GCP: Overview

College Credits

Google learning and cloud content divides into at least the following kinds:

1. Google Certification
   • Proctored examinations through Pearson.
   • These are not ACE College Credit eligible in-of-themselves (although they are more valuable professionally).
2. Google Certificates
   • Through skills.google/
   • Not all Google Courses, Labs, etc. result in a Certificate.
   • In fact only a handful do - and of these only those described here are ACE College Credit eligible.
3. Coursera Certificates
   • These are offered through Coursera but don't automatically confer a Google Certificate nor a Google Certification.
   • These don't appear to be ACE College Credit eligible.

Idioms

Ways that Google defines/does things:

• PaaS - a "type of cloud computing service lets you bind your application code to libraries that give access to the infrastructure your application needs".
• FaaS - Function-as-a-Service a subset of PaaS.
• Virtual Private Cloud (VPC) - a "secure, individual, private cloud-computing model hosted within a public cloud".

Some Quick Comparison with AWS

• Subnets

  • Are actually Regional (spanning multiple Zones) in GCP.
  • (In AWS, these are restricted to single Available Zones.)

• Cloud Load Balancer

  • Load balances between Compute Engine Regions in GCP.
  • (In AWS, these typically load balance within the same Region althought there are some exceptions)

• Projects

  • Permissions, environments, etc. are usually grouped by Project in GCP.
  • (In AWS, these are usually grouped by Account or Organizational Unit.)

• Billing

  • Projects require a Billing Account to use paid features.
  • Billing Account are associated with one or more Projects.

• Google App Engine's most direct comparison is AWS Lightsail.

  • Developers focus solely on source code (rather than the underlying infrastructure), to quickly skaffold and deploy apps.

• GKE vs. EKS

  • Respective Kubernetes Services
  • GKE is classified as a PaaS using GCP's classification taxonomies.

Cost Summary

• Generally, AWS is better for high-traffic, resource and data intensive Enterprise operations (it has slightly better discount data and I/O rates, better Instance Reservation discounts, and better pricing for Large Tier Instances and SSD).
  • At scale, GCP quickly becomes more expensive.
• GCP is slightly more cost-performant (roughly 10%) for low-volume, low-traffic, Applications demanding smaller Containers and Compute Instances.
  • It's also often considered to have better NVIDIA and GPU support although AWS has continued to mature its offerings.

Studies, models, cost comparisons:

1. https://www.qovery.com/blog/google-cloud-vs-aws-cost-breakdown-by-service
2. https://spot.rackspace.com/blog/cloud-computing-cost
3. https://www.usage.ai/blogs/finops/multi-cloud/cloud-pricing-comparison/

Resources and Links

1. https://docs.aws.amazon.com/whitepapers/latest/real-time-communication-on-aws/cross-region-dns-based-load-balancing-and-failover.html
2. https://www.acenet.edu/National-Guide/Pages/Organization.aspx?oid=3fdb1492-e04f-e911-a97b-000d3a363c81
3. https://www.qovery.com/blog/google-cloud-vs-aws-cost-breakdown-by-service
4. https://spot.rackspace.com/blog/cloud-computing-cost
5. https://www.usage.ai/blogs/finops/multi-cloud/cloud-pricing-comparison/

GCP: Google Cloud Computing Foundations Certificate

Cloud Computing Fundamentals

Notes.

Best ways to interact with Google Cloud Resources:

• Google Cloud CLI
• Google Cloud Console
• Official Google Cloud Client Libraries and Google API Client Libraries

Useful Google Cloud Shell Commands

Used in many Google Skill Labs and Challenges.

Note that the early Skill Labs and Challenges tend to be Imperative (emphasizing sequences of CLI commands for new users to gain familiarity).

Google Cloud Shell (gcloud through the interactive terminal):

gcloud config set compute/region asia-southeast1
gcloud config get-value compute/region
gcloud config set compute/zone asia-southeast1-a
gcloud config get-value compute/zone

gcloud compute project-info describe --project $(gcloud config get-value project)

# Define an Environment Variable
export PROJECT_ID=$(gcloud config get-value project)
export ZONE=$(gcloud config get-value compute/zone)
export REGION=$(gcloud config get-value compute/region)
echo -e "PROJECT ID: $PROJECT_ID\nZONE: $ZONE\nZONE: $REGION"

Resources and Links

1. https://www.skills.google/paths/36

GCP: CCF VMs

Virtual Machines

# Create VM
## Used in several skill labs
gcloud compute instances create www1 --machine-type e2-medium --zone $ZONE
gcloud compute instances create www2 \
    --zone=asia-southeast1-b \
    --tags=network-lb-tag \
    --machine-type=e2-small \
    --image-family=debian-12 \
    --image-project=debian-cloud \
    --metadata=startup-script='#!/bin/bash
      apt-get update
      apt-get install apache2 -y
      service apache2 restart
      echo "<h3>Web Server: www1</h3>" | tee /var/www/html/index.html'
## Then list and filter them
gcloud compute instances list
gcloud compute instances list --filter="name=('www1')"

# SSH
gcloud compute ssh www2 --zone $ZONE

# Deploy contents of current directory to App Engine
gcloud app deploy
gcloud app browse

Resources and Links

1. https://www.skills.google/paths/36

GCP: CCF Compute

Compute Services Comparison

Resources and Links

1. https://www.skills.google/paths/36
2. https://docs.cloud.google.com/compute/docs/tutorials/high-scalability-autoscaling

GCP: CCF Load Balancers

Load Balancers

gcloud config set compute/region asia-southeast1
gcloud config set compute/zone asia-southeast1-b
export ZONE=$(gcloud config get-value compute/zone)
export REGION=$(gcloud config get-value compute/region)

