GCP-PCD

Cloud-Native Design Principles

The Google Cloud Professional Cloud Developer role centers on designing, building, testing, and deploying cloud-native applications that take full advantage of Google-managed services. Strong candidates understand 12-Factor App methodology: codebase in version control, explicit dependencies, environment-based configuration, backing services as attached resources, strict separation of build/release/run, stateless processes, port binding, horizontal scaling via the process model, fast startup/graceful shutdown, dev/prod parity, logs as event streams, and admin processes as one-off tasks. These principles map directly to Cloud Run, Cloud Functions, and GKE workloads.

Event-Driven Patterns

• Pub/Sub: global, at-least-once delivery, push or pull subscriptions, ordering keys (regional), filters, dead-letter topics, exactly-once delivery (preview) for regional topics. Publish throughput auto-scales; subscriber concurrency controls via streaming pull.
• Cloud Tasks: HTTP task queues with rate limiting, retries, per-task scheduling; ideal for async unit-of-work patterns where you need precise retry and deadline control.
• Eventarc: triggers from Audit Logs, Pub/Sub, or third-party sources (via Eventarc Advanced), delivered in CloudEvents format to Cloud Run or GKE.
• Cloud Scheduler: cron-like jobs invoking HTTP, Pub/Sub, or App Engine HTTP targets.
• Workflows: serverless orchestration using YAML; supports retries, parallel branches, and callbacks for long-running approval flows.

Idempotency & Retries

Design handlers to be idempotent: use idempotency keys from clients, deduplicate Pub/Sub messages with message IDs, prefer upserts over inserts, and wrap side-effecting operations in transactions with stable row keys. Configure retry policies with exponential backoff + jitter to avoid thundering herds. Cloud Tasks and Pub/Sub both offer configurable retry windows; Cloud Run responds with 2xx for success, 4xx to drop, and 5xx to request retries from the caller.

gcloud pubsub topics create orders
gcloud pubsub subscriptions create orders-sub \
  --topic=orders \
  --push-endpoint=https://handler-xyz.a.run.app/ \
  --ack-deadline=60 \
  --dead-letter-topic=orders-dlq \
  --max-delivery-attempts=5

Cloud Run (Services & Jobs)

Cloud Run runs stateless containers autoscaled from zero. Two resources: Services (request-driven HTTP/gRPC, long-lived, multiplex requests per container) and Jobs (finite batch tasks with task array support). Choose concurrency carefully: default 80, max 1000. Lower concurrency = more isolation, higher cost. CPU allocation: request-only or always-on (needed for background threads). Second-generation execution environment provides full Linux compatibility and NFS mounts.

gcloud run deploy api \
  --source=. \
  --region=europe-west1 \
  --concurrency=80 \
  --min-instances=1 \
  --max-instances=50 \
  --cpu=1 --memory=512Mi \
  --allow-unauthenticated \
  --set-env-vars=LOG_LEVEL=info \
  --set-secrets=DB_PASSWORD=db-password:latest

Cloud Functions (1st gen vs 2nd gen)

GKE (Autopilot vs Standard)

• Autopilot: Google manages nodes, security, and scaling. Billed per pod resource requests. Good default for most teams.
• Standard: you manage node pools, versions, surge upgrades, and cluster autoscaler. Needed for GPUs/TPUs, Windows nodes, privileged workloads.
• Workload Identity binds KSAs to GSAs (no node-level keys). Always prefer over legacy node service accounts.
• Ingress: GKE Ingress (GCLB), Gateway API, or Multi-cluster Ingress for global routing.

App Engine

Standard environment offers fast scale-to-zero but restricts runtimes to language-specific sandboxes. Flexible runs user-provided containers on managed VMs (slower scale, min 1 instance typical). For new apps, prefer Cloud Run unless you need specific App Engine services like Memcache or Task Queues (legacy).

# app.yaml for App Engine Standard
runtime: python312
instance_class: F2
automatic_scaling:
  min_instances: 0
  max_instances: 10
  target_cpu_utilization: 0.6
env_variables:
  LOG_LEVEL: "info"
handlers:
- url: /.*
  script: auto
  secure: always

Cloud Storage

Object storage with strong consistency. Key concepts for developers:

• Storage classes: Standard, Nearline (30d min), Coldline (90d), Archive (365d). Lifecycle rules transition or delete based on age, version, or custom time.
• Signed URLs: time-limited, use V4 signing; generate via gsutil signurl or client SDK with a service account.
• CORS: set via JSON config to allow browser-based uploads/downloads.
• Resumable uploads for files > 5MB; composite objects via compose.
• Versioning protects against accidental overwrites; turbo replication provides 15-min RPO across regions.
• Uniform vs fine-grained access: uniform (recommended) uses IAM exclusively; fine-grained adds ACLs.

