# Gke Kubernetes

> GKE Kubernetes

- Skill: `kienbui1995/gke-kubernetes` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kienbui1995/gke-kubernetes`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kienbui1995/gke-kubernetes/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: kienbui1995 (https://skillmd.com/u/kienbui1995)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kienbui1995/gke-kubernetes

---


# GKE Kubernetes

## When to Use
- Designing or troubleshooting Kubernetes workloads on GCP
- Choosing between GKE Autopilot and Standard
- Configuring autoscaling, node pools, and resource limits
- Preparing for GCP Professional Cloud Developer or DevOps Engineer exam

## Core Jobs

### 1. Autopilot vs Standard
| Factor | Autopilot | Standard |
|--------|-----------|---------|
| Node management | Google manages nodes | You manage node pools |
| Billing | Per Pod (vCPU + memory) | Per node (whether used or not) |
| Security | Hardened by default | Configurable |
| Best for | Most workloads | Specialized hardware, DaemonSets, GPUs |
| Cost for variable load | Lower (scale to 0) | Higher (min node pool) |

### 2. Node Pool Design (Standard)
- Separate node pools by workload type (general, GPU, high-memory)
- Use **node taints + tolerations** to route workloads to specific pools
- Enable **Cluster Autoscaler** to scale node pools based on demand
- Use **spot/preemptible nodes** for fault-tolerant batch workloads (60-90% cost savings)

### 3. Workload Autoscaling
- **HPA (Horizontal Pod Autoscaler)** — scale Pod replicas based on CPU/memory/custom metrics
- **VPA (Vertical Pod Autoscaler)** — adjust Pod resource requests/limits automatically
- **Cluster Autoscaler** — add/remove nodes based on pending pods

### 4. Workload Identity
- Best practice: bind Kubernetes ServiceAccount to GCP Service Account
- Replaces legacy metadata server credentials (no key files needed)
- Enables fine-grained GCP IAM per workload
- Setup: annotate K8s SA with GCP SA email; bind `roles/iam.workloadIdentityUser`

### 5. GKE Ingress
- **GKE Ingress (L7)** — HTTP/HTTPS routing; backed by Cloud Load Balancing
- **Gateway API** — newer, more expressive routing (replaces Ingress long-term)
- **Internal Ingress** — routes traffic within VPC only
- Use **BackendConfig** to configure Cloud Armor, CDN, health checks on backends

## Key Concepts
- **Pod Disruption Budget (PDB)** — minimum available pods during voluntary disruptions
- **Resource quotas** — limit resource usage per namespace
- **Namespace** — logical isolation within a cluster
- **GKE Dataplane V2** — eBPF-based networking (Cilium); enables network policy

## Checklist
- [ ] Autopilot considered before Standard (unless specific need)?
- [ ] Workload Identity enabled (no service account keys on nodes)?
- [ ] Resource requests and limits set on all containers?
- [ ] HPA configured for variable-load services?
- [ ] Pod Disruption Budgets set for critical workloads?
- [ ] Private cluster (no public IPs on nodes) for sensitive workloads?

## Output Format
- 🔴 **Critical** — service account key files mounted in pods, no resource limits (noisy neighbor risk)
- 🟡 **Warning** — no HPA for variable-load services, public nodes for sensitive workloads
- 🟢 **Suggestion** — Autopilot for cost efficiency, Workload Identity for all GCP API access

## Exam Tips
- Autopilot = Google manages nodes, billing per pod (not per node)
- Workload Identity = K8s ServiceAccount ↔ GCP ServiceAccount (no key files)
- Spot nodes = 60-90% cheaper, can be preempted; use for fault-tolerant batch
- HPA scales Pods; Cluster Autoscaler scales Nodes — both needed for full autoscaling
- Private cluster = nodes have no external IPs; traffic via Cloud NAT or Private Google Access
- Pod Disruption Budget = minimum available pods during node upgrades/drains