gke-deployer

gke-deployer

Deploy an ADK 2.0 agent to GKE (standard or Autopilot). Use when you need finer control than Cloud Run gives — sidecars, GPUs, persistent volumes, custom networking.

When GKE over Cloud Run

Need	GKE	Cloud Run
GPU for local model inference	yes	limited
Sidecars (proxies, agents)	easy	not supported
StatefulSets, persistent volumes	yes	no
Long-running streaming connections	yes	yes (with limits)
Min ops overhead	no	yes

Manifests

deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: adk-agent
  labels: { app: adk-agent }
spec:
  replicas: 2
  selector: { matchLabels: { app: adk-agent } }
  template:
    metadata:
      labels: { app: adk-agent }
    spec:
      serviceAccountName: adk-agent-sa
      containers:
      - name: agent
        image: gcr.io/$PROJECT/adk-agent:latest
        ports: [{ containerPort: 8080 }]
        env:
        - name: GOOGLE_GENAI_USE_VERTEXAI
          value: "true"
        - name: GOOGLE_CLOUD_PROJECT
          valueFrom: { configMapKeyRef: { name: adk-config, key: project } }
        - name: GOOGLE_CLOUD_LOCATION
          valueFrom: { configMapKeyRef: { name: adk-config, key: location } }
        resources:
          requests: { cpu: "500m", memory: "1Gi" }
          limits:   { cpu: "2",    memory: "2Gi" }
        readinessProbe:
          httpGet: { path: /health, port: 8080 }
          initialDelaySeconds: 5
        livenessProbe:
          httpGet: { path: /health, port: 8080 }
          initialDelaySeconds: 30

service.yaml:

apiVersion: v1
kind: Service
metadata: { name: adk-agent, labels: { app: adk-agent } }
spec:
  type: ClusterIP
  selector: { app: adk-agent }
  ports: [{ port: 80, targetPort: 8080 }]

hpa.yaml:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: adk-agent }
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: adk-agent }
  minReplicas: 2
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target: { type: Utilization, averageUtilization: 60 }

Workload Identity (Vertex auth)

PROJECT=my-project
NAMESPACE=default
KSA=adk-agent-sa
GSA=adk-agent@$PROJECT.iam.gserviceaccount.com

gcloud iam service-accounts create adk-agent --project=$PROJECT
gcloud projects add-iam-policy-binding $PROJECT \
  --member="serviceAccount:$GSA" --role="roles/aiplatform.user"

kubectl create serviceaccount $KSA
gcloud iam service-accounts add-iam-policy-binding $GSA \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:$PROJECT.svc.id.goog[$NAMESPACE/$KSA]"

kubectl annotate serviceaccount $KSA \
  iam.gke.io/gcp-service-account=$GSA

Roll out

gcloud builds submit --tag gcr.io/$PROJECT/adk-agent:latest
kubectl apply -f deployment.yaml -f service.yaml -f hpa.yaml
kubectl rollout status deployment/adk-agent

Ingress (public exposure)

Use a Gateway or Ingress resource with TLS via google-managed-cert.

Validation

• kubectl get pods — all adk-agent-* Running
• kubectl logs -l app=adk-agent — no auth errors
• HPA scales up under load test
• curl <ingress>/health returns ok over HTTPS

See also

• cloud-run-deployer for simpler serverless option
• agent-runtime-config for tuning ADK runtime params