GCP DevOps Engineer key terms

The tree of Google Cloud containers - organization, folders and projects - that determines where resources live and how IAM allow policies and organization policies are inherited from parent to child.

A container inside the organization used to group projects and other folders so that policies and IAM roles can be attached once and inherited by everything beneath it, mirroring teams or environments.

A constraint set on the resource hierarchy that restricts how resources may be configured, such as blocking external IP addresses or limiting allowed regions; it is enforced separately from IAM permissions.

A policy that explicitly blocks selected principals from using specific permissions; deny rules take precedence over any allow policy granted higher or lower in the resource hierarchy.

A topology in which a host project owns the VPC network and subnets and shares them with service projects, letting a central team administer networking while other teams deploy their own resources.

A security perimeter around Google Cloud APIs and resources that limits data movement and helps prevent exfiltration even if credentials are stolen; access across the boundary must be explicitly configured.

A keyless method that lets external workloads, such as GitHub Actions jobs or AWS roles, exchange their own credentials for short-lived Google Cloud tokens and impersonate a service account.

A declarative infrastructure-as-code tool used to create and change Google Cloud resources reproducibly; state files record what exists and plans preview changes before they are applied.

Service level indicator: a quantitative measure of the service experience, such as request latency, error rate, or availability, computed from monitoring data over a defined window.

Service level objective: a target value or range for a service level indicator over a period, for example 99.9 percent of requests succeeding over the last 28 days.

Service level agreement: a contract with customers stating expected reliability and the consequences, such as service credits, when the commitment is missed; it is usually looser than internal objectives.

The amount of unreliability an objective permits in a period, calculated as 100 percent minus the target; failures consume it, and its remaining balance guides release and change decisions.

How quickly a service consumes its error budget relative to the steady allowed pace; a burn rate of two means the budget is being spent twice as fast as permitted, which suits multi-window alerting.

A written review after an incident that focuses on system causes and contributing factors rather than individual fault, producing prioritized action items intended to prevent recurrence.

The four metrics Google's SRE guidance recommends monitoring for any user-facing system: latency, traffic, errors, and saturation of the most constrained resource.

Repetitive, manual, automatable operational work that grows with the service and delivers little lasting value; teams cap the proportion of time spent on it and redirect the rest to engineering.

A serverless continuous integration and delivery service that runs each build step in a container according to a configuration file, producing artifacts such as images and supporting parallel or dependent steps.

A Cloud Build configuration that starts a build automatically in response to an event, such as a push or pull request on a connected repository, a tag, or a Pub/Sub message.

A dedicated set of Cloud Build workers owned by your project; builds run inside your network and can reach private resources such as internal IP addresses or private package repositories.

A managed repository for container images and language packages with IAM control, regional storage, and vulnerability scanning; it is the recommended replacement for the older Container Registry.

A managed continuous delivery service that promotes releases through an ordered set of targets such as dev, staging, and prod, supporting GKE, Cloud Run, and custom targets with approval gates.

Releasing a new version to a small slice of traffic or users first and then increasing exposure while watching health metrics, so problems affect fewer users and can be reverted quickly.

A deploy-time control for GKE and Cloud Run that admits only container images satisfying required attestations, such as passing vulnerability checks or being produced by a trusted pipeline.

A serverless service for running machine learning workflows defined as a directed acyclic graph of containerized steps, providing caching, artifact lineage, and reproducibility for training and evaluation.

An operating model where the desired state of clusters and infrastructure lives in a Git repository, and an agent such as Config Sync continuously reconciles the live environment to match it.

A Cloud Logging rule that routes matching log entries to a destination such as a Cloud Storage bucket, BigQuery dataset, or Pub/Sub topic, using inclusion and exclusion filters.

A metric derived from log entries matching a filter, either counting occurrences or extracting numeric values, which then feeds dashboards and alerting policies without charting raw logs.

A Cloud Monitoring rule that fires when a condition on a metric, SLO, or log query is met and sends notifications through channels such as email, PagerDuty, or Pub/Sub.

A synthetic probe that Cloud Monitoring sends from multiple global locations to a public URL or resource to verify availability and measure response latency over time.

A distributed tracing system that collects latency data for requests as they cross services and shows where time is spent in the call path, helping locate performance bottlenecks.

A continuous profiling tool that samples CPU usage and memory allocation of running applications with low overhead, attributing consumption to specific functions and lines of code.

A service that aggregates and counts application exceptions and stack traces collected from logs, groups them into issues, and can notify when a new error type appears.

The combined logging and monitoring agent installed on Compute Engine instances; it collects system and application metrics and forwards logs to Cloud Logging and Cloud Monitoring.

A discount obtained by committing to a fixed amount of vCPU, memory, or other resource usage in a region for one or three years, in exchange for a substantially lower price.

Compute Engine instances that use spare capacity at a large discount and can be stopped at any time with short notice; suited to fault-tolerant, batch, or otherwise interruptible workloads.

Suggestions generated by analyzing historical usage that propose smaller or larger machine types or disk sizes, to remove waste or fix persistent overutilization.

A Cloud Billing feature that writes detailed line-item cost and usage data to BigQuery so teams can query, attribute, and visualize spending beyond the built-in cost reports.

A Cloud Billing budget with threshold rules that send notifications, optionally to a Pub/Sub topic, when actual or forecast spend crosses a percentage of the specified amount.

A controller that adds or removes capacity based on demand signals; for managed instance groups it uses metrics such as CPU utilization, load balancer capacity, or a schedule.