Gke Deployment

GKE Deployment

Production-ready Kubernetes deployment patterns for Google Kubernetes Engine.

What I Do

• Write Kubernetes Deployments with proper update strategies
• Configure Services (ClusterIP, NodePort, LoadBalancer) and Ingress
• Implement HPA with CPU, memory, and custom metrics
• Define resource requests/limits and health probes
• Manage ConfigMaps, Secrets, and Workload Identity

When to Use Me

• Deploy applications or microservices to GKE
• Configure Ingress with HTTPS and managed certificates
• Set up autoscaling based on metrics
• Write health check endpoints and probe configurations
• Troubleshoot pod crashes, restarts, or scheduling issues
• Implement blue-green or canary deployment strategies

Deployment Patterns

Rolling Update (Zero Downtime)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: my-app
  template:
    spec:
      containers:
      - name: my-app
        image: us-docker.pkg.dev/PROJECT/REPO/my-app:TAG  # Artifact Registry (preferred)
        # Or legacy: gcr.io/PROJECT/my-app:TAG
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi

Service Configuration

Health Probes

containers:
- name: my-app
  startupProbe:
    httpGet: {path: /healthz, port: 8080}
    periodSeconds: 10
    failureThreshold: 30
  livenessProbe:
    httpGet: {path: /healthz, port: 8080}
    periodSeconds: 15
    failureThreshold: 3
  readinessProbe:
    httpGet: {path: /ready, port: 8080}
    periodSeconds: 5
    failureThreshold: 3

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300

Context7 Integration

Use Context7 MCP server for up-to-date Kubernetes docs:

context7_resolve-library-id("kubernetes", "HPA configuration")
context7_query-docs("/kubernetes/website", "Ingress path types")

Quick Decision Matrix

Common Errors

Resource Guidelines

Security Checklist

• runAsNonRoot: true
• readOnlyRootFilesystem: true
• Drop all capabilities
• Workload Identity for GCP access
• NetworkPolicies applied
• PodDisruptionBudgets configured

GKE-Specific Patterns

Workload Identity (GCP API Access)

# ServiceAccount annotation
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app
  annotations:
    iam.gke.io/gcp-service-account: my-app@PROJECT.iam.gserviceaccount.com

# Bind KSA to GSA
gcloud iam service-accounts add-iam-policy-binding \
  my-app@PROJECT.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT.svc.id.goog[NAMESPACE/my-app]"

GKE Ingress with Managed Certificate

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "gce"
    networking.gke.io/managed-certificates: "my-cert"
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
            name: my-app
            port:
              number: 80
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: my-cert
spec:
  domains:
  - api.example.com

Container-Native Load Balancing (NEG)

apiVersion: v1
kind: Service
metadata:
  annotations:
    cloud.google.com/neg: '{"ingress": true}'  # Enable NEGs
spec:
  type: ClusterIP  # Not NodePort

Gateway API vs Ingress (Modern Routing)

GKE Gateway API is the modern, role-oriented replacement for Ingress. For new clusters, prefer Gateway API. Ingress is still fully supported but is on a slower trajectory and won't get new features (e.g., GAMMA, mesh integration).

Minimal Gateway example (GKE-managed, HTTPS via FrontendTLSPolicy):

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-app-gateway
  namespace: default
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        options:
          networking.gke.io/pre-shared-certs: my-cert   # ManagedCertificate
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
spec:
  parentRefs:
    - name: my-app-gateway
  hostnames: ["api.example.com"]
  rules:
    - matches:
        - path: { type: PathPrefix, value: / }
      backendRefs:
        - name: my-app
          port: 80

When to keep Ingress: existing production clusters with ManagedCertificate already wired up, or when you need the kubernetes.io/ingress.class=gce class behavior for compatibility. Otherwise, default to Gateway API for new work.

See references/research.md for detailed examples and advanced patterns.

Related Skills

Resources

• GKE Docs
• K8s API Reference