Managing Implementation

State Management

Terraform state tracks the mapping between configuration and real infrastructure. On GCP, the recommended backend is Google Cloud Storage with state locking.

# Backend configuration — GCS with state locking
terraform {
  backend "gcs" {
    bucket  = "my-project-tf-state"
    prefix  = "terraform/production"
  }

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = "my-project-id"
  region  = "us-central1"
}

Module Patterns

Google provides Cloud Foundation Toolkit (CFT) modules — production-ready, opinionated Terraform modules for common GCP patterns.

Terraform in CI/CD

# cloudbuild.yaml — Terraform plan + apply pipeline
steps:
  - id: 'tf-init'
    name: 'hashicorp/terraform:1.7'
    args: ['init']
    dir: 'infrastructure/'

  - id: 'tf-validate'
    name: 'hashicorp/terraform:1.7'
    args: ['validate']
    dir: 'infrastructure/'

  - id: 'tf-plan'
    name: 'hashicorp/terraform:1.7'
    args: ['plan', '-out=tfplan']
    dir: 'infrastructure/'

  # Apply only on main branch
  - id: 'tf-apply'
    name: 'hashicorp/terraform:1.7'
    args: ['apply', '-auto-approve', 'tfplan']
    dir: 'infrastructure/'

Architecture

Apigee is Google Cloud's full-lifecycle API management platform. It sits between API consumers and backend services, providing security, analytics, monetization, and developer portal capabilities.

Policies and Features

• OAuth 2.0 / API Keys — Authentication and authorization for API consumers.
• Quota / Spike Arrest — Rate limiting to protect backends. Quota is per-consumer, spike arrest is per-proxy.
• Response Caching — Cache backend responses to reduce latency and backend load.
• Message Transformation — JSON-to-XML, field masking, header manipulation.
• Analytics — API traffic metrics, error rates, latency percentiles, developer adoption.
• Developer Portal — Self-service portal for API consumers to discover, register, and test APIs.
• Monetization — Billing plans for API usage (freemium, pay-per-call, tiered).

Strategy Comparison

Rollback Patterns

# Cloud Run — instant rollback to previous revision
gcloud run services update-traffic my-api \
    --to-revisions=my-api-00005-abc=100 \
    --region=us-central1

# GKE — rollback a deployment
kubectl rollout undo deployment/my-app
kubectl rollout status deployment/my-app

# Cloud Deploy — rollback a release
gcloud deploy rollbacks create my-rollback \
    --delivery-pipeline=my-pipeline \
    --release=release-001 \
    --region=us-central1

Capabilities

Gemini Cloud Assist is an AI-powered assistant integrated into the Google Cloud Console. It helps architects and operators with natural-language queries about their infrastructure.

gcloud Deep Dive

Client Libraries

Google Cloud provides idiomatic client libraries for Python, Java, Go, Node.js, C#, Ruby, and PHP. These are preferred over REST API calls for application integration.

# Python — Cloud Storage client library
from google.cloud import storage

client = storage.Client(project="my-project")
bucket = client.bucket("my-bucket")
blob = bucket.blob("data/report.csv")
blob.upload_from_filename("/tmp/report.csv")

# Python — BigQuery client library
from google.cloud import bigquery

client = bigquery.Client(project="my-project")
query = """
    SELECT name, COUNT(*) as count
    FROM `my-project.my_dataset.my_table`
    GROUP BY name ORDER BY count DESC LIMIT 10
"""
results = client.query(query).result()
for row in results:
    print(f"{row.name}: {row.count}")

For the PCA exam, understand the testing pyramid and how it applies to cloud architectures:

• Infrastructure Tests — Validate Terraform plans with terraform validate, policy checks with Sentinel or OPA/Gatekeeper, and drift detection.
• Container Image Scanning — Artifact Registry automatically scans for CVEs. Binary Authorization enforces that only scanned images deploy to GKE.
• Integration Testing — Test service interactions in a staging environment that mirrors production. Cloud Build can orchestrate multi-service test suites.
• Smoke Testing — Post-deployment health checks to verify the new version serves traffic correctly before promoting.