Professional Cloud DevOps Engineer

Preemptible VMs may be stopped without notice, so they are appropriate for fault-tolerant batch workloads that can be retried. A GPU-based video-rendering platform can resume or rerun interrupted rendering work, while its input and output videos remain durably stored in the storage bucket.

SRE postmortems should result in blameless, concrete preventative action items that improve systems and processes. Requiring successful pre-release execution of test cases that detect the relevant error type directly reduces the likelihood that the same software-change failure reaches users. Google SRE guidance recommends preventative fixes and emphasizes that changing automated systems and processes is more reliable than trying to change human behavior.

Google Cloud Managed Service for Prometheus managed collection is Google’s recommended approach for Kubernetes environments. It collects Prometheus metrics from GKE workloads while the managed Kubernetes operator handles collector deployment, scrape configuration, scaling, and related operational maintenance; the collected data supports Cloud Monitoring querying and alerting.

GKE SYSTEM logging collects system logs required for cluster operations, while WORKLOAD logging collects logs generated by non-system application containers. Configuring the development cluster with --logging=SYSTEM prevents verbose application workload logs from being ingested into Cloud Logging while preserving GKE operational/system logs. About GKE logs

Binary Authorization can require a trusted attestation before an image is deployed to production. An automated load-test workload should create the attestation only after the test succeeds, using an asymmetric signing key held in Cloud KMS. Workload Identity Federation for GKE is the recommended way for a GKE workload to obtain the IAM authorization needed to use Google Cloud APIs, avoiding less-secure, long-lived service account JSON keys stored as Kubernetes Secrets.