1. Observability #
Monitoring, Logging, Trace.
Principles #
gcloud logging read 'resource.type="cloud_run_revision" AND severity>=ERROR' --limit=10 --freshness=1d
gcloud logging sinks create vers-bq bigquery.googleapis.com/projects/mon-projet/datasets/journaux --log-filter='severity>=WARNING'
gcloud monitoring uptime create api-uptime --resource-type=uptime-url --resource-labels=host=api.exemple.fr,project_id=mon-projet2. Security #
Secrets, keys, posture.
Services #
| Service | Role |
|---|---|
| Secret Manager | Versioned secrets, access through IAM |
| Cloud KMS | Managed encryption keys (CMEK) |
| Security Command Center | Inventory, misconfigurations, threats |
| Cloud Armor | WAF and DDoS protection in front of the load balancer |
| Binary Authorization | Allow only signed images on GKE and Cloud Run |
3. Infrastructure as code and costs #
Automating and controlling.
Practices #
- Terraform (google provider) or Infrastructure Manager (Terraform managed by Google).
- Deployment through Cloud Build or GitHub Actions with Workload Identity Federation.
- Budgets, billing export to BigQuery, Active Assist recommendations (idle VMs, right-sizing).
- Google Cloud Architecture Framework: operational excellence, security, reliability, costs, performance, sustainability.
gcloud billing budgets create --billing-account=<id> --display-name="Budget formation" --budget-amount=50EUR --threshold-rule=percent=0.8
gcloud recommender recommendations list --recommender=google.compute.instance.MachineTypeRecommender --project=mon-projet --location=europe-west9-a