GKE vs Cloud Run Decision

# Build container image with Cloud Build
gcloud builds submit --tag us-docker.pkg.dev/my-project/my-repo/api:v1.2.3

# Deploy with production settings
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1.2.3 \
  --region=us-central1 \
  --platform=managed \
  --memory=1Gi \
  --cpu=2 \
  --concurrency=100 \
  --min-instances=2 \
  --max-instances=50 \
  --cpu-throttling \
  --service-account=my-api@my-project.iam.gserviceaccount.com \
  --set-env-vars="ENV=production,LOG_LEVEL=info" \
  --set-secrets="DB_PASSWORD=db-password:latest,API_KEY=api-key:latest" \
  --vpc-egress=private-ranges-only \
  --network=prod-vpc \
  --subnet=prod-us-central1 \
  --no-allow-unauthenticated \
  --tag=stable

# Deploy a canary with traffic splitting
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1.3.0 \
  --region=us-central1 \
  --tag=canary \
  --no-traffic

# Send 5% of traffic to the canary
gcloud run services update-traffic my-api \
  --region=us-central1 \
  --to-tags=canary=5

# If canary looks good, promote to 100%
gcloud run services update-traffic my-api \
  --region=us-central1 \
  --to-latest

# Set up a custom domain with managed TLS
gcloud run domain-mappings create \
  --service=my-api \
  --domain=api.example.com \
  --region=us-central1

# cloud-run-service.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: my-api
  annotations:
    run.googleapis.com/launch-stage: BETA
spec:
  template:
    metadata:
      annotations:
        run.googleapis.com/execution-environment: gen2
        autoscaling.knative.dev/minScale: "2"
        autoscaling.knative.dev/maxScale: "50"
    spec:
      serviceAccountName: my-api@my-project.iam.gserviceaccount.com
      containers:
        # Main application container (receives traffic)
        - image: us-docker.pkg.dev/my-project/my-repo/api:v1.2.3
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: "2"
              memory: 1Gi
          env:
            - name: ENV
              value: production
          startupProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 2
            periodSeconds: 3
            failureThreshold: 10
        # OpenTelemetry Collector sidecar
        - image: us-docker.pkg.dev/my-project/my-repo/otel-collector:latest
          resources:
            limits:
              cpu: "0.5"
              memory: 256Mi
          env:
            - name: OTEL_EXPORTER_ENDPOINT
              value: "https://otel.example.com:4317"
        # Cloud SQL Auth Proxy sidecar
        - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.8.0
          args:
            - "--structured-logs"
            - "--port=5432"
            - "my-project:us-central1:my-db"
          resources:
            limits:
              cpu: "0.5"
              memory: 256Mi

# Create a batch processing job
gcloud run jobs create data-pipeline \
  --image=us-docker.pkg.dev/my-project/my-repo/pipeline:v1.0.0 \
  --region=us-central1 \
  --tasks=100 \
  --parallelism=10 \
  --task-timeout=3600 \
  --max-retries=3 \
  --memory=2Gi \
  --cpu=2 \
  --service-account=pipeline@my-project.iam.gserviceaccount.com \
  --set-env-vars="BATCH_SIZE=1000,OUTPUT_BUCKET=gs://my-output"

# Execute the job
gcloud run jobs execute data-pipeline --region=us-central1

# Schedule the job to run nightly
gcloud scheduler jobs create http nightly-pipeline \
  --schedule="0 2 * * *" \
  --time-zone="America/New_York" \
  --uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/my-project/jobs/data-pipeline:run" \
  --http-method=POST \
  --oauth-service-account-email=scheduler@my-project.iam.gserviceaccount.com

# Monitor job executions
gcloud run jobs executions list --job=data-pipeline --region=us-central1

# Create Autopilot cluster with production settings
gcloud container clusters create-auto prod-cluster \
  --region=us-central1 \
  --release-channel=regular \
  --network=prod-vpc \
  --subnetwork=prod-us-central1 \
  --cluster-secondary-range-name=gke-pods \
  --services-secondary-range-name=gke-services \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --master-authorized-networks="10.10.0.0/20" \
  --workload-pool=my-project.svc.id.goog \
  --enable-dns-access \
  --cluster-dns=clouddns \
  --cluster-dns-scope=cluster

