Announcing Google Cloud Spanner as a Vault Storage Back End | Hacker News Reader

Announcing Google Cloud Spanner as a Vault Storage Back End

cloudplatform.googleblog.com

126 pointspetercooper43 comments

Isn't Spanner outrageously expensive?

ISTR reading to basically avoid touching Spanner if you're just experimenting or playing around, unless you are prepared to receive a very large bill (something like ~$700/mo. just for the lowest-end setup).

Spanner is relatively more expensive than something like CloudSQL or BigTable, but brings added reliability, availability, and consistency. There are definitely more cost-effective solutions for Vault storage, such as the Google Cloud Storage backend, but at the time of this writing, they do not provide the same guarantees as Spanner.

Ultimately it's about your organization's risk tolerance. If a service is non-critical, non-SPOF, perhaps Spanner is overkill. On the other hand, if you have a service that requires immediate global consistency and availability, such as global secrets management, Spanner is a great choice.

To be clear, this post is not saying "use Spanner with Vault"; it's saying "Spanner is now supported as a Vault storage backend for users who need the features it provides".

FD: I work for Google Cloud

Can you comment on how Spanner differs from AWS’ DynamoDB Global Tables?

I'm not incredibly familiar with DynamoDB Global Tables, but a cursory browse of the marketing page, it looks like:

1. DynamoDB Global Table replication is eventually consistent to all regions; Spanner is strongly consistent in all regions

2. Spanner is a schema-based with SQL language support. DynamoDB is a noSQL store.

I'm sure there are other differences that I am not aware of. DynamoDB is more closely aligned to the Google Cloud Datastore or Bittable offerings (https://cloud.google.com/free/docs/map-aws-google-cloud-plat...). You can read more about the use cases for Spanner here: https://cloud.google.com/spanner/.

FD: I work for Google Cloud.

Thank you! It’s relevant to a project I’m working on; appreciate the reply!

It's not outrageously expensive if you have hit the limits of of Postgres or MySQL or need multi-region replication, but yes, for small amounts of data there's too much overhead from all the redundancy.

Using it for Vault makes more sense if you are already storing other, larger amounts of data. Then the incremental cost is much smaller and more than worth it.

Yes, the pricing for Spanner is fair for what it offers in production (and test). But I really think there should be a cheaper way to use it for dev purposes (and for trying it out). Either running an emulator locally, or on a micro instance equivalent in the cloud.

A Spanner setup that will outperform PostgreSQL on a hefty x86 box will run you close to 150-200K a month.

A hefty box is a SPOF, so that's an apple to oranges comparison. How do you upgrade that machine to a newer Postgres version?

You generally run at least 2 instances

No longer consistent.

No longer consistent if you run two instances since a write may fail to replicate after returning a success to the user.

PG had Synchronous Replication since like 9.2

Then it isn't HA.

Patroni

Availability issue solved!

haha, so you run million of users out of a single box, no HA, sharding, backup / re-import that takes hours ect ... please... It's not all about performance, it's about running a business that's up most of the time.

Did I ever claim millions of users? I said a spanner setup that will outperform PG on big x86 box will cost 150-200K per month. All issues you outline are trivial to solve.

HA is trivial...?

Patroni

To me, spanner’s main draw is automatic sharding and consistency across replicas. If you’re spending less than $700/mo on your database you probably don’t need those features. Why pay for automatic sharding if your workload fits on one machine? Why pay for global consistency if, again, you can fit everything on one machine (and therefore local consistency = global consistency)?

If you want to use spanner but don't have a large data workload I would recommend looking into firestore as it is built on top of spanner.

http://firebase.googleblog.com/2017/10/cloud-firestore-for-r...

Isn't it actually built on top of Datastore?

It is, that is also where the name is coming from (Firebase + Datastore = Firestore).

Firestore also differs a lot from Cloud Spanner, most notably in the way that it can be used directly on the client, whereas Cloud Spanner is meant to be used in combination with a server side application.

Firestore also has server side apis and client libraries. But yeah "same same but different".

Long story short. It's using spanner tech under the hood.

"And for you database aficionados out there, we should point out that our multi-region database offers strong consistency (just like Cloud Spanner!),"

That's not what the quoted text really means; Datastore has a form of strong consistency too. I'm pretty sure Firestore is built on Datastore.

https://cloud.google.com/datastore/docs/concepts/structuring...

I think it’s for the convenience of people that are already using spanner and don’t want an additional data store.

Totally. I'm hoping eventually they add a free or cheap tier of some sort for testing. Otherwise they are locking out a huge number of organizations simply because it is impractical to use something so expensive in development mode.

I would love to be able to use some cheap, basic DB under the Spanner API for ease of migration.

Some stellar marketing. GC should be offering Vault as a service. No one should be running a critical service like this unless you have a team large enough that can support it. Frustratingly AWS KMS + Credstash is as close to a managed vault that's available right now.

Thanks for the feedback. I'll be sure that both our marketing team and product management team receive it :)

FD: I work for Google Cloud

AWS has a solution that awkwardly tucked under the "SSM" product, it's called the Parameter Store.

https://aws.amazon.com/systems-manager/features/#Parameter_S...

I really don't know why they don't spin it out into a separate product, I honesly had no idea it existed until my colleague just happened to stumble across it

Have you tried https://azure.microsoft.com/en-us/services/key-vault/? I haven’t played with it much yet, but it seems to tick the boxes.

Thanks! I'll check it out.

AWS SSM pretty decent as a middle ground.

Oh wow. I had no idea about uts credential store functions. Thanks!

I am using it as a secrets backend for concourse pretty extensively. It's just good enough for that if you lock down the parameters with IAM policies, allowing restrictive get and puts. I am a huge fan of vault, and have run it before when needed though.

Seth joining Google seems to be beneficial for both the companies!

I had to do a double take on the author name. I didn't realize Seth had moved but it certainly seems like a great fit.

Does this remove the limitation that vault reads may only go through the master on the non-enterprise vault version? The global replication is much less useful if reads must go through a single server in a single region.

As of Vault 0.9.4, this is still the case. The leader services all read and write responses. The Spanner backend does enable Vault to run in HA mode, but only a single server will respond to requests.

If, in the future, Vault allows for multi-leader or at least read-only followers to respond, the Spanner backend would support that. Unfortunately this is a limitation in Vault's current architecture, and not something a new storage backend can fix.

Reply on news.ycombinator.com