GCP 🟠

Google Cloud Platform — comprehensive architectural deep dives covering Google’s global private network, container platforms, distributed storage, big data engines, generative AI supercomputing, and enterprise zero-trust security. Built to match the depth of the AWS knowledge base with Architecture & Mental Models + Production gcloud CLI + Quotas & Limits + References + 2 Realistic Pricing Scenarios + 5+ Battle-Tested Nuggets & Gotchas.

Service Catalog

1. Compute & Containers Hub

• Compute Engine (GCE) — Machine families, custom CPU/RAM shapes, Regional MIGs, auto-healing, Spot VMs, Live Migration, and OS Login.
• Managed Instance Groups (MIGs) — Regional vs Zonal MIGs, auto-healing health checks, rolling zero-downtime updates, stateful MIGs, and autoscaling policies.
• Spot VMs & Preemption Engineering — 30-second ACPI shutdown notice, metadata polling, shutdown scripts, and fault-tolerant batch architectures.
• Google Kubernetes Engine (GKE) Master Hub — Autopilot vs Standard, VPC-native alias IPs, Datapath V2 (Cilium eBPF), private clusters, and Gateway API.
  • GKE Autopilot Architecture & SRE Mechanics — Pod-level billing, mutating webhooks, DaemonSet economics, and compute classes.
  • Cluster Topologies (Zonal vs Regional) — Master replication, etcd Raft quorum, 99.95% SLA, and cross-zone networking costs.
  • Release Channels & Upgrades — Rapid, Regular, Stable, Surge vs Blue-Green node upgrades, and PodDisruptionBudgets.
  • GKE Autoscaling Architecture — Cluster Autoscaler (CA), Node Auto-Provisioning (NAP), HPA v2, and VPA.
  • Heterogeneous Node Pools & Accelerators — Taints, Tolerations, Node Affinity, Local NVMe SSDs, and Tau Arm64.
  • GKE Networking Deep Dive — VPC-native alias IPs, Datapath V2 (Cilium eBPF), Zonal NEGs, and Cloud Armor WAF.
  • GKE Gateway API Architecture — HTTPRoute, GatewayClasses, GCPBackendPolicy, and canary traffic splitting.
  • Multi-Cluster Services (MCS) & Ingress (MCI) — ServiceExport, ServiceImport, clusterset.local, and global Anycast failover.
  • Advanced Network Security & FQDN Policies — Datapath V2 eBPF, Layer 7 FQDN egress filtering, and dedicated Egress NAT.
  • Storage CSI, Hyperdisk & Volume Snapshots — Persistent Disk CSI driver, Hyperdisk Extreme/Balanced, and online expansion.
  • Cloud Storage FUSE CSI Driver — POSIX object storage mounts, AI/ML dataset streaming, and local NVMe caching.
  • Filestore CSI Driver (Managed NFS) — ReadWriteMany (RWX) multi-pod state, multi-share instance packing, and automated snapshots.
  • GPU & TPU Orchestration — NVIDIA L4/A100/H100, Cloud TPU v5e/v5p slices, GPUDirect RDMA, Ray on GKE, and Kueue.
  • Batch Workloads & Kueue Queueing — IndexedJob API, fair-share scheduling, preemption handling, and Spot VM fault tolerance.
  • GKE Security & Hardening — Workload Identity, Shielded nodes, Binary Authorization, and CIS benchmark enforcement.
  • Binary Authorization & Supply Chain Security — Cryptographic attestations, Cloud KMS image signing, and Break-Glass procedures.
  • Multi-Tenancy Isolation & GKE Sandbox (gVisor) — Hard vs soft multi-tenancy, gVisor microkernel, and Pod Security Standards.
  • GKE Observability & Managed Prometheus (GMP) — PodMonitoring, ClusterPodMonitoring, ContainerLogV2 logging, and PromQL.
  • Backup for GKE & Disaster Recovery — Native Kubernetes resource and Persistent Volume backups, and cross-region recovery.
  • GKE SRE Production Troubleshooting Runbook — CrashLoopBackOff, Node NotReady, OOMKilled (Exit Code 137), and IP exhaustion.
  • GKE Cost Optimization & FinOps — GKE Cost Allocation in BigQuery, rightsizing, Spot node pools, and CUDs.
  • GKE Fleets, Anthos Service Mesh & Policy Controller — Multi-cluster Fleet federation, managed Istio mTLS, and OPA Gatekeeper guardrails.
• Cloud Run Services — Stateless serverless containers, request concurrency (up to 1,000 req/inst), Direct VPC Egress, and CPU allocation models.
• Cloud Run Jobs & Batch Processing — Run-to-completion batch processing, task arrays, concurrency parallelism, Cloud Scheduler integration, and 24-hour execution limits.
• Cloud Functions (2nd Gen) & Eventarc — Cloud Run infrastructure, Eventarc CloudEvents triggers, concurrency, cold-start mitigation, and 60-minute execution limits.

