/gke-basics

GKE Basics & Critical Gotchas

Routing Note: For Workload Identity KSA/GSA setup, open gke-workload-identity/SKILL.md. For cluster security flags (--database-encryption-key, --security-posture, RBAC, Shielded Nodes, Binary Authorization), open gke-platform-security/SKILL.md. For cluster upgrades or maintenance windows, open gke-upgrades/SKILL.md. For generating Kubernetes YAML manifests (Deployment, StatefulSet, Service, HTTPRoute, PodDisruptionBudget), open gke-manifest-generation/SKILL.md.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

• Default to Autopilot for almost all workloads.
• Use Standard ONLY if:
  • Custom node OS kernel parameters (sysctl) are required.
  • Custom node taints or specific hardware node pools are required.
  • DaemonSets require raw hostPath mounts to the host OS filesystem.
• When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
• For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

1. Private Autopilot Clusters:

   • Use --enable-private-nodes for private node IP addresses.
   • Use --enable-private-endpoint to disable public IP access to the control plane.
   • Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:

     gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
       --enable-private-nodes \
       --enable-private-endpoint \
       --enable-master-authorized-networks \
       --master-authorized-networks=CIDR_BLOCK

2. Workload Identity (IAM Binding):

   • Never mount raw GCP Service Account JSON keys in Pods; open gke-workload-identity/SKILL.md for KSA/GSA setup.

3. Autopilot Resource Requests:

   • In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
   • Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

4. Cluster Credentials:

   • Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:

     gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet

Reference Directory

• Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

• CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

• Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

• MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

• Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.