GCP DevOps Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Organization node creation

The organization resource appears automatically when a project belongs to a Google Workspace or Cloud Identity domain; Free Tier and consumer accounts have none, so folders are unavailable.

IAM policy inheritance

Allow policies are additive as you descend the hierarchy, so a project cannot reduce access granted at folder or organization level. Deny policies instead override any allow.

VPC Service Controls perimeter

A boundary around projects that blocks data exfiltration for protected APIs; Access Context Manager access levels determine which clients, networks, or devices may cross it.

Org Policy constraint

Constraints such as iam.disableServiceAccountKeyCreation are inherited from the node where they are enforced, and child projects cannot loosen them; only the enforcing node can change them.

Shared VPC roles

The host project owns subnets, firewall rules, and the network while service projects attach to use them; admins need compute.xpnAdmin granted at the organization or folder level.

Aggregated log sink

A sink created at folder or organization level that routes matching log entries from every descendant project into one central log bucket or BigQuery dataset.

Project ID immutability

The project ID is globally unique and cannot be changed after creation; the project number is assigned by Google, and the display name is mutable and need not be unique.

Error budget formula

Error budget equals 1 minus the SLO. A 99.9% availability SLO over 30 days allows roughly 43 minutes of unavailability before the budget is exhausted.

Burn rate

Burn rate is the observed error rate divided by the error budget consumption rate; a burn rate of 1.0 exhausts the entire budget exactly at the end of the SLO window.

Multi-window burn-rate alerts

Standard alerting pairs a fast 1-hour window at 14.4x burn, consuming 2% of budget, with slower 6-hour 6x and 3-day 1x conditions to reduce false positives.

Availability SLI

Good events divided by valid events: for example, successful HTTP responses divided by all eligible requests, excluding client errors such as 404 that are not server failures.

Golden signals

Latency, traffic, errors, and saturation are the four signals to monitor for each user-facing service; alerting should target user-visible symptoms rather than underlying causes.

Error budget policy

A pre-agreed written rule that freezes feature releases and redirects engineering effort to reliability work when the service has exhausted its error budget.

Canary deployment

Shift a small percentage of traffic to the new revision, compare its SLIs against the baseline, and roll back automatically if the error budget burns faster.

Cloud Build triggers

Triggers start builds on push, tag, or pull request events from a connected repository; substitutions inject dynamic values and private pools reach private networks.

Artifact Registry

A managed repository for container images and language packages offering IAM, vulnerability scanning, and regional storage; it replaces Container Registry for new projects.

Cloud Deploy rollout

A delivery pipeline lists ordered targets such as dev and prod; each release is promoted through rollouts that support canary, linear, and verification phases.

Binary Authorization

An admission controller that permits only container images carrying valid attestations from approved attestors to deploy to GKE or Cloud Run.

Config Sync GitOps

Config Sync continuously reconciles cluster resources to the desired state stored in a Git repository and reports drift, giving an auditable deployment history.

Vertex AI Pipelines

Serverless Kubeflow-based orchestration of ML workflow steps such as data preparation, training, evaluation, and deployment, with artifact lineage tracked automatically.

Log bucket retention

The _Required bucket retains Admin Activity and System Event audit logs for 400 days; the _Default bucket keeps other logs 30 days unless custom retention is configured.

Log-based metric

A counter or distribution extracted from log entries matching a filter; it can drive dashboards and alerting policies without any change to application code.

Ops Agent

The unified collector installed on Compute Engine VMs that ships metrics and logs to Cloud Monitoring and Cloud Logging, replacing the legacy separate agents.

Cloud Trace spans

Distributed tracing groups spans into a request timeline; the latency report shows which span dominates end-to-end time across microservices.

Uptime check

A Cloud Monitoring probe issued from multiple global locations against a URL, TCP, or ICMP endpoint; results can back an SLI or an alerting policy.

Managed Prometheus

A Google-managed service that ingests Prometheus metrics from GKE workloads and answers PromQL queries without you operating a Prometheus server yourself.

Sustained use discount

An automatic Compute Engine discount applied when an instance runs for a substantial part of the billing month; no commitment or customer action is required.

Committed use discount

A one- or three-year commitment to a baseline of vCPU, memory, or spend in exchange for a discount of up to roughly 57% on Compute Engine resources.

Spot VM pricing

Spot virtual machines cost up to 91% less than on-demand but carry no SLA and can be preempted at any time with a short 30-second shutdown notice.

Storage class minimums

Nearline requires 30 days, Coldline 90 days, and Archive 365 days of storage duration; deleting objects earlier incurs a prorated early-deletion charge.

GKE cluster autoscaler

It adds or removes nodes when pods are unschedulable or nodes are underused, while node auto-provisioning creates new node pools matching pending pod requirements.

Billing export to BigQuery

Detailed cost and usage data exported to BigQuery can be joined with resource labels for chargeback; budgets alone only send alerts and never cap spending.