GCP Cloud Associate Udemy Flashcards
What is App Engine?
App Engine is a fully managed, serverless platform for developing and hosting web applications at scale.
What is App Engine’s built-in traffic splitting feature?
By deploying a new version of the application within the same App Engine environment and using the GCP Console to configure traffic splitting, you can easily direct a specified percentage of requests to the new version. This approach allows for gradual rollout and A/B testing without affecting the overall infrastructure or moving to a different compute service. It’s a straightforward and efficient way to test new versions with a subset of users, adhering to best practices for safe deployment and iteration.
Main difference between compute engine model and the app engine model?
Compute Engine provides IaaS (Infrastructure as a Service), requiring more manual setup and management of the compute resources compared to the PaaS (Platform as a Service) model of App Engine.
What would splitting traffic between two app engine applications require (as opposed to splitting traffic between versions of the same app engine)?
App Engine’s traffic splitting is designed to work within a single application across different versions, not between separate App Engine applications. Splitting traffic between separate apps would require a custom solution or an external load balancer, complicating the process beyond the intended simplicity and efficiency of using App Engine’s built-in traffic management features.
What is a kubernetes snapshot
- Kubernetes volume snapshots let you create a copy of your volume at a specific point in time. You can use this copy to bring a volume back to a prior state or to provision a new volume.
- A volume snapshot in Kubernetes is equivalent to taking a backup of your data in other storage systems.
What is a persistent volume in GKE?
PersistentVolume resources are used to manage durable storage in a cluster. In GKE, a PersistentVolume is typically backed by a persistent disk.
What is a NFS?
Network File System (NFS) is a distributed file system protocol for shared storage. The NFS shared storage protocol defines the way files are stored and retrieved from storage devices across networks. Filesotre is a NFS solution on Google Cloud.
What is Filestore?
Filestore instances are fully managed NFS file servers on Google Cloud for use with applications running on Compute Engine virtual machine (VM) instances, Google Kubernetes Engine clusters, external datastores such as Google Cloud VMware Engine, or your on-premises machines.
What is a node in GKE
A Node is a worker machine in Kubernetes and may be either a virtual or a physical machine, depending on the cluster. Each Node is managed by the control plane. A Node can have multiple pods, and the Kubernetes control plane automatically handles scheduling the pods across the Nodes in the cluster.
What is a pod in GKE?
Pods are the atomic unit on the Kubernetes platform. When we create a Deployment on Kubernetes, that Deployment creates Pods with containers inside them (as opposed to creating containers directly). Each Pod is tied to the Node where it is scheduled, and remains there until termination (according to restart policy) or deletion. In case of a Node failure, identical Pods are scheduled on other available Nodes in the cluster.
A Pod is a Kubernetes abstraction that represents a group of one or more application containers (such as Docker), and some shared resources for those containers. Those resources include:
Shared storage, as Volumes
Networking, as a unique cluster IP address
Information about how to run each container, such as the container image version or specific ports to use
What are local SSD for GKE?
Local solid-state drives (SSDs) are fixed-size SSD drives, which can be mounted to a single Compute Engine VM. You can use Local SSD on GKE to get highly performant storage that is not persistent (ephemeral) that is attached to every node in your cluster. Local SSDs also provide higher throughput and lower latency than standard disks.
What is kubernetes NodePort?
NodePort service in Kubernetes is a service that is used to expose the application to the internet from where the end-users can access it. If you create a NodePort Service Kubernetes will assign the port within the range of (30000-32767). The application can be accessed by end-users using the node’s IP address.
What is Kubernetes Ingress?
Kubernetes Ingress is an API object that helps developers expose their applications and manage external access by providing http/s routing rules to the services within a Kubernetes cluster.
What are advantages of kubernetes ingress?
It can simplify production environments because it facilitates a simple method of establishing rules to route traffic rather than creating specialized load balancers or manually exposing each service within a node.
How does kubernetes ingress allows you to expose your application to the public using HTTPS on a public IP address in Google Kubernetes Engine (GKE)?
Using a Kubernetes Ingress allows you to define HTTP and HTTPS routes to your services and enables SSL termination, ensuring secure communication. The Ingress controller automatically configures a Cloud Load Balancer to route external traffic to the appropriate service endpoints.
what is a kubernetes ClusterIP?
ClusterIP is the default service type in Kubernetes, and it provides internal connectivity between different components of our application. Kubernetes assigns a virtual IP address to a ClusterIP service that can solely be accessed from within the cluster during its creation. ClusterIP services are an excellent choice for internal communication between different components of our application that don’t need to be exposed to the outside world.
