Google Kubernetes Engine to STACKIT Kubernetes Engine

A regional GKE cluster and node pool, converted

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "google_container_cluster" "platform" {
  name                     = "platform"
  location                 = "europe-west3"
  network                  = google_compute_network.platform.id
  subnetwork               = google_compute_subnetwork.gke.id
  min_master_version       = "1.32"
  remove_default_node_pool = true
  initial_node_count       = 1
  deletion_protection      = true

  release_channel {
    channel = "REGULAR"
  }

  workload_identity_config {
    workload_pool = "shop-platform-prod.svc.id.goog"
  }
}

resource "google_container_node_pool" "general" {
  name     = "general"
  cluster  = google_container_cluster.platform.id
  location = "europe-west3"

  autoscaling {
    min_node_count = 1
    max_node_count = 5
  }

  node_config {
    machine_type    = "e2-standard-8"
    disk_size_gb    = 100
    service_account = google_service_account.nodes.email
    oauth_scopes    = ["https://www.googleapis.com/auth/cloud-platform"]
  }
}

resource "stackit_ske_cluster" "platform" {
  project_id = var.project_id
  name       = "platform"
  node_pools = [{
    name               = "general"
    machine_type       = var.general_machine_type
    minimum            = var.platform_general_minimum
    maximum            = var.platform_general_maximum
    availability_zones = var.availability_zones
  }]
  kubernetes_version_min = "1.36"
  lifecycle {
    prevent_destroy = true
  }
}

• Per-zone autoscaling made explicit

  GKE counts min_node_count and max_node_count per zone; SKE counts the whole pool. The code copies neither number as if it were the same and asks you for the pool totals in two variables.

• Version checked against SKE

  The source asks for Kubernetes 1.32. SKE in eu01 supports 1.35 and newer, so the code asks for 1.36 and flags the four minor versions it crosses, so you check removed APIs first.

• Destroy protection kept

  deletion_protection becomes lifecycle prevent_destroy on the SKE cluster: Terraform refuses to destroy it, as the Google provider refused to delete the protected cluster.

• Release channel

  SKE has no release channels. Automatic Kubernetes updates are a maintenance setting of the cluster, switched on by default.

The node service account, converted

From the same run. Left: the input. Right: the resource blocks StackToIT wrote; the review comments above each block in the file are left out here.

resource "google_service_account" "nodes" {
  account_id   = "gke-nodes"
  display_name = "GKE node service account"
}

resource "stackit_service_account" "nodes" {
  project_id = var.project_id
  name       = "gke-nodes"
}

• A STACKIT service account

  gke-nodes becomes a STACKIT service account of the same name. Its role bindings become STACKIT role assignments on the project or on resources.

• Node settings named

  An SKE node pool takes no service account or OAuth scopes. The code lists the disk size, the service account and the scopes of the pool as not carried.

• Machine type from the source size

  The machine type variable records e2-standard-8 at about 8 vCPU and 32 GiB, next to the link to the STACKIT machine types.

What changes around the workloads

• Workload Identity

  GKE Workload Identity gives way to Workload Identity on SKE: a STACKIT service account with a federated identity provider that trusts the service account issuer of the SKE cluster, created for each Kubernetes service account.

• Network placement

  An SKE cluster joins a STACKIT Network Area network, or SKE creates a network for the cluster itself. The run asks which one, because it depends on how your STACKIT projects are laid out.

• Storage and ingress

  Persistent-disk storage classes and GCE ingress are replaced by their SKE counterparts.

How the GKE estate maps

Classes as the run decided them. The subnetwork keeps 10.40.0.0/20 as the prefix of its STACKIT network.

Questions platform teams ask

Sources

• Google Cloud Docs: GKE overview
• STACKIT Docs: Kubernetes Engine (SKE)