DevOps, IaC, GitOps, and Operations

Product Name & Status Changes (Mid-2026 Update)

Old / Legacy Name	Current Status	What to Know for the Exam
Cloud Deployment Manager	End of support: March 31, 2026. No longer usable.	If a question describes YAML/Jinja/Python declarative templates, that’s legacy DM. The exam-correct migration path is now Infrastructure Manager (Terraform-based) or a third-party IaC tool. A tool called DM Convert (`dm-to-terraform`) exists to translate old DM configs to Terraform (HCL) or Kubernetes Resource Model (KRM) for Config Connector.
Infrastructure Manager (Infra Manager)	Generally Available (GA).	This is now Google’s first-party managed Terraform service (“Terraform-as-a-Service”). No self-managed state backend or CI pipeline required. Charges flow through Cloud Build minutes + Cloud Storage, not a separate Infra Manager fee.
Cloud Foundation Toolkit (CFT)	Narrowed scope, now essentially a curated set of production-ready Terraform blueprints/modules.	Exam framing: CFT = reusable, Google-recommended Terraform modules for landing zones / foundations, not a separate product to “choose” over Terraform.
Config Connector & Config Controller	Active for Kubernetes-native GCP resource management (KRM).	If a question emphasizes “manage GCP resources as Kubernetes custom resources / GitOps,” think Config Connector; if it says “fully managed hosted control plane for that pattern,” think Config Controller.
Ops Agent	Standard, GA. Combines the old Monitoring agent + Logging agent.	If you see “install two separate agents on my VM for logs and metrics” (that’s the deprecated legacy pattern), use the modern, correct answer: the single Ops Agent.
Cloud Debugger	Deprecated / Shut down.	Do not select it as an answer for live production debugging. Cloud Trace + Cloud Profiler + Error Reporting remain the current APM toolset.
Artifact Registry	GA, fully replaces legacy Container Registry (gcr.io), which is shut down.	If an exam question references `gcr.io` as the target for a new design, that’s a red flag; the correct current answer is Artifact Registry, which supports containers, language packages (npm, Maven, Python, Go), and OS packages in one regional/multi-regional repo with built-in vulnerability scanning.

Infrastructure as Code (IaC) & GitOps

Core Concept

IaC = defining infrastructure in versioned, declarative configuration files rather than manual console/CLI actions. Enables repeatability, peer review (pull requests), and drift detection, directly supporting the Operational Excellence and Reliability pillars of the Well-Architected Framework.

Terraform on Google Cloud

State file: The single source of truth mapping your config to real-world resource IDs. Must be stored remotely and securely (Cloud Storage bucket with Object Versioning enabled, or Terraform Cloud/Enterprise).
- !! Exam pitfall: Never commit state to source control (it can contain secrets in plaintext).
- Object Versioning: Crucial for recovering state files corrupted during interrupted terraform apply operations.
State locking: Prevents concurrent apply operations from corrupting state. The GCS backend supports native locking via GCS object holds/mutexes.
Keyless Authentication & Security:
- !! Exam pitfall: Never download static long-lived Service Account JSON keys into CI/CD runners (GitHub Actions, GitLab CI, Jenkins).
- Use Workload Identity Federation (WIF) to authenticate external CI/CD pipelines directly to GCP using short-lived tokens.
- In native GCP pipelines (Cloud Build), use Service Account Impersonation (google_service_account_access_token or -impersonate-service-account).
Least Privilege Roles for IaC: Assign targeted roles (e.g. roles/resourcemanager.projectIamAdmin, roles/compute.networkAdmin) to the Terraform Service Account rather than broad roles/owner or roles/editor.
Modular design: Reusable modules (e.g., a “VPC module,” a “GKE cluster module”) promote consistency across teams/projects (philosophy behind CFT Terraform blueprints).
Drift detection: terraform plan compares real infrastructure to the state file/config and reports differences caused by manual out-of-band changes.
- !! Exam pitfall: Terraform does not continuously monitor for drift
- Detection only happens when you run plan or refresh.
Workflow: write → plan → apply. Recommend running plan in CI (triggered by a pull request) and gating apply behind manual approval for production.

Infrastructure Manager (Infra Manager)

Google-managed execution environment for Terraform; you supply a Terraform root module (Infra Manager calls this a “blueprint”) stored in Cloud Storage, a Git repo, or uploaded locally.
Handles state storage and locking for you
- No separate GCS backend configuration required.
Supports preview deployments (a dry-run showing planned changes before apply)
- Analogous to terraform plan.
Integrates with Cloud Build under the hood for Git-triggered automated deployment workflows and supports Developer Connect for repo connections.
Requires a dedicated Service Account passed during deployment creation
- Least privilege
- Scoped only to the resources the Terraform config manages.

