gke-networking

Synced v1.0.0 License: Apache-2.0 Source: google/skills/skills/cloud/gke-networking Commit: 99c871e Latest included change:

Plans, configures, and manages core GKE cluster networking. Covers private clusters, VPC-native configurations, DNS, node egress, Dataplane V2, and IP planning. Use when designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges, or managing VPC- native cluster modes. Don't use for application ingress, load balancing, or service networking (use gke-service-networking instead).

Summary

Purpose
Establishes a private, VPC-native networking baseline for GKE and explains how cluster addressing, DNS, egress, and network policy fit together.
When to use
Use it to compare private control-plane access options, plan pod and service address ranges, integrate an existing VPC or subnet, or design egress and in-cluster traffic controls.
Outputs
It provides recommended network settings, cluster access patterns and commands, IP range planning guidance, and configuration options for egress and network policy.
Upstream changes (6, latest included 2026-09-21)
becc4b8 Enforce semantic versioning (MAJOR.MINOR.PATCH) for skills. Added version 1.0.0 to the GKE networking skill's metadata.
6aa329d Add gke-workload-security and rename gke-security to gke-platform-security Updated the Network Policy note to refer to `gke-workload-security` instead of `gke-security` for default-deny policy.
48378f5 Rescope gke-networking and add gke-service-networking. Refined evaluation benchmarks for both skills. Rescoped the skill to core cluster networking, removing ingress and service-networking material while expanding VPC-native and egress guidance.
4ce85f5 Update GKE skills to clarify Autopilot defaults, VPC-Native benefits, and Backup for GKE best practices: - gke-cluster-creation: Add warning and operational details when deviating to GKE Standard mode. - gke-networking: Document benefits of VPC-Native mode (scalability, direct VPC integration, avoiding IP exhaustion). - gke-golden-path: Update defaults table to include loggingConfig. - gke-backup-dr: Add best practices for stateful backups (quiescing, CSI snapshots, service terminology). Added a VPC-native mode benefits section covering scalability, direct VPC integration, and reduced IP-exhaustion risk.
c75b500 Restructure the YAML frontmatter in all SKILL.md files to nest the 'category' field under the 'metadata:' block. The 'category' field is used to organize the skills in the README.md Moved the Networking category field into the skill frontmatter's `metadata` block.
5d9d054 Refactor GKE basic skill into individual skills Added a GKE networking skill document covering private-cluster defaults and access, VPC/IP planning, ingress and egress, network policy, Cloud Armor, SSL, and PSC.
npx skills add "lettucebo/Skills#v2.2.0@gke-networking" --full-depth

⚠ Available after v2.2.0 is published

GKE Networking

This reference covers networking configuration for GKE clusters. The golden path enforces private, VPC-native clusters with Dataplane V2.

MCP Tools: get_cluster, update_cluster, apply_k8s_manifest, get_k8s_resource

Golden Path Networking Defaults

Setting Golden Path Value Day-0/1 Notes
privateClusterConfig.enablePrivateNodes true Day-0 Nodes have no public IPs
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled true Day-0 Control plane only reachable via private endpoint or DNS
controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic true Day-0 Allows DNS-based access from outside VPC
networkConfig.datapathProvider ADVANCED_DATAPATH (Dataplane V2) Day-0 eBPF-based, built-in Network Policy
networkConfig.dnsConfig.clusterDns CLOUD_DNS Day-0 Managed DNS, more reliable than kube-dns
networkConfig.enableIntraNodeVisibility true Day-1 VPC Flow Logs for intra-node traffic
ipAllocationPolicy.autoIpamConfig.enabled true Day-0 Automatic IP range management
ipAllocationPolicy.createSubnetwork true Day-0 Auto-create dedicated subnet
defaultMaxPodsConstraint.maxPodsPerNode 48 Day-0 Conservative default; 110 for high density

Private Cluster Access Patterns

The golden path creates a private cluster. Users access it via:

  1. DNS endpoint (default): allowExternalTraffic: true enables access via the cluster's DNS endpoint from outside the VPC. No VPN required.
  2. Private endpoint: Direct access from within the VPC or via Cloud VPN/Interconnect.
  3. Authorized networks: Add specific CIDRs to masterAuthorizedNetworksConfig for IP-based access control.
# Access private cluster via DNS endpoint (golden path default)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --dns-endpoint \
  --quiet

# Access via private endpoint (from within VPC)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --internal-ip \
  --quiet

Bring-Your-Own VPC/Subnet

If the customer has existing network infrastructure:

gcloud container clusters create-auto {cluster_name} \
  --region {region} \
  --network {vpc_name} \
  --subnetwork {subnet_name} \
  --cluster-secondary-range-name {pod_range} \
  --services-secondary-range-name {svc_range} \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet

Day-0 Warning: VPC, subnet, and IP ranges cannot be changed after cluster creation.

VPC-Native Mode Benefits

VPC-native clusters route traffic natively using GCP Alias IP ranges. Key benefits to cover:

  1. Scalability: Traffic routes natively inside the VPC, bypassing the need for custom routes and avoiding custom route limit bottlenecks.
  2. Direct VPC Integration: Direct resource integration across GCP networks without complex bridging or routing tunnels.
  3. Avoiding IP Exhaustion: Supports discontiguous IP ranges and optimizes allocation, reducing the risk of exhausting subnet IP ranges.

IP Planning

Resource Golden Path Notes
Pod CIDR /17 (auto) ~32K pod IPs; size based on maxPodsPerNode
Service CIDR /20 (auto) ~4K service IPs
Node subnet auto-created /20 recommended for growth
Max pods/node 48 Each node gets a /25 pod range; set to 110
: : : for /24 per node :

Pod CIDR sizing rule of thumb:

  • maxPodsPerNode=48 -> each node uses a /25 (128 IPs) from pod CIDR
  • maxPodsPerNode=110 -> each node uses a /24 (256 IPs) from pod CIDR
  • Larger maxPodsPerNode = fewer nodes fit in a given CIDR

Egress

  • Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs) to allow private nodes to reach the internet without public IP exposure.
  • For static egress IPs: configure Cloud NAT with manual IP allocation to maintain a consistent source IP for external allowlists or partner firewalls.
  • For restricted egress: route through a firewall appliance via custom routes to inspect and filter outbound traffic according to organization security policies.

Network Policy

Dataplane V2 (golden path) provides built-in Network Policy enforcement — no additional addon needed. Apply default-deny per namespace, then allow specific flows.

See the gke-workload-security skill for default-deny policy and the gke-multitenancy skill for per-team allow policies.

History

v1.0.0 mapping-added 99c871e