End-to-end architecture designs, here's the problem, here's how you'd solve it
A small startup needs a reliable office network for about ten people: fast WiFi and wired desks, a separate guest network, basic security, and a way for remote workers to reach internal resources without exposing everything to the internet.
Remote workers → VPN client → Firewall VPN → same L3 switch path to VLAN 10/20
| Decision | Why it matters |
|---|---|
| VLANs | Isolate staff, servers, and guests so broadcast domains and blast radius stay small. |
| L3 switch | Route between VLANs on-device instead of hair-pinning through a separate router. |
| VPN | Encrypt remote access; avoid exposing management or file shares directly. |
| WiFi | WPA3-Enterprise or WPA3-Personal on staff SSID; captive portal optional on guest. |
You need to run a production web application with a database, HTTPS everywhere, autoscaling frontends, protected APIs, and a CDN, without managing physical load balancers or TLS certificates on each VM.
| Rule | Allow |
|---|---|
| Ingress to LB | TCP 80/443 from 0.0.0.0/0 (or restricted ranges) to tagged frontend targets |
| Web → API | From frontend service account / subnet to internal LB or pod IPs on app ports |
| API → DB | TCP 3306 (or 5432) from GKE nodes or serverless connector to Cloud SQL private IP only |
| Service | Role |
|---|---|
| Cloud CDN | Cache static assets at the edge; reduce origin load |
| Cloud Armor | WAF, rate limits, geo/IP allow lists in front of the external LB |
| External HTTPS LB | Managed certs, global anycast front end, health-checked backends |
| Compute Engine MIG | Autoscaling stateless web tier |
| Internal LB + GKE | Private API tier; no public IPs on workloads |
| Cloud SQL | Managed DB with private IP and automated backups |
An enterprise with an on-premises data center needs secure, predictable connectivity into GCP so teams can use Shared VPC, private Google APIs, and lift-and-shift or hybrid workloads without sending everything over the public internet unencrypted.
DNS: Cloud DNS inbound forwarding + on-prem conditional forwarders (or outbound to corporate resolvers) so names resolve in both directions.
| Option | Bandwidth | Cost / complexity | Latency |
|---|---|---|---|
| HA VPN | Up to a few Gbps aggregate (depends on tunnels) | Lower capex; quick to stand up | Internet path; more jitter |
| Partner Interconnect | 50 Mbps–50 Gbps | Carrier engagement; recurring port fee | Often better than VPN; not private fiber |
| Dedicated Interconnect | 10–100 Gbps | Highest commitment; physical POP work | Lowest, most consistent to Google edge |
A global-facing application must stay available (think 99.99% SLO), survive regional outages, and serve users from nearby edges, while keeping a clear story for data replication, failover, and how long recovery takes.
Failover: LB health checks detach unhealthy backends; promote replica or use managed failover; Cloud DNS geolocation or health-checked routing steers users.
| Topic | What to decide |
|---|---|
| RPO | How much data loss is acceptable, synchronous replication vs async replica lag |
| RTO | Time to redirect traffic, promote DB, or shift to standby GKE, practice with game days |
| Health checks | Align probe paths with real user journeys (not just TCP open on port 443) |
| DNS TTL | Lower TTL before changes; balance with resolver caching and cost of churn |
Traditional “castle and moat” designs trust anything inside the corporate network. Zero trust assumes breach: every access request is authenticated, authorized, encrypted, and logged, regardless of whether the user is on VPN or in a coffee shop.
| Component | Purpose |
|---|---|
| IAP | OAuth 2.0 gate in front of HTTPS resources and TCP tunnel for SSH/RDP without bastion IPs |
| VPC Service Controls | Perimeters that constrain data exfil from GCP APIs; VPC SC bridges for controlled egress |
| Private Google Access (PGA) | Reach Google APIs from RFC1918 without public internet paths |
| OS Login | IAM-bound Linux user accounts and sudo policies on GCE |
| Binary Authorization | Only deploy container images signed / attested per policy (supply chain) |