Network Load Balancer:

https://www.skills.google/paths/8/course_templates/648

gcloud compute instances create web1 \
  --zone=$ZONE\
  --tags=network-lb-tag \
  --machine-type=e2-small \
  --image-family=debian-12 \
  --image-project=debian-cloud \
  --metadata=startup-script='#!/bin/bash
      apt-get update
      apt-get install apache2 -y
      service apache2 restart
      echo "<h3>Web Server: web1</h3>" | tee /var/www/html/index.html'

gcloud compute firewall-rules create www-firewall-network-lb \
  --target-tags network-lb-tag --allow tcp:80
gcloud compute addresses create network-lb-ip-1 \
  --region $REGION
gcloud compute http-health-checks create basic-check
gcloud compute target-pools create www-pool \
  --region $REGION --http-health-check basic-check
gcloud compute target-pools add-instances www-pool \
    --instances web1,web2,web3
gcloud compute forwarding-rules create www-rule \
    --region $REGION \
    --ports 80 \
    --address network-lb-ip-1 \
    --target-pool www-pool

Application Load Balancer:

• Managed Instance Group - akin to an Autoscaling Group.
• Backend Service - akin to a Target Group, how the Managed Instance Group is associated with the Load Balancer.
• Target HTTP Proxy - akin to AWS ELB Listeners.
• URL Maps, Global Forwarding Rule - akin to AWS Route 53 Records.

gcloud compute instance-templates create lb-backend-template \
   --region=$REGION \
   --network=default \
   --subnet=default \
   --tags=allow-health-check \
   --machine-type=e2-medium \
   --image-family=debian-12\
   --image-project=debian-cloud \
   --metadata=startup-script='#!/bin/bash
     apt-get update
     apt-get install apache2 -y
     a2ensite default-ssl
     a2enmod ssl
     vm_hostname="$(curl -H "Metadata-Flavor:Google" \
     http://169.254.169.254/computeMetadata/v1/instance/name)"
     echo "Page served from: $vm_hostname" | \
     tee /var/www/html/index.html
     systemctl restart apache2'

# Managed Instance Group
## Automatically creates and associates VM Instances 
## using the Template created above.
gcloud compute instance-groups managed create lb-backend-group \
  --template=lb-backend-template --size=2 --zone=$ZONE

# Health Checks, Firewall Rules
## Make sure the Tags match!
gcloud compute firewall-rules create fw-allow-health-check \
  --network=default \
  --action=allow \
  --direction=ingress \
  --source-ranges=130.211.0.0/22,35.191.0.0/16 \
  --target-tags=allow-health-check \
  --rules=tcp:80
gcloud compute addresses create lb-ipv4-1 \
  --ip-version=IPV4 \
  --global
gcloud compute health-checks create http http-basic-check \
  --port 80

# Create the Backend Service...
gcloud compute backend-services create web-backend-service \
  --protocol=HTTP \
  --port-name=http \
  --health-checks=http-basic-check \
  --global
## ...and Associate the Managed Instance Group
gcloud compute backend-services add-backend web-backend-service \
  --instance-group=lb-backend-group \
  --instance-group-zone=asia-southeast1-b \
  --global

# Expose the Application Load Balancer
gcloud compute url-maps create web-map-http \
  --default-service web-backend-service
## And define listeners
gcloud compute target-http-proxies create http-lb-proxy \
  --url-map web-map-http
gcloud compute forwarding-rules create http-content-rule \
  --address=lb-ipv4-1\
  --global \
  --target-http-proxy=http-lb-proxy \
  --ports=80

Resources and Links

1. https://www.skills.google/paths/36
2. https://www.skills.google/paths/8/course_templates/648
3. https://docs.cloud.google.com/compute/docs/tutorials/high-scalability-autoscaling

GCP: CCF Security

Secure a Bastion

export ZONE="asia-south1-b"
export REGION="asia-south1"
export TAG_ONE=accept-ssh-iap-ingress-ql-609
export TAG_TWO=accept-http-ingress-ql-609
export TAG_THREE=accept-ssh-internal-ingress-ql-609

gcloud compute firewall-rules delete open-access

gcloud compute instances start bastion --zone=$ZONE

gcloud compute instances add-tags bastion \
    --zone=$ZONE \
    --tags=$TAG_ONE

gcloud compute firewall-rules create allow-ssh-iap-ingress \
    --network acme-vpc \
    --direction=INGRESS \
    --action=ALLOW \
    --rules=tcp:22 \
    --source-ranges=35.235.240.0/20 \
    --target-tags=$TAG_ONE

gcloud compute instances add-tags juice-shop \
    --zone=$ZONE \
    --tags=$TAG_TWO

gcloud compute firewall-rules create allow-http-juice-shop \
    --network acme-vpc \
    --direction=INGRESS \
    --action=ALLOW \
    --rules=tcp:80 \
    --source-ranges=0.0.0.0/0 \
    --target-tags=$TAG_TWO

gcloud compute instances add-tags juice-shop \
    --zone=$ZONE \
    --tags=$TAG_THREE

## Subnet must be represented by exact IP Range
### Fetch it
export MGMT_SUBNET_RANGE=$(gcloud compute networks subnets describe acme-mgmt-subnet \
    --region=$REGION \
    --format="value(ipCidrRange)")

gcloud compute firewall-rules create allow-ssh-internal-ingress \
    --network=acme-vpc \
    --direction=INGRESS \
    --action=ALLOW \
    --rules=tcp:22 \
    --source-ranges=$MGMT_SUBNET_RANGE \
    --target-tags=$TAG_THREE

