An enterprise runs a multi-tenant Google Kubernetes Engine (GKE) cluster where microservices belonging to a core payment platform are distributed across dozens of distinct tenant namespaces. All pods expose Prometheus metrics on the HTTP path /metrics. Due to high-cardinality debug metrics prefixed with payment_debug_, Cloud Monitoring ingestion costs have increased significantly. Managed collection for Google Cloud Managed Service for Prometheus (GMP) is active on the cluster. You need to implement a centralized collection configuration that discovers and scrapes these payment pods across all namespaces while discarding the payment_debug_ metrics prior to ingestion into Cloud Monitoring. What should you do?

Deploy a ClusterPodMonitoring custom resource that matches the payment workloads across all namespaces and configure a metricRelabeling rule with action: drop targeting the payment_debug_ metric name regex.: ### What ClusterPodMonitoring and Metric Relabeling Are `ClusterPodMonitoring` is a non-namespaced Kubernetes custom resource provided by **Google Cloud Managed Service for Prometheus (GMP)**. It allows administrators to define target discovery and metric scraping specifications that apply globally across all namespaces in a cluster. The `metricRelabeling` configuration within the custom resource uses standard **Prometheus metric relabeling rules** to modify, drop, or keep specific time series before they are exported to the central **Monarch** storage backend. ### How It Meets the Requirements - **Cross-namespace scraping**: By using `ClusterPodMonitoring`, the managed collector discovers matching pods across all existing and future tenant namespaces without requiring separate scraping manifests in each individual namespace. - **Filtering high-cardinality metrics**: Placing a `metricRelabeling` entry with `action: drop` and a regex targeting `payment_debug_.+` on `__name__` strips out unneeded high-cardinality metrics directly at the node collector level, stopping them before ingestion. ### Key Advantages and Capabilities - **Centralized administration**: Eliminates configuration sprawl and maintenance overhead across dozens of namespaces. - **Cost optimization**: Discards high-volume time series at scrape time, directly reducing billable samples sent to **Cloud Monitoring**. - **Native GMP integration**: Operates seamlessly with the managed collector DaemonSet deployed and maintained by GKE. ### Why This Is Optimal Alternative approaches like deploying duplicate `PodMonitoring` objects per namespace increase administrative overhead, while configuring drop filters in alert evaluators still incurs data ingestion costs. `ClusterPodMonitoring` with local `metricRelabeling` delivers the lowest operational friction and maximum cost efficiency.

Gmp Clusterpodmonitoring Metric Relabeling Filter | Professional Cloud DevOps Engineer

AdvancedProfessional Cloud DevOps Engineer

A DevOps engineer is troubleshooting missing telemetry and latency metrics in the Cloud Service Mesh dashboard for a microservice deployed on Google Kubernetes Engine (GKE). The mesh uses a managed control plane with distroless Envoy sidecar proxy containers. The engineer suspects that the Envoy sidecar failed to receive its telemetry filter configuration from the control plane. However, executing kubectl exec directly into the istio-proxy container to run diagnostic commands fails because the distroless proxy image lacks utilities like curl and bash. What should the engineer do to inspect the Envoy proxy configuration dump and verify that the telemetry filter is active?

Collecting metrics (e.g., from applications, platforms, networking, Cloud Service Mesh, Google Cloud Managed Service for Prometheus, hybrid/multi-cloud environments)

AdvancedProfessional Cloud DevOps Engineer

Your enterprise operates a hybrid cloud architecture comprising Google Cloud workloads and critical on-premises database clusters (such as Cassandra and Elasticsearch). You have been tasked with centralizing infrastructure and database metrics into Google Cloud Monitoring without modifying underlying application code. After deploying BindPlane to collect telemetry from your on-premises servers, you observe that the volume of ingested metric data in Cloud Monitoring is exceeding budget thresholds. Your monitoring policy only requires performance metrics at a 5-minute granularity for standard operational dashboards, and several default component metrics are unnecessary for your operational alerting. What should you do to optimize your hybrid metric pipeline and reduce ingestion costs?

AdvancedProfessional Cloud DevOps Engineer

An enterprise is designing a secure software supply chain pipeline for containerized applications deployed to Google Kubernetes Engine (GKE). The security architecture must satisfy the following requirements: Store build artifacts in Artifact Registry with encryption controlled by company-managed keys in Cloud KMS. Protect the repository and vulnerability scanning services against data exfiltration using network perimeters. Prevent unverified images or container images containing policy violations from being deployed to production GKE clusters. Which combination of Google Cloud security controls and architectural practices should the DevOps engineer implement?

AdvancedProfessional Cloud DevOps Engineer

Your team is establishing a vulnerability scanning and compliance pipeline for containerized microservices stored in Artifact Registry. The solution must meet the following requirements: Shift-left validation: Scan images locally during the Cloud Build stage before pushing to the repository and fail the build if vulnerabilities exceed defined severity thresholds. Continuous monitoring: Automatically detect both OS-level and application language-pack (e.g., Go, Java, Node.js, Python) vulnerabilities in pushed images, while maintaining continuously updated vulnerability metadata as new CVEs emerge. Least privilege: Grant an automated security auditing service account only the minimum permissions required to query and retrieve vulnerability occurrences and dependency metadata across the project. Which combination of configuration steps and IAM permissions should you implement?

AdvancedProfessional Cloud DevOps Engineer

Your organization operates a multi-VPC architecture across multiple Google Cloud projects. You have a central hub network named hub-vpc (10.0.0.0/16) that is connected via VPC Network Peering to spoke-a-vpc (10.1.0.0/16). You deploy a new custom VPC named spoke-b-vpc (10.2.0.0/16) and configure VPC Network Peering between spoke-b-vpc and hub-vpc. Workloads running in spoke-b-vpc must directly access backend services running in spoke-a-vpc over private RFC 1918 IP addresses. Currently, network traffic from spoke-b-vpc fails to reach spoke-a-vpc. Furthermore, the ingress firewall rules in spoke-a-vpc only allow traffic originating from 10.1.0.0/16. How should you resolve the connectivity issue while adhering to Google Cloud networking best practices?

AdvancedProfessional Cloud Security Engineer

A security engineer is designing an automated CI/CD pipeline in Google Cloud to build and publish hardened base container images. The pipeline must enforce security guardrails by shifting vulnerability detection left. The pipeline must fulfill the following requirements: Build container images locally within the build environment using a hardened Dockerfile. Inspect the container image for known operating system and language package vulnerabilities before it is published. Automatically fail the build pipeline and prevent pushing the image to the production Artifact Registry repository if any CRITICAL or HIGH severity vulnerabilities are detected. Use native Google Cloud CLI tools and services within the build workflow. Which pipeline workflow should the security engineer implement in Cloud Build?

Professional Cloud DevOps Engineer

Gmp Clusterpodmonitoring Metric Relabeling Filter

Related questions