gke-cluster-creation

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GKE Cluster Creation

GKE集群创建

This reference guides creating GKE clusters. The golden path Autopilot configuration is the default for all new clusters.

MCP Tools:

list_clusters

create_cluster

get_cluster

list_operations

get_operation

本参考指南介绍GKE集群的创建流程。黄金路径Autopilot配置是所有新集群的默认选项。

MCP工具：

list_clusters

create_cluster

get_cluster

list_operations

get_operation

Workflow

工作流程

Discover context: Use
```
list_clusters
```
to see existing clusters. Use
```
gcloud config get-value project
```
if project unknown.
Gather inputs: project_id, region, cluster_name, environment type
Select mode: Autopilot (default) vs Standard
Configure networking: auto-create subnet (default) or bring-your-own
Review golden path settings: present the config and confirm with user
Create: Use MCP
```
create_cluster
```
tool. Fall back to
```
gcloud
```
CLI only if MCP is unavailable.
Track: Use
```
get_operation
```
to monitor creation progress
Verify: Use
```
get_cluster
```
with
```
readMask="*"
```
to confirm golden path settings applied

发现上下文：使用
```
list_clusters
```
查看现有集群。若项目未知，使用
```
gcloud config get-value project
```
查询。
收集输入信息：project_id、region、cluster_name、环境类型
选择模式：Autopilot（默认） vs Standard
配置网络：自动创建子网（默认）或使用自定义子网
审核黄金路径设置：展示配置并获取用户确认
创建集群：使用MCP的
```
create_cluster
```
工具。仅当MCP不可用时，才回退使用
```
gcloud
```
CLI。
跟踪进度：使用
```
get_operation
```
监控创建进度
验证配置：使用
```
get_cluster
```
并设置
```
readMask="*"
```
，确认黄金路径设置已生效

Mode Selection

模式选择

Criteria	Autopilot (Golden Path)	Standard
Node management	Google-managed	Self-managed
Pricing	Pay per pod resource	Pay per node (VM)
: : request : :
Node customization	Via ComputeClasses	Full control
DaemonSets	Allowed (with	Full control
: : restrictions) : :
GPU/TPU	Supported via	Supported via node pools
: : ComputeClasses : :
Best for	Most production workloads	Kernel tuning, custom OS,
: : : privileged workloads :

Rule: Default to Autopilot unless the customer has a specific requirement that Autopilot cannot satisfy.

判定标准	Autopilot（黄金路径）	Standard
节点管理	谷歌托管	自行管理
定价方式	按Pod资源使用量计费	按节点（VM）计费
节点自定义能力	通过ComputeClasses实现	完全控制
DaemonSets支持	允许（存在限制）	完全控制
GPU/TPU支持	通过ComputeClasses支持	通过节点池支持
适用场景	大多数生产级工作负载	需要内核调优、自定义OS、特权工作负载的场景

规则：默认使用Autopilot，除非客户有Autopilot无法满足的特定需求。

Templates

模板

1. Golden Path Autopilot (Production)

1. 黄金路径Autopilot（生产环境）

This is the default. All settings match

../gke-golden-path/assets/golden-path-autopilot.yaml

Via gcloud:

bash

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel regular \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-dns-access \
  --enable-secret-manager \
  --secret-manager-rotation-interval=120s \
  --scoped-rbs-bindings \
  --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,STORAGE,POD,DEPLOYMENT,STATEFULSET,DAEMONSET,HPA,CADVISOR,KUBELET,DCGM \
  --quiet

Via MCP (
create_cluster
):

json

{
  "parent": "projects/<PROJECT_ID>/locations/<REGION>",
  "cluster": {
    "name": "<CLUSTER_NAME>",
    "autopilot": { "enabled": true },
    "privateClusterConfig": { "enablePrivateNodes": true },
    "masterAuthorizedNetworksConfig": {
      "privateEndpointEnforcementEnabled": true
    },
    "releaseChannel": { "channel": "REGULAR" },
    "secretManagerConfig": {
      "enabled": true,
      "rotationConfig": { "enabled": true, "rotationInterval": "120s" }
    },
    "rbacBindingConfig": {
      "enableInsecureBindingSystemAuthenticated": false,
      "enableInsecureBindingSystemUnauthenticated": false
    }
  }
}

这是默认模板。所有设置与

../gke-golden-path/assets/golden-path-autopilot.yaml

一致。

通过gcloud创建：

bash

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel regular \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-dns-access \
  --enable-secret-manager \
  --secret-manager-rotation-interval=120s \
  --scoped-rbs-bindings \
  --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,STORAGE,POD,DEPLOYMENT,STATEFULSET,DAEMONSET,HPA,CADVISOR,KUBELET,DCGM \
  --quiet

