Google Kubernetes Engine

Google Kubernetes Engine is the managed Kubernetes service from the company that created Kubernetes and released it as open source in 2014. GKE handles the infrastructure work that Kubernetes requires: provisioning and upgrading the control plane, patching node operating systems, integrating with Google Cloud networking and identity, and providing tooling for multi-cluster operations.

You write manifests describing desired application state; Kubernetes continuously reconciles actual state toward it. Failed pods are replaced, rolling updates are coordinated, and new replicas are scheduled as load grows — all automatically.

Autopilot vs Standard Mode

GKE Autopilot is the recommended starting point for new clusters. Google manages every aspect of the nodes: their size, count, OS, patching, and security hardening. You pay for the CPU and memory your pods request, billed per second — so tuning resource requests, not just actual usage, is what controls the bill. Autopilot enforces security best practices by default — privileged containers are blocked, and Workload Identity is the only authentication mechanism for pod-to-Google-API calls.

GKE Standard keeps node management on your team. You choose node machine types, configure node pools, and are responsible for upgrades. Use it when you need custom node images, OS-level access, fine-grained node-pool control, or networking configurations that Autopilot does not support. GPUs and TPUs are no longer a reason to pick Standard — Autopilot provisions and scales both.

Cluster Architecture

Every GKE cluster has a control plane (managed by Google) and one or more node pools. In Standard mode, zonal clusters have a single-zone control plane while regional clusters replicate the control plane across three zones. The cluster management fee is the same flat rate for both topologies, so regional clusters provide HA for the control plane at no extra control-plane cost — though only a single zonal or Autopilot cluster qualifies for the free-tier credit. For production HA workloads, default to regional clusters; zonal is acceptable for dev, batch, and cost-sensitive workloads that can tolerate a zone outage.

Node Pools

A node pool is a group of nodes sharing the same machine type, OS image, and configuration. Multiple node pools let you route different workload types to appropriate hardware. Node Auto-Provisioning (NAP) creates and deletes node pools automatically based on pod resource requests. Spot node pools reduce node costs by up to 91%, requiring pods to tolerate interruption.

Release Channels and Upgrades

GKE offers four release channels. Rapid gets the newest Kubernetes versions first — useful for testing, not production. Regular (recommended for most) follows a few weeks behind Rapid, balancing freshness and stability. Stable follows Regular by another few months. Extended adds paid support for older versions beyond standard end-of-life. Enroll in Regular and GKE handles minor version upgrades automatically within a maintenance window you configure.

Networking

VPC-native clusters assign pod IP addresses directly from the VPC subnet using alias IP ranges. Always use VPC-native mode. Private clusters have nodes with no public IP addresses. GKE Dataplane V2 uses eBPF via Cilium for pod networking and is the recommended dataplane for new clusters. Network policies restrict pod-to-pod communication — enable them and default to deny-all ingress.

Identity and Security

Workload Identity maps a Kubernetes service account to a Google IAM service account, letting pods authenticate without mounted key files. Enable it and enforce it — mounted key files in etcd and pod specs are a key management problem. Binary Authorization enforces which container images can be deployed, ensuring only CI-signed images reach production.

Autoscaling

• Horizontal Pod Autoscaler (HPA): adjusts replica count based on CPU, memory, or custom metrics.
• Vertical Pod Autoscaler (VPA): adjusts pod resource requests/limits based on observed usage.
• Cluster Autoscaler: adds or removes nodes based on pending pods and underutilization.