## SSH in then run
gcloud compute ssh juice-shop --internal-ip

Resources and Links

1. https://www.skills.google/paths/36

GCP: CCF Data and Storage

Big Query Dataflow

gcloud services disable dataflow.googleapis.com --project qwiklabs-gcp-02-3087b0d6e7e5 --force
gcloud services enable dataflow.googleapis.com --project qwiklabs-gcp-02-3087b0d6e7e5

bq mk lab_737
## Create Table in the UI
## Create Bucket in the UI
## Create Dataflow from batch template "Text Files on Cloud Storage to BigQuery"

Managed Apache Spark

gcloud dataproc clusters create example-cluster \
  --region=us-central1 \
  --master-machine-type=n2d-standard-2 \
  --master-boot-disk-type=pd-standard \
  --master-boot-disk-size=100GB \
  --worker-machine-type=n2d-standard-2 \
  --worker-boot-disk-type=pd-standard \
  --worker-boot-disk-size=100GB \
  --num-workers=2
## Create a Job through the UI

GCP Databases

Of course other Databases can still be deployed and used (say from GCP Cloud Marketplace) but these aren't Managed by Google and aren't GCP products themselves (varying licensing).

A relevant example is MongoDB:

1. Unlike AWS, MongoDB isn't a full Service offering (GCP has fewer native NoSQL solutions overall).
2. MongoDB can still be provisioned on a VM, through GKE, or via Managed (Enterprise) Atlas MongoDB (third-party Management through MongoDB Inc., not GCP itself).

Resources and Links

1. https://www.skills.google/paths/36
2. https://www.mongodb.com/products/platform/atlas-cloud-providers/google-cloud

GCP: CCF Machine Learning

Google Cloud Speech-to-Text

## Create an API Key
export API_KEY=<YOUR_API_KEY>
## SSH into a Linux VM
touch request.json

nano request.json
## Copy contents into request.json
### {
###   "config": {
###       "encoding":"FLAC",
###       "languageCode": "en-US" 
###   },
###   "audio": {
###       "uri":"gs://cloud-samples-tests/speech/brooklyn.flac"
###   }
### }

curl -s -X POST -H "Content-Type: application/json" --data-binary @request.json \
"https://speech.googleapis.com/v1/speech:recognize?key=${API_KEY}"

curl -s -X POST -H "Content-Type: application/json" --data-binary @request.json \
"https://speech.googleapis.com/v1/speech:recognize?key=${API_KEY}" > result.json

## Upload and rename result.json to and within the relevant bucket

Cloud Natural Language API

export GOOGLE_CLOUD_PROJECT=$(gcloud config get-value core/project)

gcloud iam service-accounts create my-natlang-sa \
  --display-name "my natural language service account"

gcloud iam service-accounts keys create ~/key.json \
  --iam-account my-natlang-sa@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com

export GOOGLE_APPLICATION_CREDENTIALS="/home/USER/key.json"

## SSH into a VM
gcloud ml language analyze-entities --content="Old Norse texts portray Odin as one-eyed and long-bearded, frequently wielding a spear named Gungnir and wearing a cloak and a broad hat." > result.json
## Upload and rename result.json to and within the relevant bucket

Resources and Links

1. https://www.skills.google/paths/36
2. https://www.skills.google/paths/36/course_templates/631

GCP: Associate Cloud Engineer Certification

https://cloud.google.com/learn/certification/cloud-engineer/

I'd highly recommend this great Udemy course.

gcloud

For many gcloud compute operations, these are two primary commands (not compute/zone) since many GCP Compute Engine Resources are multi-Zone.

gcloud auth login
gcloud config set project my-project

Application Default Credentials

• GOOGLE_APPLICATION_CREDENTIALS used to find your Service Account JSON Key File.
• This will be automatically discovered once set through Application Default Credentials (ADC).

https://docs.cloud.google.com/docs/authentication/application-default-credentials

Resources and Links

1. https://www.skills.google/paths/11/course_templates/1403
2. https://docs.cloud.google.com/docs/authentication/application-default-credentials

GCP: ACE Organization

Cloud Billing

Centralized Cloud Billing Account

• A Centralized Cloud Billing Account is typically associated with an entire Organization (and all billable Resources through their respective Projects).
• A Centralized Cloud Billing Account can add company credit cards, grant access to those payment methods (but without sharing payment method details like a card card number).
• Engineers can be granted the Project Creator (roles/resourcemanager.projectCreator) and Billing Account User (roles/billing.user) Roles to both create new Projects and associate them with a Cloud Billing Account or Organization.

gcloud

For many gcloud compute operations, these are two primary commands (not compute/zone) since many GCP Compute Engine Resources are multi-Zone.

gcloud auth login
gcloud config set project my-project

IAM

GCP Hierarchy

• GCP Organization - consist of one or more GCP Folders.
• GCP Folders - consist of one or more GCP Projects.
• GCP Projects - consist of one or more GCP Services.

GCP Organization Policies apply at the GCP Organization level and are akin to:

• AWS Permission Boundaries and AWS Service Control Policies.
• GCP Organization Policies apply Constraints to all/specific Folders, Projects within the Organization (rather than ALLOW/DENY statements).

Billing typically happens at the GCP Project level.

https://docs.cloud.google.com/iam/docs/resource-hierarchy-access-control

Resources and Links

1. https://www.skills.google/paths/11/course_templates/1403
2. https://docs.cloud.google.com/iam/docs/resource-hierarchy-access-control

GCP: ACE Compute

Google Cloud Dynamic Workload Scheduler

https://cloud.google.com/blog/products/compute/introducing-dynamic-workload-scheduler

Cloud Run Functions vs. Cloud Tasks

Both are commonly used together:

1. A specific action is initiated by a Cloud Task acting as a Client that calls some Cloud Run Function.
2. The Cloud Run Function processes/handles that Request eventually returning the Response back the to calling Cloud Task.

https://docs.cloud.google.com/tasks

Compute Services

Minimum number of Instances:

• GCP App Engine Flexible Environment cannot scale an active application version down to 0 Instances.
• GCP Cloud Run can.

