Topic 11 of 11
Infrastructure as code and AI tooling
Section 2.4 of the exam guide has two parts: infrastructure as code tooling (Fabric FAST, Config Connector, Terraform, and Helm) and AI-assisted planning and implementation (Gemini CLI, Google Antigravity, Gemini Cloud Assist, and Application Design Center). Gemini Cloud Assist is explained in domain D1; here you see how it fits with the rest.
Contents
Why infrastructure as code
Instead of creating resources by hand in the console, you describe the desired end state in files that are versioned, reviewed, and applied repeatably. The exam guide's tools cover different layers:
Google Cloud resources
Terraform (and its managed service, Infrastructure Manager) or Config Connector from Kubernetes.
A whole organization
Fabric FAST: a reference design implemented in Terraform.
Applications on Kubernetes
Helm: package and install manifests as charts.
Assisted design
Application Design Center, Gemini Cloud Assist, Gemini CLI, and Antigravity.
Terraform on Google Cloud
HashiCorp's IaC tool and, according to Google, the most commonly used to provision and automate Google Cloud. It uses providers (plugins) to talk to APIs: google for general APIs and google-beta for beta APIs.
Write the configuration: You declaratively describe the infrastructure you want, not how to create it.
terraform plan: Evaluates the configuration and generates an execution plan to review before changing anything.
terraform apply: Calls the Google Cloud APIs and creates the state file (JSON) that maps the configuration to real resources.
Later applies: Compares the state with the code: creates what is missing, updates what differs, and leaves matching resources unchanged.
- Modules package and reuse code. Google publishes modules as blueprints and Jump Start Solutions examples.
- The state file tracks every resource in the deployment.
- The same configuration can be deployed several times for reproducible environments.
Infrastructure Manager
A Google managed service that automates deploying and managing infrastructure with Terraform configurations (called blueprints).
- It deploys configurations stored in Cloud Storage buckets, Git repositories, or local directories.
- It manages the lifecycle with deployments and revisions; for each revision it stores the logs, configuration, resources created, and state file.
- It supports preview deployments to see the effect of changes before applying them, and integrates with Cloud Build.
- It doesn't deploy applications onto the resources: for that there are Cloud Build, Cloud Deploy, or App Lifecycle Manager.
Fabric FAST
Part of the open-source Cloud Foundation Fabric repository, built by engineers from Google Cloud's Professional Services Organization. It has two goals:
A design
A Google Cloud organization with the typical elements enterprise customers need, based on proven patterns.
An implementation
The reference implementation of that design in Terraform.
- Stages: each performs a specific task (the first, organization-wide security; another, networking) and together they build the organization. They are modeled on security boundaries, so each stage can be delegated to the responsible team.
- Security first: minimal permissions with groups, service accounts, custom roles, and IAM Conditions.
- Factories: create resources from simple YAML descriptions.
- It fits organizations of every size, from startups to large enterprises.
Config Connector
An open-source Kubernetes add-on that lets you manage Google Cloud resources with Kubernetes tooling and APIs, the same way you manage your applications.
- It provides Custom Resource Definitions (CRDs) and controllers. When you apply an object to the cluster, Config Connector reconciles the state against Google Cloud APIs asynchronously.
- It builds on Kubernetes features: RBAC for access control, events for visibility, and a single source of desired state.
- Reconciliation uses the identity of the Config Connector service account, not that of whoever applied the manifest. That is why you must tightly control who can create those objects, for example by applying them from a trusted repository.
- It can manage existing resources and use Kubernetes Secrets for sensitive data.
Helm
The package manager for Kubernetes. It bundles related manifests (Deployments, Services, ConfigMaps…) into a unit called a chart, which you version, share, install, and roll back as a release.
Install applications
Databases, monitoring, or ingress from a chart, without assembling manifests.
Configure per environment
The same chart with different values for development, staging, and production.
Upgrade and roll back
Move a release to a new version and return to a previous revision if it fails.
Dependencies
Declare other charts you need and install them together.
helm search hubsearches charts on Artifact Hub;helm repo addadds repositories.- Artifact Registry stores Helm 3 charts packaged as OCI images in Docker repositories (native, non-OCI charts aren't supported).
AI tooling
| Tool | Where | What for |
|---|---|---|
| Gemini Cloud Assist | Google Cloud console | Design, operate, troubleshoot, and optimize with your project's context (see D1) |
| Gemini CLI | Local terminal or Cloud Shell | An open-source AI agent for coding and other tasks |
| Google Antigravity | Desktop app, IDE, CLI, and SDK | A development platform with agents that plan, code, and browse |
| Application Design Center | Google Cloud console | Design and deploy applications from approved templates |
As with any generative AI, Google recommends validating what these tools produce before you use it.