通过MCP（
create_cluster
）创建：

json

{
  "parent": "projects/<PROJECT_ID>/locations/<REGION>",
  "cluster": {
    "name": "<CLUSTER_NAME>",
    "autopilot": { "enabled": true },
    "privateClusterConfig": { "enablePrivateNodes": true },
    "masterAuthorizedNetworksConfig": {
      "privateEndpointEnforcementEnabled": true
    },
    "releaseChannel": { "channel": "REGULAR" },
    "secretManagerConfig": {
      "enabled": true,
      "rotationConfig": { "enabled": true, "rotationInterval": "120s" }
    },
    "rbacBindingConfig": {
      "enableInsecureBindingSystemAuthenticated": false,
      "enableInsecureBindingSystemUnauthenticated": false
    }
  }
}

2. Autopilot Dev/Test

2. Autopilot开发/测试环境

Relaxes some golden path defaults for cost savings and easier access in non-production.

bash

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel rapid \
  --quiet

Warning: This does not apply golden path security hardening. Suitable for dev/test only.

放宽部分黄金路径默认设置，以节省成本并方便非生产环境访问。

bash

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel rapid \
  --quiet

警告：此模板未应用黄金路径安全加固措施，仅适用于开发/测试环境。

3. Standard Regional (When Autopilot is Not an Option)

3. Standard区域集群（Autopilot不适用时）

bash

gcloud container clusters create <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --num-nodes 3 \
  --machine-type e2-standard-4 \
  --disk-type pd-balanced \
  --enable-autoscaling --min-nodes 1 --max-nodes 10 \
  --enable-shielded-nodes --enable-secure-boot \
  --workload-pool=<PROJECT_ID>.svc.id.goog \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-vertical-pod-autoscaling \
  --enable-dataplane-v2 \
  --release-channel regular \
  --quiet

bash

gcloud container clusters create <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --num-nodes 3 \
  --machine-type e2-standard-4 \
  --disk-type pd-balanced \
  --enable-autoscaling --min-nodes 1 --max-nodes 10 \
  --enable-shielded-nodes --enable-secure-boot \
  --workload-pool=<PROJECT_ID>.svc.id.goog \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-vertical-pod-autoscaling \
  --enable-dataplane-v2 \
  --release-channel regular \
  --quiet

4. GPU/AI Workloads (Autopilot with ComputeClass)

4. GPU/AI工作负载（带ComputeClass的Autopilot集群）

Create a golden path Autopilot cluster, then apply a ComputeClass for GPU workloads:

bash

undefined

先创建黄金路径Autopilot集群，再为GPU工作负载应用ComputeClass：

bash

undefined

1. Create golden path cluster (same as template 1)

1. 创建黄金路径集群（与模板1相同）

gcloud container clusters create-auto <CLUSTER_NAME>
--region <REGION> --project <PROJECT_ID>
--enable-private-nodes --enable-master-authorized-networks
--enable-dns-access --enable-secret-manager --scoped-rbs-bindings
--quiet

2. Apply GPU ComputeClass (see gke-compute-classes.md)

2. 应用GPU ComputeClass（详见gke-compute-classes.md）

kubectl apply -f gpu-compute-class.yaml

3. Or use GIQ for inference (see gke-inference.md)

3. 或使用GIQ进行推理（详见gke-inference.md）

gcloud container ai profiles manifests create
--model=gemma-2-9b-it --model-server=vllm --accelerator-type=nvidia-l4 --quiet > inference.yaml kubectl apply -f inference.yaml

undefined

gcloud container ai profiles manifests create
--model=gemma-2-9b-it --model-server=vllm --accelerator-type=nvidia-l4 --quiet > inference.yaml kubectl apply -f inference.yaml

undefined

Instructions

注意事项

ALWAYS ask for
```
project_id
```
if not in context
ALWAYS ask for
```
region
```
ALWAYS ask for a unique
```
cluster_name
```
DEFAULT to golden path Autopilot unless customer specifies otherwise
WARN about Day-0 decisions (networking, private nodes) that are hard to change later
WARN about cost for GPU or multi-region clusters
When using MCP
```
create_cluster
```
, the
```
cluster.name
```
should be the short name (e.g.,
```
my-cluster
```
), not the full resource path

务必在上下文未提供时询问
```
project_id
```
务必询问
```
region
```
务必要求提供唯一的
```
cluster_name
```
默认使用黄金路径Autopilot，除非客户另有指定
提醒用户注意难以后续修改的初始决策（如网络配置、私有节点）
提醒GPU或多区域集群的成本
使用MCP的
```
create_cluster
```
时，
```
cluster.name
```
应为短名称（例如
```
my-cluster
```
），而非完整资源路径