← worklog

2025-05-01

Bootstrapping a GKE platform for shared GitLab CI runners

GKETerraformGCPWorkload IdentityGitLab CI

Background

The team needed a dedicated GKE cluster to host shared GitLab CI/CD runners across the organization. Up until this point everything was running on AWS EKS, so this was also our first production GCP workload.

What I built

  • GKE cluster in europe-west3 provisioned entirely with Terraform
  • Node Auto Provisioning for cluster autoscaling
  • Workload Identity for pod-level GCP authentication (no static keys)
  • External Secrets Operator pulling secrets from GCP Secret Manager
  • IAP-based jump host for secure cluster access without a public endpoint
  • Grafana alerting via Rocket.Chat webhooks

What I learned

Workload Identity on GKE is cleaner than IRSA on EKS in some ways — the annotation-based binding is straightforward once you understand the GSA/KSA relationship. Node Auto Provisioning took some tuning to get the right machine family profiles defined.

What I'd do differently

Set up the jump host IAP tunnel earlier in the process — debugging without kubectl access is painful.