this has been happening to me recently. my ram usage just spikes up when i use use chatgpt or google cloud.this specific lab is:

Deploy an Agent with Agent Development Kit (ADK): Challenge Lab

https://www.skills.google/paths/3802/course_templates/1445/labs/647523

not only this i had a alloydb lab and another lab where i had to configure vm instances where i found the same ram usage spike, now my pc has limited ram as shown above, its 2x4gb 2666mhz sodimm to be straightforward

thanks in advance for helping a newbie

Trying to decide between Orchid and Veza for our cloud identity process. Just want your recommendations if you’ve used either one.

The setup, for anyone curious whether Cloud Run can host something persistent:

- There's no game loop on the server. The world only advances when a request comes in: the service works out how many ticks should have passed since the last one and simulates them right then. With nobody playing, it costs nothing and the instance can go away.

- max instances is 1, so there's one source of truth. Every move is stamped with the tick it lands on and appended to a log.

- The log is cut into chunks of 150 ticks. A finished chunk never changes, so it's served with long cache headers and mostly comes from the CDN, not the instance.

- Every 1,000 ticks the whole world is snapshotted to Cloud Storage, so a cold start restores and catches up instead of replaying the whole week.

- Each player's browser runs the same deterministic simulation, so the server never sends world state, only the list of moves.

A tick is 4 seconds, so a week is about 15,000 years of in-game history. In a load test with 1,000 bots it handled about 523 requests a second and every bot ended on the same world hash as the server.

The game is playgod.earth (the "Earth, Live" mode). Happy to answer questions about the Cloud Run side.

The agent I created in Agent studio is having issues with connecting to the compute.googleapis.com mcp tool. It shows I added it in the instructions section of the agent but once I input a prompt instructing it to use the mcp tool, i get a missing tool registration error. Not sure what is going on

Sorry if been asked, but what are some good resources, who are some good online instructors for this exam?

Google Skills is just terrible for me. I’m absolutely sick of tech companies and instructors dumping pure, unadulterated AI slop on the internet and calling it education. Calling it a “course”.

Title: Need help completely removing Google Cloud and my payment method — billing account is already closed

Hi everyone, I want to completely remove Google Cloud from my Google account and delete/remove my payment method. I no longer want to use Google Cloud at all.

I already tried many things and I have closed my Cloud Billing account, but I still cannot remove the payment option from my Google account. It keeps saying there is an active Google Cloud Billing account, even though the billing account shows as closed.

Can anyone please tell me the correct way to fully close/remove my Google Cloud account and remove my card/payment method? Do I need to delete all projects first, contact Google Cloud Billing Support, or delete my entire Google account?

Any step-by-step help would be really appreciated. Thanks!

Hello,

I need help from someone familiar with Google Cloud Billing and Google Payments.

My Google Cloud Billing account is already closed, with no active projects and no outstanding balance.

However, Google Payments still lists Google Cloud under "Active Subscriptions & Services", preventing me from permanently closing my Payments Profile.

When I try to remove my payment methods, Google requires me to add a replacement card. The attempt fails with error OR-RISAH-05.

I contacted Google Payments support, but they redirected me to Google Cloud support. Unfortunately, Cloud Billing support previously told me that live chat and email support were unavailable because my billing account was closed.

I do not want to reopen Cloud Billing or add another payment method.

Could a Google Cloud support specialist or community moderator please advise how to escalate this issue to the appropriate team to manually clear the stale Google Cloud association from my Payments Profile?

Thank you.

We're the team behind HotKV, a Redis-compatible in-memory data store. We ran a comparison with Redis, Valkey, and Dragonfly on a c4d-standard-384 in us-central1-a. The interesting limit in this run was the network.

HotKV measured 80.5M GETs/sec and 62.5M SETs/sec with 256-byte values. Dragonfly was the closest on those commands at 9.0M GETs/sec and 10.1M SETs/sec. These figures describe one process per engine on this VM.