What is kubernetes DNS?
DNS stands for Domain Name System. Kubernetes DNS is a built-in service within the Kubernetes platform, designed to provide name resolution for services within a Kubernetes cluster. It simplifies the communication process between different services and pods within the cluster by allowing the use of hostnames instead of IP addresses. It plays a crucial role in enabling service discovery for pods to locate and communicate with other services within the cluster
What is a kubernetes HAProxy?
A kubernetes HAProxy is an ingress controller that implements that adds and removes routes in its underlying HAProxy load balancer configuration when it detects that pods have been added or removed from the cluster.
What is a VPC network peering?
A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. This is done by sharing a VPC network from one project with the other project.
To enable traffic between multiple groups of Compute Engine instances running in different GCP projects, each group within its own VPC why would this not work: Verify that both projects are in a GCP Organization. Create a new VPC and add all instances.
Creating a new VPC and adding all instances to it won’t enable communication between instances in different projects and VPCs. VPCs are isolated network environments within a project and cannot span multiple projects.
Difference between IAM service viewer and IAM project viewer?
The IAM project Viewer role provides read-only access to all project resources without the ability to modify them
The IAM service Viewer role provides read-only access to specific Google Cloud services rather than the entire project.
What is a GKE node pool?
A node pool is a group of nodes within a cluster that all have the same configuration. Node pools use a NodeConfig specification. Each node in the pool has a Kubernetes node label, cloud.google.com/gke-nodepool , which has the node pool’s name as its value.
You can add a new node pool to a GKE Standard cluster using the gcloud CLI, the Google Cloud console, or Terraform. GKE also supports node auto-provisioning, which automatically manages the node pools in your cluster based on scaling requirements.
How can you deploy services to specific node pools?
When you define a Service, you can indirectly control which node pool it is deployed into. The node pool is not dependent on the configuration of the Service, but on the configuration of the Pod.
You can explicitly deploy a Pod to a specific node pool by setting a nodeSelector in the Pod manifest. This forces a Pod to run only on nodes in that node pool. For an example see, Deploying a Pod to a specific node pool.
You can specify resource requests for the containers. The Pod only runs on nodes that satisfy the resource requests. For example, if the Pod definition includes a container that requires four CPUs, the Service does not select Pods running on nodes with two CPUs.
While creating a separate Kubernetes cluster with GPU-enabled nodes is a valid approach, it introduces unnecessary complexity and overhead. Managing multiple clusters increases administrative overhead and may result in underutilization of resources. Leveraging GKE’s capabilities to add GPU-enabled node pools to the existing cluster provides a more streamlined and cost-effective solution.
what does gcloud compute networks subnets expand-ip-range do?
The gcloud compute networks subnets expand-ip-range command allows you to increase the IP range of an existing subnet in Google Cloud without needing to delete or recreate it. This method ensures that all VMs within the subnet can still reach each other without additional routes, as they remain within the same subnet but with an expanded address range. It’s a straightforward process that minimizes disruptions and maintains network connectivity.
While Shared VPC allows for resources in different projects to communicate over the same network, creating a new project is an unnecessary step when you can simply expand the current subnet’s IP range.
You cannot overwrite an existing subnet by creating a new one with the same starting IP address. Instead, you should expand the IP range of the existing subnet.
You want to configure 10 Compute Engine instances for availability when maintenance occurs. Your requirements state that these instances should attempt to automatically restart if they crash. Also, the instances should be highly available including during system maintenance. What should you do?
-
Option A: Create an instance template for the instances. Set the ‘Automatic Restart’ to on. Set the ‘On-host maintenance’ to Migrate VM instance. Add the instance template to an instance group.
- Why Correct: This option aligns with the requirement of configuring Compute Engine instances for availability during maintenance. Enabling ‘Automatic Restart’ ensures that instances attempt to restart automatically if they crash, enhancing availability. Setting ‘On-host maintenance’ to ‘Migrate VM instance’ ensures that instances are migrated to other hosts during maintenance events, minimizing downtime. Additionally, using an instance group allows for easier management and scaling of instances.
What is GCP autohealing?
Autohealing enables you to select which health check service will be used to determine if an Instance needs to be replaced due to unhealthiness. If an instance fails the health check selected, it is automatically replaced with a new instance.
what does this do? Set Content-Type metadata to application/pdf on the PDF file objects.
