Let’s talk
INSIGHTS / KNOWLEDGE, SHARED

Ideas for
your next move.

Practical thinking for teams building software, securing systems and operating modern infrastructure. Explore our engineering field notes.

500 insights · Page 14 of 42

Cloud Storage CORS: Check the Endpoint Before the Rule — conceptual 3D-style vector showing Web application origin, Endpoint choice, JSON API behavior, XML bucket CORS, Browser download URL, Browser acceptance.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Storage CORS: Check the Endpoint Before the Rule

Fix Cloud Storage browser access by identifying JSON, XML, or browser-download endpoints, reproducing preflight headers, and verifying the intended origin.

Read field note ↗
Cloud Storage Signed URLs: Preserve the Request Contract — conceptual 3D-style vector showing URL issuer, Signed request contract, Browser or client, XML endpoint, Private object, Expiration.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Storage Signed URLs: Preserve the Request Contract

Troubleshoot Cloud Storage signed URLs by checking the HTTP method, signed headers, expiry, object generation, and the XML endpoint actually requested.

Read field note ↗
BigQuery Custom Quotas: Find the Shared Caller — conceptual 3D-style vector showing Scheduled reports, Shared service account, Project quota, Per-user quota, Query jobs, Usage attribution.ENGINEERING JOURNAL ↗
Google Cloud Operations

BigQuery Custom Quotas: Find the Shared Caller

Diagnose BigQuery daily query-quota failures by identifying the execution project, shared service account, quota reset boundary, and competing workloads.

Read field note ↗
BigQuery Schema Evolution: Match the Load Job Contract — conceptual 3D-style vector showing Producer schema, Load job options, Existing table schema, Allowed evolution, Consumer query.ENGINEERING JOURNAL ↗
Google Cloud Operations

BigQuery Schema Evolution: Match the Load Job Contract

Evolve BigQuery tables without accidental rejection by checking nullable additions, required-field relaxation, load-job options, and downstream assumptions.

Read field note ↗
BigQuery Partition Expiration: Preview Existing Data — conceptual 3D-style vector showing Retention change, Existing partitions, Late arriving data, Expiration eligibility, Recovery snapshot, Query acceptance.ENGINEERING JOURNAL ↗
Google Cloud Operations

BigQuery Partition Expiration: Preview Existing Data

Change BigQuery partition retention safely by checking existing partition ages, table expiration, historical recovery, and late-arriving data behavior.

Read field note ↗
Backup for GKE: Test Conflicts, Volumes, and Ordering — conceptual 3D-style vector showing Selected backup, Restore policy, Resource conflicts, Volume data, Custom resource order, Application acceptance.ENGINEERING JOURNAL ↗
Google Cloud Operations

Backup for GKE: Test Conflicts, Volumes, and Ordering

Build a GKE restore rehearsal that checks resource conflicts, volume-data policy, custom-resource ordering, and the recovered application result.

Read field note ↗
GKE Maintenance Exclusions: Verify the Upgrade Scope — conceptual 3D-style vector showing Release channel, Exclusion scope, Control plane patch, Minor upgrade, Node upgrade, Support deadline.ENGINEERING JOURNAL ↗
Google Cloud Operations

GKE Maintenance Exclusions: Verify the Upgrade Scope

Align GKE release channels and maintenance exclusions with the upgrades you intend to postpone, while tracking support deadlines and exceptions.

Read field note ↗
GKE Surge Upgrades: Check Resource Headroom First — conceptual 3D-style vector showing Upgrade plan, Surge requirement, Quota allowance, Zonal capacity, New nodes, Drain old nodes.ENGINEERING JOURNAL ↗
Google Cloud Operations

GKE Surge Upgrades: Check Resource Headroom First

Prepare GKE node upgrades by matching surge settings to regional quota, zonal capacity, address space, and the availability needed while nodes drain.

Read field note ↗
GKE Control Plane Access: Choose the Endpoint First — conceptual 3D-style vector showing Administrator, Endpoint selection, DNS endpoint, Private IP endpoint, Identity and RBAC, Kubernetes API.ENGINEERING JOURNAL ↗
Google Cloud Operations

GKE Control Plane Access: Choose the Endpoint First

Troubleshoot GKE administration by distinguishing DNS-based access, private IP reachability, authorized networks, and Kubernetes authorization.

Read field note ↗
GKE Workload Identity: Verify the Kubernetes Principal — conceptual 3D-style vector showing Pod service account, GKE metadata server, Federated principal, Resource IAM, Google API, Node image identity.ENGINEERING JOURNAL ↗
Google Cloud Operations

GKE Workload Identity: Verify the Kubernetes Principal

Configure GKE workload access using the Pod service account and metadata path, then distinguish application API permissions from node image-pull permissions.

Read field note ↗
Cloud Run Service Calls: Match Identity and Audience — conceptual 3D-style vector showing Caller service, Google ID token, Audience check, Invoker IAM, Receiving service.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Run Service Calls: Match Identity and Audience

Diagnose private Cloud Run service calls by checking the caller service identity, invoker permission, ID-token audience, and the actual destination URL.

Read field note ↗
Cloud Run Jobs: Separate Task Timeouts from Completion — conceptual 3D-style vector showing Execution, Task attempt, Timeout boundary, Durable checkpoint, Retry attempt, Batch reconciliation.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Run Jobs: Separate Task Timeouts from Completion

Design Cloud Run job timeouts around individual task attempts, bounded retries, durable checkpoints, and evidence that the full batch actually completed.

Read field note ↗