PCDOE — frequently asked questions

Sidecars add complexity and require shared volumes. Fluentd DaemonSets are the native, scalable way to collect custom logs in GKE without touching the app container.

No, the default agent only captures stdout/stderr and predefined system logs. You must customize the Fluentd configuration to tail new file paths.

While logging.sinks.create is needed, the configWriter role includes it plus other necessary permissions for managing sinks and metrics, making it the complete solution.

No, logging.viewer only allows reading logs. Exporting requires creating sinks, which needs configWriter permissions.

Tightening the SLO (Option A) increases the cost of reliability without clear business benefit. The SRE framework suggests using stability to enable speed elsewhere.

It recommends treating reliability as a solved problem, allowing teams to increase release frequency or reduce reliability efforts to help other struggling services.

Traffic splitting sends real user requests to the new version. If you need to test extensively without impacting users, you must isolate the new version completely using tags.

Green/Blue involves managing two separate environments/services. Cloud Run Tags allow you to test different versions within the same service, which is more efficient for staged rollouts.

VPC Flow Logs use a primary sampling rate that varies based on load, meaning some packets are dropped. This sampling prevents guaranteed logging of every single IP address.

While firewall logging adds minimal overhead, it is the only native method listed that guarantees logging of every matching packet without requiring agents or complex mirroring setups.

Option C triggers tests after the merge. The requirement is to test BEFORE changes are accepted, meaning the gate must happen at the PR stage, not post-merge.

While the option mentions a specific folder, the key differentiator is the trigger mechanism (PR vs Merge). Cloud Build can be configured to watch specific directories within a repo for efficiency.

Exclusion filters run after logs are ingested into Cloud Logging, so you still pay for ingestion and analysis. Changing the mode to SYSTEM prevents the logs from being sent at all.

No, developers can still use kubectl logs to view application logs directly from the GKE nodes, as these logs remain on the local filesystem even if not exported to Cloud Logging.

Canary deployments shift a small percentage of traffic automatically. If QA must verify BEFORE any production traffic is processed, you cannot start a canary. You must deploy to a non-production stage first for manual checks.

It refers to deploying the new version to replace the old one (like a rolling update or blue/green) in the target environment, rather than gradually shifting traffic percentages as in a canary.

Creating a cluster per application leads to exponential management overhead and high costs, violating the requirement to minimize operational burden.

Namespaces provide logical isolation; when combined with RBAC and Network Policies, they prevent unauthorized cross-application access within the same cluster.

Using .* triggers on all tags, including development ones, which violates the 'minimize overhead' requirement and risks deploying untested code.

No, the scenario specifies releases are tagged. Using branch patterns would ignore the tag-based deployment strategy required.

Managed Service for Prometheus focuses on Prometheus-native metrics. The question specifies OpenTelemetry, and BindPlane is the dedicated tool for managing OTel collector fleets and routing.

The scoping project allows you to manage permissions and configurations centrally for all member projects, simplifying the administrative overhead of cross-project monitoring.

Kustomize requires defining patches and managing additional files. For simple scalar overrides like replicas, raw YAML is more direct and reduces configuration overhead.

No, a single profile applies one set of configurations. Multiple profiles allow distinct settings (e.g., 2 vs 5 replicas) to be activated per environment.

Option D configures the policy but does not create the attestor or sign the images. Without signatures, no image passes the policy check.

No, when integrated with Cloud Build, the signing process can be automated via the pipeline, minimizing manual effort as requested.