GCP Compute Engine Preemptible VMs can only run for up to 24 hours.

Service Accounts

GCP recommends creating a Service Account and attaching that to a Compute Engine VM with minimal IAM Roles sufficient to perform its tasks.

Resources and Links

1. https://cloud.google.com/blog/products/compute/introducing-dynamic-workload-scheduler
2. https://www.skills.google/paths/11/course_templates/1403
3. https://docs.cloud.google.com/tasks

GCP: ACE Load Balancers

Network Load Balancers

Passthrough Network Load Balancers don't terminate the Connection between the Client and target.

By contrast:

1. Network Load Balancer with TCP Proxy will first terminate the Connection between the Client and Load Balancer.
2. Then open a Connection from Load Balancer to the target.

DNS

CNAME entries can't be associated with AWS Route 53 roots or GCP Load Balancer IP Addresses directly so in both cases:

1. Use an ALIAS (A record).

Resources and Links

1. https://docs.cloud.google.com/load-balancing/docs/passthrough-network-load-balancer

GCP: ACE Networking

Shared VPC

1. Create a Shared VPC in a Project (Host Project).
2. Attach Projects to the Host Project.
3. Hierarchical Rules, IAM Roles, Firewall Policies, etc. apply.

Resources and Links

1. https://docs.cloud.google.com/vpc/docs/provisioning-shared-vpc

GCP: ACE Deployments

Resource Management, Deployments

Managed Instance Group

• Will apply updates automatically if set to proactive.
• https://docs.cloud.google.com/compute/docs/instance-groups/updating-migs

GCP Config Connector

• Allows GCP Resources to be managed through Kuberetes.

GCP Application Design Center

• GCP Service akin to AWS Service Catalog that allows approved Terraform templates to be shared and used.
• https://docs.cloud.google.com/application-design-center/docs/application-centric-google-cloud

GCP Infrastructure Manager

• Newer GCP Service that manages Terraform configurations, deployments, etc. automatically.
• Akin to AWS Cloud Formation

Deployment Strategy (very high-level overview):

Resources and Links

1. https://docs.cloud.google.com/compute/docs/instance-groups/updating-migs
2. https://cloud.google.com/blog/products/compute/introducing-dynamic-workload-scheduler
3. https://docs.cloud.google.com/vpc/docs/private-service-connect
4. https://docs.cloud.google.com/vpc/docs/private-services-access
5. https://docs.cloud.google.com/vpc/docs/private-google-access
6. https://www.skills.google/paths/11/course_templates/1403
7. https://medium.com/google-cloud/part-i-gke-managed-dranet-with-tpus-ece22b31e4d9
8. https://github.com/GoogleCloudPlatform/cluster-toolkit/tree/main/examples/gke-tpu-v6e
9. https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway
10. https://docs.cloud.google.com/application-design-center/docs/application-centric-google-cloud
11. https://docs.cloud.google.com/tasks
12. https://docs.cloud.google.com/alloydb/docs/overview
13. https://cloud.google.com/database-migration
14. https://docs.cloud.google.com/iam/docs/resource-hierarchy-access-control

GCP: ACE GKE

Features

Inference Gateway:

1. https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway

GKE Autopilot

1. Teams can still manage Deployments, Services, ConfigMaps, and Horizontal Autoscaling policies.
2. GCP will handle configuration and management of worker Nodes, Node Pools, and most Cluster infrastructure.

GKE Kubernetes LoadBalancer is the primary way to expose access to the Public Internet. (Not ClustIP which is used for coordinating IP Addresses within the Clusters.)

Resources and Links

1. https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway
2. https://www.skills.google/paths/11/course_templates/1403

GCP: ACE Machine Learning

XLA

Accelerated Linear Algebra (XLA) integrates with existing, widely used, ML libraries while offering deep compiler-level optimizations:

1. PyTorch/XLA
2. JAX/XLA

GKE TPU

Kubernetes added DRA in 2025:

1. ResourceClaims were added then as well.
2. Kubernetes workloads are often used to manage AI workloads in the cloud (GKE, TPU, DRA).

See:

1. https://www.skills.google/paths/11/course_templates/1403
2. https://medium.com/google-cloud/part-i-gke-managed-dranet-with-tpus-ece22b31e4d9
3. https://github.com/GoogleCloudPlatform/cluster-toolkit/tree/main/examples/gke-tpu-v6e

Resources and Links

1. https://www.skills.google/paths/11/course_templates/1403
2. https://medium.com/google-cloud/part-i-gke-managed-dranet-with-tpus-ece22b31e4d9
3. https://github.com/GoogleCloudPlatform/cluster-toolkit/tree/main/examples/gke-tpu-v6e
4. https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway

GCP: ACE Data and Storage

Other Database Services

GCP AlloyDB (for PostgresSQL)

• Fully managed PostgresSQL on GCP.
• Significantly faster performance than traditional PostgresSQL.
• Massive scaling capabilities (vastly exceeding what PostgresSQL can handle data-wise).
• Horizontal READ and vertical scaling.
• Cost-efficient High Availability Node and READ Pool sharing of storage layer.
• Built in AI Assistance.

https://docs.cloud.google.com/alloydb/docs/overview

GCP Database Migration Service

• Available for MySQL, PostgreSQL, SQL Server, and Oracle databases.
• Typical migration paths are to GCP CloudSQL or (if Postgres) to GCP AlloyDB.
• Can migrate from AWS RDS and AWS Aurora to GCP CloudSQL

https://cloud.google.com/database-migration

BigQuery

• An OLAP Query Engine and Data Warehouse, not a Database.
• Sometimes used with GCP Bigtable (NoSQL Database) to offload costly operations from Bigtable.
• Useful for adhoc SQL Queries against massive datasets.
• INFORMATION_SCHEMA provides real-time metadata (not just Table or configuration data).

