How to Manage GKE Storage and Networking: A Production-Ready Guide

Manage GKE storage and networking by deploying VPC-native private clusters with Dataplane V2 for zero-trust security, while utilizing managed CSI drivers—including Compute Engine PD, Filestore, and GCS FUSE—through standardized StorageClasses for persistent and object storage workloads.

According to the google/skills repository, production-ready GKE environments follow a golden path configuration that unifies private networking architecture with automated storage provisioning. This approach eliminates manual CIDR planning while providing built-in network policies and flexible persistent volume options for enterprise workloads.

GKE Networking: The Golden Path Configuration

The networking implementation defined in skills/cloud/gke-networking/SKILL.md establishes secure defaults for VPC-native clusters. This configuration prioritizes private node architecture and eBPF-based network policies to minimize attack surfaces while simplifying operations.

Private Cluster Architecture

Enable private nodes and private control-plane endpoints to ensure nodes have no public IP addresses and the Kubernetes API is accessible only within the VPC. According to the source code, the golden path requires four critical settings:

• privateClusterConfig.enablePrivateNodes: Set to true to remove public IPs from nodes, reducing the attack surface.
• masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled: Set to true to restrict control plane access to private endpoints only.
• networkConfig.datapathProvider: Use ADVANCED_DATAPATH to enable Dataplane V2, which provides eBPF-based network policy enforcement without additional agents.
• networkConfig.enableIntraNodeVisibility: Enable VPC Flow Logs for intra-node traffic monitoring.

Additionally, ipAllocationPolicy.autoIpamConfig.enabled should be set to true to automatically manage IP ranges, eliminating manual CIDR planning and preventing IP exhaustion during scaling. The golden path automatically provisions dedicated subnets with /17 for pods and /20 for services.

Cluster Access Methods

When running private clusters, developers can connect via three distinct methods as documented in skills/cloud/gke-networking/SKILL.md:

1. DNS endpoint: The default method reachable from any internet location when allowExternalTraffic: true is configured. Retrieve credentials using:

   gcloud container clusters get-credentials {cluster_name} \
     --region {region} --dns-endpoint --quiet

2. Private endpoint: Accessible only within the VPC or through Cloud VPN/Interconnect, providing maximum isolation for regulated environments.

3. Authorized networks: A whitelist of CIDR blocks that grants additional IP-based access control to the control plane for bastion host or on-premises connectivity.

GKE Storage: CSI Drivers and StorageClasses

The storage architecture documented in skills/cloud/gke-storage/SKILL.md bundles default Container Storage Interface (CSI) drivers that GKE Autopilot enables out-of-the-box. These drivers provide multiple access patterns for different workload requirements without manual driver installation.

Default Storage Drivers

GKE supports four primary CSI drivers for persistent storage:

• Compute Engine Persistent Disk (PD): Block storage with ReadWriteOnce access, ideal for databases and single-pod workloads requiring high IOPS.
• Filestore: NFS-compatible storage with ReadWriteMany access for multi-pod shared file systems.
• Cloud Storage FUSE: Mount GCS buckets directly as volumes supporting ReadWriteMany and ReadOnlyMany access modes for object storage integration.
• Parallelstore: High-performance parallel file system with ReadWriteMany access for compute-intensive HPC applications.

Standard StorageClasses

GKE provides four default StorageClasses that map to specific disk types as defined in skills/cloud/gke-storage/SKILL.md:

• standard-rwo: Uses pd-standard disks for cost-effective, low-IOPS workloads.
• premium-rwo: Uses pd-ssd disks for high-IOPS database workloads requiring consistent latency.
• standard-rwx: Uses Filestore Basic HDD for shared NFS storage across multiple nodes.
• premium-rwx: Uses Filestore Basic SSD for higher-performance shared storage workloads.

Custom StorageClasses for Regional Replication

For workloads requiring high availability across zones, define custom StorageClasses with regional replication and volume expansion capabilities. As shown in skills/cloud/gke-storage/SKILL.md, the following configuration creates a regional SSD storage class:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-regional
provisioner: pd.csi.storage.gke.io
parameters:
  type: pd-ssd
  replication-type: regional-pd    # Replicate across 2 zones

volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

The allowVolumeExpansion: true setting enables online volume resizing, while WaitForFirstConsumer ensures pods schedule before volume creation to optimize zonal placement and reduce cross-zone traffic costs.

Implementing Persistent Storage Workloads

Deploying storage in GKE requires selecting the appropriate access mode and driver for your specific use case.

