GCP for DevOps — GKE Basics

2 minute read

GKE Basics

Google Kubernetes Engine (GKE) is a managed Kubernetes service. Google manages the control plane (API server, etcd, scheduler) while you manage the worker nodes.

Create a GKE Standard Cluster

# Create a cluster with 3 nodes
$ gcloud container clusters create dev-cluster \
    --zone=us-central1-a \
    --num-nodes=3 \
    --machine-type=e2-medium \
    --disk-size=50 \
    --enable-ip-alias \
    --release-channel=regular

# Regional cluster (HA — nodes spread across 3 zones)
$ gcloud container clusters create prod-cluster \
    --region=us-central1 \
    --num-nodes=1 \
    --machine-type=e2-standard-4 \
    --enable-ip-alias \
    --release-channel=stable \
    --enable-autorepair \
    --enable-autoupgrade

Get Credentials (kubectl Access)

# Configure kubectl for the cluster
$ gcloud container clusters get-credentials dev-cluster \
    --zone=us-central1-a

Fetching cluster endpoint and auth data.
kubeconfig entry generated for dev-cluster.

# Verify connection
$ kubectl cluster-info

Kubernetes control plane is running at https://34.123.45.67
GLBCDefaultBackend is running at https://34.123.45.67/api/v1/...

$ kubectl get nodes

NAME                                        STATUS   ROLES    AGE   VERSION
gke-dev-cluster-default-pool-abc12345-1ab   Ready    <none>   5m    v1.28.3-gke.1234
gke-dev-cluster-default-pool-abc12345-2cd   Ready    <none>   5m    v1.28.3-gke.1234
gke-dev-cluster-default-pool-abc12345-3ef   Ready    <none>   5m    v1.28.3-gke.1234

Node Pools

Node pools group nodes with the same configuration. A cluster can have multiple pools for different workload types.

# Add a high-memory node pool
$ gcloud container node-pools create highmem-pool \
    --cluster=dev-cluster \
    --zone=us-central1-a \
    --machine-type=e2-highmem-4 \
    --num-nodes=2 \
    --disk-size=100

# Add a GPU node pool
$ gcloud container node-pools create gpu-pool \
    --cluster=dev-cluster \
    --zone=us-central1-a \
    --machine-type=n1-standard-4 \
    --accelerator=type=nvidia-tesla-t4,count=1 \
    --num-nodes=1

# List node pools
$ gcloud container node-pools list \
    --cluster=dev-cluster \
    --zone=us-central1-a

NAME           MACHINE_TYPE    DISK_SIZE_GB  NODE_VERSION
default-pool   e2-medium       50            1.28.3-gke.1234
highmem-pool   e2-highmem-4    100           1.28.3-gke.1234

# Resize a node pool
$ gcloud container clusters resize dev-cluster \
    --node-pool=default-pool \
    --num-nodes=5 \
    --zone=us-central1-a

Cluster Autoscaler

Automatically add or remove nodes based on pending pods.

# Enable autoscaling on a node pool
$ gcloud container clusters update dev-cluster \
    --zone=us-central1-a \
    --enable-autoscaling \
    --node-pool=default-pool \
    --min-nodes=1 \
    --max-nodes=10

Workload Identity

The recommended way to give GKE workloads access to GCP APIs (replaces node-level service accounts).

# Enable Workload Identity on the cluster
$ gcloud container clusters update dev-cluster \
    --zone=us-central1-a \
    --workload-pool=my-project.svc.id.goog

# Create a GCP service account
$ gcloud iam service-accounts create gke-app-sa \
    --display-name="GKE App SA"

# Grant permissions
$ gcloud projects add-iam-policy-binding my-project \
    --member="serviceAccount:gke-app-sa@my-project.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

# Bind K8s SA to GCP SA
$ gcloud iam service-accounts add-iam-policy-binding \
    gke-app-sa@my-project.iam.gserviceaccount.com \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:my-project.svc.id.goog[default/app-ksa]"

# Annotate the Kubernetes service account
$ kubectl annotate serviceaccount app-ksa \
    iam.gke.io/gcp-service-account=gke-app-sa@my-project.iam.gserviceaccount.com

Cluster Networking

Feature Description
VPC-native (alias IP) Pods get IPs from VPC subnet (recommended)
Private cluster No public IPs on nodes
Authorized networks Restrict API server access by IP
Network policy Calico-based pod-to-pod firewall 
# Create a private cluster
$ gcloud container clusters create private-cluster \
    --zone=us-central1-a \
    --enable-private-nodes \
    --master-ipv4-cidr=172.16.0.0/28 \
    --enable-ip-alias \
    --enable-master-authorized-networks \
    --master-authorized-networks=203.0.113.0/24

Common Mistakes

Mistake Why It’s Wrong Fix
Zonal cluster for production Single point of failure Use regional clusters
No autoscaling Over/under-provisioned Enable cluster autoscaler
Node-level SA with broad permissions Security risk Use Workload Identity
Default node pool for everything Can’t optimize per workload Create dedicated node pools
No release channel Manual upgrade burden Use regular or stable channel

Quick Reference

Command Description
gcloud container clusters create C Create cluster
gcloud container clusters get-credentials C Get kubectl access
gcloud container node-pools create P --cluster=C Add node pool
gcloud container clusters resize C --num-nodes=N Resize nodes
gcloud container clusters update C --enable-autoscaling Enable autoscaler

Next → GKE Autopilot

Updated:

You may also enjoy