Compute Engine: Networking, Storage & Cost Optimization

Firewall Rules

# Allow HTTP/HTTPS traffic to instances with tag http-server
gcloud compute firewall-rules create allow-http   --allow=tcp:80,tcp:443   --target-tags=http-server   --direction=INGRESS   --priority=1000

# Allow SSH from specific IP range
gcloud compute firewall-rules create allow-ssh-office   --allow=tcp:22   --source-ranges=203.0.113.0/24   --direction=INGRESS

# Allow internal traffic within VPC
gcloud compute firewall-rules create allow-internal   --allow=tcp:0-65535,udp:0-65535,icmp   --source-ranges=10.128.0.0/9  # default VPC range

# List firewall rules
gcloud compute firewall-rules list

# Add tag to instance (to match firewall rules)
gcloud compute instances add-tags my-vm   --tags=http-server --zone=us-central1-a

Persistent Disks

# Create disk
gcloud compute disks create my-disk   --size=100GB   --type=pd-ssd   --zone=us-central1-a
# Disk types: pd-standard, pd-ssd, pd-balanced, pd-extreme

# Attach disk to instance
gcloud compute instances attach-disk my-vm   --disk=my-disk   --zone=us-central1-a

# After attaching: format and mount inside VM
sudo mkfs.ext4 -m 0 -E lazy_itable_init=0 /dev/sdb
sudo mkdir -p /mnt/data
sudo mount -o discard,defaults /dev/sdb /mnt/data
# Add to /etc/fstab for persistence

# Detach disk
gcloud compute instances detach-disk my-vm   --disk=my-disk --zone=us-central1-a

# Create snapshot
gcloud compute disks snapshot my-disk   --snapshot-names=my-disk-snap-1   --zone=us-central1-a

# Create disk from snapshot
gcloud compute disks create restored-disk   --source-snapshot=my-disk-snap-1   --zone=us-central1-a

Static IPs & Load Balancing

# Reserve a static external IP
gcloud compute addresses create my-static-ip --region=us-central1

# Assign static IP to instance
gcloud compute instances add-access-config my-vm   --access-config-name="External NAT"   --address=34.x.x.x   --zone=us-central1-a

# HTTP(S) Load Balancer (high level)
# 1. Create backend service pointing to instance group
gcloud compute backend-services create web-backend   --protocol=HTTP --port-name=http --global

gcloud compute backend-services add-backend web-backend   --instance-group=web-group   --instance-group-zone=us-central1-a   --global

# 2. Create URL map
gcloud compute url-maps create web-map --default-service=web-backend

# 3. Create target HTTP proxy
gcloud compute target-http-proxies create web-proxy --url-map=web-map

# 4. Create forwarding rule
gcloud compute forwarding-rules create web-rule   --global --target-http-proxy=web-proxy --ports=80

Cost Optimization

• Spot VMs: up to 91% discount for fault-tolerant batch jobs. Set --provisioning-model=SPOT.

• Committed use discounts: 1 or 3 year commitment for 37-55% discount on specific machine types.

• Sustained use discounts: automatic 30% discount for VMs running >25% of the month.

• Rightsizing: Cloud Monitoring recommends smaller machine types based on actual CPU/memory use.

• Shutdown idle VMs: use Cloud Scheduler + Cloud Functions to stop/start dev VMs on a schedule.

• Preemptible vs Spot: Spot VMs are the successor — no max 24h limit, same pricing.

• Use pd-balanced instead of pd-ssd for most workloads — 3x cheaper with similar performance.

• Snapshot scheduling: automated disk snapshots with retention policies via resource policies.