Backup and Export

GCP Cloud SQL Exports are complete, portable, logical copy of a Database.

GCP Cloud SQL Backups are Service-managed (and hence aren't standalone).

Storage

Resources and Links

1. https://www.skills.google/paths/11/course_templates/1403
2. https://docs.cloud.google.com/alloydb/docs/overview
3. https://cloud.google.com/database-migration

GCP: ACE Pub/Sub

Pub/Sub

export SUBSCRIPTION_NAME=my-subscription-name
gcloud pubsub subscriptions list
gcloud pubsub subscriptions describe $SUBSCRIPTION_NAME

## Pull messages from a pull-based subscription
gcloud pubsub subscriptions pull $SUBSCRIPTION_NAME --limit=5

## Acknowledge receipt
gcloud pubsub subscriptions ack $SUBSCRIPTION_NAME --ack-ids=ACK_ID

Resources and Links

1. https://cloud.google.com/blog/products/compute/introducing-dynamic-workload-scheduler
2. https://www.skills.google/paths/11/course_templates/1403
3. https://docs.cloud.google.com/tasks

GCP: ACE AWS

Comparison with AWS

Observability Analytics is GCP’s recommended capability for running SQL queries directly against log data stored in GCP Cloud Logging.

• This is analogous to persisting logs to an AWS S3 Bucket then using AWS Athena to query over them.

Private Service Connect Endpoint

• Can assign a specific Private, Internal, IP Address to a (Google) Service within a VPC.
• This uses NAT and Forwarding Rules to route traffic to that target Service.
• https://docs.cloud.google.com/vpc/docs/private-service-connect
• Comparable to AWS PrivateLink.

Private Google Access

• VM's in a Subnet without External IP Addresses can connect directly with Google API's through their (the Google API's) default Public IP Addresses.
• Comparable to AWS VPC Interface Endpoints.

Attached Service Accounts are attached directly to a Resource (like a VM) and are analogous to both an AWS Task Role and AWS Task Execution Role.

• GCP Resources can also Impersonate GCP Service Accounts (analogous to AWS STS Assume).

Resources and Links

1. https://docs.cloud.google.com/vpc/docs/private-service-connect
2. https://docs.cloud.google.com/vpc/docs/private-services-access
3. https://docs.cloud.google.com/vpc/docs/private-google-access
4. https://www.skills.google/paths/11/course_templates/1403

GCP: PCA Overview

https://cloud.google.com/learn/certification/cloud-architect/

Resources and Links

1. https://www.skills.google/paths/12

GCP: PCA GKE

GKE

Recollect that Kubernetes Secrets are akin to Kubernetes Config Maps but are specifically intended to store Secrets.

Useful Google Cloud Shell Commands

Used in many Google Skill Labs and Challenges.

https://www.skills.google/paths/11/course_templates/663

https://www.skills.google/paths/12/course_templates/783

export PROJECT_ID="qwiklabs-gcp-01-00ab3bd88327"
export REGION="us-central1"
export ZONE="us-central1-a"

export CLUSTER_NAME="hello-world-uuyh"
export NAMESPACE_NAME="gmp-t3gp"
export REPO_NAME="demo-repo"
export SERVICE_NAME="helloweb-service-5t69"

export DEFAULT_CLUSTER_VER=$(gcloud container get-server-config)

## Create Cluster with specified settings
gcloud container clusters create $CLUSTER_NAME \
  --zone=$ZONE \
  --release-channel=regular \
  --cluster-version=$DEFAULT_CLUSTER_VER \
  --enable-autoscaling \
  --num-nodes 3 \
  --min-nodes 2 \
  --max-nodes 6

## This has to be run for credit
gcloud container clusters update $CLUSTER_NAME \
  --zone=$ZONE \
  --enable-managed-prometheus

## Create Namespace
kubectl create ns $NAMESPACE_NAME

## Download yaml
gcloud storage cp gs://spls/gsp510/prometheus-app.yaml .
### Edit
nano prometheus-app.yaml

## Deploy into the Namespace
kubectl -n $NAMESPACE_NAME apply -f prometheus-app.yaml

## Download yaml
gcloud storage cp gs://spls/gsp510/pod-monitoring.yaml .
### Edit
nano pod-monitoring.yaml
kubectl -n $NAMESPACE_NAME apply -f pod-monitoring.yaml

## Download yaml
gcloud storage cp -r gs://spls/gsp510/hello-app/ .
### Edit 
cd hello-app/manifests
nano helloweb-deployment.yaml
## Deploy
kubectl create -f helloweb-deployment.yaml

## Use this filter in 'Logs explorer'
### "Error: InvalidImageName" OR "Failed to apply default image tag \"<todo>\": couldn't parse image name \"<todo>\": invalid reference format"
### severity="WARNING"
### resource.type="k8s_pod"

## This was unnecessarily convoluted
### The lab says that the repo is already created, it isn't...
### I finally figured out that you have to create it like so
export REPO_NAME=demo-repo
gcloud auth configure-docker $REGION-docker.pkg.dev
gcloud artifacts repositories list
docker build -t $REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/hello-app:v2 .
gcloud artifacts repositories create $REPO_NAME \
    --repository-format=docker \
    --location=$REGION \
    --description="Docker repository for lab"
docker push $REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/hello-app:v2

