Planning and implementing a cloud solution · Topic 3 of 9

Deploying to GKE

Installing kubectl, GKE Autopilot versus Standard, regional and private clusters, getting credentials and deploying a containerized application to GKE for ACE.

4 min

In a nutshell

Install kubectl, then gcloud container clusters get-credentials.
Autopilot: Google manages nodes, billed by Pod requests. Standard: you manage node pools.
create-auto makes Autopilot clusters, which are regional.

What it is

Google Kubernetes Engine (GKE) runs Kubernetes clusters managed by Google. The exam expects you to install and configure kubectl, create clusters in different configurations (Autopilot, regional, private), and deploy a containerized application.

How it works

Installing and configuring kubectl

# install kubectl as a gcloud component (or from your OS package manager)
gcloud components install kubectl

# write cluster credentials into kubeconfig so kubectl can talk to the cluster
gcloud container clusters get-credentials shop-cluster --region=us-central1
kubectl get nodes

get-credentials is the step people forget: kubectl needs the cluster's endpoint and credentials in its kubeconfig file. GKE uses the gke-gcloud-auth-plugin for authentication.

Autopilot or Standard

	Autopilot	Standard
Who manages nodes	Google (provisioning, scaling, upgrades, security)	You (node pools, machine types, upgrades settings)
Billing	Mainly for the CPU, memory and storage your Pods request	For the nodes (VMs) you run
Control	Opinionated, secure defaults; some settings restricted	Full control of nodes and configuration
Best for	Most workloads, teams wanting minimal operations	Special node configurations or full control

# Autopilot clusters are regional
gcloud container clusters create-auto shop-auto --region=us-central1

# Standard regional cluster with nodes in each zone of the region
gcloud container clusters create shop-std --region=us-central1 --num-nodes=1

Regional and private clusters

Configuration	What it means	Why
Zonal cluster	One control plane in one zone	Cheapest, but a zone outage affects the control plane
Regional cluster	Control plane replicas and nodes across zones in a region	Higher availability for control plane and workloads
Private cluster (private nodes)	Nodes have only internal IP addresses	Nodes are not reachable from the internet
Private endpoint	Control plane reachable only through its private endpoint	Restricts kubectl access to internal networks

Private nodes have no external IPs, so pulling images from the internet or reaching external APIs needs Cloud NAT; Google APIs and Artifact Registry are reachable through Private Google Access. Use control plane authorized networks to restrict which IP ranges can reach the control plane.

Exam tip

In --num-nodes on a regional Standard cluster, the number is per zone. --num-nodes=1 in a three-zone region gives three nodes.

Deploying a containerized application

# deploy an image and expose it with an external load balancer
kubectl create deployment web --image=us-docker.pkg.dev/PROJECT/repo/web:1.0
kubectl scale deployment web --replicas=3
kubectl expose deployment web --type=LoadBalancer --port=80 --target-port=8080
kubectl get service web

In practice teams describe resources in YAML manifests and apply them with kubectl apply -f deployment.yaml, so the configuration is versioned. A Deployment keeps the desired number of Pods running; a Service gives them a stable address; an Ingress or Gateway provides HTTP(S) load balancing.

A worked scenario

A team wants to run its containerized shop with minimal cluster management and high availability. It creates a regional Autopilot cluster, runs get-credentials, applies a Deployment and a Service of type LoadBalancer from YAML, and stores images in Artifact Registry. A second, internal analytics cluster is Standard with private nodes and Cloud NAT for outbound access.

How the exam asks about this

"kubectl cannot connect to the new cluster." Run gcloud container clusters get-credentials.
"Least operational overhead for Kubernetes." GKE Autopilot.
"Control plane must survive a zone outage." A regional cluster.
"Nodes must not have public IP addresses." A private cluster (private nodes), with Cloud NAT for outbound internet.
"Expose a Deployment to the internet." A Service of type LoadBalancer or an Ingress.

What to remember for the exam

Install kubectl, then gcloud container clusters get-credentials.
Autopilot: Google manages nodes, billed by Pod requests. Standard: you manage node pools.
create-auto makes Autopilot clusters, which are regional.
Regional clusters replicate the control plane and nodes across zones.
Private nodes have internal IPs only; add Cloud NAT for internet egress.
Deployment for Pods, Service for a stable endpoint, LoadBalancer or Ingress for external access.

Watch out

A zonal cluster's control plane is unavailable during a zone outage. Choose regional for production availability.

Common mistakes

Forgetting get-credentials. kubectl has no cluster configuration without it.

Expecting private nodes to reach the internet. They need Cloud NAT.

Miscounting nodes in regional clusters. --num-nodes is per zone.

Check yourself

Which command configures kubectl to access a GKE cluster?
gcloud container clusters get-credentials CLUSTER --region=REGION (or --zone).
What is the main operational difference between Autopilot and Standard?
In Autopilot Google manages the nodes; in Standard you manage node pools.
How do Pods on private nodes reach the internet?
Through Cloud NAT.

Topic 3 of 9 in Planning and implementing a cloud solution

Test yourself on Planning and implementing a cloud solution

The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.