2. Networking & Global Transit Hub

• Virtual Private Cloud (VPC) — Global VPC routing domain, regional subnets, primary and secondary ranges for GKE, Shared VPC, Cloud NAT, and hierarchical firewalls.
• Shared VPC Architecture — Host projects vs Service projects, subnet-level IAM delegation, cross-project service accounts, centralized hybrid connectivity, and enterprise governance.
• Firewalls & Hierarchical Policies — Stateful inspection, rule priority (0-65535), Hierarchical Policies (Org/Folder), target tags vs Service Accounts, and rule logging.
• Cloud NAT Deep Dive — Software-defined distributed NAT, Cloud Router integration, dynamic port allocation, SNAT port exhaustion prevention, and outbound logging.
• Cloud Load Balancing & Cloud Armor — Single Anycast IP architecture, Envoy-based ALBs, Maglev NLBs, Zonal NEGs, Cloud Armor WAF/DDoS, and Private Service Connect.
• Cloud Router & Dynamic BGP — Fully managed BGP control plane, custom route advertisements (MED), dynamic routing modes (Regional vs Global), and BFD failover.
• Network Connectivity Center (NCC) — Centralized transit hub connecting VPCs, Cloud VPNs, Interconnects, and third-party SD-WAN router appliances.
• Cloud DNS Architecture — 100% uptime SLA, Anycast nameservers, split-horizon DNS, private forwarding zones, DNS peering, Response Policies (RPZ), and DNSSEC.
• Cloud CDN Architecture & Edge Caching — Google edge Points of Presence (PoPs), cache modes, cache key customization, negative caching, signed URLs/cookies, and cache invalidation.
• Cloud Interconnect & HA VPN — Cloud HA VPN (99.99% SLA), Dedicated vs Partner Interconnect, BGP routing with Cloud Router, and 99.99% enterprise topologies.
• Private Service Connect (PSC) — Private consumption of Google APIs and multi-tenant SaaS services, Service Attachments, PSC Endpoints, and eliminating VPC peering IP overlap.

3. Storage & Data Systems Hub

• Google Cloud Storage (GCS) — Standard, Nearline, Coldline, and sub-second instant Archive retrieval, Object Lifecycle Management, Bucket Lock WORM, and Soft Delete.
• Persistent Disk & Hyperdisk — Zonal vs Regional synchronous mirroring (RPO = 0), next-gen Hyperdisk ML/Extreme, online volume resizing, and GKE CSI driver.
• Cloud Filestore (Managed NFS) — POSIX-compliant NFSv3/NFSv4.1 shared storage, ReadWriteMany (RWX) multi-VM packing, and sub-millisecond file access.
• Storage Transfer Service & Transfer Appliance — Serverless cloud-to-cloud data migration (AWS S3, Azure Blob to GCS), on-premises agent pools, and physical migration appliances.

4. Security & Zero Trust Hub

• Identity & Access Management (IAM) — Resource hierarchy (Organization > Folders > Projects), IAM roles, service accounts, token impersonation, CEL conditions, and organization policies.
• Workload Identity & Federation — Eliminating static JSON keys. GKE Workload Identity, GitHub Actions OIDC federation, and STS token exchange.
• Security Command Center (SCC) — Centralized CSPM/CWPP, hypervisor-level VM Threat Detection (VMTD), Secret Manager versioning, and Cloud KMS envelope encryption.
• Cloud KMS, Cloud HSM & CMEK Envelope Encryption — FIPS 140-2 Level 3 hardware HSM, envelope encryption, automated key rotation, and External Key Manager (Cloud EKM).
• Cloud Armor WAF & DDoS Defense — Global Anycast edge DDoS defense, OWASP ModSecurity CRS, ML-based Adaptive Protection, and rate-based throttling.
• Identity-Aware Proxy (IAP) & BeyondCorp — Context-aware zero-trust HTTPS/TCP proxying, eliminating VPNs for SSH/RDP and internal web apps.
• Sensitive Data Protection (Cloud DLP) — Automated discovery, classification, and cryptographic tokenization/masking of PII/PHI in BigQuery, GCS, and streams.
• Certificate Authority Service (CAS) & Certificate Manager — Managed private CA hierarchy (Root/Subordinate CAs), Cloud HSM keys, automated TLS rotation, and client mTLS.

5. Governance & Organization Policies Hub

• Organization Policies & Resource Governance — Preventive admission-control guardrails across Org/Folder/Project hierarchies, boolean/list constraints, custom CEL constraints, and dry-run mode.

