动手实验室 — PCA Google Cloud Professional Cloud Architect

概述

先决条件

步骤

1. 1.提供程序、项目服务、命名

   启用 Compute、GKE、Cloud SQL、Service Networking（用于 Cloud SQL 私有 IP）和 Cloud Storage API。

   复制

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       google = { source = "hashicorp/google", version = "~> 6.0" }
     }
   }
   
   provider "google" {
     project = "your-project-id" # REPLACE
     region  = "us-central1"
   }
   
   locals {
     labels = {
       project    = "certlabpro-pca"
       managed_by = "terraform"
     }
   }
   
   resource "google_project_service" "compute" {
     service            = "compute.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "container" {
     service            = "container.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "sqladmin" {
     service            = "sqladmin.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "servicenetworking" {
     service            = "servicenetworking.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "storage" {
     service            = "storage.googleapis.com"
     disable_on_destroy = false
   }

2. 2.构建仅出站流量的 VPC + Cloud NAT

   配置服务：

   • VPC
   • Cloud NAT

   PCA 推荐的模式：私有虚拟机/Pod 没有外部 IP，但仍需要访问外部依赖项（pip / docker / API 调用）。答案是 Cloud NAT——一项托管的区域 NAT 服务，为私有资源提供仅出站的流量。

   我们划出一个 /20 子网，其中包含两个用于 GKE（Pod + 服务）的辅助范围，预置一个 Cloud Router，并为其附加一个 Cloud NAT。

   复制

   resource "google_compute_network" "main" {
     name                    = "certlabpro-pca-vpc"
     auto_create_subnetworks = false
   
     depends_on = [google_project_service.compute]
   }
   
   resource "google_compute_subnetwork" "main" {
     name                     = "certlabpro-pca-subnet"
     ip_cidr_range            = "10.10.0.0/20"
     region                   = "us-central1"
     network                  = google_compute_network.main.id
     private_ip_google_access = true
   
     secondary_ip_range {
       range_name    = "pods"
       ip_cidr_range = "10.20.0.0/14"
     }
   
     secondary_ip_range {
       range_name    = "services"
       ip_cidr_range = "10.24.0.0/20"
     }
   }
   
   resource "google_compute_router" "nat_router" {
     name    = "certlabpro-pca-router"
     region  = "us-central1"
     network = google_compute_network.main.id
   }
   
   resource "google_compute_router_nat" "nat" {
     name                               = "certlabpro-pca-nat"
     router                             = google_compute_router.nat_router.name
     region                             = "us-central1"
     nat_ip_allocate_option             = "AUTO_ONLY"
     source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
   
     log_config {
       enable = true
       filter = "ERRORS_ONLY"
     }
   }

3. 3.在 VPC 上预置 GKE Autopilot 集群

   配置服务：

   • Google Kubernetes Engine

   GKE Autopilot 是 PCA 推荐的 GKE 模式——Google 管理节点池，您按 Pod 的 vCPU/内存消耗付费。与 GKE Standard 相比，后者由您自己规划节点池并付费。PCA 考试会测试这种 Autopilot 与 Standard 之间的权衡，作为重复出现的 托管与控制 模式。

   我们启用 VPC-native（别名 IP——Pod 从第 2 步的辅助范围获取 IP，而不是从 NAT 获取）、私有集群（节点 IP 是私有的；控制平面也获得一个私有端点）和 Workload Identity（PCA 推荐的 Pod → GCP-API 身份验证模式——没有节点级别的服务账户凭据）。

   复制

   resource "google_container_cluster" "main" {
     name     = "certlabpro-pca-cluster"
     location = "us-central1" # regional Autopilot
   
     enable_autopilot = true
   
     network    = google_compute_network.main.id
     subnetwork = google_compute_subnetwork.main.id
   
     ip_allocation_policy {
       cluster_secondary_range_name  = "pods"
       services_secondary_range_name = "services"
     }
   
     private_cluster_config {
       enable_private_nodes    = true
       enable_private_endpoint = false # public control plane for kubectl access
       master_ipv4_cidr_block  = "172.16.0.0/28"
     }
   
     deletion_protection = false # lab-only
   
     depends_on = [google_project_service.container]
   }

4. 4.部署仅使用私有 IP 的 Cloud SQL Postgres

   配置服务：

   • Cloud SQL

   PCA 推荐的数据库连接方式：通过 VPC 对等实现私有 IP——Cloud SQL 在与您的 VPC 对等连接的 Google 托管 VPC 内预置，实例获得一个私有 IP，并且 Pod 通过私有网络访问它。公共 IP 的 Cloud SQL 是 PCA 考试中要避免的反模式。

   部署模式：(1) 从您的 VPC 中分配一个 /16 地址块供 Service Networking 使用，(2) 将 VPC 与 servicenetworking.googleapis.com 进行对等连接，(3) 预置 ipv4_enabled = false 并引用对等网络的 Cloud SQL 实例。

   复制

   resource "google_compute_global_address" "private_ip_alloc" {
     name          = "certlabpro-pca-sql-peer"
     purpose       = "VPC_PEERING"
     address_type  = "INTERNAL"
     prefix_length = 16
     network       = google_compute_network.main.id
   }
   
   resource "google_service_networking_connection" "sql_peering" {
     network                 = google_compute_network.main.id
     service                 = "servicenetworking.googleapis.com"
     reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
   
     depends_on = [google_project_service.servicenetworking]
   }
   
   resource "google_sql_database_instance" "main" {
     name             = "certlabpro-pca-pg"
     database_version = "POSTGRES_15"
     region           = "us-central1"
   
     settings {
       tier              = "db-perf-optimized-N-2"
       availability_type = "ZONAL" # lab-only; production = REGIONAL
   
       ip_configuration {
         ipv4_enabled    = false
         private_network = google_compute_network.main.id
       }
   
       backup_configuration {
         enabled                        = true
         point_in_time_recovery_enabled = true
       }
     }
   
     deletion_protection = false # lab-only
   
     depends_on = [
       google_service_networking_connection.sql_peering,
       google_project_service.sqladmin,
     ]
   }

5. 5.创建一个 Cloud Storage 应用存储桶用于存储资产

   配置服务：

   • Cloud Storage

   PCA 参考架构总是包含一个 Cloud Storage 存储桶用于某种用途——上传、导出、ML 特征数据、静态 Web 资产。我们在此处添加一个，启用统一存储桶级访问，并将数据在 30 天后通过生命周期规则移动到 Nearline 存储类。

   部署了五个模块（VPC + NAT、Autopilot GKE、带私有 IP 的 Cloud SQL、GCS 存储桶）后，PCA 参考架构的形态就完整了：工作负载在 GKE 上运行，通过私有网络与 Postgres 通信，将工件写入 GCS，并通过 Cloud NAT 出站。

   复制

   resource "random_id" "suffix" {
     byte_length = 4
   }
   
   resource "google_storage_bucket" "app" {
     name                        = "certlabpro-pca-app-${random_id.suffix.hex}"
     location                    = "US"
     uniform_bucket_level_access = true
     force_destroy               = true # lab-only
   
     lifecycle_rule {
       condition {
         age = 30
       }
       action {
         type          = "SetStorageClass"
         storage_class = "NEARLINE"
       }
     }
   
     labels = local.labels
   
     depends_on = [google_project_service.storage]
   }

清理