gke-basics

已同步 v1.0.0 授權: Apache-2.0 來源: google/skills/skills/cloud/gke-basics 提交: 99c871e 收錄的最新變更:

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

摘要

用途
協助完成 Google Kubernetes Engine 叢集的核心設定與操作，包括模式選擇、憑證取得及工作負載部署。
使用時機
當節點層級需求可能使 Autopilot 不適用，或需要設定私有叢集存取與 Autopilot 資源請求時，請使用此內容。
輸出結果
提供模式選擇指引、建立叢集與取得憑證的指令，以及符合 Autopilot 限制的工作負載設定建議。
上游變更（22 筆，最新收錄 2026-09-29）
9ad3d2b Disambiguate GKE skill routing boundaries across gke-basics, gke-storage, gke-inference, gke-reliability, and the GKE security skills (gke-platform-security, gke-workload-security, gke-workload-identity). 調整 gke-basics 的導流說明，將 Workload Identity 設定改由 gke-workload-identity 負責，並新增安全性、升級與產生 Manifest 的指引。
2996530 Update gke-basics mcp-usage.md with Developer Knowledge MCP server guidance and tool preference hierarchies 將 gke-basics 技能中繼資料的版本從 1.0.0 升至 1.1.0。
becc4b8 Enforce semantic versioning (MAJOR.MINOR.PATCH) for skills. 在 gke-basics 中繼資料中新增 1.0.0 版本號。
fdd89e4 Refactor gke-basics skill. 將 gke-basics 重整為叢集設定、Autopilot 與 Standard 選擇及核心操作注意事項的指引，並加入參考文件連結。
4b5a7c4 Migrate and validate the gke-workload-troubleshooting skill for GKE workload failure diagnostics. 新增 Workload Troubleshooting 導流列，列出 Pod 故障的觸發範例。
87bc953 Add gke-ai-troubleshooting-jobset-interruption skill 新增 JobSet Interruption 導流列，列出重新啟動、Spot 搶占、主機錯誤及工作者當機等觸發條件。
c8b3209 Added gke-tpu-metrics-monitoring skill for Google Cloud GKE agents. 新增 TPU Metrics 導流列，列出指標與節點健康狀況相關的觸發詞。
f125f29 Migrate and validate the gke-manifest-generation skill for GKE YAML manifest creation and tuning. 新增 Manifest Generation 導流列，涵蓋 YAML、範本、探測及資源限制。
bc3054c Add gke-ai-troubleshooting-handle-disruption-gpu-tpu to equip the troubleshooting agent with the ability to diagnose and remediate unexpected node terminations affecting GPU and TPU workloads on GKE. 新增 GPU/TPU Disruption 導流列，涵蓋終止、關機及主機維護情況。
90ac5bb Migrate from kube-agents/agents/platform/skills/gke-productionize 新增 production readiness、productionization、評分及叢集稽核等觸發條件，並導向 gke-productionize。
48378f5 Rescope gke-networking and add gke-service-networking. Refined evaluation benchmarks for both skills. 更新導流表，將網路與 Ingress 導向 gke-networking 和 gke-service-networking、安全性與 IAM 導向 gke-platform-security 和 gke-workload-security，並將自動擴縮導向 gke-workload-scaling。
24de7eb Merged gke-cost into gke-cost-analysis skill and added 5-case evaluation suite. 新增帳單匯出、預算及即時監控的成本分析導流列，並將成本最佳化觸發條件調整為 Spot VM、資源規格調整及配額。
7647820 Merged gke-cost into gke-cost-optimization skill and added 5-case evaluation suite. 將成本最佳化的導流目標從 gke-cost 改為 gke-cost-optimization。
c75b500 Restructure the YAML frontmatter in all SKILL.md files to nest the 'category' field under the 'metadata:' block. The 'category' field is used to organize the skills in the README.md 將 Containers 分類移入技能的中繼資料區塊。
5d9d054 Refactor GKE basic skill into individual skills 將 gke-basics 重整為各 GKE 技能的導流中心，以技能導流表和概念性問題指引取代原本的廣泛概述與參考目錄。
5c249e8 - Fixed CONTRIBUTING.md formatting - Removed metadata from gke-basics/SKILL.md for consistency with other skills 移除 gke-basics 前置中繼資料中的授權、作者及版本欄位。
626910e Update gcloud examples to use --quiet. 在 gke-basics 快速入門範例的三個 gcloud 指令中加入 --quiet。
6f0b877 Nests cloud/ skills under a top level skills/ directory 將技能檔案從 cloud/gke-basics/SKILL.md 重新命名為 skills/cloud/gke-basics/SKILL.md，內容未變。
9114a94 Flatten skill directories to work with multiple installation tools 將技能檔案從 cloud/products/kubernetes-engine/gke-basics/SKILL.md 移至 cloud/gke-basics/SKILL.md，內容未變。
9b3ff7f No public description 將技能標題改為 Google Kubernetes Engine (GKE) Basics。
1b57cb4 No public description 將技能前置中繼資料中的名稱從 gke 改為 gke-basics。
d3e3bab No public description 建立初始 GKE 技能檔案，加入 Autopilot 設定與部署指令，以及將常見 GKE 主題對應至專門文件的參考目錄。
npx skills add "lettucebo/Skills#v2.2.0@gke-basics" --full-depth

⚠ v2.2.0 發布後即可使用

GKE Basics & Critical Gotchas

Routing Note: For Workload Identity KSA/GSA setup, open gke-workload-identity/SKILL.md. For cluster security flags (--database-encryption-key, --security-posture, RBAC, Shielded Nodes, Binary Authorization), open gke-platform-security/SKILL.md. For cluster upgrades or maintenance windows, open gke-upgrades/SKILL.md. For generating Kubernetes YAML manifests (Deployment, StatefulSet, Service, HTTPRoute, PodDisruptionBudget), open gke-manifest-generation/SKILL.md.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

  • Default to Autopilot for almost all workloads.
  • Use Standard ONLY if:
    • Custom node OS kernel parameters (sysctl) are required.
    • Custom node taints or specific hardware node pools are required.
    • DaemonSets require raw hostPath mounts to the host OS filesystem.
  • When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
  • For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

  1. Private Autopilot Clusters:

    • Use --enable-private-nodes for private node IP addresses.
    • Use --enable-private-endpoint to disable public IP access to the control plane.
    • Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
      gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK

  2. Workload Identity (IAM Binding):

    • Never mount raw GCP Service Account JSON keys in Pods; open gke-workload-identity/SKILL.md for KSA/GSA setup.

  3. Autopilot Resource Requests:

    • In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
    • Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

  4. Cluster Credentials:

    • Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
      gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet

Reference Directory

  • Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

  • CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

  • Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

  • MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

  • Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

歷程

v1.0.0 mapping-added 99c871e