Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Google Kubernetes Engine (GKE)
Topic in 1 exam domain
A Kubernetes service for deploying and operating containerized applications at scale, also described as a runtime option for agents and AI models.
Where this appears on the exam
1 subdomain in 1 of 5 domains
Related topics
FoundationsThis topicBuilds on theseAppliedBinary AuthorizationServicelabelsConceptWorkload Identity FederationFeatureservice accountConceptArtifact RegistryService
Google Kubernetes Engine (GKE)Service
Application Default CredentialsFeatureCloud LoggingServiceGKEServicePub/SubServiceCluster AutoscalerFeatureCloud RunServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Binary Authorization works with Google Kubernetes Engine (GKE) From the official documentation: “If you use Google Kubernetes Engine (GKE) or Cloud Run, you can establish an approval process by using [Binary Authorization](/binary-authorization/docs/overview).”
- Cloud Run is an alternative to Google Kubernetes Engine (GKE) From the official documentation: “The architecture shows [Cloud Run](/run/docs/configuring/services/gpu-best-practices) and [GKE](/kubernetes-engine/docs/concepts/machine-learning/inference) as alternative runtimes for the AI model that you choose to use.”
- Cluster Autoscaler is part of Google Kubernetes Engine (GKE) From the official documentation: “- Automatically adjust the size of GKE clusters based on the current load by using [cluster autoscaler](/kubernetes-engine/docs/concepts/cluster-autoscaler).”
- Google Kubernetes Engine (GKE) works with Workload Identity Federation From the official documentation: “- Use [Workload Identity Federation](/iam/docs/workload-identities) for applications that run on GKE or run outside Google Cloud to access resources securely.”
- labels configures Google Kubernetes Engine (GKE) From the official documentation: “To register agents deployed on [Google Kubernetes Engine (GKE)](/kubernetes-engine/docs/tutorials/agentic-adk-vertex), add the required Kubernetes [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) and…”
- Cloud Run depends on Pub/Sub From the official documentation: “Cloud Run function triggered by Pub/Sub to fetch HYPR MFA logs and write to GCS.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Cloud Logging works with GKE From the official documentation: “Enable Cloud Logging on GKE Clusters”
- Artifact Registry works with Cloud Run From the official documentation: “Cloud Run recommends using Artifact Registry.”
- Binary Authorization secures Cloud Run From the official documentation: “Binary Authorization is a software supply chain security product for GKE and Cloud Run.”
- Cloud Logging works with Pub/Sub From the official documentation: “Pub/Sub writes various log entries to Cloud Logging in the Google Cloud console.”
- Cloud Run depends on service account From the official documentation: “The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.”
- service account works with Workload Identity Federation From the official documentation: “When an application uses Workload Identity Federation, it impersonates a service account.”
- Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Binary Authorization works with GKE From the official documentation: “Now, you create a GKE cluster with Binary Authorization enabled.”
- Cloud Run is an alternative to GKE From the official documentation: “For your containerized websites, you can also deploy them to [Cloud Run](/run) in addition to [using GKE](#kubernetes-engine).”
- GKE works with Workload Identity Federation From the official documentation: “To allow GitHub Actions authenticate Google Cloud and deploy to GKE, use [workload identity federation](/iam/docs/workload-identity-federation).”
- Application Default Credentials works with service account From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
- Artifact Registry works with GKE From the official documentation: “In the next tutorial, you deploy those images from the Artifact Registry repository to a GKE cluster:”
- Binary Authorization works with Cloud Run From the official documentation: “This guide shows you how to disable Binary Authorization for Cloud Run.”
- Cloud Logging depends on Application Default Credentials From the official documentation: “To authenticate to Logging, set up Application Default Credentials.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Cloud Run works with GKE From the official documentation: “Leverage Google Kubernetes Engine (GKE) and Cloud Run to deploy applications to the Google Cloud, optimizing costs, performance, and management overhead.”
- Cloud Run works with Pub/Sub From the official documentation: “A Cloud Run app receives the Pub/Sub message.”
