Managing implementation

Application and infrastructure deployment

Choosing a deployment target and method

Principles to advise teams on:

• Everything as code and in version control: application, infrastructure, pipeline definitions, policies.
• Immutable deployments: replace, do not patch in place. A new image or template, not SSH into a server.
• Environment parity: same artifact, different configuration. Configuration and secrets come from the environment (Secret Manager, ConfigMaps), never baked into images.
• Progressive delivery with automated verification and rollback, plus feature flags.
• Twelve-factor habits: stateless processes, logs to stdout, config in environment, disposable instances. They make Cloud Run and GKE work well.
• Containerisation of legacy apps is often the first step: Migrate to Containers or Buildpacks (gcloud builds submit --pack, or Cloud Run source deploys) avoid hand-writing Dockerfiles.

Infrastructure deployment

Terraform (or Infrastructure Manager) with remote state in Cloud Storage, a plan step with review, separate state per environment and component, modules for reuse, and pipeline execution under a dedicated service account with impersonation rather than personal credentials. Policy checks run against the plan (Policy Controller, Cloud Foundation Toolkit validation, organization policies as the backstop). Drift is found by re-running plan and by Cloud Asset Inventory.

API management and Apigee

Apigee is Google Cloud’s full lifecycle API management platform. Pick it when the question involves external developers or partners, monetisation, quotas per consumer, analytics on API usage, transformation or legacy facade, or enterprise policies. Concepts:

• API proxies sit between consumers and backends (Cloud Run, GKE, on-premises). Policies are attached in request and response flows: authentication (OAuth 2.0, API keys, JWT verification), quota (per developer or app, over a period), spike arrest (smooth burst rate), caching, transformation (XML to JSON, mediation), threat protection, mocking, message logging.
• API products bundle proxies and resources with quotas and are published to developer portals; developer apps get credentials. Analytics show traffic, latency and errors by consumer. Monetisation supports charging.
• Deployment: Apigee X runs on Google Cloud (a managed runtime, connected through VPC peering or Private Service Connect; Apigee hybrid runs the runtime in your own Kubernetes, on premises or elsewhere, with a Google-managed control plane). Fits EHR’s insurer APIs and KnightMotives dealers, which need partner-facing, secured and measured interfaces.
• Combine with Cloud Armor and a load balancer in front, and mTLS to the backends.

API design best practices the exam likes: version APIs (in the path or header) and keep backward compatibility; use idempotency keys so retries are safe; authenticate and authorise every call (OAuth, service accounts with short-lived tokens, never keys in URLs); rate limit and return 429 with retry hints; paginate; use clear error codes; apply exponential backoff with jitter on the client for 429 and 5xx; keep contracts in OpenAPI and test them.

Testing frameworks

Practical points: test with realistic data volumes (anonymised production data via Sensitive Data Protection, never raw PHI or PII in test); tests in the pipeline act as quality gates; run load tests before big events, since a retailer’s peak or a media launch is the failure case; quotas and per-project limits are a typical hidden cause of a failed load test, so request increases early.

Data and system migration tooling

Advice: run parallel old and new systems, validate data (row counts, checksums), schedule cutover during low traffic with a rollback plan, lower DNS TTLs in advance, and migrate in waves by dependency. Keep legacy interfaces running over hybrid networking when told they stay (EHR’s insurer integrations).

Gemini Cloud Assist

Gemini Cloud Assist is the AI assistant integrated into the Google Cloud console and Cloud Assist panel. For an implementation team it helps to:

• Design and deploy: describe an application and get an architecture and generated Terraform, gcloud commands or YAML through Application Design Center.
• Troubleshoot: investigations that gather logs, metrics, recent changes and configuration to suggest a root cause.
• Optimise: surface cost, performance and reliability recommendations.
• Understand: explain resources, errors and unfamiliar services in natural language.

Pair it with Gemini Code Assist (code completion, generation and review in the IDE, with Cloud Code and Cloud Shell Editor). Review generated code and infrastructure before applying it: AI output can be wrong and must pass the same review and tests.

Interacting with Google Cloud programmatically

Shell and IDE

• Cloud Shell: free browser-based Linux terminal with the Google Cloud CLI, kubectl, Terraform, Docker and editors preinstalled, 5 GB persistent home disk, authenticated as you. Good for quick administration, no local setup. Cloud Shell Editor is a Code OSS based editor with Cloud Code.
• Cloud Code extensions for VS Code and JetBrains: templates, Kubernetes and Cloud Run development, local debugging with Skaffold and minikube, deploying and viewing logs, Gemini Code Assist.

CLIs and SDKs

Emulators

Local emulators for Bigtable, Spanner, Pub/Sub, Firestore (and Datastore mode) run on a developer machine or CI so tests are fast, free and offline. Start with gcloud emulators ... start and point the client at it through environment variables such as PUBSUB_EMULATOR_HOST or FIRESTORE_EMULATOR_HOST. They do not reproduce scale, latency, IAM or quotas, so they do not replace integration and load tests.

Infrastructure as code

• Terraform: declarative, plan before apply, state, modules, provider for Google Cloud, large ecosystem, works across clouds (suits multicloud). State in a locked Cloud Storage bucket with versioning, never committed to Git. Use terraform import for existing resources. Config Connector and Config Sync deliver resources through Kubernetes manifests. Deployment Manager is deprecated and replaced by Infrastructure Manager.
• Practices: one root module per environment/component, pinned provider versions, reviewed plans in pull requests, least-privilege deploy service account, drift detection on a schedule, secrets only as references, labels on everything.

Accessing Google APIs

• Prefer client libraries (Java, Python, Go, Node.js, C++, C#, Ruby, PHP) over raw REST calls: they handle authentication through Application Default Credentials, retries with backoff, pagination, and streaming. The lower-level Google API client libraries and generated REST/gRPC are an option for APIs that lack Cloud client libraries.
• Authentication: on Google Cloud, attached service accounts supply ADC automatically. Locally use gcloud auth application-default login or impersonation. From outside Google Cloud use Workload Identity Federation. Avoid service account key files.
• Behave well under load: exponential backoff with jitter on retryable errors, batching requests, pagination, partial responses (fields), caching, and idempotent operations. Respect quotas and handle RESOURCE_EXHAUSTED.
• API enablement: an API must be enabled in the project (gcloud services enable) before use; set a quota project for billing and quota when using ADC with user credentials.
• Use private access to the APIs (Private Google Access, PSC) for workloads without internet.

Applying it