What's changed: Created Professional Cloud DevOps Engineer Chapter 1 (Domain 1 "Bootstrap": resource hierarchy/IAM least privilege/org policies/service accounts/Workload Identity/Shared VPC/VPC peering/Private Service Connect/multi-project monitoring/data residency; IaC = Infrastructure Manager/Config Connector/Terraform/Helm/GitOps/blueprints; multi-environments/ephemeral/GKE fleets/patching; Cloud Workstations/Cloud Shell/Gemini Code Assist).
1.2Infrastructure as Code and managing environments/dev environments
Understand IaC tooling and managed services (Infrastructure Manager, Config Connector, Cloud Foundation Toolkit, GitOps, Terraform, Helm), making changes per blueprints, multi-environments such as staging/production (ephemeral environments, GKE fleets, safe patching/upgrades), and secure cloud development environments (Cloud Workstations, Cloud Shell, Gemini Code Assist).
Manage infrastructure as code, not by hand: higher reproducibility, reviewability, and auditability, and prevented drift. Then handle environments consistently and provide a safe foundation for developers.
1.2.1Infrastructure as Code and blueprints
IaC declares configuration. Choose by requirement: Google-managed Infrastructure Manager (runs Terraform) and Config Connector (manage GCP resources as Kubernetes resources), third-party Terraform/Helm, or GitOps with Git as the source of truth. Make changes per Google-recommended blueprints (e.g., Cloud Foundation Toolkit) and automate with Python/Go scripts. Map "Git as the single source of truth = GitOps" and "Terraform-run for GCP = Infrastructure Manager."
1.2.2Multi-environments and secure dev environments
Separate multi-environments like staging/production, create disposable ephemeral environments for validation, and manage configuration and policy. Manage many GKE clusters across the org as a fleet, and plan safe patching/upgrades (staged, surge). Give developers Cloud Workstations (managed dev environments) or Cloud Shell, bootstrapped with required tooling (custom images/IDE/Cloud SDK), assisted by Gemini Code Assist. Map "disposable validation env = ephemeral environment" and "manage many clusters together = fleet."
Common: requirement → means. E.g., "run Terraform via Google-managed" = Infrastructure Manager; "manage GCP as Kubernetes resources" = Config Connector; "Git as deployment truth" = GitOps; "manage many GKE together" = fleet; "disposable validation env" = ephemeral environment; "managed dev environment" = Cloud Workstations; "AI dev assistance" = Gemini Code Assist.
Watch the mix-ups: (1) Manual changes cause drift—make IaC the single source of truth. (2) Do not confuse Infrastructure Manager (runs Terraform) with Config Connector (GCP resources via K8s). (3) For prod patches/upgrades, use staged rollout + a rollback plan.
1.2.3Section summary
- IaC = Infrastructure Manager/Config Connector/Terraform/Helm/GitOps; change per blueprints
- Separate multi-environments, validate with ephemeral environments, manage many GKE via fleets, and patch safely
- Dev environments = Cloud Workstations/Cloud Shell bootstrapped with tooling, assisted by Gemini Code Assist
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To run Terraform via a Google-managed service that also handles state, which is best?
Q2. To manage GCP resources declaratively as Kubernetes custom resources, which is best?
Q3. To make a Git repo the single source of truth and auto-reconcile to the declared state, which approach?
Q4. To manage many GKE clusters enterprise-wide with consistent policy/config, which concept?
Q5. To give developers a consistently provisioned, managed development environment, which is best?