kubernetes-gke

name	kubernetes-gke
description	Kubernetes cluster management and operations with focus on Google Kubernetes Engine (GKE). Use when working with Kubernetes clusters, deployments, services, pods, namespaces, GKE-specific features, kubectl commands, YAML manifests, helm charts, or when troubleshooting Kubernetes issues. Includes GKE autopilot, workload identity, config connector, and GCP integration.

Kubernetes with GKE Focus

Comprehensive guidance for Kubernetes operations with specialized knowledge of Google Kubernetes Engine (GKE) features and best practices.

Quick Start

Check cluster status

# List GKE clusters
gcloud container clusters list

# Get cluster credentials
gcloud container clusters get-credentials CLUSTER_NAME --region REGION

# Verify connection
kubectl cluster-info
kubectl get nodes

Common operations

# Deploy application
kubectl apply -f deployment.yaml

# Check pod status
kubectl get pods -n NAMESPACE

# View logs
kubectl logs POD_NAME -n NAMESPACE

# Scale deployment
kubectl scale deployment DEPLOYMENT_NAME --replicas=3 -n NAMESPACE

Core Workflows

1. Application Deployment

Standard deployment pattern:

1. Create namespace (if needed):

kubectl create namespace my-app

2. Apply manifests in order:

kubectl apply -f configmap.yaml
kubectl apply -f secret.yaml
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml
kubectl apply -f ingress.yaml

3. Verify deployment:

kubectl rollout status deployment/my-app -n my-app
kubectl get all -n my-app

2. Troubleshooting Pods

Systematic debugging approach:

1. Check pod status:

kubectl get pods -n NAMESPACE
kubectl describe pod POD_NAME -n NAMESPACE

2. Review events:

kubectl get events -n NAMESPACE --sort-by='.lastTimestamp'

3. Check logs:

# Current logs
kubectl logs POD_NAME -n NAMESPACE

# Previous container logs (if crashed)
kubectl logs POD_NAME -n NAMESPACE --previous

# Follow logs
kubectl logs -f POD_NAME -n NAMESPACE

# Multi-container pod
kubectl logs POD_NAME -c CONTAINER_NAME -n NAMESPACE

4. Interactive debugging:

# Execute command in pod
kubectl exec -it POD_NAME -n NAMESPACE -- /bin/sh

# Port forward for local testing
kubectl port-forward POD_NAME 8080:80 -n NAMESPACE

3. Resource Management

Check resource usage:

# Node resources
kubectl top nodes

# Pod resources
kubectl top pods -n NAMESPACE

# Resource quotas
kubectl get resourcequota -n NAMESPACE

# Limit ranges
kubectl get limitrange -n NAMESPACE

GKE-Specific Features

Autopilot vs Standard Clusters

Autopilot clusters:

• Fully managed node pools
• Automatic scaling and updates
• Pod-based pricing
• Limited node customization
• Use for: simplified operations, cost optimization

Standard clusters:

• Full control over nodes
• Custom node pools
• Node-based pricing
• Machine type selection
• Use for: specific hardware requirements, advanced configurations

Workload Identity

Enable workload identity for GCP service access:

1. Enable on cluster:

gcloud container clusters update CLUSTER_NAME \
  --workload-pool=PROJECT_ID.svc.id.goog \
  --region=REGION

2. Create Kubernetes service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-ksa
  namespace: default

3. Bind to GCP service account:

gcloud iam service-accounts add-iam-policy-binding \
  GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"

4. Annotate Kubernetes service account:

kubectl annotate serviceaccount KSA_NAME \
  iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
  -n NAMESPACE

GKE Ingress

Use GKE-managed ingress controller:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "gce"
    kubernetes.io/ingress.global-static-ip-name: "my-static-ip"
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-service
                port:
                  number: 80

For HTTPS with managed certificates:

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: my-cert
spec:
  domains:
    - example.com
    - www.example.com

Add annotation to Ingress:

metadata:
  annotations:
    networking.gke.io/managed-certificates: my-cert

Config Connector

Manage GCP resources from Kubernetes:

See CONFIG_CONNECTOR.md for complete setup and usage patterns.

GKE Networking

Network policies for pod security:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-namespace
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: allowed-namespace

Private clusters:

• Control plane is private
• Use Cloud NAT for egress
• VPC peering for internal access
• See PRIVATE_CLUSTERS.md for setup

Manifest Patterns

Deployment Best Practices

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
        version: v1.2.3
    spec:
      serviceAccountName: my-ksa
      containers:
        - name: app
          image: gcr.io/PROJECT_ID/my-app:v1.2.3
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: ENV_VAR
              valueFrom:
                configMapKeyRef:
                  name: my-config
                  key: config-key
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            
               
               
          
            
               
               
             
             
          
            
               
               
             
             
      
      
         
         
         
      
      
        
          
              
              
                
                    
                     
                    
                       

Service Types

ClusterIP (internal):

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: ClusterIP
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 8080

LoadBalancer (external):

apiVersion: v1
kind: Service
metadata:
  name: my-lb-service
  annotations:
    cloud.google.com/load-balancer-type: "Internal" # For internal LB
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 8080

ConfigMaps and Secrets

ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
data:
  app.properties: |
    key1=value1
    key2=value2
  config.json: |
    {
      "setting": "value"
    }

Secret (use GCP Secret Manager with workload identity when possible):

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  password: BASE64_ENCODED_VALUE

Helm Integration

Basic Helm operations

# Add repository
helm repo add stable https://charts.helm.sh/stable
helm repo update

# Install chart
helm install my-release stable/nginx-ingress -n namespace

# Upgrade release
helm upgrade my-release stable/nginx-ingress -n namespace

# List releases
helm list -n namespace

# Uninstall release
helm uninstall my-release -n namespace

Custom values

Create values.yaml:

replicaCount: 3
image:
  repository: gcr.io/PROJECT_ID/app
  tag: v1.0.0
resources:
  requests:
    memory: 256Mi
    cpu: 250m

