Day-4: GCP Compute Engine & Deploying Nginx on a GCP Virtual Machine

This chapter explores Google Cloud Compute Engine, the core Infrastructure-as-a-Service (IaaS) offering on Google Cloud Platform (GCP). Building directly on the Identity and Access Management (IAM) concepts covered in Day 3, this guide demonstrates how to delegate infrastructure privileges to a newly onboarded DevOps engineer, provision a Linux Virtual Machine (VM) using customized hardware specs, establish secure SSH connections via Google Cloud Shell, and deploy a live Nginx web server exposed over the public internet.

1. Introduction & Real-World DevOps Context

In modern enterprise cloud administration, access control and resource provisioning are strictly decoupled. Senior Cloud Administrators rarely build virtual machines manually for every development request. Instead, they configure granular IAM permissions, allowing specialized engineers (e.g., DevOps, SRE, Data Engineers) to self-serve resources within bounded guardrails.

Cloud Administrator
   |
   | 1. Creates Project: "VM demo"
   | 2. Grants IAM Role: "Compute Admin" to devops@example.com
   | 3. Enables Compute Engine API
   v
DevOps Engineer (devops@example.com)
   |
   | 4. Logs into GCP Console
   | 5. Provisions Compute Engine VM (Ubuntu, E2-Small)
   | 6. Deploys Nginx Web Server & Exposes Port 80
   v
End Users / Internet

The Production Scenario

1. The Request: A newly hired DevOps engineer (xyz@example.com) requires access to provision virtual machines for developers who need to host microservices.
2. The Administrator's Action: Instead of sharing root or admin credentials, the Cloud Administrator creates a project named VM demo, assigns the Compute Admin role specifically to the new engineer, enables the Compute Engine API, and hands over control.
3. The Engineer's Workflow: The DevOps engineer authenticates using their isolated credentials, switches to the assigned project context, provisions a tailored virtual machine, and deploys application workloads.

2. IAM Delegation for Compute Engine Access

To implement principle-of-least-privilege delegation, the administrator configures identity boundaries before any virtual hardware is created.

Step-by-Step IAM Setup Workflow

1. Create Target Project: Create a new GCP project named VM demo. (When using a trial account, set the Organization to No organization).
2. Navigate to IAM: Go to IAM & Admin > IAM within the project workspace.
3. Grant Access to Principle: Click Grant Access, enter the user's principal identifier (e.g., vala.abhishek@gmail.com), and select the target role.

Note: Authentication vs. Authorization Scope Providing the user's email handles Authentication (verifying who they are). Assigning the role handles Authorization (determining what they can do).

Role Comparison: Compute Admin vs. Compute Viewer

Enabling the Compute Engine API

By default, GCP APIs are disabled in newly created projects to prevent accidental resource creation and cost accumulation.

The administrator must navigate to Compute Engine > VM Instances and click Enable to activate compute.googleapis.com.

3. Understanding Compute & Virtualization Mechanics

In cloud networking terminology, Compute represents raw, scalable processing power composed of three physical pillars: CPU (Central Processing Unit), Memory (RAM), and Storage (Disk).

Real-Life Analogy: Bare-Metal Hardware vs. Hypervisor Virtualization

In a traditional IT model, organizations purchase physical bare-metal servers from vendors like HP or IBM. These physical units often come with massive hardware specifications—such as 1,000 vCPUs and 1,000 GB of RAM. Assigning an entire physical server of this capacity to a single application team is inefficient, costly, and wasteful.

Cloud providers like GCP use Virtualization Layers (driven by hypervisors like KVM, Xen, or VMware) to split massive physical bare-metal machines into isolated software units called Virtual Machines (VMs). When you request a virtual machine, GCP carves out a specific fraction of physical compute power and delivers it to you on demand.

4. GCP Machine Families & Configuration Breakdown

GCP organizes Compute Engine instances into specialized Machine Families tailored for distinct workload behaviors.

Compute Machine Families

Regional & Carbon-Aware Placement Strategy

• Regions & Zones: Choose a region geographic close to end users to reduce latency. Within a region (e.g., asia-south1 - Mumbai), GCP provides independent data centers called Availability Zones (asia-south1-a, asia-south1-b, asia-south1-c).
• Low $CO_2$ Emission Regions: Regions marked with a Low $CO_2$ icon in the console indicate Google data centers running predominantly on clean, renewable energy sources.

Cost Optimization Tactic: Tailoring E2 Shared-Core Instances

For testing, learning, and lightweight services, using high-spec instances exhausts cloud credits unnecessarily. Choosing shared-core instances under the E2 Family dramatically reduces cost:

5. Provisioning a Virtual Machine via Web Console

Once logged into GCP Console as the DevOps engineer (vala.abhishek@gmail.com), execute the following deployment steps:

1. Navigate to Compute Engine > VM Instances.
2. Click Create Instance.
3. Configure the parameters using the reference settings below:

Name:                my-first-vm
Region:              asia-south1 (Mumbai)
Zone:                asia-south1-a
Machine Family:      General Purpose
Series:              E2
Machine Type:        e2-small (2 vCPU, 2 GB RAM)
Boot Disk OS:        Ubuntu (Ubuntu 22.04 LTS / standard persistent disk 10 GB)
Firewall Rules:      [x] Allow HTTP traffic (Port 80)
                     [ ] Allow HTTPS traffic (Port 443)

4. Click Create. The hypervisor allocates the specified CPU, memory, and disk resources, and assigns an External IP Address to the instance.

