gke-app-onboarding

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GKE App Onboarding

GKE应用上线指南

This reference provides workflows for containerizing and deploying applications to GKE for the first time.

MCP Tools:

apply_k8s_manifest

get_k8s_resource

get_k8s_rollout_status

get_k8s_logs

describe_k8s_resource

本参考文档提供了首次将应用容器化并部署到GKE的工作流程。

MCP工具：

apply_k8s_manifest

get_k8s_resource

get_k8s_rollout_status

get_k8s_logs

describe_k8s_resource

Workflow

工作流程

1. App Assessment

1. 应用评估

Before containerizing, assess the application:

Language & Framework: Identify the tech stack
Dependencies: List required libraries and external services
Configuration: How is the app configured? (env vars, config files, secrets)
Statefulness: Does it need persistent storage? (databases, file storage)
Networking: Port mapping and protocol (HTTP, gRPC, TCP)
Health endpoints: Does the app expose health check endpoints?

在容器化之前，先对应用进行评估：

语言与框架：识别技术栈
依赖项：列出所需的库和外部服务
配置方式：应用的配置方式？（环境变量、配置文件、密钥）
状态性：是否需要持久化存储？（数据库、文件存储）
网络配置：端口映射与协议（HTTP、gRPC、TCP）
健康检查端点：应用是否暴露健康检查端点？

2. Containerization

2. 容器化

Create a container image:

Dockerfile (recommended for most apps):

dockerfile

undefined

创建容器镜像：

Dockerfile（多数应用推荐使用）：

dockerfile

undefined

Multi-stage build for smaller, more secure images

FROM golang:1.22 AS builder WORKDIR /app COPY . . RUN CGO_ENABLED=0 go build -o server .

FROM gcr.io/distroless/static:nonroot COPY --from=builder /app/server /server USER nonroot:nonroot EXPOSE 8080 ENTRYPOINT ["/server"]


**Best practices:**

-   Use multi-stage builds to keep production images small
-   Use distroless or minimal base images to reduce attack surface
-   Run as non-root user
-   Log to `stdout` and `stderr` for Cloud Logging collection

For applications where writing a Dockerfile is not preferred, you can use
[**Cloud Native Buildpacks**](https://buildpacks.io/) to automatically detect
the language and build a container image:

```bash
pack build <image> --builder gcr.io/buildpacks/builder:latest

FROM golang:1.22 AS builder WORKDIR /app COPY . . RUN CGO_ENABLED=0 go build -o server .

FROM gcr.io/distroless/static:nonroot COPY --from=builder /app/server /server USER nonroot:nonroot EXPOSE 8080 ENTRYPOINT ["/server"]


**最佳实践：**

-   使用多阶段构建以缩小生产镜像体积
-   使用distroless或轻量级基础镜像以减少攻击面
-   以非root用户运行
-   将日志输出到`stdout`和`stderr`，以便Cloud Logging收集

对于不希望编写Dockerfile的应用，可使用[**Cloud Native Buildpacks**](https://buildpacks.io/)自动检测语言并构建容器镜像：

```bash
pack build <image> --builder gcr.io/buildpacks/builder:latest

3. Image Management

3. 镜像管理

Build and store the container image:

bash

undefined

构建并存储容器镜像：

bash

undefined

Configure Docker for Artifact Registry

gcloud auth configure-docker <REGION>-docker.pkg.dev --quiet

Build and push

docker build -t <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG> . docker push <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>


**Vulnerability scanning**: Enable automatic scanning in Artifact Registry to
detect issues in base images and dependencies.

```bash

docker build -t <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG> . docker push <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>


**漏洞扫描**：在Artifact Registry中启用自动扫描，以检测基础镜像和依赖项中的问题。

```bash

Check scan results

gcloud artifacts docker images describe
<REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>
--show-package-vulnerability
--quiet

undefined

gcloud artifacts docker images describe
<REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>
--show-package-vulnerability
--quiet

undefined

4. Manifest Generation

4. 清单生成

Generate Kubernetes manifests for the application:

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

Checklist for manifests:

Resource requests and limits set
Liveness and readiness probes configured
At least 2 replicas for production
Service type appropriate (ClusterIP for internal, use Gateway API for external)

为应用生成Kubernetes清单：

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: <REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

清单检查清单：

设置了资源请求与限制
配置了存活探针与就绪探针
生产环境至少设置2个副本
服务类型合适（内部使用ClusterIP，外部使用Gateway API）

5. Deploy

5. 部署

undefined

undefined

MCP (preferred)

MCP（推荐方式）

apply_k8s_manifest(parent="projects/<PROJECT>/locations/<REGION>/clusters/<CLUSTER>", yamlManifest="<manifest>")

Verify

验证

get_k8s_rollout_status(parent="...", resourceType="deployment", name="my-app") get_k8s_resource(parent="...", resourceType="pod", labelSelector="app=my-app")


**kubectl fallback:**

```bash
kubectl apply -f manifests/
kubectl rollout status deployment/my-app
kubectl get pods -l app=my-app

get_k8s_rollout_status(parent="...", resourceType="deployment", name="my-app") get_k8s_resource(parent="...", resourceType="pod", labelSelector="app=my-app")


**kubectl备选方案：**

```bash
kubectl apply -f manifests/
kubectl rollout status deployment/my-app
kubectl get pods -l app=my-app

Next Steps

后续步骤

Once the application is running on GKE:

Configure autoscaling — see the
```
gke-scaling
```
skill
Set up observability — see the
```
gke-observability
```
skill
Harden security — see the
```
gke-security
```
skill
Configure reliability (PDBs, topology spread) — see the
```
gke-reliability
```
skill

应用在GKE上运行后：

配置自动扩缩容 — 请查看
```
gke-scaling
```
技能
设置可观测性 — 请查看
```
gke-observability
```
技能
强化安全防护 — 请查看
```
gke-security
```
技能
配置可靠性（PDB、拓扑分布） — 请查看
```
gke-reliability
```
技能