Google Cloud Platform (GCP) Fundamentals: VPCs, GKE, IAM, and BigQuery Architecture

Google Cloud Platform (GCP) provides hyperscale cloud infrastructure designed around Google's internal planet-scale computing innovations: Borg (container management), Spanner (globally consistent distributed storage), Dremel (serverless analytical SQL), and the Andromeda / Jupiter software-defined network.

This guide details GCP's foundational infrastructure components: Global Virtual Private Cloud (VPC) topology, Google Kubernetes Engine (GKE), Workload Identity Federation IAM, and BigQuery column-oriented analytical architecture.

1. Quick-Reference: GCP Architecture Primitives

+-----------------------------------------------------------------------------------------------------------------------+
|                                           GCP CORE INFRASTRUCTURE PRIMITIVES                                         |
+-----------------------------------------------------------------------------------------------------------------------+
| Primitive              | Architectural Nature                 | GCP Advantage              | AWS / Azure Analogue     |
+------------------------+--------------------------------------+----------------------------+--------------------------+
| Global VPC             | Non-RFC1918 SDN spanned globally     | Zero VPC-peering cross-reg | AWS VPC (Regional)       |
| Cloud Interconnect     | Direct fiber to Google Edge POPs     | Low egress packet transit  | AWS Direct Connect       |
| GKE Autopilot          | Fully managed Kubernetes node pools  | Automated SLA/SLO scaling  | AWS EKS Managed Groups   |
| BigQuery               | Serverless Dremel + Capacitor column | Zero cluster management    | AWS Redshift Serverless  |
| Workload Identity      | OIDC token binding to K8s ServiceAcct| Zero long-lived JSON keys  | AWS IRSA (IAM for SA)    |
+-----------------------------------------------------------------------------------------------------------------------+

2. Global VPC & Software-Defined Networking (Andromeda)

Unlike AWS and Azure where Virtual Private Clouds (VPCs) are strictly regional constructs requiring complex cross-region peering or transit gateways, GCP VPCs are global by default.

+-----------------------------------------------------------------------------------------+
|                                  GCP GLOBAL VPC NETWORK                                 |
+-----------------------------------------------------------------------------------------+
|                                                                                         |
|   +---------------------------------+             +---------------------------------+   |
|   | Subnet: us-central1             |             | Subnet: europe-west1            |   |
|   | Range: 10.128.0.0/20            |             | Range: 10.132.0.0/20            |   |
|   | GKE Cluster (us-central1-a)     |             | Cloud SQL (europe-west1-b)      |   |
|   +----------------+----------------+             +----------------+----------------+   |
|                    |                                               |                    |
|                    +-----------------------+-----------------------+                    |
|                                            |                                            |
|                                            v                                            |
|                  [ Google Global Fiber Backbone & Andromeda SDN ]                       |
|                  [ Internal private communication without NAT / VPN ]                   |
+-----------------------------------------------------------------------------------------+

Cross-Region Latency: Compute instances in Iowa (us-central1) communicate directly with databases in Frankfurt (europe-west1) over Google's private subsea fiber cables using internal private IPs without traversing the public internet.
Cloud Load Balancing: A single Anycast Global IPv4 VIP routes traffic to the nearest healthy instance across worldwide edge points of presence (POPs).

3. Workload Identity & Least-Privilege IAM

Distributing long-lived service account private keys (service-account-key.json) inside container images or Kubernetes secrets is one of the most common vectors for cloud security breaches.

Workload Identity Federation Architecture

GCP Workload Identity maps a Kubernetes Service Account (KSA) directly to a Google Cloud IAM Service Account (GSA) using OIDC token exchange:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: rag-retrieval-ksa
  namespace: production
  annotations:
    iam.gke.io/gcp-service-account: rag-indexer-gsa@my-project.iam.gserviceaccount.com

When pods running under this service account query GCP APIs (e.g., Cloud Storage, Vertex AI, BigQuery), the GKE metadata server transparently negotiates short-lived (1-hour) OAuth2 access tokens, eliminating hardcoded credentials.

4. BigQuery Architecture: Dremel, Capacitor, and Colossus

BigQuery achieves sub-second analytical scans across petabytes of data by separating compute from storage:

Storage (Capacitor & Colossus): Data is stored in the Capacitor columnar format across Google's Colossus distributed filesystem, employing dictionary encoding and Run-Length Encoding (RLE) to achieve $80\%$ compression.
Compute (Dremel): Queries are compiled into multi-level execution trees where thousands of worker slots read partitions in parallel.
Bimodal Ingestion: Supports high-throughput batch loads via Cloud Storage and streaming inserts via the BigQuery Storage Write API.

References

Melnik, S., et al. (2010). Dremel: Interactive Analysis of Web-Scale Datasets. Proceedings of the VLDB Endowment.
Verma, A., et al. (2015). Large-scale cluster management at Google with Borg. Proceedings of the European Conference on Computer Systems (EuroSys).
Google Cloud. (2024). Google Cloud Architecture Framework: Security, Reliability, and Performance Optimization.