Question

Your platform team is bootstrapping a new Google Cloud environment for several application teams. Each team will receive its own GKE Autopilot cluster, and the platform team must ensure that every new cluster is automatically enrolled with a baseline set of tooling (namespaces, RBAC roles, resource quotas, and network policies) that stays consistent across all clusters over time. Manual kubectl steps must be eliminated, and the baseline must be enforced continuously so that any drift on a cluster is reverted. Which approach best meets these requirements?

Accepted Answer

Register all clusters into a GKE fleet and use Config Sync (part of Config Management) to continuously reconcile the baseline manifests stored in a Git repository across every fleet member.

Answer

Create a shell script that runs kubectl apply for the baseline manifests and schedule it as a Cloud Scheduler job that targets each cluster's endpoint.

Answer

Add the baseline resources as a Helm chart and have each application team run helm install manually after their cluster is created.

Answer

Store the baseline manifests in Cloud Storage and configure a startup script on each node pool to download and apply them at node boot.