## Expose the deployment through an external kubernetes loadbalancer
kubectl expose deployment helloweb --name=helloweb-service-5t69 --type=LoadBalancer --port=8080 --target-port=8080

https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create

export REGION=europe-west1
export ZONE=europe-west1-c
export PROJECT=qwiklabs-gcp-01-8dd3c7a798ca

gcloud config set compute/region $REGION
gcloud config set compute/zone $ZONE

source <(gcloud storage cat gs://spls/gsp318/script.sh)
gcloud storage cp gs://spls/gsp318/valkyrie-app.tgz .
tar -xzf valkyrie-app.tgz
cd valkyrie-app
touch Dockerfile
nano Dockerfile
## FROM golang:1.10
## WORKDIR /go/src/app
## COPY source .
## RUN go install -v
## ENTRYPOINT ["app","-single=true","-port=8080"]
cat Dockerfile

docker build -t valkyrie-dev:v0.0.1 .
docker images
# Find ImageID
## export IMAGEID=
docker run -p 8080:8080 $IMAGEID &
docker ps -a

gcloud auth configure-docker $REGION-docker.pkg.dev
docker images
# Retag
export REPONAME=valkyrie-repo
## Use this exact name going forward
export IMAGEID=valkyrie-dev:v0.0.1
docker tag valkyrie-dev:v0.0.1 $REGION-docker.pkg.dev/$PROJECT/$REPONAME/$IMAGEID
gcloud artifacts repositories create $REPONAME \
    --repository-format=docker \
    --location=$REGION \
    --description="Docker repository for lab"
## Verify
docker images
## Push
docker push $REGION-docker.pkg.dev/$PROJECT/$REPONAME/$IMAGEID

# Deployment and Expose 80
## Replace with the above
## e.g. - europe-west1-docker.pkg.dev/qwiklabs-gcp-01-8dd3c7a798ca/valkyrie-repo/valkyrie-dev:v0.0.1
nano k8s/deployment.yaml
cat k8s/deployment.yaml
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml
kubectl expose deployment valkyrie-dev --name=valkyrie-dev --type=LoadBalancer --port=80 --target-port=80

# Info
kubectl get pods
gcloud compute instances list
kubectl get services
## Find CONTAINERID
export CONTAINERID=
docker logs $CONTAINERID

Resources and Links

1. https://www.skills.google/paths/12
2. https://www.skills.google/paths/11/course_templates/663
3. https://www.skills.google/paths/12/course_templates/783
4. https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create

GCP: PCA Terraform

Useful Google Cloud Shell Commands

Used in many Google Skill Labs and Challenges.

https://www.skills.google/paths/12/course_templates/636/labs

This lab uses "Modules" that are actually "Resource" definitions. This was confusing to me.

You have to install tf in the outer shell (not from within the Open Editor).

Create necessary files:

terraform --version
export REGION=europe-west1
export ZONE=europe-west1-d
export PROJECT=qwiklabs-gcp-02-1ec38e8c48e3

touch main.tf
touch variables.tf

mkdir modules && mkdir modules/instances
touch modules/instances/instances.tf
touch modules/instances/outputs.tf
touch modules/instances/variables.tf

mkdir modules/storage
touch modules/storage/storage.tf
touch modules/storage/outputs.tf
touch modules/storage/variables.tf

Create root variables.tf:

cat << EOF > variables.tf
variable "region" {
  type        = string
  default     = "$REGION"
}
variable "zone" {
  type        = string
  default     = "$ZONE"
}
variable "project_id" {
  type        = string
  default     = "$PROJECT"
}
EOF

Prepare instances.tf:

cat << EOF > modules/instances/instances.tf
resource "google_compute_instance" "tfinstance1" {
  name         = "tf-instance-1"
  machine_type = "e2-micro"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

resource "google_compute_instance" "tfinstance2" {
  name         = "tf-instance-2"
  machine_type = "e2-micro"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}
EOF

Prep main.tf:

cat << EOF > main.tf
provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

module "instances" {
  source = "./modules/instances"
}
EOF

So one can import by the instance name: tf-instance-1 rather than the id:

terraform init
terraform fmt
terraform import 'module.instances.google_compute_instance.tfinstance1' projects/$PROJECT/zones/$ZONE/instances/tf-instance-1
terraform import 'module.instances.google_compute_instance.tfinstance2' projects/$PROJECT/zones/$ZONE/instances/tf-instance-2
terraform show
terraform plan
terraform apply --auto-approve

export BUCKET=tf-bucket-963122

cat << EOF > modules/storage/storage.tf
resource "google_storage_bucket" "storage-bucket" {
  name          = "$BUCKET"
  location      = "US"
  force_destroy = true
  uniform_bucket_level_access = true
}
EOF

Prep main.tf:

cat << EOF > main.tf
provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

module "instances" {
  source = "./modules/instances"
}

module "storage" {
  source = "./modules/storage"
}
EOF

terraform fmt
terraform init
terraform apply --auto-approve

The Bucket must be created in GCP before switching backends over:

cat << EOF > main.tf
terraform {
  backend "gcs" {
    bucket  = "$BUCKET"
    prefix  = "terraform/state"
  }
}
provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

module "instances" {
  source = "./modules/instances"
}

module "storage" {
  source = "./modules/storage"
}
EOF

terraform init -migrate-state

Update instances.tf with the correct tfinstance3.name:

cat << EOF > modules/instances/instances.tf
resource "google_compute_instance" "tfinstance1" {
  name         = "tf-instance-1"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

resource "google_compute_instance" "tfinstance2" {
  name         = "tf-instance-2"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

resource "google_compute_instance" "tfinstance3" {
  name         = "tf-instance-230370"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}
EOF

terraform apply

Update instances.tf:

cat << EOF > modules/instances/instances.tf
resource "google_compute_instance" "tfinstance1" {
  name         = "tf-instance-1"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

resource "google_compute_instance" "tfinstance2" {
  name         = "tf-instance-2"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "default"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}
EOF

terraform apply

export VPC=tf-vpc-803543

Update main.tf with the correct network_name:

cat << EOF > main.tf
terraform {
  backend "gcs" {
    bucket  = "$BUCKET"
    prefix  = "terraform/state"
  }
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.46.0"
    }
  }
}
provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

module "instances" {
  source = "./modules/instances"
}

module "storage" {
  source = "./modules/storage"
}

module "vpc" {
    source  = "terraform-google-modules/network/google"
    version = "~> 18.2"

    project_id   = "$PROJECT"
    network_name = "$VPC"
    routing_mode = "GLOBAL"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "$REGION"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "$REGION"
        },
    ]
}
EOF

Note that the exact combination: ~> 18.2 and ~> 7.46.0 were required to finish the lab (the lab itself states that one must use 10.0.0). Otherwise, Provider and version errors will prevent the creation of required resources.

