DevOps Training
Google Cloud Track
— Islamabad 2026

GKE is where Kubernetes was born and where it is most mature. Three weeks covering it properly — from Kubernetes fundamentals through GKE-specific operations (including Autopilot) to the GitOps delivery layer.

1. Architecture: control plane (API server, etcd, scheduler, controller manager) and data plane (kubelet, kube-proxy) — GKE manages the control plane
2. Core workload objects: Pods, ReplicaSets, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs — when each is appropriate
3. Services: ClusterIP, NodePort, LoadBalancer (backed by Google Cloud LB), ExternalName — DNS-based discovery with CoreDNS
4. Ingress: GKE Ingress (Google Cloud HTTP(S) LB), NGINX Ingress, and Gateway API — TLS with Google-managed certificates
5. Persistent Volumes: Compute Engine Persistent Disk CSI driver and Filestore CSI driver for RWX workloads
6. Namespaces, RBAC, and binding Google identities to Kubernetes roles via GKE RBAC
7. Resource requests, limits, LimitRanges, ResourceQuotas, and QoS classes
8. Health checks: liveness, readiness, startup probes that work reliably with Cloud Load Balancing health checks
9. Pod scheduling: affinity/anti-affinity, topology spread constraints, taints, tolerations, PodDisruptionBudgets

1. GKE cluster modes: Standard vs Autopilot — when each is appropriate, cost model differences, and Autopilot workload constraints
2. GKE Autopilot: fully managed Kubernetes mode — no node management, pod-based billing, and built-in security hardening
3. GKE provisioning with Terraform: google_container_cluster, node pool configuration, and the GKE Terraform module
4. GKE networking: VPC-native clusters, alias IP ranges, GKE Dataplane V2 (eBPF-based), and Network Policy enforcement
5. Workload Identity for GKE: binding Kubernetes ServiceAccounts to Google service accounts — replacing service account key files
6. GKE node pools: standard, Spot, Arm (T2A), and GPU node pools — when to use each
7. GKE cluster autoscaling: Cluster Autoscaler and Node Auto-Provisioning (NAP)
8. Secret Manager CSI driver for GKE: mounting secrets as files or environment variables — no Kubernetes Secrets needed
9. GKE observability: Google Managed Prometheus, Cloud Monitoring Container Insights, and Workload metrics
10. GKE security hardening: Shielded GKE nodes, Binary Authorization admission control, and Workload Identity enforcement
11. GKE cluster upgrades: release channels (Rapid/Regular/Stable), auto-upgrade, maintenance windows, and blue/green node pool upgrades

1. Helm: packaging applications — charts, values files, hooks, and Helm with Cloud Deploy
2. Kustomize: environment-specific overlays — base + overlays for dev/staging/prod GKE clusters
3. Config Sync (Flux-based): the GKE Enterprise GitOps operator — syncing from Git, OCI registries, and Cloud Storage
4. ArgoCD on GKE: Applications, ApplicationSets, App of Apps, and multi-cluster deployments
5. Cloud Deploy with GKE: Skaffold rendering, release promotion, and GKE rollout verification with custom metrics
6. Argo Rollouts on GKE: canary and blue/green with Cloud Monitoring-backed automated analysis
7. Anthos Service Mesh (ASM): managed Istio for GKE — mTLS, traffic management, Kiali observability, and cross-cluster mesh
8. Multi-cluster GKE: GKE Fleet management, multi-cluster Ingress, and multi-cluster Services for global load balancing
9. Config Controller: hosted Config Connector and Policy Controller — managing GCP resources and enforcing policies from Git

Google Cloud has one of the most sophisticated security models of any cloud — built on BeyondProd zero-trust principles. SLSA, Binary Authorization, and VPC Service Controls are Google inventions.

1. Security Command Center Premium: security findings, compliance dashboards (CIS, PCI-DSS, NIST), threat detection, and automated Pub/Sub export for SIEM integration
2. Chronicle SIEM: Google's cloud-native security operations platform — GCP log ingestion, YARA-L detection rules, and SOAR playbooks
3. VPC Service Controls in depth: service perimeters, access levels, access policies, and bridging perimeters for controlled data sharing
4. Cloud KMS: CMEK for Cloud Storage, BigQuery, GKE, Cloud SQL, and Secret Manager — key rings, versions, rotation, and Cloud HSM
5. Cloud Armor Advanced: custom WAF rules with CEL expressions, adaptive protection (ML-based DDoS), and named IP lists
6. Cloud IDS (Intrusion Detection System): network threat detection using Palo Alto Networks signatures
7. Assured Workloads: compliance boundaries for FedRAMP, ITAR, IL4 — data residency controls and organisation policy constraints
8. Organisation Policy Service: restricting public IPs, disabling service account key creation, requiring OS Login, and enforcing uniform bucket-level access

