Skip to main content

Google Kubernetes Engine (GKE)

1 - Overview​

GKE is Google Cloud's managed Kubernetes service, offering a native Kubernetes experience with advanced features.

2 - Autopilot vs Standard​

AspectAutopilotStandard
Node managementGoogleYou
PricingPer podPer node
ScalingAutomaticConfigurable
SecurityHardenedConfigurable
CustomizationLimitedFull
MaintenanceZeroYou

2.1 Choose Autopilot if​

  • You want zero infrastructure management
  • Standard workloads with no special requirements
  • Simplicity is a priority

2.2 Choose Standard if​

  • You need GPU/TPU
  • Specific node configuration
  • Full control over the nodes

3 - Create a cluster​

3.1 Autopilot cluster​

# Create an Autopilot cluster
gcloud container clusters create-auto mon-cluster \
    --region=europe-west1 \
    --project=mon-projet

3.2 Standard cluster​

# Create a Standard cluster
gcloud container clusters create mon-cluster \
    --region=europe-west1 \
    --num-nodes=3 \
    --machine-type=e2-standard-4 \
    --enable-autoscaling \
    --min-nodes=1 \
    --max-nodes=10 \
    --enable-autorepair \
    --enable-autoupgrade

3.3 Connect to the cluster​

# Get the credentials
gcloud container clusters get-credentials mon-cluster \
    --region=europe-west1 \
    --project=mon-projet

# Verify
kubectl get nodes

4 - Deploy an application​

4.1 Kubernetes manifests​

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: app
          image: europe-west1-docker.pkg.dev/mon-projet/images/my-app:v1.0.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: my-app

4.2 Deploy​

kubectl apply -f deployment.yaml

# Verify
kubectl get pods
kubectl get services

5 - Workload Identity​

Secure access to GCP services from pods.

5.1 Enable Workload Identity​

# On the cluster (already enabled on Autopilot)
gcloud container clusters update mon-cluster \
    --region=europe-west1 \
    --workload-pool=mon-projet.svc.id.goog

5.2 Configure the Service Account​

# Create a GSA
gcloud iam service-accounts create my-app-sa

# Grant permissions
gcloud projects add-iam-policy-binding mon-projet \
    --member="serviceAccount:[email protected]" \
    --role="roles/storage.objectViewer"

# Bind the KSA to the GSA
gcloud iam service-accounts add-iam-policy-binding \
    [email protected] \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:mon-projet.svc.id.goog[default/my-app-ksa]"

5.3 Use it in the pod​

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-ksa
  annotations:
    iam.gke.io/gcp-service-account: my-app-sa@mon-projet.iam.gserviceaccount.com
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      serviceAccountName: my-app-ksa

6 - Ingress and HTTPS​

6.1 GKE Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "my-static-ip"
    networking.gke.io/managed-certificates: "my-cert"
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: my-app
                port:
                  number: 80

6.2 Managed Certificate​

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: my-cert
spec:
  domains:
    - app.example.com

7 - CI/CD with Cloud Build​

# cloudbuild.yaml
steps:
  # Build
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', '${_IMAGE}', '.']
  
  # Push
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '${_IMAGE}']
  
  # Deploy to GKE
  - name: 'gcr.io/cloud-builders/gke-deploy'
    args:
      - 'run'
      - '--filename=kubernetes/'
      - '--location=europe-west1'
      - '--cluster=mon-cluster'
      - '--image=${_IMAGE}'

substitutions:
  _IMAGE: 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/my-app:$COMMIT_SHA'

8 - Monitoring​

8.1 Integrated Cloud Monitoring​

GKE automatically sends metrics to Cloud Monitoring:

  • CPU/Memory per pod and node
  • Network traffic
  • Disk usage

8.2 GKE Dashboard​

# View metrics
gcloud monitoring dashboards list

# Enable Kubernetes metrics
gcloud container clusters update mon-cluster \
    --region=europe-west1 \
    --monitoring=SYSTEM,WORKLOAD

Summary​

In this chapter, we learned:

  • The difference between Autopilot and Standard
  • How to create clusters
  • Deploying applications
  • Workload Identity for security
  • Ingress and HTTPS
  • CI/CD integration

Next step​

In the next chapter, we will look at Cloud Run.

→ Next chapter: Cloud Run

← Back to table of contents