1
Q
What are the 4 areas of Cloud Infrastructure?
A
- Foundation
- Core Services
- Scaling and Automation
- Container and Services
2
Q
What is under Cloud Infrastructure - Foundation?
A
- Intro to GCP
- VPC Networking
- VMs
3
Q
What falls under Infrastructure - Core Services?
A
- Cloud IAM
- Data Storage Services
- Resource Management
- Resource Monitoring
4
Q
What falls under Cloud Infra - Scaling and Automation?
A
- Interconnected Networks
- Load Balancing
- Autoscaling
- Infra automation with Cloud API
- Infra Automation with Deployment Manager
- Managed Services
5
Q
What comes under Cloud Infrastructure - Container and Srvices?
A
- Application Infrastructure Services
- Application Development Services
- Containers
6
Q
Is there usually more than one solution fo a task or application in GCP?
A
YES
7
Q
What are 2 common tools allow you to interact with GCP?
A
- Cloud Console which is a web based, GUI that you access through console.cloud.google.com
- Google Cloud SDK which is a command-line interface that can be installed locally or accessed through Cloud Shell.
8
Q
What is the difference between Cloud Console and Cloud Shell?
A
Cloud shell is a command line tool, Cloud Console is a GUI
9
Q
How would you define GCP’s networking?
A
GCP uses software defined network that is built on a global fiber infrastructure that makes GCP one of the largest and fastest.
10
Q
How should one think about resources in GCP?
A
Thinking resources as services as opposed to hardware - will help with options available and their behavior
11
Q
What are VPCs objects?
A
- Projects
- Networks
- Default, auto mode, custom
- Subnetworks
- Regions
- Zones
- IP Addresses
- Internal, external, range
- VMs
- Routes
- Firewall rules
12
Q
What can you do with a VPC?
A
With Google Cloud Platform VPC, you can provision your GCP resources, connect them to each other and isolate them from one another in a virtual private cloud
13
Q
How would you describe a VPC?
A
Essentially, VPC is a comprehensive set of Google managed networking objects
14
Q
What are different modes of networks in VPC?
A
Default
Auto
Custom
15
Q
What do sub-networks help accomplish?
A
Sub-networks let you divide and segregate your resources.
16
Q
What is the key organizer of the infrastructure resources?
A
Project
17
Q
What is a key role played by the project?
A
A project associates objects and services with Billing
18
Q
How many networks(VPCs) can a project have?
A
Five
19
Q
How would you describe a VPC?
A
A VPC network is somply a construct of all of the individial IP addresses, or services that are within that network
20
Q
What are some features of a network?
A
- No IP address range
- Is global and spans all available regions
- Contains sub-networks
- Can be of type default, auto or custom
21
Q
What is one feature of auto network?
A
Auto networks can be promoted to custom, but once custom they stay custom.
22
Q
How do things get isolated using networks(VPC)
A
23
Q
How do sub-networks cross zones?
A
- Subnetworks can extend across zones in the same region
- One VM and an alternate VM can be on the same subnet but in different zones
- A single firewall rule can apply to both VMs even though they are in different zones
24
Q
What are subnetworks mostly designed for?
A
Subnetworks are for managing resources.
- Networks have no IP range, so subnetworks don’t need to fit into an address hierarchy
- Instead, subnetworks can be used to groop and manage resources.
- They can represent departments, business dunctions or systems
25
What kind of IPs can a VM get?
Internal
External
26
How are the internal IP assigned to a VM?
An internal IP is allocated from a subnet range to VMs by DHCP
27
How often do the DHCP lease renews?
Every 24 hours
28
How does the network scoped DNS find the VMs?
VM name & IP are registered with network scoped DNS
- We do in local host files(?)
29
How are the external IPs assigned to a VM?
Assigned from a pool. Ephemeral
30
How can I get the external IP of the VM?
VMs don't know the external IP. It's mapped to an internal IP
The mapping is done by VPC
31
How does DNS resolution for internal addresses work?
Each instance has a hostname that can be resolved to an internal IP address:
- The hostname is same as the instance name
- FQDN is [hostname].c.[project-id[.internal.
Example: guestbook-test.c.guesbook-151617.inernal
32
What do hostnames resolve to?
Hostnames resolve to Internal IPs
33
Hostname is same as....
Instance name
34
What is the FQDN of a hostname of a VM?
[hostname].c.[project-id].internal
35
How is the name resolution handled for a VM?
By an internal DNS resolver
- which is configured on instance via DHCP
- as address - 169.254.169.254
36
What is a meta DNS server for a VM?
Each instance has a meta DNS server that acts as a DNS resolver for that instance
- The meta data server handles all DNS queries for local network resources and routes all other queries to Google’s public DNS servers for public name resolution
37
Think on this one...