- Cluster Autoscaler is part of GKE From the official documentation: “GKE's *cluster autoscaler* automatically resizes the number of nodes in a given node pool, based on the demands of your workloads.”
- GKE works with Pub/Sub From the official documentation: “GKE publishes upgrade notifications to [Pub/Sub](/pubsub/docs/overview), providing you with a channel to receive information from GKE about your clusters.”
- Pub/Sub works with service account From the official documentation: “5. Creates a service account to represent the Pub/Sub subscription identity.”
- Application Default Credentials works with Cloud Logging From the official documentation: “To authenticate to Logging, set up Application Default Credentials.”
- Application Default Credentials configures Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Application Default Credentials works with GKE From the official documentation: “To authenticate to GKE, set up Application Default Credentials.”
- Application Default Credentials depends on service account From the official documentation: “If your `BidiProcessOrder` client runs in a secure environment that can be configured with service account credentials (such as Compute Engine, Google Kubernetes Engine, or your on-premise servers), it can use [Application Default Credentials…”
- Application Default Credentials is an alternative to service account From the official documentation: “There are two ways to obtain credentials for the agent to use: - Let the agent use a service account with private-key authentication - Let the agent use application default credentials (ADC).”
- Application Default Credentials works with Workload Identity Federation From the official documentation: “The preferred method to set up authentication from outside of Google Cloud is to use workload identity federation. For more information, see [Set up ADC for on-premises or another cloud provider](/docs/authentication/set-up-adc-on-premises) in the authentication documentation.”
- Artifact Registry works with Cloud Logging From the official documentation: “Artifact Registry sends the following types of audit log data to Cloud Logging:”
- Artifact Registry secures Cloud Run From the official documentation: “You can use Artifact Registry together with other Google Cloud products and features to improve the security posture of developer workflows and tools, software dependencies, CI/CD systems used to build and deploy your software, and runtime environments such as Google Kubernetes…”
- Artifact Registry works with Pub/Sub From the official documentation: “When you activate the Artifact Registry API in a Google Cloud project, Artifact Registry tries to automatically create a Pub/Sub topic with the topic ID `gcr` using Google-owned and Google-managed encryption keys.”
- Binary Authorization secures Artifact Registry From the official documentation: “If you're using Artifact Registry to store your artifacts, we recommend that you configure controls to help you secure your artifact repositories, such as access control, data exfiltration prevention, vulnerability scanning, and Binary Authorization.”
- Binary Authorization secures GKE From the official documentation: “Use Binary Authorization to make sure trusted images are deployed to Google Kubernetes Engine (GKE) and Cloud Run.”
- Cloud Logging works with Cloud Run From the official documentation: “Cloud Logging captures, stores, and analyzes Cloud Run logs.”
- Cloud Logging works with Cluster Autoscaler From the official documentation: “The cluster autoscaler emits events detailing scale-up, scale-down, and other significant decisions. These events are available as log entries in Cloud Logging.”
- Cloud Logging works with labels From the official documentation: “[Labels](/resource-manager/docs/creating-managing-labels) can track your resource spend in Cloud Billing, and provide extra insights in Cloud Logging.”
- Cloud Run depends on Artifact Registry From the official documentation: “The containerized function is stored in Artifact Registry and deployed to Cloud Run as a service.”
- Cloud Run works with service account From the official documentation: “Map a custom Service Account to a Cloud Run service”
- Cloud Run works with Workload Identity Federation From the official documentation: “This tutorial describes how to use Workload Identity Federation to authenticate workloads that run outside of Google Cloud so that they can access microservices hosted by Cloud Run.”
- GKE depends on Artifact Registry From the official documentation: “When you create or update a cluster, GKE pulls container images for the Kubernetes system software running on the control plane and nodes from Artifact Registry repositories in the `pkg.dev` or the `gcr.io` domain.”
- Workload Identity Federation configures Pub/Sub From the official documentation: “If your architecture includes an [external identity provider](/iam/docs/workload-identity-federation#providers) such as Active Directory or a local Kubernetes cluster, you can use [workload identity federation](/iam/docs/workload-identity-federation) to manage access to Pub/Sub.”
How learners score on this topic
Last updated