GCP for DevOps — GKE Autopilot

GKE Autopilot

GKE Autopilot is a fully managed Kubernetes mode where Google manages the nodes, scaling, security hardening, and OS patching. You only define pods — Google handles everything else.

Autopilot vs Standard

Feature	GKE Standard	GKE Autopilot
Node management	You manage	Google manages
Node pools	Manual creation	Automatic
Pricing	Per node (VM)	Per pod (CPU/memory/GPU)
Security hardening	Your responsibility	Built-in (COS, gVisor ready)
Cluster autoscaler	Opt-in	Always on
OS patching	Manual or auto-upgrade	Automatic
Pod scheduling	Full control	Google optimizes
SSH to nodes	Yes	No
DaemonSets	Full support	Limited (system only)
Privileged pods	Allowed	Restricted

Create an Autopilot Cluster

# Create an Autopilot cluster (regional by default)
$ gcloud container clusters create-auto autopilot-prod \
    --region=us-central1 \
    --release-channel=stable

# Get kubectl credentials
$ gcloud container clusters get-credentials autopilot-prod \
    --region=us-central1

# Verify — no nodes until you deploy workloads
$ kubectl get nodes

No resources found

Deploy a Workload

When you deploy pods, Autopilot automatically provisions the right nodes.

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
        - name: web
          image: us-central1-docker.pkg.dev/my-project/my-repo/web:v1.0.0
          resources:
            requests:
              cpu: "250m"
              memory: "512Mi"
            limits:
              cpu: "500m"
              memory: "1Gi"
          ports:
            - containerPort: 8080

$ kubectl apply -f deployment.yaml

# Autopilot provisions nodes automatically
$ kubectl get nodes

NAME                                              STATUS   ROLES    AGE   VERSION
gke-autopilot-prod-nap-abc123-1                   Ready    <none>   30s   v1.28.3-gke.1234

$ kubectl get pods

NAME                       READY   STATUS    RESTARTS   AGE
web-app-6d8f7b9c4-abc12   1/1     Running   0          45s
web-app-6d8f7b9c4-def34   1/1     Running   0          45s
web-app-6d8f7b9c4-ghi56   1/1     Running   0          45s

Resource Requests Are Required

Autopilot requires resource requests on all containers. If you don’t set them, Autopilot applies defaults.

Resource	Default Request	Default Limit
CPU	500m	500m
Memory	512Mi	512Mi
Ephemeral storage	1Gi	1Gi

Best practice: Always set explicit resource requests to optimize costs.

Compute Classes

Autopilot supports different compute classes for workload optimization.

# Request a specific compute class
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ml-inference
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ml-inference
  template:
    metadata:
      labels:
        app: ml-inference
    spec:
      nodeSelector:
        cloud.google.com/compute-class: "Performance"
      containers:
        - name: model
          image: my-model:latest
          resources:
            requests:
              cpu: "4"
              memory: "16Gi"

Compute Class	Description
General-purpose (default)	Balanced CPU/memory
Balanced	Higher memory-to-CPU ratio
Performance	Highest single-thread performance
Scale-Out	Cost-optimized, Arm-based (T2A)
Accelerator	GPU workloads (T4, L4, A100)

Autopilot Networking

# Create Autopilot with private cluster
$ gcloud container clusters create-auto autopilot-private \
    --region=us-central1 \
    --enable-private-nodes \
    --enable-master-authorized-networks \
    --master-authorized-networks=203.0.113.0/24

Horizontal Pod Autoscaler (HPA)

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

When to Use Autopilot vs Standard

Scenario	Recommendation
New projects, small teams	✅ Autopilot
Compliance requiring node access	❌ Standard
DaemonSets required	❌ Standard
Privileged containers	❌ Standard
Cost optimization (pod-level billing)	✅ Autopilot
GPU workloads	✅ Either
Large multi-tenant clusters	⚡ Standard (more control)

Common Mistakes

Mistake	Why It’s Wrong	Fix
No resource requests	Gets default (may be too high/low)	Always set explicit requests
Over-requesting resources	Pay for unused capacity	Right-size with metrics
Expecting DaemonSet support	Restricted in Autopilot	Use sidecars or GKE Standard
Ignoring compute classes	Suboptimal performance	Match compute class to workload
Not using HPA	Manual scaling	Configure HPA for dynamic workloads

Quick Reference

Command	Description
gcloud container clusters create-auto C	Create Autopilot cluster
gcloud container clusters get-credentials C	Get kubectl access
kubectl get nodes	See provisioned nodes
kubectl top pods	Check resource usage
gcloud container clusters delete C	Delete cluster

Next → Cloud Run