Google Cloud GKE Production Guide

1# Authenticate
2gcloud auth login
3gcloud config set project MY_PROJECT_ID
4
5# Enable required APIs
6gcloud services enable container.googleapis.com   artifactregistry.googleapis.com   sqladmin.googleapis.com
7
8# Create GKE Autopilot cluster (managed nodes — recommended)
9gcloud container clusters create-auto prod-cluster   --region us-central1   --release-channel stable
10
11# Get credentials
12gcloud container clusters get-credentials prod-cluster --region us-central1
13
14# Verify
15kubectl get nodes

1# Create Docker repository
2gcloud artifacts repositories create prod-images   --repository-format docker   --location us-central1
3
4# Authenticate Docker
5gcloud auth configure-docker us-central1-docker.pkg.dev
6
7# Build and push
8IMAGE=us-central1-docker.pkg.dev/MY_PROJECT/prod-images/api:v1.0.0
9docker build -t $IMAGE .
10docker push $IMAGE

1# Create GCP service account
2gcloud iam service-accounts create prod-api-sa   --display-name "Prod API Service Account"
3
4# Grant permissions (e.g. Cloud SQL client)
5gcloud projects add-iam-policy-binding MY_PROJECT   --member "serviceAccount:prod-api-sa@MY_PROJECT.iam.gserviceaccount.com"   --role "roles/cloudsql.client"
6
7# Link Kubernetes SA to GCP SA
8gcloud iam service-accounts add-iam-policy-binding   prod-api-sa@MY_PROJECT.iam.gserviceaccount.com   --role roles/iam.workloadIdentityUser   --member "serviceAccount:MY_PROJECT.svc.id.goog[production/api-sa]"
9
10# Kubernetes SA with annotation
11kubectl create serviceaccount api-sa -n production
12kubectl annotate serviceaccount api-sa -n production   iam.gke.io/gcp-service-account=prod-api-sa@MY_PROJECT.iam.gserviceaccount.com

1# Reserve a static IP
2gcloud compute addresses create prod-ingress-ip --global
3
4# ManagedCertificate
5apiVersion: networking.gke.io/v1
6kind: ManagedCertificate
7metadata:
8  name: prod-cert
9spec:
10  domains: [api.example.com]
11---
12apiVersion: networking.k8s.io/v1
13kind: Ingress
14metadata:
15  name: prod-ingress
16  annotations:
17    kubernetes.io/ingress.global-static-ip-name: prod-ingress-ip
18    networking.gke.io/managed-certificates: prod-cert
19    kubernetes.io/ingress.class: gce
20spec:
21  rules:
22    - host: api.example.com
23      http:
24        paths:
25          - path: /*
26            pathType: ImplementationSpecific
27            backend:
28              service:
29                name: api
30                port:
31                  number: 80

1# Create Cloud SQL PostgreSQL instance
2gcloud sql instances create prod-postgres   --database-version POSTGRES_16   --tier db-g1-small   --region us-central1   --availability-type REGIONAL   --backup-start-time 02:00   --retained-backups-count 7
3
4# Cloud SQL Auth Proxy sidecar in pod
5containers:
6  - name: cloud-sql-proxy
7    image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2
8    args:
9      - "--structured-logs"
10      - "--port=5432"
11      - "MY_PROJECT:us-central1:prod-postgres"
12    securityContext:
13      runAsNonRoot: true

1# HPA on CPU
2kubectl autoscale deployment api --cpu-percent=70 --min=3 --max=20
3
4# KEDA for event-driven scaling (e.g. Pub/Sub queue depth)
5apiVersion: keda.sh/v1alpha1
6kind: ScaledObject
7metadata:
8  name: api-scaler
9spec:
10  scaleTargetRef:
11    name: api
12  minReplicaCount: 2
13  maxReplicaCount: 50
14  triggers:
15    - type: gcp-pubsub
16      metadata:
17        subscriptionName: tasks-subscription
18        value: "50"   # scale up when 50+ messages in queue