[GCP] Three Traps Migrating GKE Gateway API To A Global LB

July 12, 2026 in gcp

Situation

Needed The PRD Domain’s Certificate To Auto-Renew, Which Meant Switching GatewayClass From Regional (gke-l7-regional-external-managed) To Global (gke-l7-global-external-managed) — Certificate Manager’s Google-Managed Auto-Renewing Certs Only Support Global. That Night I Hit Three Traps Back To Back: Certificate Manager’s Annotation Syntax Is Completely Different, GCPBackendPolicy Can Only Bind One Service And Two Of Mine Fought Over It, And Global Security Policy’s Default Rule Is Allow, Not Deny. Five Days Later, Adding An Internal Gateway, The Second Trap Bit Me Again — Verbatim. That’s When I Knew It Wasn’t Bad Luck, It Was A Rule.

[GCP] Deploy vLLM On Cloud Run (GPU & CPU)

July 11, 2026 in gcp

Situation

Want To Deploy vLLM On Cloud Run To Serve An LLM. Two Paths: GPU Mode (For Real Service) Or CPU Mode (For Tiny Model / Architecture Test Only). Both Fully Tested End To End.

Result First:

	GPU Mode	CPU Mode
Support Level	GA	Experimental
Tested Model	Gemma-4-E2B-it (L4)	Qwen2.5-0.5B-Instruct
Response Time	6.1s	114s
Build Effort	Low, Use Official Image	High, ~56 Min Multi-Stage Build
Use Case	Real Service, Demo	Architecture Test Only

GPU Is About 19x Faster Than CPU. CPU Mode Works, But Don’t Expect Speed.

[GCP] Helm Upgrade's Resource Deletion Mechanism — Anatomy Of A Namespace Wipeout On myApp-gke

June 30, 2026 in gcp

Situation

Was Adding An HTTPS Listener To The PRD GKE Gateway. helm upgrade Got Stuck On A Field Manager Conflict, So I Threw --server-side --force-conflicts At It To Push Through — And It Wiped The Entire myApp Namespace (Deployment / Pod / Service / HPA / Secret, All Gone). Recovery Worked, No Data Lost, But The Mechanism Is Worth Understanding Properly, Or I’ll Walk Into It Again.