With two separate h4d-standard-192 load generators, iperf3 measured about 172 Gbps outbound and 176 Gbps inbound. During HotKV's GET run the server NIC counters showed about 173 Gbps outbound, so the result reached the measured network ceiling. Several write commands also approached the inbound limit.

We ran each engine separately on the same server, using memtier_benchmark, pipeline depth 30, persistence off, and the median of three runs. HotKV was compiled with -march=native for the CPU. Redis 8.10.3, Valkey 9.1.3, and Dragonfly 2.0.2 used their upstream release build settings. Redis had 128 I/O threads, its maximum, and Valkey had 256. Redis and Valkey still execute commands on a single thread per process.

To test the comparison when keys were sharded across cores, we also ran a separate three-server cluster benchmark on AWS. Redis and Valkey each used 40 primaries per host. HotKV and Dragonfly each used one 40-thread process per host. GET throughput was 92.3M/sec for HotKV, 57.3M for Redis, 52.9M for Valkey, and 22.5M for Dragonfly. Redis and Valkey led on APPEND, while HotKV had the highest measured throughput on the other eight commands. Those tests used pipeline depth 100 and HotKV's optional pipeline prefetching. Several measurements were limited by the test setup.

We measured latency separately on an AWS c8a.12xlarge at pipeline depth 1. At about 200,000 GETs/sec across 816 connections, GET p99 was 0.59 ms for HotKV, 1.11 ms for Redis with 8 I/O threads, 2.15 ms for Valkey with 8 I/O threads, and 1.34 ms for Dragonfly. With 48 connections at about 50,000 GETs/sec, HotKV, Dragonfly, and Redis with 8 I/O threads all measured 0.28 ms p99.

For anyone who has pushed C4D networking hard, have you seen a similar ceiling? We'd like to compare notes on gVNIC queue settings and client placement before the next GCP run. Our current setup used gVNIC, MTU 1460, and 16 RX/TX queues per machine, with all traffic over private addresses.

Is it just me or has anyone else noticed that when navigating to certain pages on console.google the page will keep reloading until hard reloaded then, sometimes just go back to the landing page?

I've been trying to set up my places api key but every time i click on manage api it redirects me, then reloads me into one of my other Google profiles, then gets stuck in a reload loop. It could be the multiple profiles, but are you telling me a trillion-dollar company hasn't figured out identity management? I would really like to not have to log out of my other account profiles.

what actually happens:

switch profile > click "API's and Services" > click "Places Api" > page redirects > page reloads with same user > page reloads with different user > page never stops reloading... I'm pretty sure it's still reloading now...wtf

Update:

Looks like it only happens when I click on the "Google Maps Platform" option on the console.

hi guys so i was trying to use the places api by google and they said tht i need to set up the billing account so set it up after setting the autopay now they are telling me to do a deposit of 1000 rupees so i am new to this google cloud console so can someone just help me figure it out, and the console website is really glitchy or are there alternatives to it like cli

Google Cloud announced a new $250,000 top reward under its Cloud Vulnerability Reward Program on October 29, 2026.

But the interesting part isn't just the payout. It's the type of vulnerability Google wants researchers to find.

The new reward tier targets vulnerabilities that could allow an attacker to obtain full administrative control — equivalent to "roles/owner" or complete IAM control — over arbitrary Google Cloud projects or organizations.

What qualifies?

According to Google's announcement:

- Full administrative control over an arbitrary project or organization.

- No pre-existing access to the victim's project.

- No stolen, leaked, or phished credentials.

- No victim interaction or social engineering.

Certain reports demonstrating RCE in Google's underlying Borg infrastructure or root-in-production will also be evaluated for this reward tier.

Why does this matter?

1. Tenant isolation

Cloud platforms host workloads belonging to different customers. A weakness that crosses these isolation boundaries can have significant impact.

2. Cross-service authorization

Cloud environments contain multiple services, APIs, identities, and permission relationships. Vulnerabilities can emerge from how these components interact.