Firestore

Firestore comes in two modes: Native (real-time, offline, mobile/web SDKs) and Datastore (single-region, server-side only, GQL). Pick mode at database creation - you cannot switch. Scales to millions of ops/sec globally. Best practices: keep writes < 1/sec per document, avoid monotonic key patterns, use composite indexes for multi-field queries, model hot counters as distributed counters (sharded).

// Firestore transaction in Node.js
const {Firestore} = require('@google-cloud/firestore');
const db = new Firestore();

await db.runTransaction(async (t) => {
  const ref = db.collection('accounts').doc('A1');
  const snap = await t.get(ref);
  const bal = snap.data().balance - 100;
  t.update(ref, {balance: bal});
});

Relational & Scale-out

• Cloud SQL: managed MySQL/Postgres/SQL Server. Regional HA (sync standby in another zone), read replicas (cross-region supported), Point-in-Time Recovery with binary logs / WAL, IAM database authentication.
• Cloud Spanner: horizontally scalable relational with external consistency (TrueTime). Choose multi-region for 99.999%. Schema design: avoid hot spots, use UUIDv4 or reverse timestamp keys, interleave child tables for locality.
• AlloyDB: PostgreSQL-compatible with columnar accelerator, 4x faster than Cloud SQL Postgres for analytical queries.

Bigtable, Memorystore, BigQuery

Connecting from Serverless

Cloud Run and Functions use Serverless VPC Connector or Direct VPC Egress to reach private resources (Memorystore, Cloud SQL private IP, Compute VMs). For Cloud SQL, prefer Cloud SQL Auth Proxy or the Go/Java/Python connector libraries with IAM authentication.

Cloud Build

Fully managed CI runner that executes cloudbuild.yaml steps in sequence or parallel (waitFor). Triggers can listen to Cloud Source Repositories, GitHub, GitLab, or Bitbucket. Common patterns include building container images, running tests, deploying to Cloud Run/GKE/App Engine, and executing Terraform plans.

steps:
  - name: gcr.io/cloud-builders/docker
    args: ['build','-t','europe-west1-docker.pkg.dev/PROJECT/apps/api:$SHORT_SHA','.']
  - name: gcr.io/cloud-builders/docker
    args: ['push','europe-west1-docker.pkg.dev/PROJECT/apps/api:$SHORT_SHA']
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk
    entrypoint: gcloud
    args: ['run','deploy','api','--image','europe-west1-docker.pkg.dev/PROJECT/apps/api:$SHORT_SHA',
           '--region','europe-west1','--quiet']
options:
  logging: CLOUD_LOGGING_ONLY
  machineType: E2_HIGHCPU_8
substitutions:
  _ENV: production
timeout: 1200s

Artifact Registry

• Regional or multi-regional repos for Docker, Maven, npm, Python, apt, yum, Helm, Go, generic.
• VPC-SC compatible, supports CMEK, virtual repositories (aggregate multiple upstream repos).
• Enable vulnerability scanning with Artifact Analysis (Container Analysis + OS scan).
• Authenticate via gcloud auth configure-docker REGION-docker.pkg.dev.
• Use immutable tags and digest-based pulls to avoid drift.

Cloud Deploy (Continuous Delivery)

Google's managed CD service for Cloud Run, GKE, Anthos, and on-prem. Pipelines promote a release through ordered targets (dev → staging → prod). Supports canary, blue/green, custom strategies, approval gates, automated rollback. Verify steps run Cloud Build jobs; deploy hooks attach pre/post validations.

Dockerfile Best Practices

# Multi-stage build for Go
FROM golang:1.22-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /out/app ./cmd/api

FROM gcr.io/distroless/static:nonroot
COPY --from=build /out/app /app
USER nonroot
ENTRYPOINT ["/app"]

Supply Chain Security

• Enable Binary Authorization on Cloud Run or GKE to allow only signed images.
• Use SLSA build provenance generated by Cloud Build.
• Pin base images by digest; rebuild weekly to pick up CVE patches.
• Scan with Artifact Analysis; automate PRs via Container Registry attestations.

