{"meta":{"title":"Deploying to Google Kubernetes Engine","intro":"Learn how to deploy a project to Google Kubernetes Engine (GKE) as part of a continuous deployment (CD) workflow.","product":"GitHub Actions","breadcrumbs":[{"href":"/en/actions","title":"GitHub Actions"},{"href":"/en/actions/how-tos","title":"How-tos"},{"href":"/en/actions/how-tos/deploy","title":"Deploy"},{"href":"/en/actions/how-tos/deploy/deploy-to-third-party-platforms","title":"Deploy to third-party platforms"},{"href":"/en/actions/how-tos/deploy/deploy-to-third-party-platforms/google-kubernetes-engine","title":"Google Kubernetes Engine"}],"documentType":"article"},"body":"# Deploying to Google Kubernetes Engine\n\nLearn how to deploy a project to Google Kubernetes Engine (GKE) as part of a continuous deployment (CD) workflow.\n\n## Prerequisites\n\nBefore you proceed with creating the workflow, you will need to complete the following steps for your Kubernetes project. This guide assumes the root of your project already has a `Dockerfile` and a Kubernetes Deployment configuration file.\n\n### Creating a GKE cluster\n\nTo create the GKE cluster, you will first need to authenticate using the `gcloud` CLI. For more information on this step, see the following articles:\n\n* [`gcloud auth login`](https://cloud.google.com/sdk/gcloud/reference/auth/login)\n* [`gcloud` CLI](https://cloud.google.com/sdk/gcloud/reference)\n* [`gcloud` CLI and Cloud SDK](https://cloud.google.com/sdk/gcloud#the_gcloud_cli_and_cloud_sdk)\n\nFor example:\n\n```shell copy\n$ gcloud container clusters create $GKE_CLUSTER \\\n\t--project=$GKE_PROJECT \\\n\t--zone=$GKE_ZONE\n```\n\n### Enabling the APIs\n\nEnable the Kubernetes Engine and Container Registry APIs. For example:\n\n```shell copy\n$ gcloud services enable \\\n\tcontainerregistry.googleapis.com \\\n\tcontainer.googleapis.com\n```\n\n### Configuring a service account and storing its credentials\n\nThis procedure demonstrates how to create the service account for your GKE integration. It explains how to create the account, add roles to it, retrieve its keys, and store them as a base64-encoded encrypted repository secret named `GKE_SA_KEY`.\n\n1. Create a new service account:\n\n   ```shell copy\n   gcloud iam service-accounts create $SA_NAME\n   ```\n\n2. Retrieve the email address of the service account you just created:\n\n   ```shell copy\n   gcloud iam service-accounts list\n   ```\n\n3. Add roles to the service account.\n\n   > \\[!NOTE]\n   > Apply more restrictive roles to suit your requirements.\n\n   ```shell copy\n   gcloud projects add-iam-policy-binding $GKE_PROJECT \\\n     --member=serviceAccount:$SA_EMAIL \\\n     --role=roles/container.admin\n   gcloud projects add-iam-policy-binding $GKE_PROJECT \\\n     --member=serviceAccount:$SA_EMAIL \\\n     --role=roles/storage.admin\n   gcloud projects add-iam-policy-binding $GKE_PROJECT \\\n     --member=serviceAccount:$SA_EMAIL \\\n     --role=roles/container.clusterViewer\n   ```\n\n4. Download the JSON keyfile for the service account:\n\n   ```shell copy\n   gcloud iam service-accounts keys create key.json --iam-account=$SA_EMAIL\n   ```\n\n5. Store the service account key as a secret named `GKE_SA_KEY`:\n\n   ```shell copy\n   export GKE_SA_KEY=$(cat key.json | base64)\n   ```\n\n   For more information about how to store a secret, see [Using secrets in GitHub Actions](/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets).\n\n### Storing your project name\n\nStore the name of your project as a secret named `GKE_PROJECT`. For more information about how to store a secret, see [Using secrets in GitHub Actions](/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets).\n\n### (Optional) Configuring kustomize\n\nKustomize is an optional tool used for managing YAML specs. After creating a `kustomization` file, the workflow below can be used to dynamically set fields of the image and pipe in the result to `kubectl`. For more information, see [kustomize usage](https://github.com/kubernetes-sigs/kustomize#usage).