# How to Manage GKE Storage and Networking: A Production-Ready Guide > Master GKE storage and networking with VPC-native clusters and Dataplane V2. Utilize managed CSI drivers for persistent and object storage to build secure, production-ready applications. - Repository: [Google/skills](https://github.com/google/skills) - Tags: how-to-guide - Published: 2026-09-05 --- **Manage GKE storage and networking by deploying VPC-native private clusters with Dataplane V2 for zero-trust security, while utilizing managed CSI drivers—including Compute Engine PD, Filestore, and GCS FUSE—through standardized StorageClasses for persistent and object storage workloads.** According to the `google/skills` repository, production-ready GKE environments follow a **golden path** configuration that unifies private networking architecture with automated storage provisioning. This approach eliminates manual CIDR planning while providing built-in network policies and flexible persistent volume options for enterprise workloads. ## GKE Networking: The Golden Path Configuration The networking implementation defined in [`skills/cloud/gke-networking/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-networking/SKILL.md) establishes secure defaults for VPC-native clusters. This configuration prioritizes private node architecture and eBPF-based network policies to minimize attack surfaces while simplifying operations. ### Private Cluster Architecture Enable **private nodes** and **private control-plane endpoints** to ensure nodes have no public IP addresses and the Kubernetes API is accessible only within the VPC. According to the source code, the golden path requires four critical settings: - **`privateClusterConfig.enablePrivateNodes`**: Set to `true` to remove public IPs from nodes, reducing the attack surface. - **`masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled`**: Set to `true` to restrict control plane access to private endpoints only. - **`networkConfig.datapathProvider`**: Use `ADVANCED_DATAPATH` to enable **Dataplane V2**, which provides eBPF-based network policy enforcement without additional agents. - **`networkConfig.enableIntraNodeVisibility`**: Enable VPC Flow Logs for intra-node traffic monitoring. Additionally, **`ipAllocationPolicy.autoIpamConfig.enabled`** should be set to `true` to automatically manage IP ranges, eliminating manual CIDR planning and preventing IP exhaustion during scaling. The golden path automatically provisions dedicated subnets with `/17` for pods and `/20` for services. ### Cluster Access Methods When running private clusters, developers can connect via three distinct methods as documented in [`skills/cloud/gke-networking/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-networking/SKILL.md): 1. **DNS endpoint**: The default method reachable from any internet location when `allowExternalTraffic: true` is configured. Retrieve credentials using: ```bash gcloud container clusters get-credentials {cluster_name} \ --region {region} --dns-endpoint --quiet ``` 2. **Private endpoint**: Accessible only within the VPC or through Cloud VPN/Interconnect, providing maximum isolation for regulated environments. 3. **Authorized networks**: A whitelist of CIDR blocks that grants additional IP-based access control to the control plane for bastion host or on-premises connectivity. ## GKE Storage: CSI Drivers and StorageClasses The storage architecture documented in [`skills/cloud/gke-storage/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-storage/SKILL.md) bundles default Container Storage Interface (CSI) drivers that GKE Autopilot enables out-of-the-box. These drivers provide multiple access patterns for different workload requirements without manual driver installation. ### Default Storage Drivers GKE supports four primary CSI drivers for persistent storage: - **Compute Engine Persistent Disk (PD)**: Block storage with `ReadWriteOnce` access, ideal for databases and single-pod workloads requiring high IOPS. - **Filestore**: NFS-compatible storage with `ReadWriteMany` access for multi-pod shared file systems. - **Cloud Storage FUSE**: Mount GCS buckets directly as volumes supporting `ReadWriteMany` and `ReadOnlyMany` access modes for object storage integration. - **Parallelstore**: High-performance parallel file system with `ReadWriteMany` access for compute-intensive HPC applications. ### Standard StorageClasses GKE provides four default StorageClasses that map to specific disk types as defined in [`skills/cloud/gke-storage/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-storage/SKILL.md): - **`standard-rwo`**: Uses `pd-standard` disks for cost-effective, low-IOPS workloads. - **`premium-rwo`**: Uses `pd-ssd` disks for high-IOPS database workloads requiring consistent latency. - **`standard-rwx`**: Uses Filestore Basic HDD for shared NFS storage across multiple nodes. - **`premium-rwx`**: Uses Filestore Basic SSD for higher-performance shared storage workloads. ### Custom StorageClasses for Regional Replication For workloads requiring high availability across zones, define custom StorageClasses with regional replication and volume expansion capabilities. As shown in [`skills/cloud/gke-storage/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-storage/SKILL.md), the following configuration creates a regional SSD storage class: ```yaml apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: fast-regional provisioner: pd.csi.storage.gke.io parameters: type: pd-ssd replication-type: regional-pd # Replicate across 2 zones volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true ``` The **`allowVolumeExpansion: true`** setting enables online volume resizing, while `WaitForFirstConsumer` ensures pods schedule before volume creation to optimize zonal placement and reduce cross-zone traffic costs. ## Implementing Persistent Storage Workloads Deploying storage in GKE requires selecting the appropriate access mode and driver for your specific use case. ### Block Storage with Compute Engine PD For single-pod databases requiring high-performance block storage, create a `ReadWriteOnce` PVC using the `premium-rwo` StorageClass: ```yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: database-pvc spec: accessModes: - ReadWriteOnce storageClassName: premium-rwo resources: requests: storage: 100Gi ``` ### Shared File Storage with Filestore For workloads requiring multiple pods to access the same filesystem simultaneously, use Filestore with `ReadWriteMany` access: ```yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: shared-data spec: accessModes: - ReadWriteMany storageClassName: standard-rwx resources: requests: storage: 1Ti # Minimum for Basic Filestore tier ``` ### Object Storage with GCS FUSE Mount Google Cloud Storage buckets directly into pods without provisioning PVCs using the GCS FUSE CSI driver. As documented in [`skills/cloud/gke-storage/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-storage/SKILL.md), annotate pods to enable the sidecar injector: ```yaml apiVersion: v1 kind: Pod metadata: name: gcs-reader annotations: gke-gcsfuse/volumes: "true" spec: containers: - name: reader image: busybox command: ["ls", "/data"] volumeMounts: - name: gcs-bucket mountPath: /data volumes: - name: gcs-bucket csi: driver: gcsfuse.csi.storage.gke.io readOnly: true volumeAttributes: bucketName: ``` **Important**: The pod must use a Kubernetes service account bound to a Google service account with `roles/storage.objectViewer` permissions so the CSI driver can authenticate to the bucket. ### Volume Expansion When `allowVolumeExpansion: true` is configured on a StorageClass, expand existing PVCs without downtime using: ```bash kubectl patch pvc database-pvc -p '{"spec":{"resources":{"requests":{"storage":"400Gi"}}}}' ``` This command triggers the CSI driver to resize the underlying disk while the workload continues running. ## Integrated Deployment Workflow Combine networking and storage configurations to deploy production-ready GKE environments. According to the `google/skills` source code, the workflow involves creating a private Autopilot cluster, applying custom StorageClasses, and provisioning workloads. First, create a private, VPC-native Autopilot cluster with the golden-path flags: ```bash gcloud container clusters create-auto my-gke \ --region us-central1 \ --enable-private-nodes \ --enable-master-authorized-networks \ --network my-vpc \ --subnetwork my-subnet \ --enable-ip-alias \ --enable-dataplane-v2 \ --quiet ``` Next, apply the custom regional StorageClass: ```yaml apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: fast-regional provisioner: pd.csi.storage.gke.io parameters: type: pd-ssd replication-type: regional-pd volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true ``` Then provision a PersistentVolumeClaim for a stateful database: ```yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: db-pvc spec: accessModes: - ReadWriteOnce storageClassName: fast-regional resources: requests: storage: 200Gi ``` For data pipeline workloads, mount a GCS bucket directly: ```yaml apiVersion: v1 kind: Pod metadata: name: training-data annotations: gke-gcsfuse/volumes: "true" spec: containers: - name: trainer image: gcr.io/my-project/trainer:latest command: ["python", "train.py", "--data", "/mnt/data"] volumeMounts: - name: gcs-bucket mountPath: /mnt/data volumes: - name: gcs-bucket csi: driver: gcsfuse.csi.storage.gke.io readOnly: false volumeAttributes: bucketName: my-ml-dataset ``` ## Summary - **Private cluster architecture**: Enable `enablePrivateNodes` and Dataplane V2 (`ADVANCED_DATAPATH`) in [`skills/cloud/gke-networking/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-networking/SKILL.md) to eliminate public IPs and enforce eBPF-based network policies. - **Automatic IP management**: Configure `autoIpamConfig.enabled` to automatically allocate `/17` for pods and `/20` for services, preventing manual CIDR planning. - **Storage driver selection**: Use **Compute Engine PD** for `ReadWriteOnce` databases, **Filestore** for `ReadWriteMany` shared storage, and **GCS FUSE** for object storage integration. - **Default StorageClasses**: Leverage `premium-rwo` for high-IOPS block storage and `standard-rwx` for shared NFS workloads. - **Volume expansion**: Set `allowVolumeExpansion: true` on StorageClasses to resize PVCs online with `kubectl patch`. - **Secure access**: Connect to private clusters via DNS endpoints, private endpoints, or authorized networks as defined in the golden path configuration. ## Frequently Asked Questions ### What is the GKE golden path for networking? The GKE golden path is a prescriptive configuration defined in [`skills/cloud/gke-networking/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-networking/SKILL.md) that enables private nodes, private control-plane endpoints, Dataplane V2 for network policies, and automatic IPAM. This configuration minimizes the attack surface by ensuring nodes have no public IPs and the Kubernetes API is accessible only via private endpoints or authorized networks. ### How do I choose between Compute Engine PD and Filestore? Choose **Compute Engine PD** for single-pod workloads requiring high-performance block storage with `ReadWriteOnce` access, such as databases analyzed in [`skills/cloud/gke-storage/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-storage/SKILL.md). Select **Filestore** when multiple pods need simultaneous read-write access to the same filesystem (`ReadWriteMany`), such as shared content management systems or distributed training checkpoints. ### Can I expand existing PVCs in GKE? Yes, if the StorageClass defines `allowVolumeExpansion: true`, you can expand PVCs without downtime using `kubectl patch pvc -p '{"spec":{"resources":{"requests":{"storage":""}}}}'`. This capability is available for both Compute Engine PD and Filestore volumes as documented in the storage skill file. ### How do I securely access a private GKE cluster? Secure access methods are documented in [`skills/cloud/gke-networking/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-networking/SKILL.md) and include: (1) **DNS endpoints** for internet-based access with authentication, (2) **Private endpoints** restricted to VPC or VPN/Interconnect connectivity, and (3) **Authorized networks** specifying whitelisted CIDR blocks. Use `gcloud container clusters get-credentials` with the `--dns-endpoint` flag for programmatic access to private clusters.