# Get credentials
gcloud container clusters get-credentials prod-cluster \
  --region=us-central1

# Deploy a workload
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-api
  namespace: production
  labels:
    app: my-api
    version: v1.2.3
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-api
  template:
    metadata:
      labels:
        app: my-api
        version: v1.2.3
    spec:
      serviceAccountName: my-api-ksa
      containers:
      - name: api
        image: us-docker.pkg.dev/my-project/my-repo/api:v1.2.3
        ports:
        - containerPort: 8080
          name: http
        resources:
          requests:
            cpu: "500m"
            memory: "512Mi"
          limits:
            cpu: "1000m"
            memory: "1Gi"
        env:
        - name: ENV
          value: production
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector:
          matchLabels:
            app: my-api
---
apiVersion: v1
kind: Service
metadata:
  name: my-api
  namespace: production
spec:
  selector:
    app: my-api
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  type: ClusterIP
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-api
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-api
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Pods
        value: 2
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 30
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60
EOF

# Create GKE Standard cluster
gcloud container clusters create prod-standard \
  --region=us-central1 \
  --num-nodes=0 \
  --release-channel=regular \
  --network=prod-vpc \
  --subnetwork=prod-us-central1 \
  --cluster-secondary-range-name=gke-pods \
  --services-secondary-range-name=gke-services \
  --enable-private-nodes \
  --master-ipv4-cidr=172.16.0.0/28 \
  --enable-master-authorized-networks \
  --master-authorized-networks="10.10.0.0/20" \
  --workload-pool=my-project.svc.id.goog \
  --enable-shielded-nodes \
  --enable-image-streaming \
  --logging=SYSTEM,WORKLOAD \
  --monitoring=SYSTEM,WORKLOAD

# General-purpose node pool for web services
gcloud container node-pools create web-pool \
  --cluster=prod-standard \
  --region=us-central1 \
  --machine-type=n2-standard-4 \
  --num-nodes=2 \
  --min-nodes=2 \
  --max-nodes=20 \
  --enable-autoscaling \
  --disk-type=pd-ssd \
  --disk-size=100 \
  --node-labels=workload-type=web \
  --node-taints="" \
  --metadata=disable-legacy-endpoints=true

# Memory-optimized node pool for caching services
gcloud container node-pools create memory-pool \
  --cluster=prod-standard \
  --region=us-central1 \
  --machine-type=n2-highmem-4 \
  --num-nodes=1 \
  --min-nodes=1 \
  --max-nodes=5 \
  --enable-autoscaling \
  --node-labels=workload-type=memory \
  --node-taints="workload-type=memory:NoSchedule"

# GPU node pool for ML inference
gcloud container node-pools create gpu-pool \
  --cluster=prod-standard \
  --region=us-central1 \
  --machine-type=g2-standard-4 \
  --accelerator=type=nvidia-l4,count=1 \
  --num-nodes=0 \
  --min-nodes=0 \
  --max-nodes=10 \
  --enable-autoscaling \
  --node-labels=workload-type=gpu \
  --node-taints="nvidia.com/gpu=present:NoSchedule" \
  --spot

# Spot node pool for batch workloads (70% cheaper)
gcloud container node-pools create batch-pool \
  --cluster=prod-standard \
  --region=us-central1 \
  --machine-type=n2-standard-8 \
  --num-nodes=0 \
  --min-nodes=0 \
  --max-nodes=50 \
  --enable-autoscaling \
  --spot \
  --node-labels=workload-type=batch \
  --node-taints="cloud.google.com/gke-spot=true:NoSchedule"

# Decision Tree for Container Platform Selection
#
# 1. Need persistent volumes / StatefulSets?
#    YES -> GKE
#
# 2. Need Kubernetes CRDs / Operators / Service Mesh?
#    YES -> GKE
#
# 3. Process duration > 60 min (service) or > 24 hr (job)?
#    YES -> GKE
#
# 4. Need multi-GPU or non-L4 GPUs?
#    YES -> GKE Standard
#
# 5. Team < 5 engineers, no K8s expertise?
#    YES -> Cloud Run
#
# 6. Traffic is variable / spiky / has zero periods?
#    YES -> Cloud Run
#
# 7. Monthly compute spend > $500 with steady traffic?
#    YES -> Consider GKE Autopilot
#
# 8. 10+ microservices on shared infrastructure?
#    YES -> GKE Autopilot
#
# 9. Default answer for everything else:
#    -> Cloud Run (simplicity wins)

