GKE Autopilot is a mode of operation for Google Kubernetes Engine clusters that simplifies Kubernetes management by handling the provisioning and management of the underlying infrastructure. The mode removes the need for direct node pool configuration and shifts the operational burden of the data plane to Google Cloud. Terraform provides declarative configuration for this mode through the google_container_cluster resource and through the Terraform Google Kubernetes Engine module variants that expose Autopilot specific networking and beta feature options.

The combination of Autopilot with Workload Identity for secure GCP service access and private networking for security produces a production-ready Kubernetes cluster with minimal operational overhead. Setting this up through Terraform gives reproducible infrastructure that can be version controlled and applied across environments.

GKE Autopilot Mode and Standard Comparison

GKE Autopilot is Google's fully managed Kubernetes offering. Unlike Standard mode where you manage node pools and machine types, Autopilot handles all of that for you. You deploy workloads, and Google figures out the infrastructure.

Users can create a GKE cluster in standard mode or autopilot mode. The GKE standard mode is beneficial if you have a fair amount of experience managing the data plane of a Kubernetes environment and you would like to maintain control of resource consumption. On the other hand, GKE Autopilot provides management of nodes, pre-configuration of clusters, auto-scaling, auto-upgrades and security by Google Cloud so you can focus just on development and not on the underlying infrastructure.

GKE Autopilot provides:

A completely automated Kubernetes platform
Auto health-monitoring, checks, compute calculation, and auto-repair
Efficient per-pod billing

Autopilot helps shift several site reliability engineering responsibilities from your team to Google Cloud’s, specifically for nodes and control planes where they help with cluster provisioning and maintenance.

In Autopilot mode, Google manages the node infrastructure, removing the need to manually configure node pools, while optimizing resource utilization and costs.

The key difference between Autopilot and Standard GKE clusters is that with Autopilot:

Autopilot clusters are enabled in this module using the enable_autopilot = true configuration flag in the google_container_cluster resource.
Google manages node infrastructure, scaling, and security hardening.
Unlike GKE Standard where you manage node pools and VMs, Autopilot abstracts away node management entirely, charging per pod resource request rather than per VM.
It enforces security best practices by default including workload identity, shielded nodes, and container-optimized OS.

Terraform Provider Support and Release History

We are pleased to announce support for Google Kubernetes Engine Autopilot in HashiCorp Terraform. Released in February 2021, GKE Autopilot is a new mode of operation for GKE that automates node configuration and management. GKE Autopilot gives you a hands-off approach to using Kubernetes on Google Cloud by eliminating node management operations and maximizing your cluster efficiency.

In order to use GKE Autopilot, you will need:

A Google Cloud account
A configured gcloud SDK
The Google Cloud Terraform provider version 3.63.0 or higher

Make sure to choose the correct version of the Google Cloud Terraform provider for your cluster: It must be 3.63.0, or later.

GKE Autopilot can be enabled for your Kubernetes cluster by adding the variable enable_autopilot = true to your GKE Terraform configuration.

Enabling Autopilot with googlecontainercluster

Deploy GKE Autopilot with Terraform using the google_container_cluster resource with enable_autopilot set to true.

A representative configuration fragment is:

```
resource "googlecontainercluster" "primary" {
name = "${var.projectid}-gke"
location = var.region
network = googlecomputenetwork.vpc.name
subnetwork = googlecompute_subnetwork.subnet.name

Enabling Autopilot for this cluster

enable_autopilot = true
}
```

Write out a Terraform configuration to provision a GKE Autopilot cluster using google_container_cluser and enable Autopilot for that cluster. Please note that while using Autopilot, you do not have to specify the number of nodes required; they will be automatically calculated for you.

Variable declarations used in the example:

variable "gke_username" { default = "" description = "gke username" }

variable "gke_password" { default = "" description = "gke password" }

Configuration with Autopilot typically pairs the cluster resource with VPC-native networking with secondary IP ranges for pods and services, private cluster settings, a release channel, and workload identity. Use the google-beta provider for features like Gateway API and binary authorization.

Terraform Google Kubernetes Engine Module Autopilot Variants

This page documents the Autopilot cluster functionality within the Terraform Google Kubernetes Engine module. It covers the available Autopilot module variants, their key features, configuration options, and usage patterns.

The Terraform GKE module provides two variants of Autopilot clusters:

beta-autopilot-private-cluster
Creates a private Autopilot cluster with the control plane isolated from the public internet
beta-autopilot-public-cluster
Creates a standard Autopilot cluster with publicly accessible endpoints

Both modules support beta features of GKE through the google-beta provider, allowing access to the latest capabilities that may not yet be generally available.

Sources for the module implementation are referenced as modules/beta-autopilot-private-cluster/cluster.tf22-23 modules/beta-autopilot-public-cluster/cluster.tf22-23 modules/beta-autopilot-private-cluster/cluster.tf158 modules/beta-autopilot-public-cluster/cluster.tf158.

