting up data pipelines between clouds is significantly reduced. Import topics also provide out-of-the-box monitoring for visibility into the health and performance of the data ingestion processes. Additionally, import topics offer automatic scaling, eliminating the need for manual configuration to handle fluctuations in data volume.

In addition to enabling multi-cloud analytics with BigQuery, import topics allows for the easy migration of streaming data from Amazon Kinesis Data Streams into Pub/Sub. Once a connection between both systems has been established via an import topic, the Amazon Kinesis producers can be gradually migrated to Pub/Sub publishers on an arbitrary schedule.

Please note that only Enhanced Fan-Out Amazon Kinesis consumers are supported at the current time.

Analyzing your Amazon Kinesis Data Streams data in BigQuery

Now, imagine you operate a business with a highly variable volume of streaming data residing in Amazon Kinesis Data Streams. This data is crucial for analysis and decision-making and you want to leverage BigQuery to analyze it. First, create an import topic following these comprehensive instructions. You can create an import topic via different official Pub/Sub libraries, as well as with the Google Cloud console. After clicking on “Create Topic” from the Pub/Sub page in the console, you’ll see:

Important: After hitting "Create", Pub/Sub immediately begins reading from the Amazon Kinesis data stream and publishes messages to the import topic. If you already have data in your Kinesis data stream, there are some steps you need to take to prevent data loss when creating an import topic. If a topic has no subscriptions attached to it and does not have message retention enabled, then Pub/Sub may drop messages published to that topic. Creating a default subscription when creating the topic is not sufficient; these are still two separate operations and there is a brief period of time where the topic exists without the subscription.

To prevent data loss, you have two options:

Create a topic, and then update it to become an import topic:

Create a non-import topic.
Create a subscription to the topic.
Update the topic configuration to enable ingestion from Amazon Kinesis Data Streams, thus turning it into an import topic.

Enable message retention and seek your subscription:

Create an import topic with message retention enabled.
Create a subscription to the topic.
Seek the subscription to a timestamp prior to the creation of the topic.

Note that export subscriptions start writing data as soon as they are created. Therefore, seeking back in time can result in duplicates. Because of this, the recommended approach when using export subscriptions is the first option.

To route the data to BigQuery, create a BigQuery subscription by navigating to the Pub/Sub subscriptions page in the Pub/Sub console and clicking on “Create Subscription”:

Pub/Sub autoscales by actively monitoring the Amazon Kinesis data stream. It periodically queries the Amazon Kinesis ListShards API to maintain an up-to-date view of the stream’s shards. Whenever changes occur within the Amazon Kinesis data stream (resharding), Pub/Sub automatically adapts its ingestion configuration to ensure that all data is captured and published to your Pub/Sub topic.

Pub/Sub uses the Amazon Kinesis SubscribeToShard API to establish a persistent connection for each shard that either doesn’t have a parent shard, or whose parent shard has already been ingested, ensuring continuous ingestion of data from the different shards of the Amazon Kinesis data stream. Pub/Sub doesn’t start ingesting a child shard until its parent has been completely ingested. However, there are no strict ordering guarantees, since messages are published without an ordering key. Each individual Amazon Kinesis record is transformed into its corresponding Pub/Sub message by copying the data blob of the Amazon Kinesis record to the data field of the Pub/Sub message, which is then published. Pub/Sub attempts to maximize the data read rate per Amazon Kinesis shard.

You can now validate the successful data transfer by querying the BigQuery table directly. A quick SQL query confirms that the data from Amazon Kinesis has been populated into the table, and is now ready for further analysis and to be integrated into broader analytics workflows:

Monitoring your cross-cloud import

Monitoring your data ingestion pipeline is essential for ensuring smooth operations. We recently added three new metrics to Pub/Sub that let you verify the health of the import topic and understand its performance. They show the byte count, the message count, and the topic’s state. Unless the state is “ACTIVE”, ingestion is blocked by a misconfiguration, missing stream, or missing consumer. Refer to the official documentation for a comprehensive list of potential error states and their troubleshooting steps. These metrics can be conveniently accessed from the topic’s detail page, from where you can see your topic’s state is “ACTIVE”, its throughput, and messages per second:

Conclusion

Running in multiple cloud environments has become standard operating procedure for many companies. Even when using different clouds for different parts of your business, you should still be able to take advantage of the best products each has to offer, which may mean moving data around among them. Pub/Sub now makes it easy to stream data into Google Cloud from AWS. To get started, visit Pub/Sub in the Google Cloud console or sign up for a free trial to get started today.

