SkillOfficialCurated by metahubEval warningsdevops

gke-basics

Name: gke-basics
Author: google

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, configuring Workload Identity, or deciding between Autopilot and Standard modes. Don't use for specialized GKE networking (use gke-networking), advanced security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

pinned to #092e210updated 2 days ago

7/11Verified publisherCurated by MetaHubActively maintainedLicensedDocumentedStructuredClean repo

Ask your AI client: “install skills/gke-basics”.

Requires the metahub MCP server installed in your client. Set up MCP.

mh install skills/gke-basics

metahub onboarded this repo on the author's behalf.

If you own github.com/google/skills on GitHub, claim the listing to take over publishing. Your claim preserves the existing eval history and badges; only the curator label is replaced with verified-publisher on your next publish.

Claim this repo

Stars

16,869

Last commit

2 days ago

092e210

Latest release

published

2 days ago

#google
#googlecloud
#skills

About this skill

Pulled from SKILL.md at publish time.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Evaluation report

Warnings

Automated checks the publisher passed at publish time — structure, docs, safety, and whether the artifact behaves as claimed.092e210· 2 days ago

Documentation

7 passed2 warnings

Homepage or repository declaredwarn
No homepage or repository declared.
Add a "homepage" or "repository" field to SKILL.md.
Documentation shows usagewarn
Documentation has no code examples.
Add at least one fenced example showing a real invocation.
Description quality
51 words · 437 chars — "Manages core GKE cluster provisioning, credentials, Autopilot vs Standard select…"
README is present and substantial
11,950 chars · 7 sections · 1 code block
Tags / topics declared
3 total — google, googlecloud, skills
README has usage / example sections
found: Installation
Homepage / docs URL declared
no homepage declared (registry will use the repo URL) — info-only, not blocking
Description is substantive
Description is 51 words.
Documentation present and substantive
Documentation present (SKILL.md, 430 words).

Release history

releasecurrent092e210warn2 days ago

View on GitHub

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

Default to Autopilot for almost all workloads.
Use Standard ONLY if:
- Custom node OS kernel parameters (sysctl) are required.
- Custom node taints or specific hardware node pools are required.
- DaemonSets require raw hostPath mounts to the host OS filesystem.
When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

Private Autopilot Clusters:
- Use --enable-private-nodes for private node IP addresses.
- Use --enable-private-endpoint to disable public IP access to the control plane.
- Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
```
gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK
```
Workload Identity (IAM Binding):
- Never mount raw GCP Service Account JSON keys in Pods.
- Annotate the Kubernetes ServiceAccount (KSA) to bind to the Google Service Account (GSA):
```
metadata:
  annotations:
    iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com
```
Autopilot Resource Requests:
- In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
- Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.
Cluster Credentials:
- Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
```
gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet
```

Reference Directory

Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.
CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.
Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.
MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.
Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

Reviews

No reviews yet. Be the first.

Skill

Verification Before Completion

Evidence before assertions, always

#f2cbfbeActiveCode Review, Testing & QualityMIT+6

obra

253,04922,600Shell

verificationqualityworkflow

Skill

Writing Plans

Turn specs into phased implementation plans

#f2cbfbeActiveProductivity & WorkflowsMIT+5

obra

253,04922,600Shell

planningarchitectureworkflow

Skill

Test-Driven Development

Red → green → refactor discipline for any feature or bugfix

#f2cbfbeActiveCode Review, Testing & QualityMIT+6

obra

253,04922,600Shell

tddtestingworkflow+1

mh install skills/gke-basics

gke-basics

pinned to #092e210updated 2 days ago

7/11Verified publisherCurated by MetaHubActively maintainedLicensedDocumentedStructuredClean repo

Key Selection Rules: Autopilot vs. Standard

Default to Autopilot for almost all workloads.

Use Standard ONLY if:

Custom node OS kernel parameters (sysctl) are required.
Custom node taints or specific hardware node pools are required.
DaemonSets require raw hostPath mounts to the host OS filesystem.

When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).

For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

Private Autopilot Clusters:

Use --enable-private-nodes for private node IP addresses.
Use --enable-private-endpoint to disable public IP access to the control plane.

Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:

gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK

Workload Identity (IAM Binding):

Never mount raw GCP Service Account JSON keys in Pods.

Annotate the Kubernetes ServiceAccount (KSA) to bind to the Google Service Account (GSA):

metadata:
  annotations:
    iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

Autopilot Resource Requests:

In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.

Cluster Credentials:

Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
```
gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet
```

Reference Directory

Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.

Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

gke-basics

About this skill

Evaluation report

Documentation

Release history

Contents

Key Selection Rules: Autopilot vs. Standard

Critical Gotchas & Best Practices

Reference Directory

Reviews

Related

Verification Before Completion

Writing Plans

Test-Driven Development

gke-basics

About this skill

Evaluation report

Documentation

Release history

Contents

Key Selection Rules: Autopilot vs. Standard

Critical Gotchas & Best Practices

Reference Directory

Reviews

Related

Verification Before Completion

Writing Plans

Test-Driven Development