\n\n### (Optional) Configure a deployment environment\n\nEnvironments are used to describe a general deployment target like `production`, `staging`, or `development`. When a GitHub Actions workflow deploys to an environment, the environment is displayed on the main page of the repository. You can use environments to require approval for a job to proceed, restrict which branches can trigger a workflow, gate deployments with custom deployment protection rules, or limit access to secrets. For more information about creating environments, see [Managing environments for deployment](/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments).\n\n## Creating the workflow\n\nOnce you've completed the prerequisites, you can proceed with creating the workflow.\n\nThe following example workflow demonstrates how to build a container image and push it to GCR. It then uses the Kubernetes tools (such as `kubectl` and `kustomize`) to pull the image into the cluster deployment.\n\nUnder the `env` key, change the value of `GKE_CLUSTER` to the name of your cluster, `GKE_ZONE` to your cluster zone, `DEPLOYMENT_NAME` to the name of your deployment, and `IMAGE` to the name of your image.\n\nIf you configured a deployment environment, change the value of `environment` to be the name of your environment. If you did not configure an environment or if your workflow is in a private repository and you do not use GitHub Enterprise Cloud, delete the `environment` key.\n\n```yaml copy\n# This workflow uses actions that are not certified by GitHub.\n# They are provided by a third-party and are governed by\n# separate terms of service, privacy policy, and support\n# documentation.\n\n# GitHub recommends pinning actions to a commit SHA.\n# To get a newer version, you will need to update the SHA.\n# You can also reference a tag or branch, but the action may change without warning.\n\nname: Build and Deploy to GKE\n\non:\n  push:\n    branches:\n      - main\n\nenv:\n  PROJECT_ID: ${{ secrets.GKE_PROJECT }}\n  GKE_CLUSTER: cluster-1    # Add your cluster name here.\n  GKE_ZONE: us-central1-c   # Add your cluster zone here.\n  DEPLOYMENT_NAME: gke-test # Add your deployment name here.\n  IMAGE: static-site\n\njobs:\n  setup-build-publish-deploy:\n    name: Setup, Build, Publish, and Deploy\n    runs-on: ubuntu-latest\n    environment: production\n\n    steps:\n    - name: Checkout\n      uses: actions/checkout@v6\n\n    # Setup gcloud CLI\n    - uses: google-github-actions/setup-gcloud@1bee7de035d65ec5da40a31f8589e240eba8fde5\n      with:\n        service_account_key: ${{ secrets.GKE_SA_KEY }}\n        project_id: ${{ secrets.GKE_PROJECT }}\n\n    # Configure Docker to use the gcloud command-line tool as a credential\n    # helper for authentication\n    - run: |-\n        gcloud --quiet auth configure-docker\n\n    # Get the GKE credentials so we can deploy to the cluster\n    - uses: google-github-actions/get-gke-credentials@db150f2cc60d1716e61922b832eae71d2a45938f\n      with:\n        cluster_name: ${{ env.GKE_CLUSTER }}\n        location: ${{ env.GKE_ZONE }}\n        credentials: ${{ secrets.GKE_SA_KEY }}\n\n    # Build the Docker image\n    - name: Build\n      run: |-\n        docker build \\\n          --tag \"gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA\" \\\n          --build-arg GITHUB_SHA=\"$GITHUB_SHA\" \\\n          --build-arg GITHUB_REF=\"$GITHUB_REF\" \\\n          .\n\n    # Push the Docker image to Google Container Registry\n    - name: Publish\n      run: |-\n        docker push \"gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA\"\n\n    # Set up kustomize\n    - name: Set up Kustomize\n      run: |-\n        curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64\n        chmod u+x ./kustomize\n\n    # Deploy the Docker image to the GKE cluster\n    - name: Deploy\n      run: |-\n        ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA\n        ./kustomize build . | kubectl apply -f -\n        kubectl rollout status deployment/$DEPLOYMENT_NAME\n        kubectl get services -o wide\n```\n\n## Further reading\n\nFor more information on the tools used in these examples, see the following documentation:\n\n* For the full workflow template, see the [\"Build and Deploy to GKE\" workflow](https://github.com/actions/starter-workflows/blob/main/deployments/google.yml).\n* The Kubernetes YAML customization engine: [Kustomize](https://kustomize.io/).\n* [Deploying a containerized web application](https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app) in the Google Kubernetes Engine documentation."}