About This Edition: A clean, intermediate-level architectural guide covering all 11 Subsections and 58 Official Considerations of the Google Cloud Certified Professional Cloud Developer curriculum, illustrated with Mermaid architecture blueprints and 116 custom-designed concept & architecture diagrams.
Chapter Plan at a Glance
Ch # | Chapter Title | Subsections | Considerations | Custom Diagrams | Core Focus |
|---|---|---|---|---|---|
00 | Overview | — | Mermaid | The Architectural Planes, plain-English guide to in-scope services, and the 10 Core Architectural Principles. | |
01 | 1.1 | 12 | 24 | Compute platform selection, stateless horizontal scaling, gRPC vs. REST, Apigee/API Gateway, Eventarc/Pub/Sub choreography vs. Cloud Workflows orchestration, and Memorystore caching. | |
02 | 1.2, 1.3 | 15 | 30 | IAM least privilege, Workload Identity Federation, IAP/Identity Platform, Secret Manager rotation, CMEK, Sensitive Data Protection, and Cloud Storage/AlloyDB/Firestore/BigQuery access patterns. | |
03 | 2.1, 2.2, 2.3 | 6 | 12 | Cloud Workstations, local CLI emulators, Gemini Code Assist, Cloud Build multi-stage containers, Artifact Registry, Binary Authorization, and unit/integration/load testing. | |
04 | 3.1, 3.2 | 9 | 18 | Cloud Run revisions, traffic splitting, concurrency, min-instances, Direct VPC Egress, Cloud Run Jobs, GKE Autopilot/Standard, Liveness/Readiness/Startup probes, HPA/VPA, and Gateway API. | |
05 | 4.1, 4.2 | 11 | 22 | Cloud SQL Auth Proxy, connection pooling, Pub/Sub ordering/dead-letter queues, Cloud Tasks vs. Scheduler, gRPC streaming, batching, pagination, exponential backoff, and Vertex AI Gemini APIs. | |
06 | 4.3 | 5 | 10 | Structured JSON logging ( trace correlation), OpenTelemetry instrumentation, Cloud Trace latency waterfalls, Cloud Profiler flame graphs, Error Reporting, and Gemini Cloud Assist. | |
07 | All Sections | — | — | Side-by-side Look-Alike Tool Comparison Matrix, 5-Step Architecture Decision Checklist, and Top 25 Golden Rules. |
Detailed Table of Contents
Chapter 0: The PCD Reference Stack & 10 Core Principles
- 0.1 The Master Architectural Map: All In-Scope Services of the PCD Stack
- 0.2 The 10 Core Architectural Principles
Chapter 1: Designing High-Performing, Event-Driven & Resilient Cloud-Native Applications and APIs
- Subsection 1.1: Designing high-performing applications and APIs (Section 1: Designing Highly Scalable, Secure, and Reliable Cloud-Native Applications)
- Consideration 1.1a: Choosing the appropriate platform based on the use case and requirements (e.g., Compute Engine, GKE, Cloud Run) (Diagrams:
pcd-1.1a-1-run-services-default.jpg,pcd-1.1a-2-run-jobs-serverless-batch.jpg) - Consideration 1.1b: Building, refactoring, and deploying application containers to Cloud Run and GKE (Diagrams:
pcd-1.1b-1-12-factor-logging-stdout.jpg,pcd-1.1b-2-multi-stage-docker-builds.jpg) - Consideration 1.1c: Understanding how Google Cloud services are geographically distributed (e.g., latency, regional services, zonal services) (Diagrams:
pcd-1.1c-1-zonal-vs-regional-vs.jpg,pcd-1.1c-2-minimizing-global-user.jpg) - Consideration 1.1d: Configuring load balancers and applications for session affinity and performant content delivery (Diagrams:
pcd-1.1d-1-right-load-balancer-load.jpg,pcd-1.1d-2-session-affinity.jpg) - Consideration 1.1e: Implementing caching solutions (e.g., Memorystore) (Diagrams:
pcd-1.1e-1-cache-aside-lazy-loading.jpg,pcd-1.1e-2-memorystore-redis-vs.jpg) - Consideration 1.1f: Creating and deploying APIs (e.g., HTTP REST, gRPC) (Diagrams:
pcd-1.1f-1-http-json-rest-vs.jpg,pcd-1.1f-2-idempotency-keys-non.jpg) - Consideration 1.1g: Using application rate limiting, authentication, and observability (e.g., Apigee, Cloud API Gateway) (Diagrams:
pcd-1.1g-1-apigee-vs-api-gateway.jpg,pcd-1.1g-2-apigee-api-gateway-apigee.jpg) - Consideration 1.1h: Integrating applications using asynchronous or event-driven approaches (e.g., Eventarc, Pub/Sub) (Diagrams:
pcd-1.1h-1-decoupling-spiky.jpg,pcd-1.1h-2-to-many-fan-out.jpg) - Consideration 1.1i: Optimizing for cost and resource usage (Diagrams:
pcd-1.1i-1-run-concurrency-vs-cpu.jpg,pcd-1.1i-2-run-cpu-allocation-cpu.jpg) - Consideration 1.1j: Understanding data replication to support zonal and regional failover models (Diagrams:
pcd-1.1j-1-rpo-recovery-point.jpg,pcd-1.1j-2-sql-availability-zonal.jpg) - Consideration 1.1k: Using traffic splitting strategies (e.g., gradual rollouts, rollbacks, A/B testing) on a new service on Cloud Run or GKE (Diagrams:
pcd-1.1k-1-run-revision-traffic.jpg,pcd-1.1k-2-percentage-canary-vs.jpg) - Consideration 1.1l: Orchestrating application services with Workflows, Eventarc, Cloud Tasks, and Cloud Scheduler (Diagrams:
pcd-1.1l-1-orchestration-workflows.jpg,pcd-1.1l-2-tasks-rate-limiting.jpg) - Quick Decision Cheat Sheet (Subsection 1.1)
Chapter 2: Application Security, Zero-Trust Identity, Secret Manager & Data Access Patterns
- Subsection 1.2: Designing secure applications (Section 1: Designing Highly Scalable, Secure, and Reliable Cloud-Native Applications)
- Consideration 1.2a: Implementing data retention and organization policies (e.g., Cloud Storage Object Lifecycle Management, retention policies) (Diagrams:
pcd-1.2a-1-object-lifecycle.jpg,pcd-1.2a-2-arch-storage-storage.jpg) - Consideration 1.2b: Using security mechanisms that identify vulnerabilities and protect services and resources (e.g., Identity-Aware Proxy, Web Security Scanner) (Diagrams:
pcd-1.2b-1-identity-aware-proxy-iap.jpg,pcd-1.2b-2-cryptographic.jpg) - Consideration 1.2c: Responding to and resolving vulnerabilities, including those identified by Artifact Analysis and Security Command Center (Diagrams:
pcd-1.2c-1-artifact-analysis.jpg,pcd-1.2c-2-distinguishing-os-base.jpg) - Consideration 1.2d: Storing, accessing, and rotating application secrets, credentials, and encryption keys (e.g., Secret Manager, Cloud KMS, Workload Identity Federation) (Diagrams:
pcd-1.2d-1-secret-manager-vs-kms.jpg,pcd-1.2d-2-secret-manager-security.jpg) - Consideration 1.2e: Authenticating to Google Cloud services (e.g., ADC, JWT, OAuth 2.0, Cloud SQL Auth Proxy, AlloyDB Auth Proxy) (Diagrams:
pcd-1.2e-1-application-default.jpg,pcd-1.2e-2-service-to-service.jpg) - Consideration 1.2f: Managing and authenticating end-user accounts (e.g., Identity Platform) (Diagrams:
pcd-1.2f-1-identity-platform-ciam-vs.jpg,pcd-1.2f-2-multi-tenancy-in-identity.jpg) - Consideration 1.2g: Securing cloud resources using IAM roles for service accounts (Diagrams:
pcd-1.2g-1-service-account-as.jpg,pcd-1.2g-2-serviceaccountuser-vs.jpg) - Consideration 1.2h: Securing service-to-service communications (e.g., Cloud Service Mesh, Kubernetes Network Policies) (Diagrams:
pcd-1.2h-1-service-mesh-l7-mtls.jpg,pcd-1.2h-2-kubernetes.jpg) - Consideration 1.2i: Running services with least privileged access (Diagrams:
pcd-1.2i-1-eliminate-default-compute.jpg,pcd-1.2i-2-role-hierarchy-predefined.jpg) - Consideration 1.2j: Securing application artifacts using Binary Authorization (Diagrams:
pcd-1.2j-1-binary-authorization.jpg,pcd-1.2j-2-always-deploy-by.jpg) - Quick Decision Cheat Sheet (Subsection 1.2)
- Subsection 1.3: Storing and accessing data (Section 1: Designing Highly Scalable, Secure, and Reliable Cloud-Native Applications)
- Consideration 1.3a: Selecting the appropriate storage system based on the volume of data and performance requirements (Diagrams:
pcd-1.3a-1-structured-relational.jpg,pcd-1.3a-2-sql-spanner-sql-bigtable.jpg) - Consideration 1.3b: Designing appropriate schemas for structured databases (e.g., AlloyDB, Spanner) and unstructured databases (e.g., Bigtable, Datastore) (Diagrams:
pcd-1.3b-1-spanner-schema-uuidv4.jpg,pcd-1.3b-2-never-spanner-spanner.jpg) - Consideration 1.3c: Understanding the implications of eventual and strongly consistent replication of AlloyDB, Bigtable, Cloud SQL, Spanner, and Cloud Storage (Diagrams:
pcd-1.3c-1-strongly-consistent-by.jpg,pcd-1.3c-2-spanner-storage-functions.jpg) - Consideration 1.3d: Creating signed URLs to grant access to Cloud Storage objects (Diagrams:
pcd-1.3d-1-signed-urls-are-essential.jpg,pcd-1.3d-2-generating-signed-urls.jpg) - Consideration 1.3e: Writing data to BigQuery for analytics and AI/ML workloads (Diagrams:
pcd-1.3e-1-bigquery-storage-write.jpg,pcd-1.3e-2-pub-sub-bigquery.jpg) - Quick Decision Cheat Sheet (Subsection 1.3)
Chapter 3: Cloud Development Environments, Container Supply Chain (SLSA) & Automated Testing
- Subsection 2.1: Setting up your development environment (Section 2: Building and Testing Applications)
- Consideration 2.1a: Emulating Google Cloud services using the Google Cloud CLI for local application development and local unit testing (Diagrams:
pcd-2.1a-1-common-pitfall-emulating.jpg,pcd-2.1a-2-ephemeral-state-fast.jpg) - Consideration 2.1b: Using Google Cloud console, Cloud SDK, Cloud Code, Gemini Cloud Assist, Gemini Code Assist, Cloud Shell, and Cloud Workstations (Diagrams:
pcd-2.1b-1-shell-vs-workstations.jpg,pcd-2.1b-2-shell-console-shell-code.jpg) - Quick Decision Cheat Sheet (Subsection 2.1)
- Subsection 2.2: Building (Section 2: Building and Testing Applications)
- Consideration 2.2a: Using Cloud Build and Artifact Registry to build and store containers from source code (Diagrams:
pcd-2.2a-1-cloudbuild-yaml-executes.jpg,pcd-2.2a-2-accelerating-builds.jpg) - Consideration 2.2b: Configuring provenance in Cloud Build (e.g., Binary Authorization) (Diagrams:
pcd-2.2b-1-automatic-slsa-build.jpg,pcd-2.2b-2-build-provenance-captures.jpg) - Quick Decision Cheat Sheet (Subsection 2.2)
- Subsection 2.3: Testing (Section 2: Building and Testing Applications)
- Consideration 2.3a: Writing unit tests with the help of Gemini Code Assist (Diagrams:
pcd-2.3a-1-context-engineering.jpg,pcd-2.3a-2-hermetic-unit-tests-via.jpg) - Consideration 2.3b: Executing automated integration tests in Cloud Build (Diagrams:
pcd-2.3b-1-running-multi-container.jpg,pcd-2.3b-2-live-revision-smoke.jpg) - Quick Decision Cheat Sheet (Subsection 2.3)
Chapter 4: Configuring & Deploying Cloud-Native Runtimes: Cloud Run & Google Kubernetes Engine (GKE)
- Subsection 3.1: Deploying applications to Cloud Run (Section 3: Configuring Cloud-Native Applications for Deployment)
- Consideration 3.1a: Deploying applications from source code (Diagrams:
pcd-3.1a-1-single-command-source.jpg,pcd-3.1a-2-run-container-runtime.jpg) - Consideration 3.1b: Invoking Cloud Run services using triggers (e.g., Eventarc, Pub/Sub) (Diagrams:
pcd-3.1b-1-primary-trigger.jpg,pcd-3.1b-2-securing-trigger.jpg) - Consideration 3.1c: Configuring event receivers (e.g., Eventarc, Pub/Sub) (Diagrams:
pcd-3.1c-1-parsing-event-envelopes.jpg,pcd-3.1c-2-eventarc-cloudevents.jpg) - Consideration 3.1d: Exposing and securing APIs in applications (e.g., Apigee) (Diagrams:
pcd-3.1d-1-securing-perimeter-apigee.jpg,pcd-3.1d-2-defense-in-depth-run.jpg) - Consideration 3.1e: Deploying a new API version in Cloud Endpoints considering backward compatibility (Diagrams:
pcd-3.1e-1-non-breaking-additive-vs.jpg,pcd-3.1e-2-non-breaking-safe-minor.jpg) - Quick Decision Cheat Sheet (Subsection 3.1)
- Subsection 3.2: Deploying containers to GKE (Section 3: Configuring Cloud-Native Applications for Deployment)
- Consideration 3.2a: Deploying containerized applications (Diagrams:
pcd-3.2a-1-right-kubernetes-workload.jpg,pcd-3.2a-2-deployment-gke-workloads.jpg) - Consideration 3.2b: Defining resource requirements for container workloads (Diagrams:
pcd-3.2b-1-resources-requests-vs.jpg,pcd-3.2b-2-requests-scheduling-hpa.jpg) - Consideration 3.2c: Implementing Kubernetes health checks to increase application availability (Diagrams:
pcd-3.2c-1-master-probe-types.jpg,pcd-3.2c-2-zero-downtime-graceful.jpg) - Consideration 3.2d: Configuring the Horizontal Pod Autoscaler for cost optimization (Diagrams:
pcd-3.2d-1-hpa-calculates-replica.jpg,pcd-3.2d-2-scaling-on-custom.jpg) - Quick Decision Cheat Sheet (Subsection 3.2)
Chapter 5: Integrating Managed Data Services & Consuming Google Cloud and Vertex AI APIs
- Subsection 4.1: Integrating applications with data and storage services (Section 4: Integrating Applications with Google Cloud Services)
- Consideration 4.1a: Managing connections to various Google Cloud datastores (e.g., Cloud SQL, Firestore, Cloud Storage) (Diagrams:
pcd-4.1a-1-global-scope-connection.jpg,pcd-4.1a-2-golden-functions-sql-sql.jpg) - Consideration 4.1b: Reading and writing data to and from various Google Cloud datastores (Diagrams:
pcd-4.1b-1-preventing-lost-updates.jpg,pcd-4.1b-2-storage-conditional.jpg) - Consideration 4.1c: Writing applications that publish and consume data using Pub/Sub (Diagrams:
pcd-4.1c-1-publisher-best-practices.jpg,pcd-4.1c-2-subscriber-best-practices.jpg) - Quick Decision Cheat Sheet (Subsection 4.1)
- Subsection 4.2: Consuming Google Cloud APIs (Section 4: Integrating Applications with Google Cloud Services)
- Consideration 4.2a: Enabling Google Cloud services (Diagrams:
pcd-4.2a-1-service-usage-api-gcloud.jpg,pcd-4.2a-2-required-iam-role-to.jpg) - Consideration 4.2b: Making API calls using supported options (e.g., Cloud Client Libraries, REST API, gRPC, API Explorer) (Diagrams:
pcd-4.2b-1-hierarchy-of-api.jpg,pcd-4.2b-2-calling-generative-ai.jpg) - Consideration 4.2c: Batching requests (Diagrams:
pcd-4.2c-1-batching-matters-batching.jpg,pcd-4.2c-2-service-specific-batching.jpg) - Consideration 4.2d: Restricting return data (Diagrams:
pcd-4.2d-1-over-fetching-problem.jpg,pcd-4.2d-2-partial-responses-via.jpg) - Consideration 4.2e: Paginating results (Diagrams:
pcd-4.2e-1-never-fetch-unbounded.jpg,pcd-4.2e-2-cursor-based-token.jpg) - Consideration 4.2f: Caching results (Diagrams:
pcd-4.2f-1-layers-of-api-response.jpg,pcd-4.2f-2-memorystore-vision-api.jpg) - Consideration 4.2g: Handling errors (e.g., exponential backoff) (Diagrams:
pcd-4.2g-1-know-which-http-grpc.jpg,pcd-4.2g-2-retryable-transient.jpg) - Consideration 4.2h: Using service accounts to make Cloud API calls (Diagrams:
pcd-4.2h-1-attached-service-accounts.jpg,pcd-4.2h-2-compute-engine-access.jpg) - Quick Decision Cheat Sheet (Subsection 4.2)
Chapter 6: Production Observability, OpenTelemetry Distributed Tracing & AI-Assisted Troubleshooting
- Subsection 4.3: Troubleshooting and observability (Section 4: Integrating Applications with Google Cloud Services)
- Consideration 4.3a: Instrumenting code to facilitate troubleshooting using metrics, logs, and traces in Google Cloud Observability (Diagrams:
pcd-4.3a-1-vendor-neutral.jpg,pcd-4.3a-2-structured-json-logging.jpg) - Consideration 4.3b: Identifying and resolving issues using Google Cloud Observability (Diagrams:
pcd-4.3b-1-right-observability-tool.jpg,pcd-4.3b-2-log-router-sinks-log.jpg) - Consideration 4.3c: Managing application issues using Error Reporting (Diagrams:
pcd-4.3c-1-error-reporting-groups.jpg,pcd-4.3c-2-formatting-logs-so-error.jpg) - Consideration 4.3d: Using trace IDs to correlate trace spans across services (Diagrams:
pcd-4.3d-1-distributed-traces-break.jpg,pcd-4.3d-2-propagating-trace-context.jpg) - Consideration 4.3e: Using Gemini Cloud Assist (Diagrams:
pcd-4.3e-1-accelerating-incident.jpg,pcd-4.3e-2-operations-logging-gemini.jpg) - Quick Decision Cheat Sheet (Subsection 4.3)
Chapter 7: Master Look-Alike Tool Comparison & Decision Playbook
- 7.1 The Master Look-Alike Tool Comparison Matrix
- 7.2 The 5-Step Architecture Decision Checklist
- 7.3 Top 25 Golden Rules for Final Review
Generating the Custom Illustrations (pcd-image-prompts.json)
All 116 custom image prompts and output filenames for this book are stored in pcd-image-prompts.json (and mirrored in openai-image-gen/out/9006-openai-prompts-pcd-book.json). To generate the illustrations using openai-image-gen/images-from-prompts.py, run:
cd openai-image-gen uv run images-from-prompts.py -file ../books/pcd-architecture-takeaways/pcd-image-prompts.json -simple -quality medium
AwesomeGCP.com Learning
The approach taken is a question-led learning approach: you explore realistic project scenarios where you need to make decisions or take actions to achieve business goals within specific constraints. Instead of passive learning, you are challenged to think and work through the options to master the Professional Cloud Developer (PCD) certification!