PCDOE — frequently asked questions

Sidecars add complexity and require shared volumes. Fluentd DaemonSets are the native, scalable way to collect custom logs in GKE without touching the app container.

No, the default agent only captures stdout/stderr and predefined system logs. You must customize the Fluentd configuration to tail new file paths.

While logging.sinks.create is needed, the configWriter role includes it plus other necessary permissions for managing sinks and metrics, making it the complete solution.

No, logging.viewer only allows reading logs. Exporting requires creating sinks, which needs configWriter permissions.

Tightening the SLO (Option A) increases the cost of reliability without clear business benefit. The SRE framework suggests using stability to enable speed elsewhere.

It recommends treating reliability as a solved problem, allowing teams to increase release frequency or reduce reliability efforts to help other struggling services.

Yes. An aggregated sink created on the production folder includes log entries from the folder itself and from all child folders and projects, so you do not need a sink per project.

Pub/Sub is a streaming transport, not a log analysis store. It is appropriate when a named subscriber such as a SIEM or Cloud Function consumes the stream; without one, a Cloud Logging bucket provides the native query and alerting path.

No. The hourly processing warning applies to Cloud Storage buckets used for archival. Log entries routed to Cloud Logging buckets are available for querying and analysis without that archival delay.

Traffic splitting sends real user requests to the new version. If you need to test extensively without impacting users, you must isolate the new version completely using tags.

Green/Blue involves managing two separate environments/services. Cloud Run Tags allow you to test different versions within the same service, which is more efficient for staged rollouts.

VPC Flow Logs use a primary sampling rate that varies based on load, meaning some packets are dropped. This sampling prevents guaranteed logging of every single IP address.

While firewall logging adds minimal overhead, it is the only native method listed that guarantees logging of every matching packet without requiring agents or complex mirroring setups.

Data loss is a critical failure that compromises user trust and system integrity. It requires thorough investigation to understand the root cause and implement safeguards to prevent recurrence.

No. If instances fail and are automatically replaced by auto-healing systems without user-visible impact, it is considered routine operation. Postmortems are reserved for events with significant user impact or data loss.

You can share visibility by granting IAM roles (e.g., Viewer) on the dashboard resource, but this grants access to all other resources in the project too. For external partners, this is often insecure.

Sharing a URL allows viewing/copying if you have permissions. Exporting JSON allows importing the dashboard configuration into another project without exposing the source project's data or resources.

Option C triggers tests after the merge. The requirement is to test BEFORE changes are accepted, meaning the gate must happen at the PR stage, not post-merge.

While the option mentions a specific folder, the key differentiator is the trigger mechanism (PR vs Merge). Cloud Build can be configured to watch specific directories within a repo for efficiency.

Exclusion filters run after logs are ingested into Cloud Logging, so you still pay for ingestion and analysis. Changing the mode to SYSTEM prevents the logs from being sent at all.

No, developers can still use kubectl logs to view application logs directly from the GKE nodes, as these logs remain on the local filesystem even if not exported to Cloud Logging.

An SLO equal to the current p90/p95 values leaves no meaningful error budget. Normal variance can consume the target immediately, causing false breaches even while users remain satisfied; C gives a small, deliberate buffer.

There is no universal number; the practice is modest, not huge. Here 190 ms p90 and 330 ms p95 keep the SLO close to the 160/300 ms baseline while allowing for normal variance; D is too relaxed.

It is the measurement and compliance window. The observed percentiles over 28 days describe current behavior, while the published SLO uses that baseline plus error budget for the same window.

The error specifically mentions attempting to create in '[global]'. Even if you add US regions, the default behavior of some services might still attempt to write to global metadata or intermediate states. Using user-managed replication explicitly defines the storage locations, preventing any ambiguity.

No. Removing the policy removes the compliance guardrail, allowing resources to be created in non-US regions, which violates the healthcare regulations stated in the question.

idleTimeout stops the workstation after a period of no user activity, preserving state for when the user returns. runningTimeout stops the workstation after a total cumulative runtime, regardless of whether the user is currently active.

