Managing multiple environments (e.g., staging, production)

Managing ephemeral environments

Ephemeral environments are temporary copies of your application, like staging or a feature branch, that are created for a specific task and then deleted. They are often spun up automatically, for example, to test a new feature before it is merged into the main codebase. Managing these environments efficiently requires automation to create them on-demand and clean them up afterward to avoid unnecessary costs. Services like Cloud Build can automate the creation of these environments, while policies in Cloud Deployment Manager or Terraform ensure they are built from the same configuration as production. The key relationship is that the lifecycle of an ephemeral environment—from creation, through testing, to deletion—is fully automated and tied to a development event, such as a pull request.

Managing configuration and policy

Configuration defines how your environments behave, and policy defines the rules they must follow. Keeping configuration consistent across staging and production prevents bugs that only appear in one place. Tools like Terraform or Google Cloud Deployment Manager manage infrastructure as code, letting you define environments in files that can be version-controlled and reused. Policy management ensures security and compliance rules are enforced automatically; for instance, using Organization Policy Constraints to block public IP assignment or Forseti to scan for policy violations. The relationship is that configuration builds the environment, and policy continuously guards it, creating a separation between the setup process and the ongoing governance that applies to all environments equally.

Managing Google Kubernetes Engine (GKE) clusters across an enterprise (e.g., fleets)

When an organization runs many GKE clusters for different teams or environments, managing them individually becomes inefficient. The concept of a "fleet" treats all these clusters as a single group to be managed centrally. Google Kubernetes Engine itself and the Anthos platform provide tools for multi-cluster management. This allows for operations like deploying applications consistently across all clusters in the fleet from a single control point. Centralized policy enforcement, security posture management, and consistent observability metrics can also be applied fleet-wide. The critical relationship is between the central control plane, which defines the desired state, and the individual clusters, which report their status and receive configurations, ensuring all environments—from development to production—adhere to the same standards.

Safe and secure patching and upgrading practices

Applying updates to software and infrastructure in multiple environments must be done carefully to avoid downtime and security gaps. A safe practice is to stage updates, applying them first in a non-production environment like staging to test for issues before rolling out to production. For GKE, this involves managing node pool upgrades and control plane updates with maintenance windows and surge settings that control how many nodes are updated at once. The security relationship is that patching closes known vulnerabilities, so the process must be timely and reliable. Automation tools ensure patches are applied consistently, and rollback plans must be in place. The order of operations is crucial: test in staging, monitor health, then proceed to production, always maintaining the ability to revert if a problem is detected.