Google Cloud Platform Expertise

Key Principles

• Use managed services (Cloud SQL, Pub/Sub, Cloud Run) over self-managed infrastructure whenever the service meets requirements; managed services reduce operational burden
• Follow the principle of least privilege for IAM: create service accounts per workload with only the roles they need, never use the default compute service account in production
• Design for multi-region availability using global load balancers, regional resources, and cross-region replication where recovery time objectives demand it
• Label all resources consistently (team, environment, cost-center) for billing attribution and automated lifecycle management
• Enable audit logging and Cloud Monitoring alerts from day one; retroactive observability is expensive and incomplete

Techniques

• Use

  gcloud config configurations

  to manage multiple project/account contexts and switch between dev/staging/prod without re-authenticating
• Deploy to Cloud Run with

  gcloud run deploy --image gcr.io/PROJECT/IMAGE --region us-central1 --allow-unauthenticated

  for serverless containerized services
• Manage GKE clusters with

  gcloud container clusters create

  using

  --enable-autoscaling

  ,

  --workload-identity

  , and

  --release-channel regular

  for production readiness
• Configure Cloud Functions with event triggers from Pub/Sub, Cloud Storage, or Firestore for event-driven architectures
• Set up VPC Service Controls to create security perimeters around sensitive data services, preventing data exfiltration even with compromised credentials
• Create billing alerts with

  gcloud billing budgets create

  to catch cost anomalies before they become budget overruns

Common Patterns

• Cloud Run + Cloud SQL: Deploy a stateless API on Cloud Run connected to Cloud SQL via the Cloud SQL Auth Proxy sidecar, with connection pooling and automatic TLS
• Pub/Sub Fan-Out: Publish events to a Pub/Sub topic with multiple push subscriptions triggering different Cloud Functions for decoupled event processing
• GKE Workload Identity: Bind Kubernetes service accounts to GCP service accounts, eliminating the need for exported JSON key files and enabling fine-grained IAM per pod
• Cloud Storage Lifecycle: Configure object lifecycle policies to transition infrequently accessed data to Nearline/Coldline storage classes and auto-delete expired objects

Pitfalls to Avoid

• Do not export service account JSON keys for applications running on GCP; use workload identity, metadata server, or application default credentials instead
• Do not use the default VPC network for production workloads; create custom VPCs with defined subnets, firewall rules, and private Google access
• Do not enable APIs project-wide without reviewing the permissions they grant; some APIs auto-create service accounts with broad roles
• Do not skip setting up Cloud Armor WAF rules for public-facing load balancers; DDoS protection and bot management should be active before the first incident