Skip to main content

Best practices

1 - Architecture​

1.1 Project organization​

1.2 Naming conventions​

ResourceConventionExample
Projectenv-app-regionprod-myapp-eu
GKE clusterenv-cluster-regionprod-cluster-euw1
Cloud Run serviceapp-envapi-prod
AR repositorytype-purposedocker-images
Secretapp-env-namemyapp-prod-db-password

2 - Security​

2.1 Principle of Least Privilege​

# Create custom roles with minimal permissions
gcloud iam roles create cloudRunDeployer \
    --project=mon-projet \
    --permissions=run.services.get,run.services.update

# Use Workload Identity rather than service account keys
gcloud container clusters update mon-cluster \
    --workload-pool=mon-projet.svc.id.goog

2.2 VPC Service Controls​

# Create a service perimeter
gcloud access-context-manager perimeters create my-perimeter \
    --resources="projects/mon-projet" \
    --restricted-services="artifactregistry.googleapis.com"

2.3 Secrets Management​

# Use Secret Manager
gcloud secrets create my-secret \
    --replication-policy="automatic"

# Mount in Cloud Run
gcloud run services update my-service \
    --set-secrets="API_KEY=my-secret:latest"

2.4 Binary Authorization​

# Policy to allow only signed images
defaultAdmissionRule:
  evaluationMode: REQUIRE_ATTESTATION
  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
  requireAttestationsBy:
    - projects/mon-projet/attestors/prod-attestor

3 - CI/CD​

3.1 Pipeline pattern​

# cloudbuild.yaml - Complete pipeline
steps:
  # 1. Lint & Static Analysis
  - name: 'node:18'
    entrypoint: 'npm'
    args: ['run', 'lint']
  
  # 2. Tests
  - name: 'node:18'
    entrypoint: 'npm'
    args: ['test', '--', '--coverage']
  
  # 3. Build
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', '${_IMAGE}', '.']
  
  # 4. Security Scan
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'artifacts'
      - 'docker'
      - 'images'
      - 'scan'
      - '${_IMAGE}'
  
  # 5. Push
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '${_IMAGE}']
  
  # 6. Deploy (via Cloud Deploy)
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: 'gcloud'
    args:
      - 'deploy'
      - 'releases'
      - 'create'
      - 'release-$SHORT_SHA'
      - '--delivery-pipeline=my-pipeline'
      - '--images=app=${_IMAGE}'

substitutions:
  _IMAGE: 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'

options:
  machineType: 'E2_HIGHCPU_8'

3.2 Separate environments​

EnvironmentTriggerApproval
DevPush to developNo
StagingPR merged to mainNo
ProductionTag v*Yes

4 - Costs​

4.1 Cloud Run optimization​

# Min instances to 0 for non-critical services
gcloud run services update my-service \
    --min-instances=0 \
    --max-instances=10

# CPU allocation only during requests
gcloud run services update my-service \
    --cpu-throttling

4.2 GKE optimization​

# Use Autopilot to optimize automatically
# Or configure the cluster autoscaler
gcloud container clusters update mon-cluster \
    --enable-autoscaling \
    --min-nodes=0 \
    --max-nodes=10

4.3 Cleanup policies​

# Artifact Registry - delete old images
gcloud artifacts repositories set-cleanup-policies images \
    --location=europe-west1 \
    --policy=cleanup-policy.json

5 - Monitoring​

5.1 Golden Signals​

SignalGCP metric
Latencyrun.googleapis.com/request_latencies
Trafficrun.googleapis.com/request_count
Errorsrun.googleapis.com/request_count (5xx)
Saturationrun.googleapis.com/container/cpu/utilizations

5.2 Essential alerts​

# Recommended alerts
- name: High Error Rate
  condition: error_rate > 1%
  duration: 5m
  
- name: High Latency
  condition: p99_latency > 1s
  duration: 5m
  
- name: Service Down
  condition: uptime_check_failed
  duration: 1m

5.3 SLO​

# Recommended SLO
availability: 99.9%
latency_p99: < 500ms

6 - Production checklist​

Infrastructure​

  • VPC with private subnets
  • Restrictive firewall rules
  • VPC Service Controls
  • Binary Authorization

CI/CD​

  • Build triggers configured
  • Automated tests
  • Security scanning
  • Cloud Deploy for CD

Monitoring​

  • Dashboards configured
  • Alerts on Golden Signals
  • Uptime checks
  • Log-based metrics

Security​

  • Workload Identity enabled
  • Secrets in Secret Manager
  • IAM with least privilege
  • Audit logs enabled

7 - Reference architecture​

Summary​

In this chapter, we covered:

  • The organization of GCP projects
  • Security best practices
  • CI/CD patterns
  • Cost optimization
  • Monitoring and alerting
  • A production checklist

Next step​

In the next chapter, we will put things into practice with Exercises and Projects.

→ Next chapter: Exercises and Projects

← Back to table of contents