# Deploy with Direct VPC Egress (recommended)
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1.2.3 \
  --region=us-central1 \
  --network=prod-vpc \
  --subnet=prod-us-central1 \
  --vpc-egress=private-ranges-only

# For services that need to access the internet through Cloud NAT:
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1.2.3 \
  --region=us-central1 \
  --network=prod-vpc \
  --subnet=prod-us-central1 \
  --vpc-egress=all-traffic

# Ingress controls: restrict who can reach your service
gcloud run services update my-api \
  --region=us-central1 \
  --ingress=internal-and-cloud-load-balancing

# Service-to-service authentication (no service mesh needed)
# Calling service gets an identity token automatically:
# curl -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
#   https://target-service-xyz-uc.a.run.app/api/endpoint

# Network Policy for pod-level isolation (not available in Cloud Run)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: my-api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: production
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  - to:  # Allow DNS resolution
    - namespaceSelector: {}
    ports:
    - protocol: UDP
      port: 53

---
# Gateway API for advanced traffic routing
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: my-api-route
  namespace: production
spec:
  parentRefs:
  - name: external-gateway
    namespace: gateway-system
  hostnames:
  - "api.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /v2
    backendRefs:
    - name: my-api-v2
      port: 80
      weight: 90
    - name: my-api-v3-canary
      port: 80
      weight: 10
  - matches:
    - path:
        type: PathPrefix
        value: /v1
    backendRefs:
    - name: my-api-v1
      port: 80

# === Cloud Run Security ===
# Disable public access (require authentication)
gcloud run services update my-api \
  --region=us-central1 \
  --no-allow-unauthenticated \
  --ingress=internal-and-cloud-load-balancing

# Enable Binary Authorization
gcloud run services update my-api \
  --region=us-central1 \
  --binary-authorization=default

# === GKE Security ===
# Enable Workload Identity
gcloud container clusters update prod-cluster \
  --region=us-central1 \
  --workload-pool=my-project.svc.id.goog

# Create and bind service accounts
kubectl create serviceaccount my-api-ksa -n production

gcloud iam service-accounts add-iam-policy-binding \
  my-api@my-project.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:my-project.svc.id.goog[production/my-api-ksa]"

kubectl annotate serviceaccount my-api-ksa \
  -n production \
  iam.gke.io/gcp-service-account=my-api@my-project.iam.gserviceaccount.com

# Enable GKE Sandbox (gVisor) for untrusted workloads
gcloud container node-pools create sandboxed-pool \
  --cluster=prod-cluster \
  --region=us-central1 \
  --sandbox=type=gvisor \
  --machine-type=n2-standard-4 \
  --num-nodes=2

# Enable Binary Authorization on GKE
gcloud container clusters update prod-cluster \
  --region=us-central1 \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE

# View recent logs
gcloud run services logs read my-api \
  --region=us-central1 \
  --limit=100

# View logs filtered by severity
gcloud logging read 'resource.type="cloud_run_revision" AND resource.labels.service_name="my-api" AND severity>=ERROR' \
  --limit=50 \
  --format="table(timestamp, textPayload)"

# Check service metrics
gcloud run services describe my-api \
  --region=us-central1 \
  --format="yaml(status.traffic, status.latestReadyRevisionName)"

# View revision details (instance count, concurrency)
gcloud run revisions list \
  --service=my-api \
  --region=us-central1 \
  --format="table(name, active, serviceAccount, containers.image, scaling)"

# Key Cloud Run metrics to monitor:
# - cloud.run/request_latencies (p50, p95, p99)
# - cloud.run/request_count (by response code)
# - cloud.run/container/instance_count (current instances)
# - cloud.run/container/cpu/utilization
# - cloud.run/container/memory/utilization
# - cloud.run/container/startup_latencies (cold start times)

