| name | gke |
| description | Deploy and manage Kubernetes workloads on Google Kubernetes Engine (GKE). Covers Autopilot and Standard modes, Workload Identity, node pool management, networking, security, and gcloud/kubectl CLI patterns. Warns before cluster creation (billable). |
| version | 0.1 |
| triggers | ["GKE","kubernetes on GCP","google kubernetes engine","create GKE cluster","workload identity","node pool","GKE autopilot","kubectl GCP","GKE networking","GKE security"] |
| required_scopes | ["container.clusters.create","container.clusters.delete","container.clusters.get","container.clusters.list","container.clusters.update","container.nodes.list"] |
| mcp_servers | ["google-gke"] |
GKE — Google Kubernetes Engine
Run Kubernetes workloads with Google's managed control plane. Choose Autopilot (fully managed nodes) or Standard (you manage node pools).
Mode Selection
| Autopilot | Standard |
|---|
| Node management | Google | You |
| Billing | Per pod resource | Per node |
| Best for | Ops-light teams, variable load | Fine-grained node control |
Core Patterns
Create an Autopilot cluster (recommended)
gcloud container clusters create-auto CLUSTER_NAME \
--region REGION \
--project PROJECT_ID
Get credentials
gcloud container clusters get-credentials CLUSTER_NAME \
--region REGION \
--project PROJECT_ID
Workload Identity (never use SA key files in pods)
kubectl annotate serviceaccount KSA_NAME \
iam.gke.io/gcp-service-account=GSA_EMAIL
gcloud iam service-accounts add-iam-policy-binding GSA_EMAIL \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"
Safety Rules
- Always use Workload Identity — never mount SA key files into pods
- Enable Binary Authorization for production clusters
- Cost warning: GKE clusters incur cluster management fee + node costs
References