Also note that the lab seemingly requires creating the vpc in two places you will see an error that the Resource already exists but this can be ignored.

To be clearer it requires the student to create the vpc Module in main.tf before referring to it within instances.tf - instances.tf, however, is already referenced by main.tf so it has to be added to instances.tf - this strange convention is apparently what others have done to complete the challenge as well.

rm .terraform.lock.hcl
terraform init
terraform apply

Update instances.tf:

cat << EOF > modules/instances/instances.tf
resource "google_compute_instance" "tfinstance1" {
  name         = "tf-instance-1"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "$VPC"
    subnetwork = "subnet-01"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

resource "google_compute_instance" "tfinstance2" {
  name         = "tf-instance-2"
  machine_type = "e2-standard-2"
  zone         = "$ZONE"
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
  network_interface {
    network = "$VPC"
    subnetwork = "subnet-02"
  }
  metadata_startup_script = <<-EOT
        #!/bin/bash
    EOT
  allow_stopping_for_update = true
}

module "vpc" {
    source  = "terraform-google-modules/network/google"
    version = "~> 18.2"

    project_id   = "$PROJECT"
    network_name = "$VPC"
    routing_mode = "GLOBAL"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "$REGION"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "$REGION"
        },
    ]
}
EOF

terraform apply

Update main.tf one last time updating the tf-firewall.name:

cat << EOF > main.tf
terraform {
  backend "gcs" {
    bucket  = "$BUCKET"
    prefix  = "terraform/state"
  }
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.46.0"
    }
  }
}
provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

module "instances" {
  source = "./modules/instances"
}

module "storage" {
  source = "./modules/storage"
}

module "vpc" {
    source  = "terraform-google-modules/network/google"
    version = "~> 18.2"

    project_id   = "$PROJECT"
    network_name = "$VPC"
    routing_mode = "GLOBAL"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "$REGION"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "$REGION"
        },
    ]
}

resource "google_compute_firewall" "tf-firewall"{
  name    = "tf-firewall"
  network = "projects/$PROJECT/global/networks/$VPC"

  allow {
    protocol = "tcp"
    ports    = ["80"]
  }

  source_tags = ["web"]
  source_ranges = ["0.0.0.0/0"]
}
EOF

terraform apply

Resources and Links

1. https://www.skills.google/paths/12/course_templates/636/labs
2. https://registry.terraform.io/providers/hashicorp/google/latest/docs
3. https://github.com/tariqsheikhsw/GoogleCloudArchitectLabs/blob/main/Solutions/GSP345.sh <- this was helpful to prep for the PCA

GCP: PCA Serverless

Useful Google Cloud Shell Commands

Used in many Google Skill Labs and Challenges.

https://www.cloudskillsboost.google/course_templates/741

export REGION=us-west1
export REPO_NAME=lab
export PROJECT_ID=qwiklabs-gcp-02-4304b07c61f7

gcloud artifacts repositories create $REPO_NAME \
    --repository-format=docker \
    --location=$REGION \
    --description="Docker repository for lab"
gcloud auth configure-docker $REGION-docker.pkg.dev
gcloud artifacts repositories list

# Backend
export IMAGE=$REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/billing-staging-api:0.1
## From within the relevant lab directory...
docker build -t $IMAGE .
docker push $IMAGE
gcloud run deploy public-billing-service-607 \
  --image $IMAGE \
  --platform managed \
  --region $REGION \
  --max-instances=1

# Frontend
export IMAGE=$REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/frontend-staging:0.1
## From within the relevant lab directory...
docker build -t $IMAGE .
docker push $IMAGE
gcloud run deploy frontend-staging-service-740 \
  --image $IMAGE \
  --platform managed \
  --region $REGION \
  --max-instances=1

# Private
export IMAGE=$REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/billing-staging-api:0.2
## From within the relevant lab directory...
docker build -t $IMAGE .
docker push $IMAGE
gcloud run deploy private-billing-service-875 \
  --image $IMAGE \
  --platform managed \
  --region $REGION \
  --no-allow-unauthenticated \
  --max-instances=1
BILLING_URL=$(gcloud run services describe private-billing-service-875 \
--platform managed \
--region us-west1 \
--format "value(status.url)")
curl -X get -H "Authorization: Bearer $(gcloud auth print-identity-token)" $BILLING_URL

# Billing Service Account
gcloud iam service-accounts create billing-service-sa-101 --display-name "Billing Service Cloud Run"

# Associate Service Account
## And deploy Prod Billing Service
export IMAGE=$REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/billing-prod-api:0.1
docker build -t $IMAGE .
docker push $IMAGE
gcloud run deploy billing-prod-service-460 \
  --image $IMAGE \
  --platform managed \
  --region $REGION \
  --no-allow-unauthenticated \
  --max-instances=1

gcloud run services add-iam-policy-binding billing-prod-service-460 --member=serviceAccount:billing-service-sa-101@$PROJECT_ID.iam.gserviceaccount.com --role=roles/run.invoker --region $REGION

