Resilience & Disaster Recovery — Zones, Regions & Multi-region

Choose zonal, regional or multi-region versions of each resource on purpose, replicate the data tier to match the RPO, and let the global load balancer move users without DNS.

State the recovery time and recovery point objectives first. On Google Cloud much of the answer is then settled by a choice made when each resource is created: its location scope.

A chain of shops behind one phone number. Customers dial the same number wherever they are and are put through to the nearest open branch; if a branch shuts, the switchboard simply stops sending calls there. The hard part is not the phone line — it is making sure every branch has today's stock.

Key Concepts

Every resource has a location scope.

    zonal          one datacentre: a zonal disk, a VM, a zonal
                   GKE cluster
    regional       spread across zones: regional MIGs, regional
                   disks, regional GKE clusters, Cloud SQL HA
    multi-region   spread across regions: Spanner, Firestore,
                   Cloud Storage, BigQuery
    global         one resource everywhere: the external Application
                   Load Balancer, VPC networks, Cloud DNS

The commonest resilience defect on Google Cloud is a zonal resource chosen by default — a zonal GKE cluster whose control plane is unavailable while it upgrades, or a zonal disk under a database — when the regional version was one flag away.

The front door is already global. The external Application Load Balancer serves a single anycast IP from Google's edge and sends each request to the nearest healthy backend. When a region's backends fail their health checks, traffic shifts within seconds, with no DNS record to change and no TTL to wait out. The compute side of active-active is largely a matter of configuration.

The data tier is where the RPO is decided.

    Cloud SQL        HA: a synchronous standby in a second zone.
                     Cross-region replica: asynchronous, promoted in
                     a regional outage. Enterprise Plus adds managed
                     switchover to a designated DR replica.
    Persistent Disk  regional disks are synchronous across two zones;
                     asynchronous replication copies a disk to another
                     region with an RPO under a minute
    Cloud Storage    dual-region buckets; turbo replication guarantees
                     new objects reach both regions within 15 minutes
    Spanner          multi-region configurations replicate
                     synchronously: no data loss, no conflict handling

Spanner is the answer only when the requirement is real. It offers relational semantics and writes that survive the loss of a region with no data loss, which nothing else in that table does — at a price that only makes sense when the business truly needs it.

Kubernetes needs two things. Regional GKE clusters keep the control plane and nodes across three zones, and Backup for GKE captures workloads and persistent volumes so they can be restored into a cluster in another region.

Make backups outlive their owners. Backup and DR Service can keep backups in a vault with enforced retention that nobody — a project owner included — can shorten or delete early. That is the defence against ransomware, and against the mistaken delete that is far likelier than a region failing.

Rehearse it. Promote the Cloud SQL replica, drain a region's backends from the load balancer, restore a GKE backup into the secondary region — and time each step against the RTO.

What the interviewer is probing.1. "What is the single most common resilience mistake on Google Cloud?" Probing: location scope. Stalls: "Too few replicas." Moves up: accepting a zonal resource — a cluster, a disk, an instance — where a regional version exists, usually for little extra effort.

2. "A region goes down. How are users routed to the other one, and how quickly?" Probing: anycast against DNS. Stalls: "Update the DNS records." Moves up: the global external load balancer's single anycast IP routes around backends that fail health checks within seconds — no record changes, no TTLs.

3. "The RPO for uploaded files is fifteen minutes. Which Cloud Storage setup meets it?" Probing: replication guarantees. Stalls: "A multi-region bucket." Moves up: a dual-region bucket with turbo replication, which guarantees new objects reach both regions within fifteen minutes; default replication only aims for most objects within an hour.

4. "When would you choose Spanner purely for disaster recovery?" Probing: proportionality. Stalls: "Always, it is multi-region." Moves up: only when relational data must keep accepting writes through a regional loss with zero data loss; otherwise Cloud SQL with a cross-region replica meets most RPOs at a fraction of the cost.