Managing and Provisioning Cloud Infrastructure

Load Balancing

Google Cloud offers six types of load balancers. The exam frequently tests your ability to select the right type based on protocol, scope (global vs regional), and backend type.

Cloud DNS and CDN

Cloud DNS is a managed authoritative DNS service. It supports public and private zones, DNSSEC, DNS peering, and split-horizon DNS (different responses for internal vs external queries).

Cloud CDN caches content at Google's edge locations. It integrates exclusively with the External HTTP(S) Load Balancer. Key configuration points include cache modes (CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL) and signed URLs/cookies for access control.

# Enable Cloud CDN on a backend service
gcloud compute backend-services update my-backend \
    --enable-cdn \
    --cache-mode=CACHE_ALL_STATIC \
    --default-ttl=3600 \
    --max-ttl=86400 \
    --global

# Create a Cloud DNS managed zone
gcloud dns managed-zones create my-zone \
    --dns-name=example.com. \
    --description="Production DNS zone" \
    --dnssec-state=on

# Add an A record
gcloud dns record-sets create www.example.com. \
    --zone=my-zone \
    --type=A \
    --ttl=300 \
    --rrdatas=34.120.1.1

Cloud Storage Classes and Lifecycle

Data Transfer Options

# Create a dual-region bucket with Autoclass
gcloud storage buckets create gs://my-autoclass-bucket \
    --location=US \
    --default-storage-class=STANDARD \
    --enable-autoclass \
    --uniform-bucket-level-access

# Enable versioning and retention policy
gcloud storage buckets update gs://my-autoclass-bucket \
    --versioning \
    --retention-period=90d

GKE Deep Dive

GKE is the most complex compute platform on the PCA exam. You must understand the differences between Autopilot and Standard modes, node pool strategies, and cluster networking.

# Create a GKE Autopilot cluster
gcloud container clusters create-auto my-autopilot \
    --region=us-central1 \
    --release-channel=regular \
    --enable-private-nodes \
    --master-ipv4-cidr=172.16.0.0/28

# Create a GKE Standard cluster with custom node pool
gcloud container clusters create my-standard \
    --region=us-central1 \
    --num-nodes=2 \
    --enable-autoscaling --min-nodes=1 --max-nodes=5 \
    --machine-type=e2-standard-4 \
    --enable-ip-alias \
    --workload-pool=my-project.svc.id.goog

# Add a GPU node pool
gcloud container node-pools create gpu-pool \
    --cluster=my-standard \
    --region=us-central1 \
    --machine-type=n1-standard-8 \
    --accelerator=type=nvidia-tesla-t4,count=1 \
    --num-nodes=0 \
    --enable-autoscaling --min-nodes=0 --max-nodes=3

Cloud Run Configuration

Cloud Run deploys stateless containers with automatic scaling. Key configuration decisions include concurrency, CPU allocation, and VPC connectivity.

# Deploy a Cloud Run service with VPC connector
gcloud run deploy my-api \
    --image=gcr.io/my-project/my-api:v1 \
    --platform=managed \
    --region=us-central1 \
    --memory=512Mi \
    --cpu=1 \
    --concurrency=80 \
    --min-instances=1 \
    --max-instances=100 \
    --vpc-connector=my-connector \
    --vpc-egress=private-ranges-only \
    --set-env-vars=DB_HOST=10.0.0.5 \
    --allow-unauthenticated

# Create a VPC Access connector for Cloud Run
gcloud compute networks vpc-access connectors create my-connector \
    --region=us-central1 \
    --network=my-vpc \
    --range=10.8.0.0/28

Training Pipelines

As a Cloud Architect, you design the infrastructure for ML workflows rather than writing model code. Key decisions include compute selection, data pipeline design, and model serving architecture.

Model Serving

API Catalog

Document AI

Document AI provides pre-trained and custom document processors. It extracts structured data from invoices, receipts, tax forms, contracts, and lending documents. Key architectural consideration: Document AI processes run in specific regions — choose the region closest to your data for compliance and latency.

gcloud Patterns

The gcloud CLI is essential for managing GCP resources. The exam may test you on correct command syntax and flag usage for common provisioning tasks.

# Create a VPC with custom subnets
gcloud compute networks create prod-vpc \
    --subnet-mode=custom

gcloud compute networks subnets create web-subnet \
    --network=prod-vpc \
    --region=us-central1 \
    --range=10.0.1.0/24 \
    --enable-private-ip-google-access

gcloud compute networks subnets create db-subnet \
    --network=prod-vpc \
    --region=us-central1 \
    --range=10.0.2.0/24 \
    --enable-private-ip-google-access

# Create firewall rules
gcloud compute firewall-rules create allow-http \
    --network=prod-vpc \
    --allow=tcp:80,tcp:443 \
    --source-ranges=0.0.0.0/0 \
    --target-tags=http-server

gcloud compute firewall-rules create allow-internal \
    --network=prod-vpc \
    --allow=tcp,udp,icmp \
    --source-ranges=10.0.0.0/16

Terraform Patterns

# Terraform — GKE cluster with Workload Identity
resource "google_container_cluster" "primary" {
  name     = "production-cluster"
  location = "us-central1"

  # Remove default node pool, create custom ones
  remove_default_node_pool = true
  initial_node_count       = 1

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }
}

resource "google_container_node_pool" "primary_nodes" {
  name       = "primary-pool"
  cluster    = google_container_cluster.primary.id
  node_count = 2

  autoscaling {
    min_node_count = 1
    max_node_count = 10
  }

  node_config {
    machine_type = "e2-standard-4"
    disk_size_gb = 100
    disk_type    = "pd-ssd"

    oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]

    workload_metadata_config {
      mode = "GKE_METADATA"
    }
  }
}