Google GKE Deployment Guide

Prerequisites

Before deploying to Google Kubernetes Engine (GKE), ensure you have:

• Google Cloud SDK installed and configured
• Kubernetes CLI (kubectl) installed
• Helm 3.x installed

Cluster Setup

1. Set your project:

gcloud config set project YOUR_PROJECT_ID

2. Create a GKE cluster:

gcloud container clusters create prime-edm-cluster \
  --zone us-central1-a \
  --num-nodes 3 \
  --machine-type e2-standard-2

3. Get credentials:

gcloud container clusters get-credentials prime-edm-cluster --zone us-central1-a

Installing Prime EDM Charts

1. Add the Helm repository:

helm repo add prime-edm https://charts.acx-sandbox.net --username $USER --password $PASSWORD
helm repo update

2. Create GKE-specific values:

# gke-values.yaml
global:
  provider: gcp
  region: us-central1

storage:
  class: standard
  
serviceAccount:
  annotations:
    iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

ingress:
  annotations:
    kubernetes.io/ingress.class: gce

3. Install the chart:

helm install prime-edm prime-edm/prime-edm -f gke-values.yaml

GKE-Specific Configuration

Storage Classes

GKE provides several storage options:

storage:
  # Standard persistent disk
  class: standard
  
  # SSD persistent disk
  # class: premium-rwo
  
  # Regional persistent disk
  # class: standard-rwo-regional

Load Balancer

Using Google Cloud Load Balancer:

ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: gce
    kubernetes.io/ingress.global-static-ip-name: prime-edm-ip

Workload Identity

Configure Workload Identity:

serviceAccount:
  create: true
  annotations:
    iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

Secrets Management

Google Secret Manager Setup

1. Enable Secret Manager API:

gcloud services enable secretmanager.googleapis.com

2. Create Workload Identity:

# Create service account
gcloud iam service-accounts create prime-edm-sa

# Add IAM policy binding
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:prime-edm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

# Create Kubernetes service account
kubectl create serviceaccount prime-edm-ksa

# Bind service accounts
gcloud iam service-accounts add-iam-policy-binding \
  prime-edm-sa@$PROJECT_ID.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:$PROJECT_ID.svc.id.goog[default/prime-edm-ksa]"

3. Install External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace \
  --set installCRDs=true

4. Create SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: gcp-backend
spec:
  provider:
    gcpsm:
      projectID: $PROJECT_ID
      auth:
        workloadIdentity:
          serviceAccountRef:
            name: prime-edm-ksa
            namespace: default

5. Create ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: gcp-backend
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: username
    remoteRef:
      key: projects/$PROJECT_ID/secrets/db-username/versions/latest
  - secretKey: password
    remoteRef:
      key: projects/$PROJECT_ID/secrets/db-password/versions/latest

Monitoring

Cloud Operations Integration

Enable Cloud Operations (formerly Stackdriver):

monitoring:
  cloudOperations:
    enabled: true
    projectId: YOUR_PROJECT_ID

Best Practices

1. Use node selectors:

nodeSelector:
  cloud.google.com/gke-nodepool: prime-edm-pool

2. Configure resource limits:

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 500m
    memory: 1Gi

3. Enable auto-scaling:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

Troubleshooting

Common issues and solutions:

1. Load balancer issues:

   • Check firewall rules
   • Verify health checks
   • Validate backend services

2. Storage problems:

   • Confirm storage class exists
   • Check PVC status
   • Verify IAM permissions

3. Identity issues:

   • Check Workload Identity setup
   • Verify service account bindings
   • Validate IAM roles