Self-Managed Kubernetes to Google GKE Blueprint
Move a self-managed Kubernetes cluster to GKE Standard or Autopilot to shed control-plane and node toil. Provision with Terraform, re-point GitOps, adapt networking, storage, and identity to GCP, and cut over stateful data with parallel-run validation.
What and Why
This blueprint moves workloads from a self-managed Kubernetes cluster to Google Kubernetes Engine (GKE). With GKE Standard, Google runs the control plane and you manage nodes; with GKE Autopilot, Google manages nodes too and you pay per pod. Either way you keep your manifests, Helm charts, and GitOps, while shedding upgrade and etcd toil.
Phases
Assessment. Inventory add-ons (CNI, ingress, storage, DNS), CRDs and operators, RBAC, and persistent volumes. Decide Standard versus Autopilot based on whether you need privileged DaemonSets or custom node configuration (which Autopilot restricts).
GKE provisioning. Create the cluster with Terraform. Configure VPC-native networking, Workload Identity (the GKE equivalent of pod IAM), the GKE ingress or Gateway API, Persistent Disk/Filestore CSI drivers, and pod security standards. For Autopilot, validate workload compatibility first.
Workload migration. Re-point Argo CD at GKE and sync. Adapt LoadBalancer services and storage classes to GCP equivalents and move secrets to Secret Manager via Workload Identity.
Data cutover. Replicate stateful data to Persistent Disk, Filestore, or Cloud SQL, then switch DNS to the GKE ingress in a short window, running clusters in parallel during validation.
Decommission. After soak, drain and remove the self-managed cluster.
Key Risks and Mitigations
- Autopilot restrictions may block privileged workloads. Confirm compatibility or use Standard.
- Networking and storage differences. Test ingress, services, and PVCs early.
- Identity model shift to Workload Identity. Map service accounts deliberately.
- Skills gap. Lean on managed defaults and reference architectures.
Recommended Tooling
Terraform for the cluster, Argo CD for GitOps, the GKE Gateway API and CSI drivers, Secret Manager with Workload Identity, and Google Cloud Managed Service for Prometheus with Grafana.
Success Metrics
Track reduced control-plane and node operational toil, availability through cutover, deployment frequency, and mean time to recovery.
Prerequisites
Workloads on Kubernetes with manifests in Git, a Google Cloud project and VPC, a GitOps controller, and a data replication plan for stateful services.