GKE Basics & Critical Gotchas

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

• Default to Autopilot for almost all workloads.
• Use Standard ONLY if:
• Custom node OS kernel parameters (sysctl) are required.
• Custom node taints or specific hardware node pools are required.
• DaemonSets require raw hostPath mounts to the host OS filesystem.
• When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
• For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

1. Private Autopilot Clusters:
   * Use --enable-private-nodes for private node IP addresses.
   * Use --enable-private-endpoint to disable public IP access to the control plane.
   * Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
   bash gcloud container clusters create-auto CLUSTER_NAME --region=REGION \ --enable-private-nodes \ --enable-private-endpoint \ --enable-master-authorized-networks \ --master-authorized-networks=CIDR_BLOCK

2. Workload Identity (IAM Binding):
   * Never mount raw GCP Service Account JSON keys in Pods.
   * Annotate the Kubernetes ServiceAccount (KSA) to bind to the Google Service Account (GSA):
   yaml metadata: annotations: iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

3. Autopilot Resource Requests:
   * In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
   * Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

4. Cluster Credentials:
   * Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
   bash gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet

Reference Directory

• Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

• CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

• Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

• MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

• Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.