Private Versus Public Autopilot Networking Variables

The primary difference between private and public Autopilot clusters is the networking configuration and variable availability.

Variable	Private Module	Public Module	Default Value
enableprivateendpoint	✓	✗	false
enableprivatenodes	✓	✗	true
masteripv4cidr_block	✓	✗	null
privateendpointsubnetwork	✓	✗	null
masterglobalaccess_enabled	✓	✗	true

The private variant exposes controls for isolating the control plane from the public internet. enable_private_endpoint allows creation of a private endpoint for the control plane. enable_private_nodes controls node private IP assignment. master_ipv4_cidr_block defines the CIDR for the master. private_endpoint_subnetwork specifies the subnetwork for private endpoints. master_global_access_enabled controls global access to the master.

The public variant creates a standard Autopilot cluster with publicly accessible endpoints and does not expose those private networking variables.

Workload Identity, Private Networking and Production Hardening

GKE Autopilot is Google's fully managed Kubernetes offering. Combined with Workload Identity for secure GCP service access and private networking for security, you get a production-ready Kubernetes cluster with minimal operational overhead.

Deploy GKE Autopilot with Terraform using the google_container_cluster resource with enable_autopilot set to true. Configure VPC-native networking with secondary IP ranges for pods and services, private cluster settings, a release channel, and workload identity. Use the google-beta provider for features like Gateway API and binary authorization.

Workload Identity is enforced as a security best practice by default in Autopilot. The mode also enforces shielded nodes and container-optimized OS by default.

Operational Characteristics, Automation and SLAs

GKE Autopilot is now active and providing automated node management, improved utilization, security, and reduced cost of maintenance. Users can leverage Google Cloud’s SRE tooling to maintain their nodes and pods.

In the automation page, you can adjust the maintenance window after cluster creation.

Google Cloud offers a 99.95% SLA for the control plane of its GKE Autopilot clusters, and a 99.9% SLA for GKE Autopilot pods, while reducing the overall operational load required for managing clusters.

Auto health-monitoring, checks, compute calculation, and auto-repair are provided as part of the completely automated Kubernetes platform. Per-pod billing replaces per-VM billing, which changes cost modeling for teams.

Fleet Management and Cost Allocation

Use GKE Fleet to manage multiple Autopilot clusters across environments and regions. Fleet enables centralized policy management, multi-cluster services, and consistent configuration through Config Sync with GitOps patterns.

Monitor costs with GKE cost allocation. Enable cost allocation in the GKE cluster settings to attribute compute costs to individual namespaces and workloads. Integrate with Cloud Billing export to BigQuery for detailed cost analytics and chargeback reporting.

Frequently Asked Questions

What is GKE Autopilot and how does it differ from GKE Standard?

GKE Autopilot is a fully managed Kubernetes mode where Google manages the node infrastructure, scaling, and security hardening. Unlike GKE Standard where you manage node pools and VMs, Autopilot abstracts away node management entirely, charging per pod resource request rather than per VM. It enforces security best practices by default including workload identity, shielded nodes, and container-optimized OS.

How do I deploy GKE Autopilot with Terraform?

Conclusion

Terraform integration with GKE Autopilot converts a managed Kubernetes mode into declarative, repeatable infrastructure. The enable_autopilot = true flag on google_container_cluster eliminates node pool authoring, while the beta-autopilot-private-cluster and beta-autopilot-public-cluster module variants expose the networking distinctions that matter for production isolation. Private clusters gain control plane isolation through enable_private_endpoint, enable_private_nodes, master_ipv4_cidr_block, private_endpoint_subnetwork, and master_global_access_enabled, variables absent from the public variant.

Workload Identity, private networking, VPC-native secondary ranges, release channels, and the google-beta provider for Gateway API and binary authorization combine to produce a hardened baseline that aligns with Autopilot’s default enforcement of shielded nodes and container-optimized OS. The operational model shifts SRE responsibilities for nodes and control planes to Google Cloud, with auto health-monitoring, auto-repair, auto-scaling, and auto-upgrades reducing maintenance burden. The 99.95% control plane SLA and 99.9% pod SLA provide measurable reliability targets, while per-pod billing changes cost attribution compared with Standard mode.

Provider version 3.63.0 or higher is required, and the February 2021 Terraform support announcement established the foundation for ongoing feature parity. Fleet enables multi-cluster policy and Config Sync with GitOps patterns across environments, while cost allocation with Cloud Billing export to BigQuery supports namespace and workload level chargeback. Together these capabilities allow teams to treat GKE Autopilot as a fully automated, secure, and financially observable platform delivered through Terraform.

Terraform Google Kubernetes Engine Autopilot Module Variants and Workload Identity Configuration