# Frontend Service Account
gcloud iam service-accounts create frontend-service-sa-119 --display-name "Billing Service Cloud Run Invoker"

## These steps were out of order in the lab
# Associate Service Account
## And deploy Prod Frontend Service
export IMAGE=$REGION-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/frontend-prod:0.1
## From within the relevant lab directory...
docker build -t $IMAGE .
docker push $IMAGE
gcloud run deploy frontend-prod-service-711 \
  --image $IMAGE \
  --platform managed \
  --region $REGION \
  --no-allow-unauthenticated \
  --max-instances=1

gcloud run services add-iam-policy-binding frontend-prod-service-711 --member=serviceAccount:frontend-service-sa-119@$PROJECT_ID.iam.gserviceaccount.com --role=roles/run.invoker --region $REGION

Resources and Links

1. https://www.cloudskillsboost.google/course_templates/741

GCP: PMLE Overview

https://cloud.google.com/learn/certification/machine-learning-engineer

ChatGPT helped format and generate many tables below.

Verbiage

• Labels - in GCP terminology this corresponds to what you're trying to predict (hot dog, not hot dog)
• Features - the measurable parts of a data point.

BigQuery ML

https://www.skills.google/paths/17/course_templates/627

SELECT
  pickup_datetime,
  pickup_longitude,
  pickup_latitude,
  dropoff_longitude,
  dropoff_latitude,
  passenger_count,
  tolls_amount,
  fare_amount AS fare_amount_910
FROM `qwiklabs-gcp-04-7085cf65a05f.taxirides.historical_taxi_rides_raw` 

# Must use reasonable values
WHERE trip_distance > 0
  AND fare_amount BETWEEN 0 and 3
  AND pickup_longitude BETWEEN -180 AND 180
  AND pickup_latitude BETWEEN -90 AND 90
  AND dropoff_longitude BETWEEN -180 AND 180
  AND dropoff_latitude BETWEEN -90 AND 90
  
LIMIT 999999

CREATE OR REPLACE MODEL `taxirides.fare_model_243`
OPTIONS
(
  model_type='linear_reg',
  input_label_cols = ['fare_amount_910']
) AS

# input_label_cols must be exposed in SELECT
# too many features with throw a label error!
SELECT
  fare_amount_910,
  passenger_count, 
  ST_Distance(ST_GeogPoint(pickup_longitude, pickup_latitude), ST_GeogPoint(dropoff_longitude, dropoff_latitude)) AS euclidean
FROM
  `qwiklabs-gcp-04-7085cf65a05f.taxirides.taxi_training_data_195`;

CREATE OR REPLACE MODEL `qwiklabs-gcp-04-7085cf65a05f`.`taxirides`.`fare_model_243` 
OPTIONS ( 
    model_type = 'LINEAR_REG',
    labels = ['fare_amount_910']
) AS SELECT
  pickup_datetime,
  pickup_longitude,
  pickup_latitude,
  dropoff_longitude,
  dropoff_latitude,
  passenger_count,
  tolls_amount,
  fare_amount_910
FROM
  `qwiklabs-gcp-04-7085cf65a05f`.`taxirides`.`taxi_training_data_195`;

CREATE OR REPLACE TABLE `qwiklabs-gcp-04-7085cf65a05f`.`taxirides`.`2015_fare_amount_predictions` 

AS SELECT *
FROM
  ML.PREDICT( MODEL `qwiklabs-gcp-04-7085cf65a05f`.`taxirides`.`fare_model_243`,
    (SELECT
      pickup_datetime,
      pickuplon AS pickup_longitude,
      pickuplat AS pickup_latitude,
      dropofflon AS dropoff_longitude,
      dropofflat AS dropoff_latitude,
      passengers AS passenger_count,
      0.0 AS tolls_amount /* Assuming tolls_amount is 0 for prediction data if not available */
    FROM
      `qwiklabs-gcp-04-7085cf65a05f`.`taxirides`.`report_prediction_data`
    WHERE
      EXTRACT(YEAR
      FROM
        pickup_datetime) = 2015 ));

Resources and Links

1. https://www.skills.google/paths/17
2. https://www.skills.google/paths/17/course_templates/627

GCP: PMLE Solutions

AI and ML Solutions on GCP

AI Solutions

Pre-Trained APIs

Gemini Enterprise Agent Platform

GAN

Agentic

Resources and Links

1. https://cloud.google.com/terms/services?hl=en

GCP: PMLE Challenges

Common AI Challenges

Resources and Links

1. https://docs.cloud.google.com/architecture/ml-on-gcp-best-practices
2. https://docs.cloud.google.com/architecture/guidelines-for-developing-high-quality-ml-solutions

GCP: PMLE Architecture

Machine Learning

Neural Network Architecture

Training, Optimization, and Regularization

Learning Paradigms, Classical ML, and Data Techniques

Evaluation, Validation, and Model Reliability

GAN, LLM, and RAG

Cloud and Infrastructure

MCP Authorization and Security

GCP recommends "positioning Apigee between MCP clients and enterprise backends":

• Enables fine-grained authorization (FGA)
• Complete audit trails
• Policy evaluation via emerging standards like OpenID AuthZEN

https://cloud.google.com/blog/products/ai-machine-learning/mcp-support-for-apigee

Resources and Links

1. https://cloud.google.com/blog/products/ai-machine-learning/mcp-support-for-apigee

Code samples:

1. https://github.com/Thoughtscript/tcg_data_science/tree/main/jupyter
2. https://github.com/Thoughtscript/python_api_2023/tree/main/backend/ml
3. https://github.com/Thoughtscript/kaggle_jupyter_notebook_2025
4. https://github.com/Thoughtscript/Hugging_Face_LLM_2025