# Check pod status and events
kubectl get pods -n production -l app=my-api -o wide
kubectl describe pod <pod-name> -n production
kubectl get events -n production --sort-by=.metadata.creationTimestamp

# View pod logs
kubectl logs -n production -l app=my-api --tail=100 -f
kubectl logs -n production <pod-name> -c api --previous  # crashed container

# Debug with ephemeral containers (no need for debug tools in image)
kubectl debug -it <pod-name> -n production \
  --image=busybox:latest --target=api -- sh

# Check resource utilization
kubectl top pods -n production -l app=my-api
kubectl top nodes

# View HPA status
kubectl get hpa -n production my-api -o yaml

# Key GKE metrics to monitor:
# - kubernetes.io/container/cpu/core_usage_time
# - kubernetes.io/container/memory/used_bytes
# - kubernetes.io/container/restart_count
# - kubernetes.io/pod/network/received_bytes_count
# - Kube-state-metrics for deployment/replica status
# - Node-level: CPU/memory/disk utilization per node pool

# cloudbuild.yaml for Cloud Run deployment
steps:
  # Run tests
  - name: 'node:20'
    entrypoint: 'npm'
    args: ['ci']
  - name: 'node:20'
    entrypoint: 'npm'
    args: ['test']

  # Build and push container image
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA'
      - '-t'
      - 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:latest'
      - '.'

  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '--all-tags', 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api']

  # Deploy to Cloud Run with no traffic (canary)
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'run'
      - 'deploy'
      - 'my-api'
      - '--image=us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA'
      - '--region=us-central1'
      - '--tag=canary'
      - '--no-traffic'

  # Send 10% traffic to canary
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'run'
      - 'services'
      - 'update-traffic'
      - 'my-api'
      - '--region=us-central1'
      - '--to-tags=canary=10'

  # Note: Promote to 100% after manual approval or automated health checks

options:
  logging: CLOUD_LOGGING_ONLY
  machineType: 'E2_HIGHCPU_8'

images:
  - 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA'
  - 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:latest'

# Option 1: Cloud Build + kubectl apply
# cloudbuild.yaml for GKE deployment
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA', '.']

  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA']

  # Update the image tag in the Kubernetes manifest
  - name: 'gcr.io/cloud-builders/gke-deploy'
    args:
      - 'run'
      - '--filename=k8s/'
      - '--image=us-docker.pkg.dev/$PROJECT_ID/my-repo/api:$SHORT_SHA'
      - '--cluster=prod-cluster'
      - '--location=us-central1'
      - '--namespace=production'

---
# Option 2: ArgoCD GitOps (recommended for GKE)
# Application manifest for ArgoCD
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-api
  namespace: argocd
spec:
  project: production
  source:
    repoURL: https://github.com/myorg/k8s-manifests.git
    targetRevision: main
    path: apps/my-api/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - ApplyOutOfSyncOnly=true
  # Rolling update strategy configured in the Deployment spec
  # ArgoCD monitors rollout health and can auto-rollback

# Extract key configuration from a Kubernetes Deployment
# and create equivalent Cloud Run deploy command

# Step 1: Get current K8s deployment details
kubectl get deployment my-api -n production -o yaml > k8s-deployment.yaml

# Step 2: Deploy to Cloud Run with equivalent settings
# Map K8s resources -> Cloud Run resources
# Map K8s env vars -> Cloud Run env vars
# Map K8s secrets -> Secret Manager references
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1.2.3 \
  --region=us-central1 \
  --memory=1Gi \
  --cpu=2 \
  --concurrency=100 \
  --min-instances=3 \
  --max-instances=50 \
  --service-account=my-api@my-project.iam.gserviceaccount.com \
  --set-env-vars="ENV=production,LOG_LEVEL=info" \
  --set-secrets="DB_PASSWORD=db-password:latest" \
  --network=prod-vpc \
  --subnet=prod-us-central1 \
  --vpc-egress=private-ranges-only \
  --no-allow-unauthenticated

# Step 3: Test the Cloud Run service
curl -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  https://my-api-xyz-uc.a.run.app/healthz

# Step 4: Update DNS / load balancer to point to Cloud Run
# Step 5: Monitor for 24-48 hours before decommissioning K8s deployment