Table of Contents
🌏 中文版
Google Kubernetes Engine is managed Kubernetes. Google operates the control plane; you compose a platform from Deployments, Services, Jobs, Gateways, policies, and controllers. The first choice is not machine type but Autopilot versus Standard.
Autopilot and Standard choose responsibility
GKE modes recommend Autopilot for most workloads. Google manages node provisioning, scaling, and many security defaults. Standard exposes node pools, placement, privileged configuration, and capacity. Privileged workloads, special kernel agents, or detailed node topology justify Standard—not habit.
Autopilot remains Kubernetes. Bad requests and limits break scheduling and cost. Pod disruption budgets, readiness, topology spread, HPA, rollout, and application SLOs remain yours. The shared-responsibility model does not own RBAC, workload policy, data protection, or application vulnerabilities.
Do not fall back to node keys
Use Workload Identity Federation to map Kubernetes service accounts to Google Cloud permissions instead of storing service-account JSON keys in Secrets. A namespace alone is not a strong security boundary. Combine RBAC, NetworkPolicy, Pod Security, admission policy, and tenant-aware data authorization.
Control-plane endpoints, private nodes, egress, Cloud NAT, load balancers, DNS, and firewalls affect reachability and cost. Do not install a service mesh before defining a need. Add it only when mTLS, traffic policy, and cross-service telemetry outweigh its operational cost.
Managed does not mean upgrade-free
GKE advances supported versions. Release channels choose cadence, while maintenance windows and exclusions choose timing. Validate API removals, admission webhooks, CSI/CNI, and controllers in lower-risk clusters before production. Exclusions are not permanent freezes.
GKE or Cloud Run
Cloud Run usually ships stateless HTTP, events, jobs, and simple workers faster. GKE earns its cost for a shared multi-team platform, Kubernetes operators, complex networking, GPU scheduling, stateful workloads, or one API across environments.
Adopting GKE means operating an internal platform continuously. Drain a node, lose a zone, revoke workload identity, and rehearse an incompatible upgrade. Verify budgets, autoscaling, policy, backup, and rollback under failure.
References
Loading...