Cloud Logging

Structured logs written as JSON are automatically parsed and indexed. Use severity, trace, spanId, and logging.googleapis.com/labels fields. Log Router sinks forward to BigQuery, Cloud Storage, Pub/Sub, or another project (aggregated sinks at org level). Log buckets default 30 days; use custom buckets for longer retention or regional compliance.

{
  "severity": "ERROR",
  "message": "Payment declined",
  "logging.googleapis.com/trace": "projects/P/traces/abc123",
  "orderId": "ord_42",
  "amountCents": 1999
}

Cloud Monitoring

• Uptime checks: synthetic HTTPS/TCP probes from multiple regions, tied to alert policies.
• Alert policies: metric threshold, MQL, PromQL (Managed Prometheus), or log-based.
• SLOs: define SLIs (availability, latency), burn rate alerts (fast / slow), error budgets.
• Dashboards: custom or prebuilt; group by service, label, or resource.
• Metrics explorer supports PromQL and MQL; export via Monitoring API or BigQuery export.

Error Reporting, Trace, Profiler, Debugger

OpenTelemetry on GCP

Google is standardizing on OpenTelemetry for traces and metrics. Ops Agent (on VMs) and managed workloads (Cloud Run, GKE) auto-collect. Use the opentelemetry-exporter-gcp-trace or OTLP exporter → Managed Service for Prometheus.

from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.exporter.cloud_trace import CloudTraceSpanExporter
from opentelemetry.sdk.trace.export import BatchSpanProcessor

provider = TracerProvider()
provider.add_span_processor(BatchSpanProcessor(CloudTraceSpanExporter()))
trace.set_tracer_provider(provider)
tracer = trace.get_tracer(__name__)

with tracer.start_as_current_span("charge-card"):
    charge(order_id)

API Management

• Apigee: full API gateway with analytics, developer portal, monetization, policy-driven routing. Deployment: Apigee X (paid, GCP-native) or hybrid.
• API Gateway: lightweight, managed gateway for OpenAPI specs, backs Cloud Run/Functions/App Engine. Good for internal APIs.
• Cloud Endpoints: OpenAPI/gRPC with ESP/ESPv2 sidecar; authentication via JWT, API keys.
• Versioning strategies: URI path (/v1), header (Accept), or content negotiation; maintain backwards compatibility.

Identity & Access

End-User Authentication

• Identity Platform / Firebase Auth: consumer identity, social, SAML/OIDC, MFA.
• IAP (Identity-Aware Proxy): sits in front of Cloud Run, App Engine, GCE, GKE; enforces Google identity and context-aware access.
• Cloud Endpoints + JWT: verify Firebase or Google ID tokens.
• OAuth 2.0 / OIDC: use Google Sign-In or IdP - never store passwords yourself.

Secret Manager

Store credentials, API keys, certificates. Each secret has versions; enable rotation and automatic expiration. Grant roles/secretmanager.secretAccessor to the runtime service account. Mount secrets in Cloud Run with --set-secrets (volume or env) and GKE via the Secret Manager CSI driver.

gcloud secrets create db-password --replication-policy=automatic
echo -n "s3cret!" | gcloud secrets versions add db-password --data-file=-
gcloud run services update api --set-secrets=DB_PASSWORD=db-password:latest

Encryption & Networking

• Default encryption at rest for all GCP storage; optional CMEK via Cloud KMS for regulatory needs.
• CSEK (customer-supplied) for Compute/Storage when you must hold the keys.
• VPC Service Controls (VPC-SC) create perimeters around APIs to stop data exfiltration.
• Private Service Connect to expose internal APIs; Cloud Armor for WAF (OWASP CRS, bot management, Adaptive Protection).
• mTLS: terminate at Global External HTTPS Load Balancer or use Service Mesh (Cloud Service Mesh / Anthos SM).

Testing & Local Development

• Firestore/Pub/Sub/Spanner emulators via gcloud beta emulators for integration tests.
• Skaffold for iterative GKE/Cloud Run development; Cloud Code IDE extensions for VS Code and JetBrains.
• gcloud run services proxy or run services revisions-url for local testing against cloud services.
• Use Cloud Build private pools for tests that need VPC access.