Google PCA Ensure solution and operations reliability — All Questions With Answers

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-container
        image: gcr.io/my-project/my-app:latest
        ports:
        - containerPort: 8080
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          tcpSocket:
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 20

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "group:viewers@example.com"
      ]
    },
    {
      "role": "roles/storage.objectCreator",
      "members": [
        "user:bob@example.com"
      ]
    }
  ],
  "etag": "BwXQ=="
}

Refer to the exhibit.

```
$ gcloud compute instances list --limit=5
NAME         ZONE        MACHINE_TYPE   PREEMPTIBLE
instance-1   us-east1-b  n1-standard-1  true
instance-2   us-east1-c  n1-standard-1  false
instance-3   us-central1-a e2-medium    false
instance-4   us-central1-b  n1-standard-1 false
instance-5   us-west1-a   n1-highcpu-4  false
```

SLO History for last 30 days:
Service: payments-api
SLO: 99.9% availability over 30 days
Compliance: 99.89%
Error budget remaining: 0%
Burn rate: 2.5 over last 1 hour
Alert: Error budget exhausted

Stackdriver Logging query results:
resource.type="gce_instance"
logName="projects/my-project/logs/syslog"

Timestamps:
2023-11-01 10:15:23 UTC - Out of memory: Killed process 1234 (java)
2023-11-01 10:15:24 UTC - Out of memory: Killed process 5678 (python)
2023-11-01 10:15:25 UTC - Out of memory: Killed process 9012 (node)

Monitoring metric: instance/disk/bytes_used (gce_instance)
Value: 95% at 10:15:20 UTC

Deployment Manager manifest:
resources:
- name: my-cluster
  type: container.v1.cluster
  properties:
    zone: us-central1-a
    initialNodeCount: 3
    nodeConfig:
      machineType: n1-standard-1
      oauthScopes:
      - https://www.googleapis.com/auth/pubsub
- name: my-job
  type: container.v1.job
  properties:
    cluster: $(ref.my-cluster.name)
    template:
      spec:
        containers:
        - image: gcr.io/my-project/publisher
          env:
          - name: TOPIC
            value: my-topic
        restartPolicy: Never
    dependsOn: [my-cluster]

After deployment, the job fails with "Permission denied" when publishing to Pub/Sub topic my-topic.

Error message from Cloud Functions log:
"Function: process-image. Execution ID: abc123. Error: memory limit exceeded. Function invocation was interrupted. Consider increasing the memory allocation."

Function configuration:
- Runtime: Node.js 16
- Memory: 128MB
- Timeout: 60s
- Trigger: Cloud Storage (finalize event on bucket images-bucket)

Metrics:
- Average execution time: 45s
- Max concurrent executions: 10

gcloud container clusters describe my-cluster --zone us-central1-a
...
nodePools:
- name: default-pool
  config:
    machineType: n1-standard-4
    diskSizeGb: 100
    imageType: COS_CONTAINERD
    oauthScopes:
    - https://www.googleapis.com/auth/devstorage.read_only
  initialNodeCount: 3
  autoscaling:
    enabled: true
    minNodeCount: 1
    maxNodeCount: 10

Horizontal Pod Autoscaler:
  Name: my-hpa
  Min replicas: 3
  Max replicas: 20
  CPU target: 80%

Current state: The deployment has 5 pods. CPU usage is at 90%. The HPA has not scaled up.

gcloud compute instances describe instance-1 --zone=us-central1-a
...
metadata:
  items:
  - key: startup-script
    value: |
      #!/bin/bash
      apt-get update
      apt-get install -y nginx
      systemctl enable nginx
      systemctl start nginx
  - key: enable-oslogin
    value: "false"
...
networkInterfaces:
- accessConfigs:
  - name: external-nat
    natIP: 35.192.0.1
  network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
...
scheduling:
  preemptible: true
...
status: RUNNING

gcloud container clusters describe prod-cluster --zone=us-central1-a
...
nodePools:
- config:
    machineType: n1-standard-4
    oauthScopes:
    - https://www.googleapis.com/auth/devstorage.read_only
    - https://www.googleapis.com/auth/logging.write
    - https://www.googleapis.com/auth/monitoring
  initialNodeCount: 3
  management:
    autoRepair: true
    autoUpgrade: true
...
addonsConfig:
  networkPolicyConfig:
    disabled: false
...
networkPolicy:
  enabled: true
  provider: CALICO
...
  subnetwork: default

gcloud compute forwarding-rules describe my-https-rule --region=us-central1
...
IPAddress: 34.96.0.1
IPProtocol: TCP
portRange: 443-443
target: https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/targetPools/my-target-pool
...
gcloud compute target-pools describe my-target-pool --region=us-central1
...
healthCheck: https://www.googleapis.com/compute/v1/projects/my-project/global/httpHealthChecks/my-health-check
instances:
- us-central1-a/instances/web-1
- us-central1-b/instances/web-2
...
gcloud compute http-health-checks describe my-health-check
...
requestPath: /health
port: 80
...

Refer to the exhibit.

```
$ gcloud container clusters describe my-cluster --region us-central1
...
nodePools:
- config:
    diskSizeGb: 100
    diskType: pd-standard
    imageType: COS_CONTAINERD
    machineType: n1-standard-2
    oauthScopes:
    - https://www.googleapis.com/auth/devstorage.read_only
  initialNodeCount: 3
  management:
    autoRepair: true
    autoUpgrade: true
  name: default-pool
...
```

Refer to the exhibit.

gcloud compute instances describe example-instance --format=json

{
  ...
  "scheduling": {
    "onHostMaintenance": "TERMINATE",
    "automaticRestart": true
  },
  "status": "RUNNING"
}

Refer to the exhibit.

{
  "kind": "storage#bucket",
  "id": "my-important-bucket",
  "name": "my-important-bucket",
  "retentionPolicy": {
    "retentionPeriod": "2592000",
    "effectiveTime": "2024-01-01T00:00:00Z",
    "isLocked": true
  },
  "versioning": {
    "enabled": true
  }
}

Refer to the exhibit.

# Sample managed instance group configuration (YAML)
resource:
  type: compute.beta.instanceGroupManager
  properties:
    zone: us-central1-a
    targetSize: 3
    baseInstanceName: my-app
    instanceTemplate: global/instanceTemplates/my-template
    autoHealingPolicies:
    - healthCheck: global/healthChecks/http-health-check
      initialDelaySec: 300
    autoScaler:
      minNumReplicas: 3
      maxNumReplicas: 10
      coolDownPeriodSec: 60
      cpuUtilization:
        utilizationTarget: 0.6