gke-basics

已同步 v1.0.0 许可证: Apache-2.0 来源: google/skills/skills/cloud/gke-basics 提交: 99c871e 收录的最新变更:

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

摘要

用途
协助完成 Google Kubernetes Engine 集群的核心设置与操作，包括模式选择、凭证取得及工作负载部署。
使用时机
当节点层级需求可能使 Autopilot 不适用，或需要设置私有集群访问与 Autopilot 资源请求时，请使用此内容。
输出结果
提供模式选择指引、创建集群与取得凭证的指令，以及符合 Autopilot 限制的工作负载设置建议。
上游变更（22 条，最新收录 2026-09-29）
9ad3d2b Disambiguate GKE skill routing boundaries across gke-basics, gke-storage, gke-inference, gke-reliability, and the GKE security skills (gke-platform-security, gke-workload-security, gke-workload-identity). 调整 gke-basics 的导流说明，将 Workload Identity 设置改由 gke-workload-identity 负责，并添加安全性、升级与产生 Manifest 的指引。
2996530 Update gke-basics mcp-usage.md with Developer Knowledge MCP server guidance and tool preference hierarchies 将 gke-basics 技能中继数据的版本从 1.0.0 升至 1.1.0。
becc4b8 Enforce semantic versioning (MAJOR.MINOR.PATCH) for skills. 在 gke-basics 中继数据中添加 1.0.0 版本号。
fdd89e4 Refactor gke-basics skill. 将 gke-basics 重整为集群设置、Autopilot 与 Standard 选择及内核操作注意事项的指引，并加入参考文档链接。
4b5a7c4 Migrate and validate the gke-workload-troubleshooting skill for GKE workload failure diagnostics. 添加 Workload Troubleshooting 导流列，列出 Pod 故障的触发范例。
87bc953 Add gke-ai-troubleshooting-jobset-interruption skill 添加 JobSet Interruption 导流列，列出重新启动、Spot 抢占、主机错误及工作者当机等触发条件。
c8b3209 Added gke-tpu-metrics-monitoring skill for Google Cloud GKE agents. 添加 TPU Metrics 导流列，列出指针与节点健康状况相关的触发词。
f125f29 Migrate and validate the gke-manifest-generation skill for GKE YAML manifest creation and tuning. 添加 Manifest Generation 导流列，涵盖 YAML、范本、探测及资源限制。
bc3054c Add gke-ai-troubleshooting-handle-disruption-gpu-tpu to equip the troubleshooting agent with the ability to diagnose and remediate unexpected node terminations affecting GPU and TPU workloads on GKE. 添加 GPU/TPU Disruption 导流列，涵盖终止、关机及主机维护情况。
90ac5bb Migrate from kube-agents/agents/platform/skills/gke-productionize 添加 production readiness、productionization、评分及集群审核等触发条件，并导向 gke-productionize。
48378f5 Rescope gke-networking and add gke-service-networking. Refined evaluation benchmarks for both skills. 更新导流表，将网络与 Ingress 导向 gke-networking 和 gke-service-networking、安全性与 IAM 导向 gke-platform-security 和 gke-workload-security，并将自动扩缩导向 gke-workload-scaling。
24de7eb Merged gke-cost into gke-cost-analysis skill and added 5-case evaluation suite. 添加帐单导出、预算及实时监控的成本分析导流列，并将成本优化触发条件调整为 Spot VM、资源规格调整及配额。
7647820 Merged gke-cost into gke-cost-optimization skill and added 5-case evaluation suite. 将成本优化的导流目标从 gke-cost 改为 gke-cost-optimization。
c75b500 Restructure the YAML frontmatter in all SKILL.md files to nest the 'category' field under the 'metadata:' block. The 'category' field is used to organize the skills in the README.md 将 Containers 分类移入技能的中继数据区块。
5d9d054 Refactor GKE basic skill into individual skills 将 gke-basics 重整为各 GKE 技能的导流中心，以技能导流表和概念性问题指引取代原本的广泛概述与参考目录。
5c249e8 - Fixed CONTRIBUTING.md formatting - Removed metadata from gke-basics/SKILL.md for consistency with other skills 移除 gke-basics 前置中继数据中的授权、作者及版本字段。
626910e Update gcloud examples to use --quiet. 在 gke-basics 快速入门范例的三个 gcloud 指令中加入 --quiet。
6f0b877 Nests cloud/ skills under a top level skills/ directory 将技能文件从 cloud/gke-basics/SKILL.md 重命名为 skills/cloud/gke-basics/SKILL.md，内容未变。
9114a94 Flatten skill directories to work with multiple installation tools 将技能文件从 cloud/products/kubernetes-engine/gke-basics/SKILL.md 移至 cloud/gke-basics/SKILL.md，内容未变。
9b3ff7f No public description 将技能标题改为 Google Kubernetes Engine (GKE) Basics。
1b57cb4 No public description 将技能前置中继数据中的名称从 gke 改为 gke-basics。
d3e3bab No public description 创建初始 GKE 技能文件，加入 Autopilot 设置与部署指令，以及将常见 GKE 主题对应至专门文档的参考目录。
npx skills add "lettucebo/Skills#v2.2.0@gke-basics" --full-depth

⚠ v2.2.0 发布后即可使用

GKE Basics & Critical Gotchas

Routing Note: For Workload Identity KSA/GSA setup, open gke-workload-identity/SKILL.md. For cluster security flags (--database-encryption-key, --security-posture, RBAC, Shielded Nodes, Binary Authorization), open gke-platform-security/SKILL.md. For cluster upgrades or maintenance windows, open gke-upgrades/SKILL.md. For generating Kubernetes YAML manifests (Deployment, StatefulSet, Service, HTTPRoute, PodDisruptionBudget), open gke-manifest-generation/SKILL.md.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

  • Default to Autopilot for almost all workloads.
  • Use Standard ONLY if:
    • Custom node OS kernel parameters (sysctl) are required.
    • Custom node taints or specific hardware node pools are required.
    • DaemonSets require raw hostPath mounts to the host OS filesystem.
  • When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
  • For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

  1. Private Autopilot Clusters:

    • Use --enable-private-nodes for private node IP addresses.
    • Use --enable-private-endpoint to disable public IP access to the control plane.
    • Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
      gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK

  2. Workload Identity (IAM Binding):

    • Never mount raw GCP Service Account JSON keys in Pods; open gke-workload-identity/SKILL.md for KSA/GSA setup.

  3. Autopilot Resource Requests:

    • In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
    • Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

  4. Cluster Credentials:

    • Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
      gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet

Reference Directory

  • Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

  • CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

  • Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

  • MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

  • Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

历史

v1.0.0 mapping-added 99c871e