IaC Tooling Selection Cheat Sheet

Requirement / Scenario	Recommended Solution
Need Google-recommended production landing zone modules	Cloud Foundation Toolkit (CFT) Terraform Blueprints
Managed Google-native execution engine without managing remote state/CI runners	Infrastructure Manager (Infra Manager)
Cross-cloud infrastructure provisioning with existing team expertise	Terraform (with GCS remote backend + WIF)
Kubernetes-native teams wanting GitOps for GCP resources	Config Controller / Config Connector
Migrating legacy Deployment Manager YAML templates	DM Convert (`dm-to-terraform`) → Terraform / Infra Manager

GitOps Architecture (Config Sync, Config Connector, & Config Controller)

GitOps is an operational framework that applies DevOps best practices (version control, PR reviews, CI/CD) to infrastructure and cluster configuration:

Declarative State: Infrastructure and application configurations are defined declaratively in Git repositories.
Git as Single Source of Truth: All desired state is committed to a Git repository.
Continuous Reconciliation Loop: Automated agents continuously pull desired state from Git and apply it to live environments, correcting drift automatically.

GCP GitOps Building Blocks

Config Connector: Kubernetes operator managing GCP resources (e.g. kind: SQLInstance, kind: PubSubTopic, kind: StorageBucket) as Kubernetes Custom Resource Definitions (CRDs).
Config Sync: Continuous reconciliation engine syncing Git configs (KRM YAMLs) across GKE Fleet member clusters, automatically detecting and reverting out-of-band manual drift.
Config Controller: Fully managed hosted GKE control plane pre-loaded with Config Connector + Config Sync + Policy Controller (OPA Gatekeeper).
Policy Controller: Enforces policy-as-code constraints (e.g. requiring labels, blocking privileged containers) before manifests are reconciled.

Modern CI/CD, Supply Chain Security, Staged Deployments, & Rollbacks

Cloud Build (CI Engine)

Serverless CI system that executes build steps as containers defined in cloudbuild.yaml.
Execution Mechanics:
- Parallel step execution using waitFor: ['-'] or specifying preceding step IDs.
- Custom parameters using Substitutions (_MY_CUSTOM_VAR).
- Secret Manager Integration: Reference secrets directly in cloudbuild.yaml via availableSecrets without exposing plaintext values in logs.
Worker Pools:
- Default Shared Pool: Runs in a public Google-managed network with no private network access.
- Private Pools: Run builds inside dedicated, single-tenant worker instances connected to your private VPC network via VPC Peering.
  - !! Exam pitfall: If Cloud Build must deploy to a private GKE cluster control plane, push images to a private Artifact Registry, or query an internal database, you must use Cloud Build Private Pools.

Software Supply Chain Security & DevSecOps (SLSA Framework)

Unit & Integration Testing: Executed directly inside isolated container steps in Cloud Build prior to packaging.
Artifact Registry: Managed repository for container images and package formats (Docker, Helm, Maven, npm, Python, Go, Apt, Yum).
- Tag Immutability: Enforce immutable tags to prevent malicious/accidental overwriting of release tags like :v1.0.
- Cleanup Policies: Automatic TTL and version retention rules to manage storage costs.
- Remote & Virtual Repositories: Cache upstream dependencies (e.g. Docker Hub, npm) securely within your GCP perimeter.
Automated Vulnerability Scanning: Artifact Analysis continuously scans container images in Artifact Registry for known CVEs.
Binary Authorization (BinAuthz): Deploy-time policy enforcement engine for GKE and Cloud Run.
- Enforces that only container images cryptographically signed by trusted Attestors (via Cloud KMS) can be deployed to GKE or Cloud Run.
- If image scanning finds unpatched Critical CVEs or missing signatures, BinAuthz blocks deployment.
- Breakglass Mechanism: Allows emergency manual overrides for incident response, which generates high-priority audit logs in Cloud Audit Logging.

Cloud Deploy (Managed CD)

Managed continuous delivery service for progressing releases across ordered targets (e.g. dev → staging → prod) for GKE, Cloud Run, and Anthos/GKE Enterprise clusters using Skaffold declarative manifests.

