kienbui1995/skills/cloud/gcp/gke-kubernetes

GKE Kubernetes

When to Use

• Designing or troubleshooting Kubernetes workloads on GCP
• Choosing between GKE Autopilot and Standard
• Configuring autoscaling, node pools, and resource limits
• Preparing for GCP Professional Cloud Developer or DevOps Engineer exam

Core Jobs

1. Autopilot vs Standard

| Factor | Autopilot | Standard | |--------|-----------|---------| | Node management | Google manages nodes | You manage node pools | | Billing | Per Pod (vCPU + memory) | Per node (whether used or not) | | Security | Hardened by default | Configurable | | Best for | Most workloads | Specialized hardware, DaemonSets, GPUs | | Cost for variable load | Lower (scale to 0) | Higher (min node pool) |

2. Node Pool Design (Standard)

• Separate node pools by workload type (general, GPU, high-memory)
• Use node taints + tolerations to route workloads to specific pools
• Enable Cluster Autoscaler to scale node pools based on demand
• Use spot/preemptible nodes for fault-tolerant batch workloads (60-90% cost savings)

3. Workload Autoscaling

• HPA (Horizontal Pod Autoscaler) — scale Pod replicas based on CPU/memory/custom metrics
• VPA (Vertical Pod Autoscaler) — adjust Pod resource requests/limits automatically
• Cluster Autoscaler — add/remove nodes based on pending pods

4. Workload Identity

• Best practice: bind Kubernetes ServiceAccount to GCP Service Account
• Replaces legacy metadata server credentials (no key files needed)
• Enables fine-grained GCP IAM per workload
• Setup: annotate K8s SA with GCP SA email; bind roles/iam.workloadIdentityUser

5. GKE Ingress

• GKE Ingress (L7) — HTTP/HTTPS routing; backed by Cloud Load Balancing
• Gateway API — newer, more expressive routing (replaces Ingress long-term)
• Internal Ingress — routes traffic within VPC only
• Use BackendConfig to configure Cloud Armor, CDN, health checks on backends

Key Concepts

• Pod Disruption Budget (PDB) — minimum available pods during voluntary disruptions
• Resource quotas — limit resource usage per namespace
• Namespace — logical isolation within a cluster
• GKE Dataplane V2 — eBPF-based networking (Cilium); enables network policy

Checklist

• [ ] Autopilot considered before Standard (unless specific need)?
• [ ] Workload Identity enabled (no service account keys on nodes)?
• [ ] Resource requests and limits set on all containers?
• [ ] HPA configured for variable-load services?
• [ ] Pod Disruption Budgets set for critical workloads?
• [ ] Private cluster (no public IPs on nodes) for sensitive workloads?

Output Format

• 🔴 Critical — service account key files mounted in pods, no resource limits (noisy neighbor risk)
• 🟡 Warning — no HPA for variable-load services, public nodes for sensitive workloads
• 🟢 Suggestion — Autopilot for cost efficiency, Workload Identity for all GCP API access

Exam Tips

• Autopilot = Google manages nodes, billing per pod (not per node)
• Workload Identity = K8s ServiceAccount ↔ GCP ServiceAccount (no key files)
• Spot nodes = 60-90% cheaper, can be preempted; use for fault-tolerant batch
• HPA scales Pods; Cluster Autoscaler scales Nodes — both needed for full autoscaling
• Private cluster = nodes have no external IPs; traffic via Cloud NAT or Private Google Access
• Pod Disruption Budget = minimum available pods during node upgrades/drains