Professional Cloud DeveloperDemo

An application-created committed write stream, used with stream offsets, provides exactly-once write semantics in the BigQuery Storage Write API. The default stream provides only at-least-once semantics and can produce duplicates; external Kafka or Pub/Sub deduplication adds unnecessary operational complexity.

Workforce Identity Federation enables workforce users from an external IdP to use SSO for Google Cloud access. Attribute mapping can populate google.display_name and google.profile_photo, which set the signed-in user's name and profile image in the Google Cloud console.

Cloud Run is a fully managed serverless platform for deploying container images. It abstracts infrastructure management and does not require creating or operating a Kubernetes cluster or virtual machine, making it the lowest-operational-complexity choice for a containerized application with no OS dependencies.

Cloud Spanner is a fully managed, globally distributed relational database that provides strong transactional consistency, automatic synchronous replication, and horizontal scalability. These capabilities support consistent application state across regions, increasing concurrent-user demand, high availability, and reduced infrastructure-management overhead. Google Cloud Spanner documentation

Cloud Armor protects applications behind an external Application Load Balancer from DDoS attacks and web attacks including SQL injection and XSS. Apigee can enforce OAuth 2.0 access-token validation before traffic reaches the GKE backend, including returning HTTP 403 when an otherwise valid token lacks the required scope. This places edge protection and API authorization in front of the microservices.

Cloud Spanner range-shards data by primary key. Version 1 UUIDs contain a timestamp in their high-order bits, causing newly inserted primary-key values to cluster in the same range. The resulting write hotspot overloads a split and limits throughput, so performance does not scale linearly.

A lower CPU utilization target makes a Compute Engine managed instance group scale out before the existing instances are as heavily loaded, preserving capacity headroom and helping prevent latency spikes. The initialization (formerly cool-down) period controls how long the autoscaler ignores utilization data from newly created VMs during scale-out; reducing an unnecessarily long period allows those instances to contribute to autoscaling decisions sooner.

Cloud Firestore is a managed mobile-oriented database that synchronizes data across client applications. Its offline persistence caches actively used data, permits reads, writes, listeners, and queries while offline, and synchronizes local changes after reconnection. Real-time listeners deliver updated snapshots whenever the watched documents or query results change.

Resource quotas manage the CPU, memory, and object resources that a namespace can consume, preventing one tenant from using more than its assigned share of a shared cluster. A LimitRange can set default compute resource requests and limits for resources in a namespace, so workloads without explicit values still have defined scheduling requirements. Together, per-team namespaces with ResourceQuotas and namespace LimitRanges provide controlled, predictable resource sharing.

Cloud Storage customer-supplied encryption-key requests made through the REST APIs must include the AES256 algorithm, the Base64-encoded AES-256 key, and the Base64-encoded SHA-256 hash of that key. A read request that omits the required SHA-256 hash is invalid and can return an HTTP 400 error.

Pub/Sub ingests and distributes streaming device events, and Dataflow provides managed stream and batch data-processing pipelines. Firestore is suitable for transactional application data, whereas BigQuery is the analytical data warehouse used for SQL queries. This produces the service sequence Pub/Sub, Dataflow, Firestore, and BigQuery.

Container Analysis automatic scanning is designed for container images pushed to Artifact Registry. After the scanning API is enabled, each new image pushed to Artifact Registry is scanned for supported OS-package vulnerabilities, and the vulnerability metadata is continuously updated as new vulnerability information becomes available. This avoids manual, per-image on-demand scans and preserves visibility into vulnerabilities at every severity.

Cloud Build provides managed CI and can use a build trigger to automatically run a build when code is pushed to Cloud Source Repositories. This avoids operating Jenkins, virtual machines, or custom event-processing services.

A phased replacement of features with appropriately scoped microservices enables incremental migration while the monolith continues to provide the remaining functionality. This strangler-fig approach reduces disruption and risk compared with a single large refactor or a complete replacement delivered only at the end. Google Cloud recommends moving services incrementally and iteratively rather than treating the change as a big-bang project.

Stackdriver Debug Logpoints dynamically add log statements to a running application without rebuilding or redeploying it. They can record code-level values and behavior as the selected execution path runs, supporting diagnosis over time.

GKE control-plane authorized networks restrict access to an IP-based public endpoint by source IP address. If Cloud Shell’s outgoing external IP address is not included in the cluster’s authorized-network CIDR ranges, requests to the Kubernetes control plane cannot connect and can time out. IAM or Kubernetes RBAC authorization failures would instead occur after connectivity is established and return an authorization-related error.

Firestore is a flexible document database with nested, semi-structured data, ACID properties for writes, transaction support, and strongly consistent queries. A regional Firestore location replicates data across multiple zones, while multi-region locations further improve availability. Firestore supports direct mobile and web SDK access without an intermediary server, as well as Node.js server client libraries when a middle tier is needed. Its mobile and web SDKs cache active data, allow reads and writes while offline, and synchronize changes after connectivity returns.

The Cloud SQL Python Connector provides secure, IAM-authorized connectivity for Python applications while avoiding manual IP allowlisting and certificate management. A service account used for this connectivity must have a role containing the cloudsql.instances.connect permission, such as Cloud SQL Client.

Workload Identity Federation for GKE is the recommended mechanism for workloads to access Google Cloud APIs because it provides distinct, fine-grained IAM identities without service-account key files. Enable it on the GKE cluster, then bind each Kubernetes service account to the appropriate Google service account using the roles/iam.workloadIdentityUser role.

roles/run.invoker is sufficient for authenticated invocation, but internal ingress also restricts the network path that may reach the Cloud Run service. Pub/Sub push subscriptions are recognized as internal Google Cloud traffic for a Cloud Run service with internal ingress, and Pub/Sub can authenticate the push request using a service account granted the Cloud Run Invoker role. Cloud Scheduler can therefore publish to Pub/Sub, which invokes the service without exposing it through an external load balancer.

A feature flag decouples deployment of the code from release of the functionality. The feature can remain disabled initially, be enabled for a small group of users, and be progressively enabled for more users only after the third-party service proves reliable. If issues occur, disabling the flag immediately removes access to the functionality without requiring a full application rollback.

A single Pub/Sub topic can accept events from all authentication-service instances. Multiple audit-service instances can pull from the same pull subscription, with Pub/Sub distributing a subset of messages to each instance; this provides load-balanced consumption without duplicating every event to every audit worker. Pull subscriptions are suited to high-volume, throughput-critical processing.

A registry in a dedicated operations project centralizes image management. The Cloud Build service account from each development project can be granted the appropriate write permissions on the registry’s backing storage in the operations project, enabling cross-project image pushes without distributing or storing long-lived credentials. Container Registry uses Cloud Storage roles for access control, including write access to existing registry hosts.

Chaos engineering intentionally introduces controlled failure scenarios to evaluate fault tolerance, observe application behavior during disruptions, and verify recovery. Google Cloud guidance for recovery testing recommends simulating failures and escalating scenarios to assess system resilience and fault tolerance.