Staged Deployment Strategies

Canary Deployments: Progressively shifts traffic to a new release version (e.g. 10% → 25% → 50% → 100%) while observing error rates and metrics.
- On Cloud Run: Uses traffic split percentages on revision tags.
- On GKE: Uses GKE Ingress / Gateway API traffic splitting rules.
Blue/Green Deployments: Provisions a full parallel “Green” deployment environment alongside the live “Blue” environment, switching 100% of user traffic instantly at the load balancer or Service level once verification tests pass.
Parallel Deployment Targets: Deploying simultaneously to multi-region targets for high availability.
Approval Gates: Manual approval steps (requireApproval: true) configured prior to promoting releases into production targets. Requires roles/clouddeploy.approver permission.

Deployment Rollbacks & Verification

Automated Verification: Cloud Deploy executes post-deployment verification tests (e.g., HTTP health checks or custom Skaffold verification scripts skaffold verify) after deploying to a target.
Automated Rollback: If verification tests fail or error thresholds spike, Cloud Deploy automatically triggers a rollback (gcloud deploy releases rollback) to the previous known-good release target.
Manual One-Click Rollback: Operations teams can manually initiate a rollback to any previous release snapshot retained in the delivery pipeline history.

Operations Suite (Observability, SRE, & APM)

Site Reliability Engineering (SRE) Core Concepts

Concept	Definition	Exam Significance
SLI (Service Level Indicator)	Quantifiable metric measuring performance (e.g. request latency < 200ms, HTTP 2xx success rate).	The actual measured performance metric.
SLO (Service Level Objective)	Target set by the engineering team (e.g. 99.9% success rate over 30 days).	Internal target for service health.
SLA (Service Level Agreement)	Contractual commitment to users with financial penalties for breach (e.g. 99.5% uptime).	Rule: SLA < SLO. SLA always gives a safety margin below the SLO.
Error Budget	`100% - SLO` (e.g. 0.1% for a 99.9% SLO).	Governs release velocity. If budget is exhausted, freeze feature releases and devote 100% engineering effort to stability and reliability.

Cloud Logging & Log Router Architecture

Ops Agent: Single unified VM agent for Compute Engine collecting system metrics (CPU, RAM, disk) and application logs.
Log Router: Processes all incoming logs and applies Inclusion & Exclusion filters.
- Exclusion Filters: Drop high-volume, non-critical logs (e.g., HTTP 200 health checks) before ingestion to reduce logging costs.
Aggregated Log Sinks: Folder or Organization-level sinks routing audit and application logs to target destinations:
- Cloud Storage: Cold storage for long-term regulatory compliance archiving (combine with Object Lock / Bucket Lock for immutability).
- BigQuery: SQL analytical queries, forensic auditing, and security investigations.
- Pub/Sub: Real-time streaming integration into external SIEM tools (Splunk, Datadog, Elastic).
- Log Buckets: Regional GCP log storage with custom retention policies (critical for GDPR data residency compliance).
Billable vs. Non-Billable Audit Logs:
- Admin Activity Logs: Always enabled, FREE (non-billable).
- Data Access Logs: Disabled by default due to high volume, BILLABLE when enabled.

Cloud Monitoring, Alerting, & Synthetic Checks

Alerting Policies: Trigger notifications based on metric thresholds, error budget burn rates, or log query matches.
Notification Channels: Email, PagerDuty, Slack, Pub/Sub, Webhooks.
Muting Rules: Temporarily suppress alerts during scheduled maintenance windows.
Synthetic / Uptime Checks: Configurable probes executing periodic HTTP/HTTPS/TCP requests from global probing locations to verify application endpoint availability and latency.

Application Performance Management (APM) Cheat Sheet

Exam Trigger Scenario	Correct Tool
“Which specific line or function in our code is burning CPU or memory?”	Cloud Profiler
“Which microservice hop is adding latency to this distributed API request?”	Cloud Trace
“We are seeing a new class of unhandled exceptions spike after a deployment”	Error Reporting
“Is our SLA/uptime target being met across global regions?”	Cloud Monitoring (SLOs, Uptime Checks)
“Need to query log trends using SQL across millions of log entries”	Log Analytics (BigQuery-powered Cloud Logging)

Cloud Workstations

Fully managed, secure cloud developer environments running inside Google-managed infrastructure, eliminating local code storage on laptops.
Security Posture: Prevents intellectual property theft by ensuring zero code resides on physical developer machines.
Pre-configured Containers: Uses custom developer container images to eliminate “works on my machine” variance across development teams.
VPC Integration: Workstations run inside your private VPC, allowing secure access to internal staging databases, code repositories, and private GKE clusters without client VPNs.
Cost Management: Integrated auto-shutdown rules automatically terminate idle workstation instances to prevent unexpected charges.