Cloud Workstations provides standardized, pre-configured IDEs, automatic scaling, and secure private access out-of-the-box, reducing administrative overhead compared to managing individual Compute Engine instances.

Canary deployments shift a small percentage of traffic automatically. If QA must verify BEFORE any production traffic is processed, you cannot start a canary. You must deploy to a non-production stage first for manual checks.

It refers to deploying the new version to replace the old one (like a rolling update or blue/green) in the target environment, rather than gradually shifting traffic percentages as in a canary.

Only if the error budget policy defines and approves an exception. The scenario provides no such exception, so the production deployment freeze still applies and the release should be delayed until the budget is replenished.

A canary reduces blast radius but is still a production deployment prohibited by the freeze. It does not address the exhausted error budget, and gradual rollout would bypass the governance the policy is meant to enforce.

An explicit policy exception for a critical reliability or security fix, or a scenario stating the error budget has been replenished, could permit deployment. Without that, passing unit tests does not satisfy the SLO-based gate.

Creating a cluster per application leads to exponential management overhead and high costs, violating the requirement to minimize operational burden.

Namespaces provide logical isolation; when combined with RBAC and Network Policies, they prevent unauthorized cross-application access within the same cluster.

Using .* triggers on all tags, including development ones, which violates the 'minimize overhead' requirement and risks deploying untested code.

No, the scenario specifies releases are tagged. Using branch patterns would ignore the tag-based deployment strategy required.

Retries can create a thundering herd effect, overwhelming an already unstable Service B. This increases latency for all users and can lead to complete service unavailability, violating the 500 ms SLO.

The database acts as a durable storage for requests that cannot be processed immediately due to the downstream failure. This ensures no data loss while the circuit is open, allowing for later processing once Service B recovers.

Cloud Deploy provides native rollout and rollback management with automated health checks and approval gates, whereas Cloud Build requires custom scripting to manage deployment lifecycles.

They allow you to automatically delete container images based on rules like age, tag patterns, or the number of retained versions, without needing custom scripts or scheduled jobs.

Silent failures usually stem from misconfigured PodMonitoring resources, such as pointing to an invalid container port or using incorrect label selectors, preventing target discovery.

No, this role grants read access to existing metrics. It does not control the collection process itself, which depends on PodMonitoring configurations and service account permissions.

Environment variables are injected at startup. Rotating them requires a full redeployment. Mounted volumes allow the application to read updated secrets from the filesystem, which can be more flexible depending on the app's design.

No. Secrets baked into Docker images are stored in the image layers and can be extracted from container registries. This is a significant security vulnerability.

Creating a new revision involves building, testing, and deploying a new container image, which takes significantly more time than adjusting Cloud Run's traffic splitting configuration. Traffic splitting is nearly instantaneous.

While debugging is essential for long-term fix, standard SRE incident response prioritizes restoring service availability first. You should stabilize the system before investing time in detailed trace analysis.

Managed Service for Prometheus focuses on Prometheus-native metrics. The question specifies OpenTelemetry, and BindPlane is the dedicated tool for managing OTel collector fleets and routing.

The scoping project allows you to manage permissions and configurations centrally for all member projects, simplifying the administrative overhead of cross-project monitoring.

Kustomize requires defining patches and managing additional files. For simple scalar overrides like replicas, raw YAML is more direct and reduces configuration overhead.

No, a single profile applies one set of configurations. Multiple profiles allow distinct settings (e.g., 2 vs 5 replicas) to be activated per environment.

Option D configures the policy but does not create the attestor or sign the images. Without signatures, no image passes the policy check.

No, when integrated with Cloud Build, the signing process can be automated via the pipeline, minimizing manual effort as requested.

Remote repositories proxy external registries (like Docker Hub) and cache images on demand. Standard repositories are used to store Docker images that you build and push yourself.

A virtual repository aggregates multiple remote repositories into a single endpoint. This simplifies pipeline configuration by allowing the CI system to pull from one URL instead of managing multiple remote endpoints.