gke-basics

Synced v1.0.0 License: Apache-2.0 Source: google/skills/skills/cloud/gke-basics Commit: 99c871e Latest included change:

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

Summary

Purpose
Supports core Google Kubernetes Engine cluster setup and operation, including mode selection, credential retrieval, and workload deployment.
When to use
Use it when node-level requirements may rule out Autopilot, or when configuring private-cluster access and Autopilot resource requests.
Outputs
Provides mode-selection guidance, commands for cluster setup and credential retrieval, and workload settings that account for Autopilot constraints.
Upstream changes (22, latest included 2026-09-29)
9ad3d2b Disambiguate GKE skill routing boundaries across gke-basics, gke-storage, gke-inference, gke-reliability, and the GKE security skills (gke-platform-security, gke-workload-security, gke-workload-identity). Clarifies gke-basics routing by sending Workload Identity setup to gke-workload-identity and adding pointers for security, upgrades, and manifest generation.
2996530 Update gke-basics mcp-usage.md with Developer Knowledge MCP server guidance and tool preference hierarchies Bumps the gke-basics skill metadata version from 1.0.0 to 1.1.0.
becc4b8 Enforce semantic versioning (MAJOR.MINOR.PATCH) for skills. Adds version 1.0.0 to the gke-basics metadata.
fdd89e4 Refactor gke-basics skill. Refactors gke-basics into guidance for cluster setup, Autopilot-versus-Standard selection, and core operational gotchas, with links to reference docs.
4b5a7c4 Migrate and validate the gke-workload-troubleshooting skill for GKE workload failure diagnostics. Adds a Workload Troubleshooting routing row with pod-failure trigger examples.
87bc953 Add gke-ai-troubleshooting-jobset-interruption skill Adds a JobSet Interruption routing row with restart, Spot preemption, host error, and worker crash triggers.
c8b3209 Added gke-tpu-metrics-monitoring skill for Google Cloud GKE agents. Adds a TPU Metrics routing row with metric and node-health trigger terms.
f125f29 Migrate and validate the gke-manifest-generation skill for GKE YAML manifest creation and tuning. Adds a Manifest Generation routing row for YAML, templates, probes, and resource limits.
bc3054c Add gke-ai-troubleshooting-handle-disruption-gpu-tpu to equip the troubleshooting agent with the ability to diagnose and remediate unexpected node terminations affecting GPU and TPU workloads on GKE. Adds a GPU/TPU Disruption routing row for termination, shutdown, and host-maintenance cases.
90ac5bb Migrate from kube-agents/agents/platform/skills/gke-productionize Adds production readiness, productionization, scoring, and cluster-audit triggers routing to gke-productionize.
48378f5 Rescope gke-networking and add gke-service-networking. Refined evaluation benchmarks for both skills. Changes the routing table to direct networking and ingress to gke-networking and gke-service-networking, security and IAM to gke-platform-security and gke-workload-security, and autoscaling to gke-workload-scaling.
24de7eb Merged gke-cost into gke-cost-analysis skill and added 5-case evaluation suite. Adds a separate cost-analysis routing row for billing exports, budgets, and live monitoring, and narrows cost-optimization triggers to Spot VMs, rightsizing, and quotas.
7647820 Merged gke-cost into gke-cost-optimization skill and added 5-case evaluation suite. Changes the cost-optimization routing target from gke-cost to gke-cost-optimization.
c75b500 Restructure the YAML frontmatter in all SKILL.md files to nest the 'category' field under the 'metadata:' block. The 'category' field is used to organize the skills in the README.md Moves the Containers category into the skill's metadata block.
5d9d054 Refactor GKE basic skill into individual skills Reworks gke-basics into a routing hub for individual GKE skills, replacing the broad overview and reference directory with a skill-routing table and conceptual-query guidance.
5c249e8 - Fixed CONTRIBUTING.md formatting - Removed metadata from gke-basics/SKILL.md for consistency with other skills Removes the license, author, and version metadata fields from the gke-basics front matter.
626910e Update gcloud examples to use --quiet. Adds --quiet to the three gcloud commands in the gke-basics quick-start example.
6f0b877 Nests cloud/ skills under a top level skills/ directory Renames the skill file from cloud/gke-basics/SKILL.md to skills/cloud/gke-basics/SKILL.md without changing its contents.
9114a94 Flatten skill directories to work with multiple installation tools Moves the skill file from cloud/products/kubernetes-engine/gke-basics/SKILL.md to cloud/gke-basics/SKILL.md without changing its contents.
9b3ff7f No public description Changes the skill heading to Google Kubernetes Engine (GKE) Basics.
1b57cb4 No public description Renames the skill's front-matter name from gke to gke-basics.
d3e3bab No public description Creates the initial GKE skill file with Autopilot setup and deployment commands plus a reference directory mapping common GKE topics to specialized docs.
npx skills add "lettucebo/Skills#v2.2.0@gke-basics" --full-depth

⚠ Available after v2.2.0 is published

GKE Basics & Critical Gotchas

Routing Note: For Workload Identity KSA/GSA setup, open gke-workload-identity/SKILL.md. For cluster security flags (--database-encryption-key, --security-posture, RBAC, Shielded Nodes, Binary Authorization), open gke-platform-security/SKILL.md. For cluster upgrades or maintenance windows, open gke-upgrades/SKILL.md. For generating Kubernetes YAML manifests (Deployment, StatefulSet, Service, HTTPRoute, PodDisruptionBudget), open gke-manifest-generation/SKILL.md.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

  • Default to Autopilot for almost all workloads.
  • Use Standard ONLY if:
    • Custom node OS kernel parameters (sysctl) are required.
    • Custom node taints or specific hardware node pools are required.
    • DaemonSets require raw hostPath mounts to the host OS filesystem.
  • When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
  • For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

  1. Private Autopilot Clusters:

    • Use --enable-private-nodes for private node IP addresses.
    • Use --enable-private-endpoint to disable public IP access to the control plane.
    • Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
      gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK

  2. Workload Identity (IAM Binding):

    • Never mount raw GCP Service Account JSON keys in Pods; open gke-workload-identity/SKILL.md for KSA/GSA setup.

  3. Autopilot Resource Requests:

    • In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
    • Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

  4. Cluster Credentials:

    • Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
      gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet

Reference Directory

  • Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

  • CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

  • Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

  • MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

  • Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

History

v1.0.0 mapping-added 99c871e