Specialist - Software Engineering

Infrastructure Overview Landing Zone and Network Foundation

· GCP folders and projects

· VPCs, subnets, and Shared VPC

· Network Connectivity Center spokes and routes

· Cloud Router, Cloud NAT, firewall rules, and DNS policies

· IP reservations, load-balancer components, and Private Service Connect

· Root and intermediate certificate authorities

· Logging sinks, organization-policy overrides, and foundational IAM

Security and Encryption

· Cloud KMS key rings and keys, including CMEK and HSM-backed encryption

· KMS IAM permissions

· Secret Manager

· Service accounts and IAM roles

· Cross-project secret synchronization into GKE using the External Secrets Operator

Kubernetes and Compute

· GKE clusters provisioned within landing-zone VPCs and subnets

· Compute Engine virtual machines and persistent disks

· Cloud Functions

Data and Analytics

· BigQuery datasets, tables, views, scheduled queries, and stored procedures

· Cloud Composer and Apache Airflow

· Dataflow

Databases and Data Stores

· Cloud SQL for PostgreSQL and MySQL

· Cloud Spanner

· Memorystore for Redis

· MongoDB Atlas through private connectivity

· Cassandra on GCP virtual machines, provisioned with Terraform and Ansible

· Supporting network infrastructure for Oracle Database@Google Cloud

Messaging and Eventing

· Pub/Sub

· Confluent Kafka, including private connectivity through Private Service Connect

· DNS-related automation and diagnostics

Artifact Management

Artifact Registry supports Docker, Maven, and npm repositories.

Networking Utilities

Cloud DNS is supported by automated connectivity and DNS diagnostics, including nslookup, curl, and Kafka Private Service Connect checks.

Infrastructure State and Project Onboarding

· GCS-based Terraform state buckets

· Project-onboarding automation for required APIs and baseline IAM

Application Lifecycle

GCP Landing Zone → GKE Cluster → Data, Messaging, and Supporting GCP Resources → GitOps/CD → Applications and Microservices

The landing-zone automation establishes where the workload will run, including the project, VPC, subnet, encryption, and connectivity foundations.

Resource-creation automation then provisions the services the application requires, such as databases, BigQuery, Kafka, Pub/Sub, Redis, secrets, and other managed services.

Finally, the GitOps/CD layer deploys application workloads to GKE, where they consume the provisioned platform services.