6. Databases & Distributed Storage Hub

• Cloud SQL — PostgreSQL, MySQL, and SQL Server with Regional synchronous HA failover, Cloud SQL Auth Proxy, and IAM database authentication.
• Cloud Spanner — TrueTime atomic clock synchronization, external consistency (serializability), Processing Units (PUs), interleaved tables, and 5-nines multi-region SLA.
• Google BigQuery — Dremel execution engine, Colossus, Capacitor columnar format, partitioned/clustered tables, and on-demand vs slot editions.
• AlloyDB for PostgreSQL — Disaggregated storage engine, log processing service, in-memory columnar engine, and zero-data-loss cross-region replication.
• Cloud Bigtable — Petabyte-scale distributed NoSQL wide-column store, SSTables on Colossus, tablet auto-splitting, and row key design.
• Cloud Firestore — Serverless document database, Native vs Datastore mode, real-time sync listeners, and ACID multi-document transactions.
• Cloud Memorystore — Managed in-memory caching for Redis and Memcached, cluster sharding up to 250 nodes, and high-availability failover.

7. Analytics & Big Data Hub

• Google BigQuery — Serverless data warehouse, BI Engine in-memory acceleration, and BigLake storage abstraction.
• Cloud Dataflow — Serverless Apache Beam streaming and batch runner, dynamic work rebalancing, watermarks, windowing, and Streaming Engine.
• Sub — Global Anycast messaging, serverless sharded log storage, ordering keys, exactly-once delivery, and dead-letter queues.
• Cloud Dataproc — Managed Spark, Hadoop, Flink, and Presto clusters, ephemeral cluster lifecycle, and Dataproc Serverless.
• Cloud Dataplex — Intelligent data mesh, universal metadata catalog, automated schema discovery, data quality (AutoDQ), and data lineage.
• Looker & Looker Studio — LookML code-based semantic modeling, in-database SQL pushdown, Persistent Derived Tables (PDTs), and enterprise BI.
• Cloud Composer — Managed Apache Airflow workflow orchestration on GKE with serverless DCU scaling.

8. AI & Machine Learning Hub

• Vertex AI Architecture & MLOps — Model Garden, Gemini 1.5/2.0 multimodal APIs, Vector Search (ScaNN), Feature Store, custom training, and managed endpoints.
• Cloud TPU Supercomputing — Matrix Multiply Units (MXUs), 2D/3D Torus Inter-Chip Interconnect (ICI), TPU v4/v5e/v5p hardware, and Queued Resources.
• GKE GPU & TPU Orchestration — Kubernetes-native AI/ML clusters with Ray on GKE (KubeRay) and Kueue.

9. Developer Tools & Delivery Hub

• Cloud Build — Serverless CI build runner, parallel container steps, private worker pools in VPC, and SLSA Level 3 provenance.
• Artifact Registry — Universal OCI container and package repository (Docker, Helm, Maven, npm, PyPI), and Container Analysis vulnerability scanning.
• Cloud Deploy — Continuous delivery orchestration for GKE, Cloud Run, and Anthos with automated canary traffic shifting and rollback.

10. Application Integration & Eventing Hub

• Cloud Tasks — Asynchronous HTTP push queue, token-bucket rate limiting, dispatch concurrency, and task deduplication.
• Cloud Workflows — Low-latency serverless state machine orchestration, YAML DAGs, built-in connectors, and the Saga pattern.
• Eventarc — Standardized CloudEvents v1.0 routing from 130+ GCP sources and direct Cloud Storage mutations.
• Apigee X API Management — Enterprise API gateway, traffic shaping (SpikeArrest/Quota), developer portal, and Cloud Armor security.

11. Monitoring & Observability Hub

• Cloud Monitoring & MQL — Cross-project metric scopes, Monitoring Query Language (MQL), Managed Service for Prometheus (GMP), and SRE SLO error budgets.
• Cloud Logging & Log Analytics — High-throughput Log Router, exclusion filters, BigQuery SQL log analytics, log-based metrics, and enterprise sinks.
• Cloud Trace — Distributed latency tracing, OpenTelemetry (OTel) standard, W3C context propagation, and span waterfall root cause analysis.
• Cloud Profiler — Zero-cost continuous production CPU, wall time, heap, and mutex profiling with flame graphs.

12. Cost Optimization & FinOps Hub

• Cost Optimization, CUDs & FinOps — Sustained Use Discounts (SUDs), Resource vs Flexible Committed Use Discounts (CUDs), Active Assist, and BigQuery billing export.
• GKE Cost Optimization & FinOps — GKE Cost Allocation in BigQuery, rightsizing, Spot node pools, and CUDs.

13. Migration & Modernization Hub

• Migration Center — Automated infrastructure discovery, VMware vCenter integration, TCO rightsizing models, and migration wave planning.

GCP vs AWS Architecture Translation

Related Hubs

• AWS — AWS architecture reference catalog
• Azure — Microsoft Azure architecture catalog
• Kubernetes — Cloud-native container orchestration and deep dives
• GCP Security Hub — Cloud-native security operations
• DevOps — CI/CD, GitOps, and platform engineering patterns
• Architecture — System design, distributed systems, and enterprise data models
• Observability — Full-stack metrics, logs, traces, and profiling