GCP Professional Cloud Developer cheat sheet

Readiness probes gate traffic by removing a pod from Service endpoints; liveness probes restart the container; startup probes protect slow-booting apps from premature liveness kills.

Stateless containers scale horizontally, so session and file state must be externalized to Memorystore, Firestore, or Cloud Storage to let any instance serve any request.

Load balancer choice rule: global external Application Load Balancer for L7 HTTP(S) across regions, Network Load Balancer for regional L4 TCP/UDP, internal load balancers for RFC 1918-only traffic.

Pub/Sub delivers at-least-once by default, so consumers must be idempotent; ordering keys give per-key ordering, and exactly-once delivery is available on pull subscriptions.

Retry logic uses exponential backoff with jitter plus a hard deadline; without a deadline, retry amplification turns a degraded dependency into a full outage.

Cloud Run scales on concurrency (default 80 concurrent requests per instance) rather than CPU utilization, so CPU-based autoscaling rules do not transfer from GKE.

Shared VPC puts subnets and firewall policy in a host project while service projects attach resources; IAM controls which principals can deploy into each shared subnet.

Private Google Access lets instances with no external IP call Google APIs over internal routing; Cloud NAT provides outbound internet for private instances with no inbound exposure.

Bucket location type sets failure domain: multi-region and dual-region buckets survive regional loss, and RPO/RTO targets decide between replication, backup, and restore.

Production IAM avoids primitive Owner/Editor grants; each workload gets its own service account with predefined or custom roles scoped to the resources it touches.

Cloud Build steps run sequentially by default; waitFor: ['-'] starts a step immediately, and waitFor: ['step_id'] gates a step on specific prior steps for parallelism.

Substitutions resolve at run time: user-defined ${_VAR} come from --substitutions, built-ins include $BUILT_IN_COMMIT_SHA and $SHORT_SHA, and $$ escapes a literal dollar sign in shell steps.

The default build timeout is 600 seconds and can be raised; a step exiting non-zero fails the build and blocks dependent steps that have not yet started.

Artifact Registry images are addressed LOCATION-docker.pkg.dev/PROJECT/REPOSITORY/IMAGE:TAG; tagging with $SHORT_SHA ties every deployed image back to a commit.

Builds that must reach private IPs (private GKE control plane, internal databases) require a private pool peered to the target VPC; the default pool has no VPC connectivity.

Secrets enter builds through availableSecrets plus secretEnv resolved from Secret Manager; secret values in cloudbuild.yaml or image layers are exposed to anyone with repo read access.

Local emulators for Pub/Sub, Firestore, Datastore, and Spanner are activated by env vars such as PUBSUB_EMULATOR_HOST and FIRESTORE_EMULATOR_HOST for offline integration tests.

gcloud run deploy --source . builds with buildpacks and needs no Dockerfile; gcloud builds submit --tag performs an explicit container image build and push.

Triggers fire on branch push, tag push, pull request, or manual invocation, and includedFiles/ignoredFiles globs limit which changed paths start a build.

Cloud Run containers must listen on the injected $PORT (default 8080) and bind 0.0.0.0; binding to localhost causes revision health checks to fail.

Cloud Run request timeout defaults to 300 seconds; work exceeding that belongs in Cloud Tasks, Pub/Sub, or Batch rather than in the request path.

Cloud Run traffic is split per revision, so a canary is a new revision at 0% followed by a percentage shift, and rollback is another percentage change with no redeploy.

Deploy with --service-account so each service runs as a dedicated identity; the default compute service account normally carries broader permissions than the workload needs.

Cloud Run ingress values all, internal, and internal-and-cloud-load-balancing set network reachability, while --allow-unauthenticated sets whether IAM authentication is required.

GKE scheduling is driven by resource requests; limits set the cgroup ceiling, and a memory-limit breach produces an OOMKilled restart while CPU limits produce throttling.

Rolling updates are governed by maxSurge and maxUnavailable, and PodDisruptionBudgets constrain how many pods can be evicted during voluntary disruptions such as node upgrades.

Small distroless images built with multi-stage builds and a non-root USER shorten image pull and cold start and reduce the runtime attack surface.

Cloud Run min instances keep warm capacity to cut cold starts, while max instances cap cost and shield downstream services from traffic spikes.

A Pub/Sub subscription can set a dead-letter topic and maxDeliveryAttempts; once the limit is hit, undeliverable messages move there instead of being redelivered indefinitely.

The Pub/Sub ack deadline defaults to 10 seconds and can be extended with modifyAckDeadline up to 600 seconds; missing the deadline causes redelivery.

Firestore single-document reads are strongly consistent; multi-document atomicity requires transactions or batched writes, and multi-field queries require composite indexes.

Cloud Storage V4 signed URLs expire after at most 7 days, so longer-lived delegation should use IAM conditions or Workload Identity Federation instead.

Storage object change events publish to Pub/Sub, and Eventarc delivers them to Cloud Run or Cloud Functions with attribute filtering, retries, and dead-letter handling.

The BigQuery Storage Write API provides exactly-once semantics on committed streams, whereas legacy streaming inserts use best-effort insertId deduplication over a short window.

Cloud Tasks fits per-request rate limiting with scheduled delays and retry policy; Pub/Sub fits high-fanout parallel delivery and offers no rate control.

Cloud Run and App Engine reach Cloud SQL through the connector socket /cloudsql/INSTANCE_CONNECTION_NAME, or via private IP through a Serverless VPC Access connector.

Workload Identity Federation exchanges external tokens from AWS, Azure, or OIDC providers for short-lived Google credentials, eliminating exported service-account keys.

A Pub/Sub subscription can set a dead-letter topic and maxDeliveryAttempts; once the limit is hit, undeliverable messages move there instead of being redelivered indefinitely.

The Pub/Sub ack deadline defaults to 10 seconds and can be extended with modifyAckDeadline up to 600 seconds; missing the deadline causes redelivery.

Firestore single-document reads are strongly consistent; multi-document atomicity requires transactions or batched writes, and multi-field queries require composite indexes.

Cloud Storage V4 signed URLs expire after at most 7 days, so longer-lived delegation should use IAM conditions or Workload Identity Federation instead.

Storage object change events publish to Pub/Sub, and Eventarc delivers them to Cloud Run or Cloud Functions with attribute filtering, retries, and dead-letter handling.

The BigQuery Storage Write API provides exactly-once semantics on committed streams, whereas legacy streaming inserts use best-effort insertId deduplication over a short window.

Cloud Tasks fits per-request rate limiting with scheduled delays and retry policy; Pub/Sub fits high-fanout parallel delivery and offers no rate control.

Cloud Run and App Engine reach Cloud SQL through the connector socket /cloudsql/INSTANCE_CONNECTION_NAME, or via private IP through a Serverless VPC Access connector.

Workload Identity Federation exchanges external tokens from AWS, Azure, or OIDC providers for short-lived Google credentials, eliminating exported service-account keys.