Hybrid & Multicloud

Designing private network connectivity for RAG-capable gen AI apps

The power of RAG

Design pattern example

The traffic flow

RAG population flow

Inference flow

Management and routing

Next steps

Unlocking enterprise data to accelerate agentic AI: How Ab Initio does it

How Google's Data Cloud powers agentic AI

A unified hub for the hybrid enterprise

Governance across the full data and AI lifecycle

Context as the foundation for agentic AI

Get started

Google Distributed Cloud brings public-cloud-like networking to air-gapped environments

Manage outbound traffic with Cloud NAT

Connect standard clusters directly to your organization

Improve reliability with Load Balancer HTTP and HTTPS health checks

Make subnet management easier with subnet groups

Get started

AWS and Google Cloud collaborate to simplify multicloud networking

Expanding Google Cloud’s Cross-Cloud Network with a groundbreaking AWS collaboration

Simplifying cross-cloud connectivity

A variety of multicloud workloads

Run Gemini anywhere, including on-premises, with Google Distributed Cloud

Transformative AI capabilities, on-premises

Secure AI infrastructure where you need it

What our customers are saying

Gemini everywhere is here

Powering public sector innovation: New networking features in GDC air-gapped

Streamlined IP management for GDC

High availability with multi-zone load balancers

Workload-level network firewall policies

A new era of network control

Run AI anywhere with Google Distributed Cloud innovations

Simplify your multi-cloud strategy with Cloud Location Finder, now in preview

Why use Cloud Location Finder?

How can Cloud Location Finder help you?

Getting started

Emulating the air-gapped experience: GDC Sandbox is now generally available

Secure development in isolated environments

Air-gapped environments are challenging

GDC Sandbox: A virtualized air-gapped environment

The GDC Sandbox architecture and experience

Use cases for GDC Sandbox

Building applications in GDC Sandbox

Ready to try GDC Sandbox?

Advancing sovereignty, choice, and security in the cloud for our customers

A commitment to customer choice

Local control, global security

Sovereign solutions for any organization

Bringing Gemini and Google Agentspace to you on-premises

Gemini on GDC: unlocking generative AI anywhere

Vertex AI: one platform for cloud and on-prem

Google Agentspace: out-of-box access to on-prem data

Get started with gen AI on GDC

Find sensitive data faster (but safely) with Google Distributed Cloud’s gen AI search solution

Gen AI-optimized infrastructure

Ready-to-deploy on-prem conversational search

Get started on your GDC development journey

Toyota shifts into overdrive: Developing an AI platform for enhanced manufacturing efficiency

Hybrid Architecture Brings Us Numerous Advantages

The Reasons We Chose Google Cloud AI Hypercomputer

Completed Large-scale Development in 1.5 Years with 6 Members

Remarkable Results Achieved Through Operating AI Platform

Utilizing Cloud Workstations for Further Productivity With an Eye on Generative AI

Introducing an industry first: application awareness on Cloud Interconnect

Prioritizing traffic with an industry first: application awareness on Cloud Interconnect

Lowering TCO with predictable pricing for Cloud Interconnect

Unifying observability for Cloud Interconnect with VPC Flow Logs

Enhancing service networking with programmability and new producers

Introducing Service Extensions plugins for Cloud Load Balancing

Accelerating the service-centric journey with new producers for Private Service Connect

Learn more

Deliver sovereign cloud solutions with the new Google Distributed Cloud initiative

Introducing the Managed Google Distributed Cloud Provider initiative

Join the Managed GDC Provider initiative

VMware Cloud Foundation on Google Cloud VMware Engine: 20% lower price and up to 40% in migration incentives

Support for VMware Cloud Foundation