GCP Professional Cloud Developer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Readiness probe

Kubernetes probe that reports whether a container can serve traffic; failing pods are removed from Service endpoints without being restarted, so traffic shifts to healthy replicas.

Liveness probe

Kubernetes probe that detects a wedged container; repeated failures cause the kubelet to restart the container, which recovers processes stuck in deadlock or infinite loops.

Pub/Sub at-least-once delivery

Default delivery guarantee where a message may arrive more than once, so subscribers must be idempotent by deduplicating on a message ID or a business key.

Global external Application Load Balancer

Google Cloud L7 HTTP(S) load balancer with one global anycast IP that routes users to the nearest healthy backend across regions and supports URL maps and Cloud CDN.

Horizontal Pod Autoscaler

GKE controller that adjusts replica count by comparing observed CPU, memory, or custom metrics against a declared target, then scaling within configured minimum and maximum bounds.

Idempotency key

Client-supplied unique identifier sent with a request so that retries after a timeout do not create duplicate records; the server stores the key and returns the original result.

Shared VPC

Topology where a host project owns subnets, routes, and firewall rules while service projects attach their resources to those subnets, centralizing network administration under one team.

Private Google Access

Subnet-level setting that lets instances without external IP addresses reach Google APIs and services through internal routing rather than sending traffic to the public internet.

waitFor in Cloud Build

Build config field controlling step ordering; by default a step waits for all prior steps, while waitFor: ['-'] starts immediately and enables parallel execution.

Cloud Build private pool

Dedicated build workers attached to a VPC network, required when build steps must reach private IP addresses such as a private GKE control plane or internal database.

Artifact Registry

Google Cloud repository service for container images and language packages, addressed as LOCATION-docker.pkg.dev/PROJECT/REPOSITORY/IMAGE and positioned as the successor to Container Registry.

Build substitutions

Variables written as ${_NAME} or $BUILT_IN in cloudbuild.yaml that are replaced at run time with values from --substitutions such as commit SHA or branch name.

Pub/Sub emulator

Local test double started with gcloud beta emulators pubsub start; code is pointed at it by setting PUBSUB_EMULATOR_HOST so integration tests avoid real topics and billing.

availableSecrets in Cloud Build

Config block that resolves Secret Manager versions and exposes them as secretEnv variables only to the named build steps, keeping plaintext secrets out of the build definition.

Cloud Build trigger

Automated build rule bound to a repository event such as branch push, tag push, or pull request, optionally filtered by includedFiles or ignoredFiles path globs.

Skaffold

Tool that rebuilds and redeploys container images to a Kubernetes cluster on each file change, providing a fast inner development loop against local or GKE clusters.

Cloud Run PORT variable

Environment variable injected into each Cloud Run container; the server must listen on this port, default 8080, or health checks fail and the revision never becomes ready.

Cloud Run concurrency setting

Maximum simultaneous requests a single container instance handles, default 80; raising it improves instance density but requires the application to be thread-safe.

Cloud Run traffic splitting

Feature that sends defined percentage shares of traffic to multiple revisions, enabling canary and blue-green releases where rollback is an immediate percentage change.

Cloud Run minimum instances

Setting that keeps a number of container instances warm to reduce cold starts at the cost of always-on billing, paired with a maximum instance cap for cost control.

PodDisruptionBudget

GKE policy that limits how many pods of a workload may be voluntarily evicted at once during node drains or cluster upgrades, preserving availability of the service.

Kubernetes resource requests

Declared CPU and memory a container needs, used by the scheduler to choose a node; limits cap consumption, and exceeding a memory limit triggers an OOM kill.

GKE rolling update

Deployment strategy replacing pods gradually, controlled by maxSurge (extra pods above the desired count) and maxUnavailable (pods allowed to be unavailable during rollout).

Secret Manager CSI driver

GKE add-on that mounts Secret Manager payloads into pods as files or environment variables, allowing secret rotation without rebuilding or redeploying the container image.

Pub/Sub dead-letter topic

Topic that receives messages after a subscription exceeds maxDeliveryAttempts, isolating poison messages so the main subscription keeps processing the remaining backlog.

Firestore transaction

Atomic read-then-write operation spanning multiple documents that aborts and retries when a concurrent change occurs, used for invariants such as counter increments.

Signed URL

Time-limited URL granting access to a Cloud Storage object without credentials; V4 signing supports expiry of at most seven days and requires the signer to hold the private key.

Cloud Storage event notification

Bucket configuration that publishes an event to Pub/Sub when an object is created, deleted, or archived, commonly triggering Cloud Run or Functions through Eventarc.

BigQuery Storage Write API

High-throughput ingestion interface over gRPC streams; committed streams give exactly-once semantics, while legacy streaming inserts offer only best-effort insertId deduplication.

Cloud Tasks

Managed queue that dispatches individual HTTP requests to a target with configurable rate limits, scheduled delays, and retry policy, suited to throttled asynchronous work.

Workload Identity Federation

Mechanism allowing external workloads such as AWS roles or OIDC tokens to impersonate a service account and call Google APIs without downloading long-lived keys.

Serverless VPC Access connector

Resource that lets Cloud Run services and App Engine send traffic to private IP addresses inside a VPC, such as Cloud SQL private IPs or a Memorystore instance.