Setting the Content-Type metadata to application/pdf on the PDF file objects instructs the browser on how to handle the file. When the correct Content-Type is specified, modern web browsers will attempt to display the PDF file inline within the browser window rather than prompting the user to save the file locally. This ensures a seamless user experience where users can view PDF files directly within the browser.
What is cloud CDN?
Enabling Cloud CDN (Content Delivery Network) improves website performance by caching content closer to users. Cloud CDN is primarily used for caching and delivering static content more efficiently, rather than controlling how browsers handle specific file types.
What is live migration?
Live migration is a feature that Google Cloud uses to migrate your VMs from one host to another for maintenance and infrastructure management without downtime. It is not a tool that customers can use to upgrade the memory or other resources of their VMs. This process is automatic and transparent, not user-initiated for resource upgrades.
What is metadata in google cloud VMs used for?
Metadata in Google Cloud VMs is used to store information about the instance or to configure how instances interact with other Google Cloud services. Adjusting metadata will not change the actual hardware or resource allocation of the VM, such as its memory capacity.
What is a CIDR?
Classless Inter-Domain Routing (CIDR) is an IP address allocation method that improves data routing efficiency on the internet. Every machine, server, and end-user device that connects to the internet has a unique number, called an IP address, associated with it. Devices find and communicate with one another by using these IP addresses. Organizations use CIDR to allocate IP addresses flexibly and efficiently in their networks.
Advantages of sharing VPC between resources?
The critical aspect here is the single VPC setup, which inherently allows all resources within it to communicate using internal IP addresses without the need for additional routing setup.
What do different CIDR ranges ensure?
Different CIDR ranges ensure that the IP address spaces do not overlap, preventing any potential addressing conflicts. Using the same CIDR range for both subnets is not possible within a single VPC. Each subnet must have a unique CIDR block to prevent IP address conflicts and to ensure proper network segmentation and routing within the VPC.
How do VMs in different VPCs communicate?
Creating two separate VPCs for production and test environments might seem like a good idea for isolation. However, this setup complicates internal communication as VMs in different VPCs cannot directly communicate using internal IP addresses without setting up VPC peering or additional routing.
What is a health check on port 443 commonly used for?
For HTTPS traffic autoscaling. By configuring the managed instance group to use this health check, it will continuously monitor the health of the VMs serving the HTTPS web application. Unhealthy VMs will be detected, and the managed instance group will automatically recreate them to maintain the desired instance count, ensuring high availability and reliability of the application.
What are Google’s best practices for managing IAM roles and permissions at scale?
- By creating a Google group, you simplify the management of access permissions, making it easier to add or remove members as the team changes.
- The
BigQuery dataViewerrole grants sufficient permissions to view datasets and perform queries. This role does not, however, allow for job management or dataset modifications, focusing on query execution and data viewing, fitting the requirement for members to perform queries. This setup enhances security and manageability by grouping permissions and managing them through a single group assignment.
What is the BigQuery jobUser role?
the BigQuery jobUser role primarily allows for managing and running jobs, which might not provide sufficient permissions for viewing or querying data within datasets. This role is more restrictive in terms of accessing data directly, which might not fully meet the data science team’s needs for querying and data analysis. The role’s focus on job management over data viewing makes it less suitable for the stated requirement.
Deploying a new instance in the europe-west1 region while ensuring access to the existing application hosted on a Compute Engine instance in the us-central1 region, following Google-recommended practices:
- Create a VPC and a subnetwork in europe-west1.
- Expose the application with an internal load balancer.
-
Create the new instance in the new subnetwork and use the load balancer’s address as the endpoint.
4.
How to quickly disable logs from a development GKE container with the minimum number of steps
- Go to the Logs ingestion window in Stackdriver Logging. - Accessing the Logs ingestion window in Stackdriver Logging allows you to manage log sources and configurations.
- Disable the log source for the GKE container resource. - Disabling the log source specifically for the GKE container resource ensures that logs from the container are no longer ingested, addressing the issue quickly and directly.
Gradually deploying a new version of a web application deployed as a managed instance group while ensuring that the available capacity does not decrease:
- Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
Using a rolling update with maxSurge set to 1 ensures that the new version of the application is gradually rolled out while maintaining the current capacity. With maxSurge set to 1, each new instance is added before the old one is removed, preventing any decrease in available capacity. Setting maxUnavailable to 0 ensures that there is no decrease in the number of available instances during the update process.
What does this do? gcloud compute instance-groups managed rolling-action start-update.
gcloud compute instance-groups managed rolling-action start-update updates instances in a managed instance group, according to the given versions and the given update policy.