DNS name always points to a specific instance no matter what the internal IP is.
38
How is DNS for external addresses managed?
39
What are range of IP addresses for VMs?
You can assign a range of IP addresses as aliases to a VM's primary network interface using alias IP ranges
-
40
What are default routes in a network?
- Every network has a default route - which indicates how the VMs talk to each other in the network
- By default, every network has routes that let instances in the network send traffic directly to each other even across subnetworks
- Every network has default route that directs packets to destinations that are outside network
41
Default networks and firewall rules
The default network has preconfigured firewall rules that allow all instances in the network talk with each other.
- Manually created networks don't have such rules
42
When are routes created?
- A route is created when a network is created, enabling traffic delivery from anywhere. (Confirm this is only true for auto/default networks)
- A route is created when a subnet is created- this is what enabled VMs on the same subnet to communicate internally
43
What do VM's routing tables do?
- Destination in CIDR notation
- Applies to traffic egressing a VM
- Forwards traffic to most specific route
- Traffic is delivered only if it also matches a firewall rule
- Created when a subnet is created
- Enabled VMs on the same subnet to communicate
44
Picture of hybrid cloud
45
What do firewall rules provide?
- Firewall rules protect your VM instances from unapproved connections
- Every VPC network also functions as distributed firewall
- Firewall rules are applied to the network as a whole
- Connections are allowed or denied at the instance level
46
Features of firewalls
- GCP firewall rules protect your virtual machine instances from unapproved connections, both inbound and outbound known as ingress and egress respectively
- While firewall rules are applied to the network as a whole, connections are allowed or denied at the instance level
- You can think of the firewall as existing not only between your instances and other networks, but between individual instances within the same network
- Also, if for some reason all firewall rules in a network are deleted, there’s still an implied deny all ingress rule, and an implied allow all egress rule for the network.
47
What are the parameters of a firewall rule?
1. direction
2. source/destination
3. protocol and port
4. action
5. priority
48
What does the -direction- parameter of the firewall rule do?
Inbound connections are are matched against ingress rules only
Outbound connections are matched against egress rules only
49
What do source or destination parameters of firewall rules do?
For the ingress direction, sources can be specified as part of the rule with IP addresses, source tags or a source service account.
For the egress direction, destinations can be specified as part of the rule with one or more ranges of IP addresses.
50
What are protocol and port parameters of the firewall rule used for
Any rule can be restricted to apply to specific protocols only or specific combinations of protocols and ports only
51
What does priority firewall parameter do?
Governs the order in which rules are evaluated: the first matching rule is applied
52
How are firewall rules assigned?
All rules are assigned to all instances, but you can assign certain rules to certain instances only.
53
What should you consider with Networks?
- VPC througput and routrip latency between VMs varies with location
- READ docs
- VPCs are evolving - anything BETA has no SLA
54
How to delete network and subnetworks?
1. Delete VMs
2. Delete firewall rules
3. Auto mode Network
1. Delete Network
4. Custom mode network
1. Delete subnetworks
2. Delete Network
55
What resources can youn assign IP addresses to?
You can assign internal & external IPs to VM instances
You can assign internal and external IPs to a forwarding rule for internal/external load balancing.
56
How many IPs can a VM have?
Each VM can have one primary internal IP, one or more secondary IP addresses, and one external IP address
57
How do instances communicate between each other in a VPC?
To communicate between instances on the same VPC network, you can use an instance’s internal IP addresses.
58
How do you connect to a VM inside a VPC if you are not part of VPC?
Similarly you must use instance’s external IP address to connect to instances outside of VPC network, unless the networks are connected in some way like VPN
59
What's the lifetime of an internal & external IP addresses?
Both external and internal primary IP addresses can be either ephemeral or static.
60
When do we need a forwarding rule?
A forwarding rule is required for Network, global, and internal load balancing
61
What is the link between a forwarding rule and a load balancer?
A forwarding rule must have an external or internal IP address, depending on the load balancer you are using
62
What kinds of forwarding rules can we create for Network and Global load balancing?
For Network and Global load balacing - you can create a regional or global forwarding rule and allocate a regional or global static IP address
63
What kind of IP can we assign to internal load balancing?
Use internal IP address
64
Why do you need to assign an external IP address to an instance or a forwarding rule?
If you need:
- to communicate with the internet
- with resources in another network
- or need to communicate resource outside of compute engine
65
If we assign a external IP does it mean that we can access it from anywhere?
Sources from outside GCP VPC network can address a specific resource by the external IP address, as long as firewall rules allow the connection.
66
What are 2 kinds of external IP addresses does Compute Engine support?
- Static external IP
- Ephemeral external IP
67
What is the lifetime of Static External IPs?
Static external IP addresses are assigned to a project long term until they are explicitly released, and remain attached to a resource (VM/FR) until they are explicitly detached.
