Manage Scalable Workloads in GKE Enterprise (MSWGKE)

Module 1 - Introduction to GKE Enterprise

Topics:

• Multi-cloud and multi-cluster overview
• GKE Enterprise introduction
• Sameness and trust
• GKE Enterprise features

Objectives:

• Recognize the challenges of designing and building multi-environment solutions.
• Compare and contrast GKE modes of operation.
• Describe the concepts of sameness and trust, and use them to manage fleets.
• Identify the features and components of the GKE Enterprise technology stack.

Activities:

• Quiz

Module 2 - GKE Enterprise architecture

Topics:

• GKE Enterprise for Centrally Managed Clusters
• Deploy an Enterprise Developer Platform with GKE
• Create and Manage GKE Enterprise Clusters
• Access GKE Enterprise Clusters

Objectives:

• Recognize how GKE Enterprise can be used to centralize cluster management.
• Examine the architecture of GKE Enterprise clusters.
• Create, connect, and manage GKE Enterprise clusters.
• Securely access GKE Enterprise clusters.

Activities:

• Quiz

Module 3 - Fleets and teams

Topics:

• GKE fleets
• Example fleet solutions
• Fleet team management
• Fleet management

Objectives:

• Define GKE fleets.
• Describe how GKE fleets can solve common cluster management problems.
• Manage fleets and teams in GKE Enterprise.
• Detail the elements of fleet management.

Activities:

• Quiz
• Lab: Manage Workloads at Scale with GKE Fleets and Teams

Module 4 - Managing GKE configuration at scale

Topics:

• Configuration management challenges
• Centralized configuration management at scale
• Config Sync
• Policy Controller
• Config Connector
• Blueprints

Objectives:

• Recognize the challenges of scaling multi-cluster, multi-tenant configurations.
• Configure a centralized configuration management using a GitOps model.
• Describe the benefits and architecture of Config Sync.
• Use Policy Controller to enforce security and compliance in GKE.
• Create a standardized, reusable, and policy-driven foundation for Kubernetes deployments.

Activities:

• Quiz
• Lab: Automate GKE Configuration with Config Sync

Module 5 - Fleet networking

Topics:

• Fleet networking communications
• Pod discovery in GKE Enterprise
• Multi-cluster Services
• Configuring multi-cluster Services
• Multi-cluster gateway
• Configuring multi-cluster gateways

Objectives:

• Explain how fleet networking works.
• Describe how Pods in a Kubernetes cluster communicate with each other.
• Enable multi-cluster Services.
• Configure multi-cluster Services.
• Detail the elements of fleet management.
• Outline the role of a multi-cluster gateway.
• Configure a multi-cluster gateway.

Activities:

• Quiz
• Lab: Deploying a Multi-Cluster Gateway Across GKE Clusters

Module 6 - Cloud Service Mesh

Topics:

• Introduction to Cloud Service Mesh
• Provisioning Cloud Service Mesh
• Handling requests
• Cloud Service Mesh dashboards and support

Objectives:

• List and describe the benefits of using Cloud Service Mesh.
• Install and configure Cloud Service Mesh on different clusters.
• Trace the path of a request through the mesh, correctly identifying and explaining the role of key components like Envoy proxies, Mesh CA, and extensions in handling the request.
• Create Service Mesh dashboards from workload telemetry including metrics, traces, and logs.

Activities:

• Quiz
• Lab: Installing Cloud Service Mesh on Google Kubernetes Engine

Module 7 - Cloud Service Mesh routing

Topics:

• Google Cloud APIs for Cloud Service Mesh
• Configuring Cloud Service Mesh with Istio API resources
• Configuring VirtualService and DestinationRule
• Configuring ServiceEntry
• Configuring a Gateway
• Configuring a WorkloadEntry and WorkloadGroup
• Network resilience and testing

Objectives:

• Explain how Cloud Service Mesh learns the network from Kubernetes.
• Deploy mesh API resources such as the VirtualService, DestinationRule, Gateway, ServiceEntry, and the Sidecar to configure the mesh.
• Describe how to harden the mesh network by introducing new functionality such as request retries, request timeouts, and circuit breakers.
• Explore Service Mesh resilience by creating failures and delays on specific services.