6. Provisioning a VM via Google Cloud CLI (gcloud)

In production environments, user interface operations are often replaced by scripts or Infrastructure-as-Code (IaC). You can provision the exact same virtual machine using the gcloud Command Line Interface (CLI).

# Provision an E2-small Ubuntu virtual machine using gcloud CLI
gcloud compute instances create my-first-vm \
    --project=vm-demo \
    --zone=asia-south1-a \
    --machine-type=e2-small \
    --image-family=ubuntu-2204-lts \
    --image-project=ubuntu-os-cloud \
    --boot-disk-size=10GB \
    --tags=http-server

7. Connecting to the Instance via Cloud Shell & SSH

SSH (Secure Shell) is a network protocol operating over port 22 that allows encrypted command-line access to remote Linux operating systems. SSH authentication relies on an asymmetric cryptographic key pair: a Public Key (stored on the target VM) and a Private Key (kept securely by the connecting user).

Connecting via Google Cloud Shell

Google Cloud Shell automates SSH key generation, metadata injection, and connection handling out of the box.

DevOps Engineer (Cloud Shell)
   |
   | 1. Runs: gcloud compute ssh --zone=asia-south1-a my-first-vm
   v
GCP Metadata Service
   |
   | 2. Automatically generates SSH keys and injects Public Key into VM
   v
Target Instance (`my-first-vm`)
   |
   | 3. Authenticates Private Key match
   v
Interactive Secure Shell Session Established

SSH Commands

Run the following command in Google Cloud Shell to establish a terminal session with your target virtual machine:

# Command structure: gcloud compute ssh --zone=<ZONE> <INSTANCE_NAME>
gcloud compute ssh --zone=asia-south1-a my-first-vm

First-Time SSH Initialization: When invoking gcloud compute ssh for the first time, Cloud Shell prompts: Do you want to continue (Y/n)?. Pressing Y triggers GCP to automatically generate a local RSA public/private key pair, upload the metadata to the instance, and establish an encrypted connection.

8. Web Server Setup: Installing and Configuring Nginx

Once logged into the remote VM shell, you can install software packages just like on a local physical computer.

Step 1: Update Package Repository Indices

Base OS images shipped by cloud providers are packaged in advance. Run apt update to ensure package manager indices reflect the latest security patches and software releases.

sudo apt update

Step 2: Install Nginx Web Server

Install the open-source Nginx HTTP server:

sudo apt install -y nginx

Step 3: Enable & Start System Service

Configure the systemctl service manager to ensure Nginx runs immediately and restarts automatically if the virtual machine reboots:

# Enable Nginx system boot hook
sudo systemctl enable nginx

# Start the Nginx daemon process
sudo systemctl start nginx

Step 4: Verify Process Execution

Check that the Nginx service is running correctly using systemctl or process table inspection (ps aux):

# Inspect systemctl service status
sudo systemctl status nginx

# Inspect Linux process table for running worker processes
ps aux | grep nginx

Step 5: Test Web Server Locally

Execute a local HTTP request within the virtual machine instance using curl:

curl localhost

Expected Output (Truncated):

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and working.</p>
</body>
</html>

9. End-to-End Verification & Real-World Networking Edge Cases

After confirming local execution, verify external access over the public internet.

External Access Steps

1. Navigate back to Compute Engine > VM Instances in the GCP Console.
2. Locate the External IP column assigned to my-first-vm (e.g., 35.200.x.x).
3. Open an Incognito browser tab and navigate to: http://<EXTERNAL_IP_ADDRESS>:80 (or simply http://<EXTERNAL_IP_ADDRESS>).

Why Port 80 Works vs. Custom Ports Blocking

When creating the VM in Section 5, checking Allow HTTP traffic attached a network tag (http-server) to the instance. This automatically creates an ingress firewall rule in the project's Virtual Private Cloud (VPC) network that opens TCP Port 80.

*Blocked unless explicitly checked during instance configuration.

10. Summary and Key Takeaways

• Decoupled Identity Delegations: Real-world cloud management relies on assigning granular IAM roles (roles/compute.admin) to targeted users rather than sharing root administrator accounts.
• API Activation Prerequisites: GCP APIs (like compute.googleapis.com) are disabled by default in new projects and must be enabled before provisioning resources.
• Core Compute Definition: Cloud compute abstractly packages CPU, Memory, and Storage, carved out from massive physical bare-metal servers via virtualization hypervisors.
• Machine Families: GCP categorizes instances into General Purpose (E2, N1), Compute-Optimized (C2), Memory-Optimized (M1), Storage-Optimized (Z3), and GPU-Accelerated (A2) based on workload requirements.
• Cost Minimization: For development and learning environments, selecting shared-core E2 micro/small instances minimizes cloud credit usage.
• SSH Key Handling: Google Cloud Shell automates RSA key generation, public key installation, and metadata injection when executing gcloud compute ssh.
• OS Repository Synchronization: Always run sudo apt update on newly created Linux instances to refresh package manager locations prior to software installation.
• Default Ingress Security: Traffic to GCP Compute instances is blocked by default. External web access requires explicitly opening target ports (such as HTTP Port 80) in the network firewall settings.