1. Shift-left: Trivy (containers), Checkov (Terraform), Semgrep (SAST), OSV-Scanner (Google's open source vulnerability tool), and licence compliance scanning
2. SBOM: generating with Syft and attesting in Artifact Registry using Google Cloud's attestation framework
3. Binary Authorization in depth: attestors, attestation authorities, Cloud KMS-signed attestations, and enforcing signing in Cloud Deploy and GKE
4. SLSA framework: Google's supply chain security standard — SLSA provenance from Cloud Build, verifying provenance in Binary Authorization
5. Container Analysis and Artifact Registry scanning: on-push and continuous scanning APIs — Pub/Sub-triggered remediation for newly discovered CVEs
6. GCP compliance frameworks: CIS Google Cloud Foundations Benchmark, PCI-DSS, ISO 27001, and SOC 2 with SCC dashboards
7. Cloud DLP: discovering and redacting PII, credentials, and PHI in Cloud Storage, BigQuery, and Datastore
8. Incident response on GCP: isolating compromised resources, forensic investigation with Cloud Audit Logs and SCC findings, and automated runbooks with Cloud Functions

GCP has the most elegant serverless ecosystem of any major cloud — Cloud Run is the industry's best serverless container platform, and Pub/Sub powers event-driven architectures at YouTube scale.

1. Cloud Run deep dive: execution model, concurrency (up to 1,000 concurrent requests per instance), CPU allocation options, and min/max instance configuration
2. Cloud Run revisions and traffic splitting: canary releases, blue/green, and rollback — managed without Kubernetes
3. Cloud Run jobs: batch and scheduled workloads — task parallelism, index-based arrays, and Cloud Scheduler integration
4. Cloud Run sidecars: multi-container Cloud Run — proxy, log shipper, or agent alongside the main container
5. Cloud Run with VPC: Direct VPC egress and VPC Access Connector — accessing Cloud SQL, Memorystore, and internal services
6. Cloud Functions (2nd gen): the Cloud Run-based Functions runtime — Eventarc-backed, longer timeouts, larger instances, and concurrency
7. Eventarc: unified eventing — routing events from GCP services, Pub/Sub, and third-party webhooks to Cloud Run and Cloud Functions
8. Cloud Pub/Sub: globally distributed message bus — pull and push subscriptions, dead-letter topics, message filtering, ordering, and exactly-once delivery
9. Cloud Tasks: managed async task queues — HTTP task targets, deduplication, scheduling, and rate limiting
10. Cloud Scheduler: managed cron jobs — triggering Pub/Sub, HTTP endpoints, and Cloud Functions on a schedule
11. Cloud Endpoints and API Gateway: managed API gateways for Cloud Run and Cloud Functions — auth, rate limiting, monitoring
12. Cloud Workflows: serverless orchestration — multi-step workflows in YAML/JSON calling GCP APIs, HTTP endpoints, and Cloud Functions
13. Event-driven patterns: choreography with Pub/Sub + Eventarc, orchestration with Cloud Workflows, and fan-out with multi-subscription topics
14. Firebase: Realtime Database, Firestore, Firebase Auth, and Cloud Functions for serverless mobile/web backends

Platform Engineering on GCP — building the foundation that development teams self-service from. Project provisioning, environment creation, policy enforcement, and the developer portal that surfaces it all.

1. Platform Engineering principles for GCP: Google's SRE culture applied to platform teams — golden paths, golden images, and DORA metrics
2. GCP organisation structure: management groups with folders (BU, team, environment), Shared VPC host project pattern, and the Google Cloud Enterprise Foundation blueprint
3. Project factory with Terraform: automating project creation with standard VPC, IAM bindings, API enablement, and budget configuration
4. Cloud Foundation Toolkit (CFT): Google's opinionated Terraform module library — project-factory, vpc, gke, iam-member-pairs modules
5. Fabric FAST: Google's modular, stage-based FAST framework for deploying a complete GCP foundation from zero
6. Backstage with GCP: internal developer portal — Google Cloud plugin, GKE plugin, Cloud Run plugin, and GCP resource entity provider
7. Config Connector advanced: managing the full GCP resource hierarchy as Kubernetes resources — policy, IAM, and networking from Git via Config Sync
8. Terraform advanced patterns for GCP: provider aliasing for multi-project, and Terratest against real GCP projects
9. Organisation Policy advanced: custom constraints using CEL expressions, policy simulation, and programmatic management with Terraform
10. GCP resource management at scale: label enforcement via Organisation Policy, and 100+ projects with hub-spoke Shared VPC topology
11. FinOps on GCP: BigQuery billing exports, Looker Studio cost dashboards, CUD optimisation, and GCP FinOps Hub recommendations

GCP's data and ML platform is the most complete of any cloud — BigQuery, Vertex AI, Dataflow, Pub/Sub, Dataproc, and Looker form an integrated stack that powers the world's most data-intensive applications.