Activities:

• Quiz
• Lab: Managing Traffic Flow with Cloud Service Mesh

Module 8 - Service Mesh security

Topics:

• Authentication and encryption
• Service authentication in the mesh
• End-user authentication in Cloud Service Mesh
• Authorization in Cloud Service Mesh

Objectives:

• Encrypt traffic between microservices to prevent anyone in the network from gaining access to private information.
• Authorize services and requests, ensuring that services only access the information that is allowed access from other services.
• Authenticate and authorize services and requests to verify trust among services in the mesh and among end users.
• Limit service access in the network so that granular controls over the communication can be established.

Activities:

• Quiz
• Lab: Secure Cloud Service Mesh with Policy Controller and mTLS

Module 9 - Multi-cluster networking with Cloud Service Mesh

Topics:

• Single network east-west routing
• Multiple network east-west routing

Objectives:

• Set up a multi-cluster mesh with a single subnet in a single VPC network. Account for variations like multi-region clusters, multiple projects, shared VPC, and private clusters.
• Enable communication between GKE clusters on different networks using an east-west gateway and attached clusters.

Activities:

• Quiz
• Lab: Manage and Secure Distributed Services with GKE Managed Service Mesh

Module 10 - Managing identity for GKE Enterprise using GKE Identity Service

Topics:

• Introduction to GKE Identity Service
• Connect gateway overview
• Configuring connect gateway for authentication and authorization
• Accessing clusters with GKE Identity Service
• Authenticating third-party identities with GKE Identity Service
• Fleet Workload Identity

Objectives:

• Explain the differences between authentication methods for GKE clusters.
• Summarize the key features of Connect gateway. Explain how it simplifies and secures connections to GKE Enterprise fleet member clusters.
• Configure Connect gateway for authentication and authorization.
• Securely access clusters using OpenID Connect (OIDC) and third-party identity providers (IdPs).
• Configure GKE Identity Service to enable authentication and authorization for users using a third-party identity provider (IdP).
• Differentiate between Workload Identity and Workload Identity Federation, and explain when to use each.

Activities:

• Quiz
• Lab: Managing Identity in GKE Enterprise with Connect Gateway

Module 11 - Security posture, compliance, and preventative controls

Topics:

• GKE security posture overview
• Security posture dashboard
• Implementing node security
• Vulnerability scanning
• Additional security services

Objectives:

• Describe GKE security posture.
• Navigate and interpret the GKE security posture dashboard to identify security issues.
• Analyze methods for hardening the GKE control plane, and evaluate their effectiveness in mitigating specific security risks.
• Implement node security measures to protect GKE worker nodes from potential threats.
• Describe the process of vulnerability scanning in GKE.
• Apply the insights from the GKE security posture dashboard to prioritize and remediate vulnerabilities in GKE deployments.
• Explain the roles and capabilities of Google Cloud's Artifact Analysis and Security Command Center in enhancing GKE security.

Activities:

• Quiz

Module 12 - CI/CD at scale in GKE

Topics:

• CI/CD in Google Cloud
• Cloud Deploy and GKE
• Cloud Run and Knative serving
• CI/CD in a private network
• Securing the software supply chain

Objectives:

• Describe the core components of Google Cloud's CI/CD pipeline and how they address common challenges in application modernization.
• Analyze how Google Cloud Deploy integrates with GKE to manage Kubernetes manifests and control deployments.
• Compare and contrast the deployment strategies for Cloud Run services and jobs within GKE Enterprise.
• Explain the steps required to establish a peered VPC connection for secure CI/CD in a private network.
• Evaluate the various security measures and tools available within Google Cloud for securing the software supply chain.

Activities:

• Quiz
• Lab: Creating CI/CD Pipelines for GKE Enterprise Clusters

Module 13 - Generative AI for GKE Enterprise

Topics:

• AI and GKE overview
• AI model training on GKE
• AI model serving on GKE
• AI cost management on GKE

Objectives:

• Explain how GKE serves as a suitable platform for large language models and the increasing demand for hardware accelerators.
• Describe the high-level architecture of a GKE-based training platform for AI models.
• Outline the architecture for a GKE-based model serving platform.
• Outline different cost management strategies available when using GKE for AI/ML workloads.

Activities:

• Quiz