Google Kubernetes Engine (GKE)

Google Kubernetes Engine (GKE)

GKE is Google’s managed Kubernetes service. Google invented Kubernetes, and GKE offers the tightest integration — managed control plane, automatic upgrades, and deep GCP ecosystem support.

GKE vs Self-Managed Kubernetes

Feature	GKE	Self-managed
Control plane	Fully managed by Google	You manage
Upgrades	Automatic or on-demand	Manual
Scaling	Node auto-provisioning	Manual setup
Monitoring	Cloud Monitoring built-in	DIY
Cost	Control plane is free	Your infrastructure

Cluster Types

Mode	Description
Autopilot	Google manages nodes — you only define workloads
Standard	You manage node pools and sizing

Autopilot is recommended for most workloads — you pay per pod, not per node.

Creating a Cluster

# Autopilot cluster (recommended)
gcloud container clusters create-auto my-cluster \
  --region=europe-west2

# Standard cluster
gcloud container clusters create my-cluster \
  --zone=europe-west2-a \
  --num-nodes=3 \
  --machine-type=e2-standard-2

Connecting kubectl to GKE

# Generate kubeconfig for your cluster
gcloud container clusters get-credentials my-cluster \
  --region=europe-west2

# Verify connection
kubectl get nodes
kubectl get pods -A

Node Pools

Standard clusters use node pools — groups of identical VMs:

# Add a node pool
gcloud container node-pools create gpu-pool \
  --cluster=my-cluster \
  --zone=europe-west2-a \
  --machine-type=n1-standard-4 \
  --accelerator=type=nvidia-tesla-t4,count=1 \
  --num-nodes=2

# Resize a node pool
gcloud container clusters resize my-cluster \
  --node-pool=default-pool \
  --num-nodes=5 \
  --zone=europe-west2-a

Cluster Autoscaler

Automatically add/remove nodes based on pending pods:

gcloud container clusters update my-cluster \
  --enable-autoscaling \
  --min-nodes=1 \
  --max-nodes=10 \
  --zone=europe-west2-a \
  --node-pool=default-pool

Workload Identity

Allows Kubernetes service accounts to act as GCP service accounts without JSON key files:

# Enable Workload Identity on cluster
gcloud container clusters update my-cluster \
  --workload-pool=PROJECT_ID.svc.id.goog \
  --region=europe-west2

# Annotate Kubernetes service account
kubectl annotate serviceaccount my-ksa \
  iam.gke.io/gcp-service-account=my-gsa@PROJECT_ID.iam.gserviceaccount.com

# Allow the binding
gcloud iam service-accounts add-iam-policy-binding my-gsa@PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:PROJECT_ID.svc.id.goog[my-namespace/my-ksa]"

Deploying to GKE

GKE is standard Kubernetes — use kubectl and standard manifests:

# Deploy an application
kubectl apply -f deployment.yaml

# Expose with a LoadBalancer (creates GCP Cloud Load Balancer)
kubectl expose deployment my-app --type=LoadBalancer --port=80 --target-port=8080

# Get the external IP
kubectl get service my-app

GKE + Cloud Build CI/CD

cloudbuild.yaml

steps:
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', 'gcr.io/$PROJECT_ID/my-app:$SHORT_SHA', '.']

  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'gcr.io/$PROJECT_ID/my-app:$SHORT_SHA']

  - name: 'gcr.io/cloud-builders/gke-deploy'
    args:
      - run
      - --filename=k8s/
      - --image=gcr.io/$PROJECT_ID/my-app:$SHORT_SHA
      - --cluster=my-cluster
      - --location=europe-west2

Useful Commands

# List clusters
gcloud container clusters list

# Upgrade cluster
gcloud container clusters upgrade my-cluster \
  --master --cluster-version=1.30 \
  --zone=europe-west2-a

# Delete cluster
gcloud container clusters delete my-cluster \
  --zone=europe-west2-a