1. BigQuery infrastructure: dataset/table organisation, column-level access control, row-level security, and partitioned/clustered table design for cost control
2. BigQuery slot management: on-demand vs capacity pricing, slot reservations (editions), and monitoring slot utilisation
3. Cloud Dataflow: the managed Apache Beam service — worker pools, autoscaling, Streaming Engine, and Dataflow templates
4. Cloud Pub/Sub as a data pipeline backbone: exactly-once delivery, Dataflow-Pub/Sub integration, dead-letter topics, and Pub/Sub Schema registry
5. Cloud Dataproc: managed Apache Spark/Hadoop — autoscaling policies, Dataproc Serverless for ephemeral Spark jobs, and Dataproc Metastore
6. Cloud Composer (managed Airflow): environment infrastructure, environment size, autoscaling workers, VPC-native networking, and DAG deployment from Cloud Storage
7. Vertex AI platform infrastructure: Workbench, custom training jobs (CPU and GPU), Training Pipelines, and the Model Registry
8. Vertex AI compute: N1/N2/A2/A3 GPU instances (T4, V100, A100, H100), Spot VM training jobs, and TPU pods for large-scale training
9. Vertex AI model serving: Dedicated Endpoints vs Serverless Prediction, traffic splitting for A/B testing, and autoscaling
10. Vertex AI Pipelines: Kubeflow Pipelines on Vertex — reproducible ML pipelines with component caching and artifact lineage
11. Vertex AI Feature Store: online store for low-latency retrieval, offline store for training, and feature monitoring
12. MLOps CI/CD on GCP: triggering Vertex AI Pipelines from Cloud Build, model evaluation gates, automatic deployment on approval
13. Data platform security: VPC Service Controls around BigQuery and Vertex AI, column-level encryption with Cloud DLP
14. Data infrastructure cost control: BigQuery slot and storage cost analysis, Dataflow job optimisation, and Vertex AI Spot VM training

SRE was invented at Google. GCP's SLO API, Managed Prometheus, Cloud Profiler, and Cloud Trace are built by the engineers who wrote the SRE book. This track applies Google's own principles to operating GCP infrastructure.

1. Google Managed Prometheus: fully managed Prometheus-compatible backend — scraping GKE workloads, rules evaluation, Grafana integration, no infrastructure to operate
2. Grafana on GCP: Google Cloud Managed Grafana vs self-hosted on Cloud Run — Cloud Monitoring, Managed Prometheus, Cloud Logging, and Cloud Trace as data sources
3. Cloud Trace advanced: sampling configuration, custom span attributes, trace-log correlation, and p99 latency analysis across Cloud Run and GKE
4. Cloud Profiler in production: continuous profiling for Go, Java, Python, and Node.js — flame graph analysis without overhead
5. OpenTelemetry Collector on GCP: deploying as a GKE DaemonSet or Cloud Run sidecar — receivers, processors, and exporters to Cloud Monitoring, Cloud Trace, and Cloud Logging
6. Log-based metrics and alerting: distribution metrics from structured log fields — latency histograms, error rate metrics
7. Cloud Monitoring custom dashboards: MQL (Monitoring Query Language) for advanced metric expressions and SLO-based widgets
8. Cloud Monitoring alerts at scale: alert rules, notification channels, and programmatic alert management with Terraform

1. SLIs, SLOs, and error budgets: defining SLIs from Cloud Monitoring metrics — the Cloud Monitoring SLO API for creating request-based and window-based SLOs natively
2. Cloud Monitoring SLO dashboard: tracking error budget burn rate and burn rate alerts (fast burn + slow burn)
3. Multi-window multi-burn-rate alerting: the Google SRE Book's recommended alerting strategy in Cloud Monitoring
4. Chaos engineering on GCP: building controlled failure experiments with Cloud Functions + Pub/Sub triggers — VM termination, Cloud SQL failover, Cloud Run scaling-to-zero, and Pub/Sub message delivery delays
5. Resilience testing: validating Cloud SQL HA failover, Cloud Run health check recovery, GKE node pool disruption, and multi-region load balancer failover
6. Cloud Functions for operational automation: auto-remediating SCC findings, auto-stopping idle Compute Engine VMs, and cleaning up orphaned Persistent Disks
7. Pub/Sub for operational event streams: Cloud Audit Logs → Pub/Sub → Cloud Functions for real-time, event-driven automation
8. Toil reduction: automating repetitive operations with Cloud Functions, Cloud Workflows, and Eventarc-triggered pipelines
9. Blameless post-mortems: reconstructing timelines using Cloud Audit Logs, Cloud Monitoring incident history, and SCC findings
10. Capacity planning: Cloud Monitoring metric trends, Committed Use Discount analyser, and Recommender right-sizing
11. Google Cloud Status integration: status RSS feed → Slack, personalised incident notifications, and GCP service health in SRE dashboards