Install with custom values:

helm install my-release ./chart -f values.yaml -n namespace

Monitoring and Logging

GKE Observability

Cloud Logging:

# View logs in Cloud Console
gcloud logging read "resource.type=k8s_container" --limit 50

# Stream logs
gcloud logging read "resource.type=k8s_container" --limit 50 --format json | jq .

Cloud Monitoring:

• Workload metrics automatically collected
• Create custom dashboards in Cloud Console
• Set up alerts for pod crashes, resource limits

Common kubectl monitoring

# Watch pods
kubectl get pods -n namespace -w

# Describe all resources
kubectl describe all -n namespace

# Get pod metrics
kubectl top pod POD_NAME -n namespace

# View resource usage
kubectl describe node NODE_NAME

Security Best Practices

Pod Security

1. Use non-root users:

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

2. Read-only root filesystem:

securityContext:
  readOnlyRootFilesystem: true

3. Drop capabilities:

securityContext:
  capabilities:
    drop:
      - ALL

4. Use network policies to restrict traffic

5. Use workload identity instead of service account keys

GKE Security Features

• Binary Authorization: Enforce deployment policies
• Shielded GKE Nodes: Secure boot and integrity monitoring
• Pod Security Policies/Standards: Enforce pod security requirements
• Private clusters: Isolate control plane

See SECURITY.md for detailed security configurations.

Backup and Disaster Recovery

Velero for backups

# Install Velero
velero install \
  --provider gcp \
  --plugins velero/velero-plugin-for-gcp:v1.5.0 \
  --bucket BUCKET_NAME \
  --secret-file ./credentials-velero

# Backup namespace
velero backup create my-backup --include-namespaces my-namespace

# Restore backup
velero restore create --from-backup my-backup

# Schedule automatic backups
velero schedule create daily-backup --schedule="0 2 * * *" --include-namespaces my-namespace

Performance Optimization

Node Pool Configuration

For compute-intensive workloads:

gcloud container node-pools create compute-pool \
  --cluster CLUSTER_NAME \
  --machine-type n2-standard-8 \
  --num-nodes 3 \
  --enable-autoscaling \
  --min-nodes 2 \
  --max-nodes 10 \
  --region REGION

For memory-intensive workloads:

gcloud container node-pools create memory-pool \
  --cluster CLUSTER_NAME \
  --machine-type n2-highmem-8 \
  --num-nodes 2 \
  --enable-autoscaling \
  --min-nodes 1 \
  --max-nodes 5 \
  --region REGION

Horizontal Pod Autoscaling

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

Vertical Pod Autoscaling

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: my-app-vpa
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  updatePolicy:
    updateMode: "Auto"

Common Issues and Solutions

ImagePullBackOff

Cause: Cannot pull container image Solutions:

• Verify image exists: gcloud container images list --repository=gcr.io/PROJECT_ID
• Check permissions: Ensure node service account has Storage Object Viewer role
• For Artifact Registry: Configure authentication

CrashLoopBackOff

Cause: Container crashes repeatedly Solutions:

1. Check logs: kubectl logs POD_NAME --previous
2. Verify environment variables and secrets
3. Check resource limits
4. Review liveness/readiness probes

Pending Pods

Cause: Cannot schedule pod Solutions:

1. Check node resources: kubectl top nodes
2. Review pod events: kubectl describe pod POD_NAME
3. Check resource requests vs available capacity
4. Verify node selectors and taints

OOMKilled

Cause: Container exceeded memory limit Solutions:

1. Increase memory limits
2. Review application memory usage
3. Consider VPA for automatic adjustment

Quick Reference

Essential kubectl commands

# Contexts
kubectl config get-contexts
kubectl config use-context CONTEXT_NAME

# Resources
kubectl get all -n namespace
kubectl get pods -o wide -n namespace
kubectl get svc,deploy,ing -n namespace

# Editing
kubectl edit deployment DEPLOYMENT_NAME -n namespace
kubectl set image deployment/DEPLOYMENT_NAME CONTAINER=IMAGE -n namespace

# Debugging
kubectl describe pod POD_NAME -n namespace
kubectl exec -it POD_NAME -n namespace -- bash
kubectl logs -f POD_NAME -n namespace

# Cleanup
kubectl delete pod POD_NAME -n namespace
kubectl delete -f manifest.yaml

GKE CLI commands

# Clusters
gcloud container clusters list
gcloud container clusters describe CLUSTER_NAME --region REGION
gcloud container clusters resize CLUSTER_NAME --num-nodes 3 --region REGION

# Node pools
gcloud container node-pools list --cluster CLUSTER_NAME --region REGION
gcloud container node-pools describe POOL_NAME --cluster CLUSTER_NAME --region REGION

# Operations
gcloud container operations list
gcloud container operations describe OPERATION_ID --region REGION

Advanced Topics

For detailed information on advanced features, see:

• CONFIG_CONNECTOR.md - Manage GCP resources from Kubernetes
• PRIVATE_CLUSTERS.md - Setup and networking for private GKE clusters
• SECURITY.md - Comprehensive security configurations
• CI_CD.md - GitOps and continuous deployment patterns
• MULTI_CLUSTER.md - Multi-cluster management and Anthos

Package Requirements

This skill requires the following tools:

• kubectl - Kubernetes command-line tool
• gcloud - Google Cloud SDK
• Optional: helm - Kubernetes package manager
• Optional: velero - Backup and restore tool