420-gcp

Google Cloud Platform (GCP) Best Practices

Guiding Principles

1. Cloud-Native Services: Leverage GCP-managed services (Cloud Run, Cloud Functions, GKE Autopilot)
2. Infrastructure as Code: Terraform for GCP resources, Cloud Build for CI/CD
3. Security First: IAM with service accounts, Secret Manager, VPC Service Controls
4. Cost Efficiency: Committed use discounts, preemptible VMs, auto-scaling
5. Observability: Cloud Logging, Cloud Monitoring, Cloud Trace

---

GCP Resource Naming Convention

Standard Format

{resource-type}-{project}-{environment}-{region}-{instance}

Examples

# Compute Instance
vm-webapp-prod-us-central1-001

# Cloud Storage Bucket (globally unique)
acme-webapp-prod-storage

# Cloud Run Service
webapp-prod-us-central1

# Cloud Function
function-process-images-prod

# GKE Cluster
gke-webapp-prod-us-central1

# Cloud SQL Instance
sql-webapp-prod-us-central1-001

# VPC Network
vpc-webapp-prod

---

Terraform for GCP

Provider Configuration

# versions.tf
terraform {
  required_version = ">= 1.12"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
    google-beta = {
      source  = "hashicorp/google-beta"
      version = "~> 5.0"
    }
  }

  backend "gcs" {
    bucket = "acme-terraform-state"
    prefix = "webapp/prod"
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

provider "google-beta" {
  project = var.project_id
  region  = var.region
}

Cloud Run Service

# cloud-run.tf
resource "google_cloud_run_v2_service" "webapp" {
  name     = "webapp-${var.environment}"
  location = var.region

  template {
    scaling {
      min_instance_count = var.environment == "prod" ? 2 : 0
      max_instance_count = var.environment == "prod" ? 100 : 10
    }

    containers {
      image = "gcr.io/${var.project_id}/webapp:${var.image_tag}"

      resources {
        limits = {
          cpu    = "1000m"
          memory = "512Mi"
        }
        cpu_idle = true
      }

      ports {
        container_port = 8080
      }

      env {
        name  = "ENVIRONMENT"
        value = var.environment
      }

      env {
        name = "DATABASE_URL"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.db_url.secret_id
            version = "latest"
          }
        }
      }

      startup_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        initial_delay_seconds = 5
        period_seconds        = 10
        failure_threshold     = 3
      }

      liveness_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        period_seconds    = 30
        failure_threshold = 3
      }
    }

    service_account = google_service_account.webapp.email
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }

  depends_on = [google_project_service.cloudrun]
}

# IAM for Cloud Run (public or authenticated)
resource "google_cloud_run_service_iam_member" "public" {
  count = var.allow_public_access ? 1 : 0

  service  = google_cloud_run_v2_service.webapp.name
  location = google_cloud_run_v2_service.webapp.location
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# Output the service URL
output "cloud_run_url" {
  value = google_cloud_run_v2_service.webapp.uri
}