Posts

google adk adding context that can be cached

 With Google ADK, we can easily add instruction via instructions settings but lets say we would like to add more context or pre-defined rules, perhaps safety rules - then we can use static_instructions  And according to the docs:   static_instruction : Optional [ types . ContentUnion ] = None   """Static instruction content sent literally as system instruction at the beginning.   This field is for content that never changes and doesn't contain placeholders.   It's sent directly to the model without any processing or variable substitution.   This field is primarily for context caching optimization. Static instructions   are sent as system instruction at the beginning of the request, allowing   for improved performance when the static portion remains unchanged. Live API   has its own cache mechanism, thus this field doesn't work with Live API.   **Impact on instruction field:**   - When static_instruction is None: instruction ...

gke setting up kubernetes rbac for a user

Image
To configure RBAC capabilities for a gke cluster, we need to enable this feature. This allow the user or principal to grant permission what he/she can do or cannot do in a cluster.  gcloud projects add-iam-policy-binding project-id \   --member="user:kepung@gmail.com" \   --role="roles/viewer" And you can see this in the IAM portal :- Next, let's connect to our cluster and create our namespace. The we will create role and rolebinding using the following script: Creating namespace kubectl create namespace team-a Creating role.yaml  # role-team-a-dev.yaml apiVersion : rbac.authorization.k8s.io/v1 kind : Role metadata :   name : team-a-developer   namespace : team-a rules :   - apiGroups : [ "" ]     resources : [ "pods" , "pods/log" ]     verbs : [ "get" , "list" , "watch" , "create" , "update" , "delete" ]   - apiGroups : [ "" ]     resources : [ "services...

gke extending subnet for a

Image
We can extended subnet if we running out of ip address in a GKE cluster. To do that first we need to create an extended subnet by using the following command gcloud compute networks subnets create research-extended \   --network=research-aue1-vpc \   --region=australia-southeast1 \   --range=10.20.0.0/20 \   --secondary-range=pods=10.100.0.0/16 Next, we will describe the GKE cluster and list down the subnet that it is currently using  gcloud container clusters describe autopilot-cluster-1 \   --location=australia-southeast1 \   --format="yaml(networkConfig, ipAllocationPolicy)" Afte that we will attached the new subnet to our GKE cluster here by running the following command   gcloud container clusters update autopilot-cluster-1 \   --location=australia-southeast1 \   --additional-ip-ranges=subnetwork=research-extended,pod-ipv4-range=pods And in the console, you can see that we have additional multi-subnet support. The max number of subn...

gcp enabling vpc log flow for a subnet

Image
 To enable VPC log flow for a subnet, we will have to go to this page here :- https://console.cloud.google.com/networking/networks/list and then select tab "Subnets in current projec" And then proceed to select "Manage flow logs" and add new configuration. If you're trying to edit an existing configuration, choose edit. (Or you can click on the blue button next to it)  Next, we will be directed to this page here : Provide a name and specify the configuration for  1. Aggregation time  2. Connection logging sampling rate : I use 50% sampling rate to reduce data size. 3. Status - make sure it is on  Once you're done, let's head over to Flow Analyzer to analyze your traffic   https://console.cloud.google.com/net-intelligence/flow-analyzer Ensure you have upgrade the bucket to support observability. Once you have enabled it, then you will be able to start using to query your vpc flow  And this can be some of the vpc flow logs that is being capture...

gke using workload identity to access secret manager

Image
This is the configuration for our project where we need the cluster name, project name, project number and secret name which looks something like (projects/1092851139093/secrets/first-api-key) In this approach we are using direct federation approach where we don't do service account impersonation and annotation. So we do not create service account. The permission are direct to the service account and namespace.  You can use this approach if you like.  export PROJECT_ID = project-f54eacb9-b4e5-40b9-b0c export PROJECT_NUMBER = 1092851139093 export CLUSTER = autopilot-cluster-1 export LOCATION = us-central1         # <-- change to your cluster's region export NAMESPACE = default export KSA = secret-reader-ksa export SECRET = first-api-key gcloud config set project $PROJECT_ID We need to enable secret manager service API service if you haven't done so  gcloud services enable container.googleapis.com secretmanager.googleapis.com Enable se...

using mcp with google monitoring in gcp

Image
We can configure our agent to call mcp server in gcp. In this setup we are using vscode. Please create mcp.json file and then use the following settings here. We are going to use the ADC route and not the OAuth client id route to do this. For other tool setup like Antigravity you can refer to this link here  https://docs.cloud.google.com/mcp/configure-mcp-ai-application#client-specific-guidance Then place your bear token here. You should be able to get it by running this command and to do some preliminary checks :-  gcloud auth list $token = gcloud auth print-access-token Invoke-RestMethod "https://oauth2.googleapis.com/tokeninfo?access_token=$token" {     "mcpServers" : {         "google-cloud-monitoring-mcp-server" : {             "url" : "https://monitoring.googleapis.com/mcp" ,             "type" : "http" ,             "headers" : {       ...

kyaml in k8s yaml definition

Image
As we are moving away from yaml to kyaml. The code snippet here shows the differences and what sort of conversion we are looking at.  What changed between them YAML KYAML Structure Indentation decides nesting Explicit { } and [ ] , so whitespace no longer matters. Look at ports and env sections  String values Quotes are optional and inconsistent Always double-quoted Keys Quoted or unquoted Unquoted Commas None Present, including a trailing comma after the last item Header None Leading --- , so it can’t be mistaken for broken JSON Comments Allowed Still allowed (JSON can’t do this)  

gcp setting up alert using promql

Image
To setup alert using promql, please goto  ttps://console.cloud.google.com/monitoring/alerting And then select "alerting". Before that place make sure you have configure or setup your "notification" channel.  And then click on "create policy". And we choose "PromQL" and add in our query - as shown here :-  And then we will try to configure - the evaluation window for this alert. We will set it to 5 min. And then we configure our evaluation channel :- Finally we will give our alert a name and click "create policy". 

k8s pod level resource limit definitions for all containers to use

This is an example of a yaml that shows k8s pod level resource limit defintions where containers will shared among themselves.  Yaml can be shown here :- apiVersion : apps/v1 kind : Deployment metadata :   name : my-app   namespace : default   labels :     app : my-app spec :   replicas : 2   revisionHistoryLimit : 5   selector :     matchLabels :       app : my-app   strategy :     type : RollingUpdate     rollingUpdate :       maxSurge : 1       maxUnavailable : 0   template :     metadata :       labels :         app : my-app     spec :       # Pod-level resources: shared by all containers in the pod.       # Stable in Kubernetes 1.37; on older versions it needs the       # PodLevelResources feature gate (beta/on by default from 1.34).       r...

gcp metric explorer using promql

Image
GCP metric explorer supports PromQL. Ideally we should use the UI to help us build our PromQL.  All we need to do is to click on the "Add query" and then we can select the metric that is relevant to us. In this case it is " dns_request_count ". Here is the sample PromQL that is generated.  { "__name__" = "kubernetes_io:pod_volume_utilization" } Memory request utilization over time  avg_over_time ({ "__name__" = "kubernetes.io/container/memory/request_utilization" , "monitored_resource" = "k8s_container" , "pod_name" = "autoscaling-metrics-adapter-857f68dbcd-kmvw8" }[ ${ __interval } ]) Dns request count over time  sum ( rate ({ "__name__" = "kubernetes.io/networking/dns/kubedns/dns_request_count" , "monitored_resource" = "k8s_container" }[ ${ __interval } ])) Add additional criteria  sum ( rate ({ "__name__" = "kubernetes.io/networki...