动手实验室 — PCDE Google Cloud Professional Cloud Database Engineer

概述

先决条件

步骤

1. 1.提供商、项目服务、命名

   启用 Cloud Build、Cloud Deploy、Cloud Run、Artifact Registry 和 Cloud Monitoring API。

   复制

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       google = { source = "hashicorp/google", version = "~> 6.0" }
     }
   }
   
   provider "google" {
     project = "your-project-id" # REPLACE
     region  = "us-central1"
   }
   
   locals {
     labels = {
       project    = "certlabpro-pcde"
       managed_by = "terraform"
     }
   }
   
   resource "google_project_service" "cloudbuild" {
     service            = "cloudbuild.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "clouddeploy" {
     service            = "clouddeploy.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "run" {
     service            = "run.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "artifactregistry" {
     service            = "artifactregistry.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "monitoring" {
     service            = "monitoring.googleapis.com"
     disable_on_destroy = false
   }

2. 2.创建 Artifact Registry 镜像目标

   配置服务：

   • Artifact Registry

   PCDE 规范的 CI/CD 形式：Cloud Build 将镜像输出到 Artifact Registry；Cloud Deploy 在不同环境中提升相同的镜像 SHA。该仓库是所有环境的单一事实来源——不可变镜像，可变标签。

   复制

   resource "google_artifact_registry_repository" "images" {
     repository_id = "certlabpro-pcde-images"
     location      = "us-central1"
     format        = "DOCKER"
   
     labels = local.labels
   
     depends_on = [google_project_service.artifactregistry]
   }

3. 3.在 GitHub 仓库上定义 Cloud Build 触发器

   配置服务：

   • Cloud Build

   Cloud Build 触发器是 PCDE 提交到构建 的基本单元。我们定义一个针对 GitHub 仓库 main 分支的触发器——每次推送都会运行仓库根目录下的 cloudbuild.yaml，它将执行 docker build + docker push 到步骤 2 中的 Artifact Registry。

   将 github-owner 和 github-repo 替换为您的实际仓库。触发器将预置，但在仓库上安装 GitHub Cloud Build 应用之前（一次性手动控制台步骤）不会触发。

   复制

   resource "google_cloudbuild_trigger" "main_push" {
     name        = "certlabpro-pcde-main-push"
     description = "Build on push to main"
     filename    = "cloudbuild.yaml"
   
     github {
       owner = "github-owner" # REPLACE
       name  = "github-repo"  # REPLACE
   
       push {
         branch = "^main$"
       }
     }
   
     depends_on = [google_project_service.cloudbuild]
   }

4. 4.连接 Cloud Deploy 管道，使其包含预演 → 生产 Cloud Run 目标

   配置服务：

   • Cloud Deploy
   • Cloud Run

   Cloud Deploy 是 GCP 的托管 CD 服务——通过有序的阶段（通常是开发 → 预演 → 生产）提升发布，每个阶段都由一个目标（Cloud Run 服务、GKE 集群或 Anthos 集群）支持。PCDE 考试广泛测试这种一次发布，多次提升的形式。

   我们定义了两个 Cloud Run 目标服务（一个用于预演，一个用于生产，两者都可扩展到零）+ 一个将它们串联起来的交付管道。实际发布将在 Cloud Build 成功运行后通过 gcloud deploy releases create 触发；本实验预置了基础架构，但未触发发布。

   复制

   resource "google_cloud_run_v2_service" "staging" {
     name     = "certlabpro-pcde-staging"
     location = "us-central1"
   
     template {
       scaling { max_instance_count = 5 }
   
       containers {
         image = "us-docker.pkg.dev/cloudrun/container/hello"
       }
     }
   
     labels = local.labels
   
     depends_on = [google_project_service.run]
   }
   
   resource "google_cloud_run_v2_service" "prod" {
     name     = "certlabpro-pcde-prod"
     location = "us-central1"
   
     template {
       scaling { max_instance_count = 10 }
   
       containers {
         image = "us-docker.pkg.dev/cloudrun/container/hello"
       }
     }
   
     labels = local.labels
   
     depends_on = [google_project_service.run]
   }
   
   resource "google_clouddeploy_target" "staging" {
     name     = "staging"
     location = "us-central1"
   
     run {
       location = "projects/${data.google_project.current.project_id}/locations/us-central1"
     }
   
     depends_on = [google_project_service.clouddeploy]
   }
   
   resource "google_clouddeploy_target" "prod" {
     name     = "prod"
     location = "us-central1"
   
     run {
       location = "projects/${data.google_project.current.project_id}/locations/us-central1"
     }
   
     require_approval = true # promotion to prod needs manual approval
   
     depends_on = [google_project_service.clouddeploy]
   }
   
   data "google_project" "current" {}
   
   resource "google_clouddeploy_delivery_pipeline" "main" {
     name     = "certlabpro-pcde-pipeline"
     location = "us-central1"
   
     serial_pipeline {
       stages {
         target_id = google_clouddeploy_target.staging.name
       }
   
       stages {
         target_id = google_clouddeploy_target.prod.name
       }
     }
   
     depends_on = [google_project_service.clouddeploy]
   }

5. 5.在生产服务上定义 SLO + 警报策略

   配置服务：

   • Cloud Monitoring

   PCDE 的 SLO / SLI / 错误预算 词汇是承载可观测性的核心形态——每个标记为站点可靠性的 PCDE 考试问题都测试这一点。我们定义了一个服务级别目标：“在 28 天滚动窗口内，99% 的对生产服务的 HTTP 请求应返回 2xx。” 然后，当燃尽率表明预算消耗过快时，将触发 Cloud Monitoring 警报。

   有了这五个模块（Artifact Registry、Cloud Build 触发器、两个 Cloud Run 目标、Cloud Deploy 管道、生产 SLO + 警报），PCDE 的 提交 → 构建 → 部署 → 观测 循环就实现了端到端预置。

   复制

   resource "google_monitoring_service" "prod" {
     service_id   = "certlabpro-pcde-prod-svc"
     display_name = "PCDE prod Cloud Run service"
   
     basic_service {
       service_type = "CLOUD_RUN"
   
       service_labels = {
         service_name = google_cloud_run_v2_service.prod.name
         location     = google_cloud_run_v2_service.prod.location
       }
     }
   
     depends_on = [google_project_service.monitoring]
   }
   
   resource "google_monitoring_slo" "prod_availability" {
     service             = google_monitoring_service.prod.service_id
     slo_id              = "certlabpro-pcde-prod-availability"
     display_name        = "99% requests return 2xx (28-day rolling)"
     goal                = 0.99
     rolling_period_days = 28
   
     basic_sli {
       availability {
         enabled = true
       }
     }
   }
   
   resource "google_monitoring_alert_policy" "prod_budget_burn" {
     display_name = "PCDE prod — fast budget burn"
     combiner     = "OR"
   
     conditions {
       display_name = "1-hour burn rate > 14.4 (fast burn)"
   
       condition_threshold {
         filter          = "select_slo_burn_rate(\"${google_monitoring_slo.prod_availability.name}\", \"3600s\")"
         duration        = "0s"
         comparison      = "COMPARISON_GT"
         threshold_value = 14.4 # consumes 2% of monthly budget in 1 hour
       }
     }
   }

清理