gke-networking

已同步 v1.0.0 授權: Apache-2.0 來源: google/skills/skills/cloud/gke-networking 提交: 99c871e 收錄的最新變更: 2026-09-21

Plans, configures, and manages core GKE cluster networking. Covers private clusters, VPC-native configurations, DNS, node egress, Dataplane V2, and IP planning. Use when designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges, or managing VPC- native cluster modes. Don't use for application ingress, load balancing, or service networking (use gke-service-networking instead).

摘要

用途: 為 GKE 建立以私有叢集和 VPC 原生模式為基礎的網路基準，並說明叢集位址配置、DNS、對外流量及網路政策如何配合。
使用時機: 當你需要比較私有控制平面的存取方式、規劃 Pod 與 Service 位址範圍、整合既有 VPC 或子網路，或設計對外流量與叢集內流量控管時使用。
輸出結果: 提供建議的網路設定、叢集存取方式與指令、IP 範圍規劃指引，以及對外連線和網路政策的設定選項。

上游變更（6 筆，最新收錄 2026-09-21）

becc4b8 2026-09-21 Enforce semantic versioning (MAJOR.MINOR.PATCH) for skills. 在 GKE 網路技能的中繼資料中新增了 1.0.0 版。

6aa329d 2026-07-23 Add gke-workload-security and rename gke-security to gke-platform-security 將 Network Policy 說明中有關預設拒絕原則的參照，從 `gke-security` 更新為 `gke-workload-security`。

48378f5 2026-07-23 Rescope gke-networking and add gke-service-networking. Refined evaluation benchmarks for both skills. 將技能重新聚焦於核心叢集網路，移除入口與服務網路相關內容，並擴充 VPC 原生模式及輸出流量說明。

4ce85f5 2026-07-14 Update GKE skills to clarify Autopilot defaults, VPC-Native benefits, and Backup for GKE best practices: - gke-cluster-creation: Add warning and operational details when deviating to GKE Standard mode. - gke-networking: Document benefits of VPC-Native mode (scalability, direct VPC integration, avoiding IP exhaustion). - gke-golden-path: Update defaults table to include loggingConfig. - gke-backup-dr: Add best practices for stateful backups (quiescing, CSI snapshots, service terminology). 新增 VPC 原生模式的效益章節，涵蓋擴充性、直接 VPC 整合及降低 IP 耗盡風險。

c75b500 2026-06-24 Restructure the YAML frontmatter in all SKILL.md files to nest the 'category' field under the 'metadata:' block. The 'category' field is used to organize the skills in the README.md 將 Networking 類別欄位移至技能 YAML 前置資料的 `metadata` 區塊中。

5d9d054 2026-06-23 Refactor GKE basic skill into individual skills 新增 GKE 網路技能文件，涵蓋私有叢集預設設定與存取、VPC/IP 規劃、入口與輸出流量、網路原則、Cloud Armor、SSL 及 PSC。

npx skills add "lettucebo/Skills#v2.2.0@gke-networking" --full-depth

⚠ v2.2.0 發布後即可使用

GKE Networking

This reference covers networking configuration for GKE clusters. The golden path enforces private, VPC-native clusters with Dataplane V2.

MCP Tools: get_cluster, update_cluster, apply_k8s_manifest, get_k8s_resource

Golden Path Networking Defaults

Setting	Golden Path Value	Day-0/1	Notes
`privateClusterConfig.enablePrivateNodes`	`true`	Day-0	Nodes have no public IPs
`masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled`	`true`	Day-0	Control plane only reachable via private endpoint or DNS
`controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic`	`true`	Day-0	Allows DNS-based access from outside VPC
`networkConfig.datapathProvider`	`ADVANCED_DATAPATH` (Dataplane V2)	Day-0	eBPF-based, built-in Network Policy
`networkConfig.dnsConfig.clusterDns`	`CLOUD_DNS`	Day-0	Managed DNS, more reliable than kube-dns
`networkConfig.enableIntraNodeVisibility`	`true`	Day-1	VPC Flow Logs for intra-node traffic
`ipAllocationPolicy.autoIpamConfig.enabled`	`true`	Day-0	Automatic IP range management
`ipAllocationPolicy.createSubnetwork`	`true`	Day-0	Auto-create dedicated subnet
`defaultMaxPodsConstraint.maxPodsPerNode`	`48`	Day-0	Conservative default; 110 for high density

Private Cluster Access Patterns

The golden path creates a private cluster. Users access it via:

DNS endpoint (default): allowExternalTraffic: true enables access via the cluster's DNS endpoint from outside the VPC. No VPN required.
Private endpoint: Direct access from within the VPC or via Cloud VPN/Interconnect.
Authorized networks: Add specific CIDRs to masterAuthorizedNetworksConfig for IP-based access control.

# Access private cluster via DNS endpoint (golden path default)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --dns-endpoint \
  --quiet

# Access via private endpoint (from within VPC)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --internal-ip \
  --quiet

Bring-Your-Own VPC/Subnet

If the customer has existing network infrastructure:

gcloud container clusters create-auto {cluster_name} \
  --region {region} \
  --network {vpc_name} \
  --subnetwork {subnet_name} \
  --cluster-secondary-range-name {pod_range} \
  --services-secondary-range-name {svc_range} \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet

Day-0 Warning: VPC, subnet, and IP ranges cannot be changed after cluster creation.

VPC-Native Mode Benefits

VPC-native clusters route traffic natively using GCP Alias IP ranges. Key benefits to cover:

Scalability: Traffic routes natively inside the VPC, bypassing the need for custom routes and avoiding custom route limit bottlenecks.
Direct VPC Integration: Direct resource integration across GCP networks without complex bridging or routing tunnels.
Avoiding IP Exhaustion: Supports discontiguous IP ranges and optimizes allocation, reducing the risk of exhausting subnet IP ranges.

IP Planning

Resource	Golden Path	Notes
Pod CIDR	`/17` (auto)	~32K pod IPs; size based on maxPodsPerNode
Service CIDR	`/20` (auto)	~4K service IPs
Node subnet	auto-created	/20 recommended for growth
Max pods/node	48	Each node gets a /25 pod range; set to 110
: : : for /24 per node :

Pod CIDR sizing rule of thumb:

maxPodsPerNode=48 -> each node uses a /25 (128 IPs) from pod CIDR
maxPodsPerNode=110 -> each node uses a /24 (256 IPs) from pod CIDR
Larger maxPodsPerNode = fewer nodes fit in a given CIDR

Egress

Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs) to allow private nodes to reach the internet without public IP exposure.
For static egress IPs: configure Cloud NAT with manual IP allocation to maintain a consistent source IP for external allowlists or partner firewalls.
For restricted egress: route through a firewall appliance via custom routes to inspect and filter outbound traffic according to organization security policies.

Network Policy

Dataplane V2 (golden path) provides built-in Network Policy enforcement — no additional addon needed. Apply default-deny per namespace, then allow specific flows.

See the gke-workload-security skill for default-deny policy and the gke-multitenancy skill for per-team allow policies.