Block Storage with Compute Engine PD

For single-pod databases requiring high-performance block storage, create a ReadWriteOnce PVC using the premium-rwo StorageClass:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: database-pvc
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: premium-rwo
  resources:
    requests:
      storage: 100Gi

Shared File Storage with Filestore

For workloads requiring multiple pods to access the same filesystem simultaneously, use Filestore with ReadWriteMany access:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: shared-data
spec:
  accessModes:
  - ReadWriteMany
  storageClassName: standard-rwx
  resources:
    requests:
      storage: 1Ti   # Minimum for Basic Filestore tier

Object Storage with GCS FUSE

Mount Google Cloud Storage buckets directly into pods without provisioning PVCs using the GCS FUSE CSI driver. As documented in skills/cloud/gke-storage/SKILL.md, annotate pods to enable the sidecar injector:

apiVersion: v1
kind: Pod
metadata:
  name: gcs-reader
  annotations:
    gke-gcsfuse/volumes: "true"
spec:
  containers:
  - name: reader
    image: busybox
    command: ["ls", "/data"]
    volumeMounts:
    - name: gcs-bucket
      mountPath: /data
  volumes:
  - name: gcs-bucket
    csi:
      driver: gcsfuse.csi.storage.gke.io
      readOnly: true
      volumeAttributes:
        bucketName: <BUCKET_NAME>

Important: The pod must use a Kubernetes service account bound to a Google service account with roles/storage.objectViewer permissions so the CSI driver can authenticate to the bucket.

Volume Expansion

When allowVolumeExpansion: true is configured on a StorageClass, expand existing PVCs without downtime using:

kubectl patch pvc database-pvc -p '{"spec":{"resources":{"requests":{"storage":"400Gi"}}}}'

This command triggers the CSI driver to resize the underlying disk while the workload continues running.

Integrated Deployment Workflow

Combine networking and storage configurations to deploy production-ready GKE environments. According to the google/skills source code, the workflow involves creating a private Autopilot cluster, applying custom StorageClasses, and provisioning workloads.

First, create a private, VPC-native Autopilot cluster with the golden-path flags:

gcloud container clusters create-auto my-gke \
  --region us-central1 \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --network my-vpc \
  --subnetwork my-subnet \
  --enable-ip-alias \
  --enable-dataplane-v2 \
  --quiet

Next, apply the custom regional StorageClass:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-regional
provisioner: pd.csi.storage.gke.io
parameters:
  type: pd-ssd
  replication-type: regional-pd
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

Then provision a PersistentVolumeClaim for a stateful database:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: db-pvc
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: fast-regional
  resources:
    requests:
      storage: 200Gi

For data pipeline workloads, mount a GCS bucket directly:

apiVersion: v1
kind: Pod
metadata:
  name: training-data
  annotations:
    gke-gcsfuse/volumes: "true"
spec:
  containers:
  - name: trainer
    image: gcr.io/my-project/trainer:latest
    command: ["python", "train.py", "--data", "/mnt/data"]
    volumeMounts:
    - name: gcs-bucket
      mountPath: /mnt/data
  volumes:
  - name: gcs-bucket
    csi:
      driver: gcsfuse.csi.storage.gke.io
      readOnly: false
      volumeAttributes:
        bucketName: my-ml-dataset

Summary

• Private cluster architecture: Enable enablePrivateNodes and Dataplane V2 (ADVANCED_DATAPATH) in skills/cloud/gke-networking/SKILL.md to eliminate public IPs and enforce eBPF-based network policies.
• Automatic IP management: Configure autoIpamConfig.enabled to automatically allocate /17 for pods and /20 for services, preventing manual CIDR planning.
• Storage driver selection: Use Compute Engine PD for ReadWriteOnce databases, Filestore for ReadWriteMany shared storage, and GCS FUSE for object storage integration.
• Default StorageClasses: Leverage premium-rwo for high-IOPS block storage and standard-rwx for shared NFS workloads.
• Volume expansion: Set allowVolumeExpansion: true on StorageClasses to resize PVCs online with kubectl patch.
• Secure access: Connect to private clusters via DNS endpoints, private endpoints, or authorized networks as defined in the golden path configuration.

Frequently Asked Questions

What is the GKE golden path for networking?

The GKE golden path is a prescriptive configuration defined in skills/cloud/gke-networking/SKILL.md that enables private nodes, private control-plane endpoints, Dataplane V2 for network policies, and automatic IPAM. This configuration minimizes the attack surface by ensuring nodes have no public IPs and the Kubernetes API is accessible only via private endpoints or authorized networks.

How do I choose between Compute Engine PD and Filestore?

Choose Compute Engine PD for single-pod workloads requiring high-performance block storage with ReadWriteOnce access, such as databases analyzed in skills/cloud/gke-storage/SKILL.md. Select Filestore when multiple pods need simultaneous read-write access to the same filesystem (ReadWriteMany), such as shared content management systems or distributed training checkpoints.

Can I expand existing PVCs in GKE?

Yes, if the StorageClass defines allowVolumeExpansion: true, you can expand PVCs without downtime using kubectl patch pvc <name> -p '{"spec":{"resources":{"requests":{"storage":"<new-size>"}}}}'. This capability is available for both Compute Engine PD and Filestore volumes as documented in the storage skill file.

How do I securely access a private GKE cluster?

Secure access methods are documented in skills/cloud/gke-networking/SKILL.md and include: (1) DNS endpoints for internet-based access with authentication, (2) Private endpoints restricted to VPC or VPN/Interconnect connectivity, and (3) Authorized networks specifying whitelisted CIDR blocks. Use gcloud container clusters get-credentials with the --dns-endpoint flag for programmatic access to private clusters.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}