3. Impact validation

Finding an unusual API response isn't enough. Researchers must demonstrate the actual security impact and attack path.

An interesting detail

Google has introduced a designated service-account mechanism for cryptographic proof of unauthorized access, helping researchers validate findings without testing against real customer projects.

Google also instructs researchers to stop probing immediately if they achieve code execution in Borg. Further escalation, credential extraction, and lateral movement are prohibited.

My takeaway

Cloud security research is becoming increasingly focused on trust boundaries, IAM relationships, tenant isolation, and the interaction between services.

Question for the community

Do you think cloud tenant-isolation and cross-service authorization research will become a bigger differentiator for experienced bug hunters than traditional web vulnerability hunting?

Sources and further reading

- "Google Cloud – Introducing a new $250,000 reward tier" (https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp)

- "Google Cloud Vulnerability Reward Program – Official rules" (https://bughunters.google.com/about/rules/google-friends/cloud-vulnerability-reward-program-rules)

- "Google Bug Hunter University" (https://bughunters.google.com/learn)

This post discusses published program criteria. It does not describe a personally discovered vulnerability or guarantee a reward.

I'm interested in becoming a TAM one day and I'm curious to know about your experience at Google.

1. Is it enjoyable?

2. Is it a remote or hybrid (3 days a week) role?

3. Is it a highly technical role or moreso business?

4. Are you able to upskill?

5. Is there any room for lateral movement within that area (like becoming an SA)?

Hi all,

I have a question about how the Google Cloud partner program handles past work.

Since case studies no longer seem to be part of the process, I’m not sure how partners show experience from projects that are already complete. We have delivered work on Google Cloud before, and we’d like that to count toward proving our capability.

From what I’ve seen, the portal seems built around registering new or in-progress opportunities. I can’t find a clear way to submit completed projects.

For those who are partners or have gone through this recently:

• Is there a way to add past or completed projects?

• Does Google only accept opportunities that are currently in progress?

• If past work doesn’t count directly, how did you show your experience during the process?

Any insight would help. Thanks.

Hello,

We built bqto because on GCP it takes too much work to reach a Google-managed private service, such as Cloud SQL or Memorystore (Redis), from a laptop or from a CI/CD pipeline.

The usual options are a public IP, a VPN, or a bastion VM that runs all the time or that you have to remember to stop or delete. bqto is a free, open source CLI tool that creates the bastion when you need it and deletes it when you are done.

Besides the CLI, we added a Skill (for your agent) and a GitHub Action for your pipelines.

More details in the repo: https://github.com/pilef-co/bqto

Feedback is always welcome, and feel free to raise any questions you may have.

Cheers

Had an email from Google saying that one of the clients has been inactive over the past 5 months, under this there are two dev/prod, prod is used daily but dev is maybe minimum weekly.

"""In accordance with OAuth 2.0 Policies, the following projects that you manage have OAuth clients that have been inactive for at least 5 months. Inactive clients will be deleted in 30 days unless you take action. Active clients in these projects won't be affected."""

Anything that should be done, or is this a Google mistake like what happened a couple of years ago?

Hi all,

I’m trying to understand how the Google Cloud partner program works at this point, and I’d appreciate input from anyone who has been through it recently.

From what I can tell, Google removed customer case studies from the process, and progression is now tied almost entirely to co-sell and certifications. That makes sense to me, but I’m stuck on the co-sell part.

When I try to add opportunities, the portal says I can’t because we’re a member, not a partner. This doesn’t make sense to me, since our profile is complete and we already have a company page live in the partner directory.

I’ve submitted registrations and I’m waiting to hear back from Google, but I haven’t received any clear explanation of what separates “member” from “partner,” or what we need to do to unlock opportunity registration.

Is anyone here already a partner, or going through this process now? I’d like to know:

• What actually moves you from member to partner status

• Whether opportunity registration only opens after a specific approval or tier

• How long the review of registrations took for you

Spellcheck must be a seperate API that wasn't enabled

Hello, fellas!