Gemini CLI
An open-source AI agent that brings Gemini to your local terminal or to Cloud Shell, where it is available with no extra setup.
- It works with a reason-and-act (ReAct) loop using built-in tools and local or remote MCP servers.
- It excels at coding (fixing bugs, building features, improving tests), but also handles content generation, research, or task management.
- Gemini Code Assist editions include quotas shared with Code Assist agent mode; it also supports a Gemini API key with pay-as-you-go.
Note from the docs
Google states that Gemini CLI isn't optimized for the latest Gemini models and recommends Antigravity CLI for the best coding experience with them.
Google Antigravity
Google's agentic development platform: a command center to launch, monitor, and orchestrate AI agents. Since version 2.0 it is an ecosystem of products:
| Antigravity | A standalone app for macOS, Linux, and Windows: manages several local agents in parallel and scheduled tasks |
| Antigravity IDE | An IDE with the agent manager, artifacts, and deep understanding of your codebase |
| Antigravity CLI | Agent interaction from the terminal |
| Antigravity SDK | Integrate Antigravity into your own systems |
| Antigravity for IDEs | Extensions for VS Code, JetBrains, Zed, and others |
You can use it with a personal Google account or a business account tied to a Google Cloud project, with licenses or pay-as-you-go through Agent Platform.
Application Design Center
It lets platform and development teams design and deploy applications on Google Cloud from templates that meet organizational standards.
Spaces
Exclusive areas where a team designs templates and deploys applications without affecting others.
Components
Google building blocks (with best practices and secure defaults) or imported from your Terraform modules: assets, services, and workloads.
Templates
Approved designs: application templates (standard or composite), catalog templates, and shared templates.
Validation
Assesses the design against Security Command Center security policies and produces a scorecard (preview).
You design with a visual canvas, natural language chat (Gemini proposes a starting point from your requirements), the REST API, or the Google Cloud CLI. Typical flow: the administrator creates spaces, platform engineers design and publish templates to a catalog, and developers pick one, customize it, assess it, and deploy it.
Which tool to use
| Need | Tool |
|---|---|
| Declarative, reproducible infrastructure | Terraform |
| Terraform managed by Google, with revisions | Infrastructure Manager |
| A complete enterprise organization | Fabric FAST |
| Google Cloud resources from Kubernetes | Config Connector |
| Packaged applications for Kubernetes | Helm |
| A self-service template catalog | Application Design Center |
| AI assistance in the console | Gemini Cloud Assist |
| AI agents for coding | Gemini CLI, Google Antigravity |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Create identical, repeatable development, test, and production environments | Terraform | Reusable declarative configuration with modules. |
| Run Terraform as a managed service, with revisions and previews | Infrastructure Manager | Google's managed toolchain for Terraform. |
| Set up an enterprise-ready Google Cloud organization following proven patterns | Fabric FAST | A reference design with stages in Terraform. |
| The team manages everything with kubectl and wants to create buckets and databases the same way | Config Connector | Google Cloud resources as Kubernetes objects. |
| Install and upgrade an app with many manifests on GKE, with rollback | Helm | Packages manifests into a versioned chart. |
| Ask an AI agent in the terminal to fix a bug in the repository | Gemini CLI or Antigravity CLI | AI agents on the command line. |
| The platform team wants a catalog of approved templates so developers can deploy on their own | Application Design Center | Templates with guardrails and self-service deployment. |
Common exam traps
❓ Which Terraform command shows changes without applying them?
terraform plan. terraform apply is the one that applies them.
❓ Which identity does Config Connector use to create resources?
Its own IAM service account, not that of the user who applied the manifest.
❓ Does Infrastructure Manager also deploy applications?
No. Only infrastructure; for applications there are Cloud Build, Cloud Deploy, or App Lifecycle Manager.
❓ Is Fabric FAST a paid Google Cloud product?
No. It is part of the open-source Cloud Foundation Fabric repository, with a reference implementation in Terraform.
❓ Where are Helm charts stored on Google Cloud?
In Artifact Registry Docker repositories, packaged as OCI images.
❓ Do you need to install Gemini CLI in Cloud Shell?
No. It is available in Cloud Shell with no extra setup.
Did you get this topic?
Test what you just learned
A platform team manages its applications with Kubernetes manifests and GitOps. It wants to create Cloud Storage buckets and Cloud SQL instances with the same kubectl workflows, without giving each developer direct permissions on Google Cloud. What should it use?
Ready to test "Infrastructure as code and AI tooling"?
Original questions, each with a full explanation.
Start a mock exam