68
What is the lifetime of Static IP addresses on a VM?
For VM instances, static external IP addresses remain attached to stopped instances until they are removed.
69
What are two ways to get Static External IPs?
You can reserve a new static external IP address or promote an existing ephemeral external IPaddress to static external IP.
70
What kind of resources (scope wise) static external IPs can be assigned to?
Static external IP address can be either a regional or global resources.
71
Whats so special about regional static external IP?
A regional static external IP allows resources of that region or resources of zones within that region to use the IP address.
In this case, VM instances and regional forwarding rules can use a regional static IP address.
I think this means - these other regional resources can reach this public IP using google infra rather than going out to internet.
72
What is special about Global Static external IPs?
Global static external IP addresses are available ONLY to global forwarding rules, use for global load balacing
You cannot assign Global IP address to a regional or zonal resource.
73
To what resources does ephemeral external IP addresses available?
Ephemeral external IP addresses are available to VM instances and forwarding rules.
74
What's the life of ephemeral exernal IP on a VM?
Ephemeral external IP addresses remain attached to a VM instance only until the VM is stopped and restarted or the instance is terminated
75
When the VM is stopped what happens to the ephemeral external IP?
If an instance is stopped, any ephemeral external IP addresses assigned to the instance are released back into the general Compute Engine pool and become available for use by other projects.
When a stopped instance is started again, a new ephemeral external IP address is assigned to the instance.
76
What the fuck is Ephemeral external IP address?
An ephemeral external IP address is an IP address that does not persist beyond the life of the resource.
77
When do the ephemeral external IP address get assigned?
When you create an instance or forwarding rule without specifying an IP address, the resource is automatically assigned an ephemeral external IP address.
78
Do I have to assign a IP for forwarding rule?
Forwarding rules always have an IP address, whether external or internal, so you should not need to assign an IP address to a forwarding rule after it is created.
79
How many primary internal IP addresses can a VM have?
Every VM instance can have one primary internal IP address that is unique to the VPC network
80
When can you assign a IP to a VM?
You can assign a specific internal IP address when you create a VM instance or you can reserve a static internal IP address for your project and assign that address to your resources.
81
What happens when you don't assign a IP to a VM?
If you do not specify an address, Compute Engine assigns one (primary internal IP) automatically.
82
Where does the primary internal IP get picked from for a VM?
In either case, the address must belong to the IP range of the subnet.
- If your network is an auto mode VPC network , the address comes from the region’s subnet.
- If your network is a , you must specify which subnet the IP address will come from.
- If your network is a , the IP address is assigned from the network’s global internal IP range.
83
What is the visibility of primary internal IP?
The internal IP address is only accessible from other instances within the same network or from a network that is linked, such as via VPN
You can address packets to a VM instance using an internal IP address of the instance.
84
What happens when you creare a auto mode VPC?
Default network automatically creates 18 subners for each resions and also add routes - One for each subnet and one default internet gateway.
85
What happens to firewall rules in auto mode VPC creation?
In auto VPC - a bunch of firewall rules are offered and we can pick
86
What happens when you create a custom VPC?
Automatic routes are created when you create a VPC in custom mode
- No default firewall rules are created in custom mode VPC
87
What fiewall rules get created in default & custom VPC?
GCP created automatic firewall rules
- icmp
- ssh - 22
- rdp - 3389
- all allow internal
88
How are all the network & projects work together?
Projects
Networks
Subnetworks
Regions
Zones
89
What is a Availability network design?
90
What is Globalization Network design?
91
What is cross project network peering netwrok design pattern?
92
What is a Management Separation network design pattern?
93
What is bastion host isolation?
Instance used as "jump host"
- External connections via SSH, used to connect to internal instances
94
NAT gateway host isolation?
95
What is the key distinguishing feature of networking in GCP?
Network topology is not dependent on address layout.
96
What are the three kinds of networks offerered in GCP
- Default, auto network and custom network
97
What is one benefit of applying firewall rules by tag rather than by address?
When a VM is created with a matching tag, the firewall rules apply irrespective of the IP address it is assigned.
98
What does a VM consist of?
- Virtual CPU
- Memory
- Disk Storage
- IP address
99
What does a VM in GCP can do more than a regular VM?
VMs can do something more:
- a micro VM uses a CPU that it shares with other virtual machines enabling you to get a VM with less capacity at a lower cost.
- some VMs offer burst capability, meaning that the virtual CPU would run above it’s rated capacity for a brief period using the available shared physical CPU.
100
GCP compute and processing options
101
What is the primary work case for compute engine?
The primary work case for compute engine is general workload especially enterprise applications to run on server infrastructure
- Compute engine is Infrastructure as Service
102
GCP PCA
flashcards
Decks in class (1)
# Cards