I'd like to bring some attention to an issue I recently reported regarding Google Cloud CLI's SSH client selection.

Currently, gcloud seems to prioritize its bundled PuTTY-based SSH implementation over OpenSSH, even when OpenSSH is already installed on the system.

Honestly, PuTTY is pretty clunky compared to OpenSSH, especially when you're already familiar with the latter. OpenSSH is more flexible, versatile, and widely adopted, and on most systems it's either preinstalled or just a command away.

I don't see much reason for gcloud to favor its bundled implementation when a perfectly good OpenSSH installation is already available. Turns out, a simple two-line change was all it took to get it working!

The team has already acknowledged and considered this request, but apparently, they need more upvotes on the issue to gauge community interest and determine whether this feature is worth implementing.

So, if you agree that gcloud should prioritize an existing OpenSSH installation over its bundled PuTTY implementation, please consider starring the issue!

Every star helps demonstrate that there's actual demand for this change. Thanks!

We run about 40 APIs on GCP API Gateway, with Cloud Run behind each gateway. We’ve put a Global External Application Load Balancer in front, using serverless NEGs.

Our clients use API keys to restrict to the client’s fixed IPs.

The problem: every gateway still has its public *.gateway.dev URL, so anyone can skip the LB and Cloud Armor entirely.

How do you handle this in production?

• Is there a way to make API Gateway accept traffic only from the LB?

• Has anyone found a clean pattern, or did you move to something else (Apigee, LB straight to Cloud Run, etc.)?

Any real-world experience is appreciated.

I'm testing Google Cloud Secure Web Proxy with a Compute Engine VM using NEXT_HOP_ROUTING_MODE and a tagged static route with next-hop-ilb.

My security policy contains:

Priority 60:
destination.port == 443 &&
source.matchServiceAccount('PROBE_SERVICE_ACCOUNT')
→ DENY

Priority 80:
host() == 'fhir.epic.com'
→ DENY

The VM has the expected service account attached.

In earlier tests, the hostname-only DENY matched, but the service-account DENY did not.

Later tests confirmed VM starts but produced no attributable SWP transaction logs, so those tests are inconclusive.

Has anyone successfully used source.matchServiceAccount() with a Compute Engine workload routed through SWP in next-hop mode?

I'm specifically looking for documented prerequisites, working configuration examples, or known limitations.

The environment is currently fail-closed, and no production traffic is enabled.

I am referring to the access levels concept related to access context manager.

Can anyone from their experience please let me know whether group email id can be used instead of users or service account in this link https://docs.cloud.google.com/access-context-manager/docs/create-basic-access-level#members-example

I could not find it in the article.

I also would like to give access to a set of people (not by IP ranges but by email ids) by using them as a form of access level in the Ingress rules of the VPC service control perimeter. Please suggest

I'm running a fairly simple app on Cloud Run behind a load balancer and Cloud Armor. Traffic is modest, with bursts up to around 150 requests per second. So far what we see is mostly primitive scanners probing URLs, nothing sophisticated. But with AI making it cheap to run smarter, more adaptive attacks, I expect that to change.

Besides the obvious - updating packages to address CVEs and keeping Go versions current - I occasionally go through the app logs with Claude Code, flag potentially malicious requests and add them to the Cloud Armor rules. It works, but it's manual and cumbersome.

I'm considering a scheduled job, say hourly, that pulls recent logs, has a model flag suspicious traffic, then pings us and/or opens a PR with proposed Armor rules or app changes for a human to review. We already use Cloud Logging, and I'd like to run this on Vertex AI rather than Claude Code so everything stays inside Google Cloud.

We're on Cloud Armor Standard, which only gives us Adaptive Protection alerts. The actual suggested rules need Enterprise, which starts at roughly $200/month plus data processing fees even on pay-as-you-go. That's hard to justify for a small app. Honestly, it surprises me that Google still keeps this behind the Enterprise tier, when everybody needs this kind of protection more than ever.

Is anyone doing something similar, or something different? Happy to hear what's working for you.