gke-cluster-creation

Files (2)

• SKILL.md
• attribution.md · references/

SKILL.md (first lines)

# GKE Cluster Creation

This reference guides creating Google Kubernetes Engine (GKE) clusters by
providing a set of best-practice templates and guiding through mode selection
and customization. The **golden path Autopilot** configuration is the default
for all new clusters.

> **MCP Tools:** `list_clusters`, `create_cluster`, `get_cluster`,
> `list_operations`, `get_operation`

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:gke-cluster-creation)"`
and append `agent-skills/1.0 (skill:gke-cluster-creation)` to `User-Agent` headers.

## Workflow

1.  **Discover context**: Use `list_clusters` to see existing clusters. Use
    `gcloud config get-value project` if project unknown.
2.  **Gather inputs**: `project_id`, `location` (region or zone),
    `cluster_name`, environment type. If missing essential details, ask the user
    before taking action.
3.  **Select mode & explain trade-offs**: If the user hasn't specified a
    template or mode, present the available templates (e.g., Autopilot, Standard
    Regional, GPU Inference, AI Hypercompute) and explain key trade-offs (Cost
    vs. Availability, Autopilot vs. Standard node management).
4.  **Configure networking**: auto-create subnet (default) or bring-your-own.
5.  **Review golden path settings**: present the default configuration block
    (`gcloud` command or `create_cluster` JSON payload) and confirm with the
    user before creation.
6.  **Create**: Use MCP `create_cluster` tool or `gcloud` CLI.
7.  **Track**: Use `get_operation` to monitor creation progress.
8.  **Verify**: Use `get_cluster` with `readMask="*"` to confirm golden path
    settings applied.

## Mode Selection

| Criteria           | Autopilot (Golden Path)   | Standard                  |
| ------------------ | ------------------------- | ------------------------- |
| Node management    | Google-managed            | Self-managed              |
| Pricing            | Pay per pod resource      | Pay per node (VM)         |
:                    : request                   :                           :
| Node customization | Via ComputeClasses        | Full control              |
| DaemonSets         | Allowed (with             | Full control              |
:                    : restrictions)             :                           :
| GPU/TPU            | Supported via             | Supported via node pools  |
:                    : ComputeClasses            :                           :
| Best for           | Most production workloads | Kernel tuning, custom OS, |
:                    :                           : privileged workloads      :

> **Rule**: Default to Autopilot unless the customer has a specific requirement
> that Autopilot cannot satisfy.

## Best Practices

When guiding the user or generating configurations, adhere to these GKE best
practices:

### Security & Networking

1.  **Private Clusters**: Default to private clusters (`enablePrivateNodes:
    true`) with a private control plane and restricted public endpoints
    (`enable-master-authorized-networks`) to minimize attack surface.
2.  **VPC-Native Networking**: Use VPC-native clusters (`useIpAliases: true` /
    `--enable-ip-alias`) to enable alias IP ranges and pod-level firewall rules.
3.  **Workload Identity**: Prefer Workload Identity (`workloadPool:
    <PROJECT_ID>.svc.id.goog`) for securely granting GKE workloads access to
    Google Cloud services instead of static service account keys.
4.  **Shielded GKE Nodes**: Enable Shielded GKE Nodes
    (`--enable-shielded-nodes`, `--enable-secure-boot`) against rootkits and
    bootkits.
5.  **Least Privilege (RBAC)**: Institute strict Role-Based Access Control
    limits (`scoped-rbs-bindings`).

### Cost Optimization

1.  **Autoscaling**: Enable Cluster Autoscaler and Horizontal/Vertical Pod
    Autoscaler (`--enable-autoscaling`, `--enable-vertical-pod-autoscaling`) to
    adjust resources based on demand.
2.  **Right-Sizing & Spot VMs**: Choose appropriate machine types and node
    counts. Consider Spot VMs (`--spot`) for fault-tolerant, non-critical batch
    or inference workloads.

### High Availability & Reliability

1.  **Regional Clusters**: Use Regional Clusters for production environments to
    ensure control plane replication across multiple zones (`--region` instead
    of `--zone`). *Note: Standard regional creates nodes across 3 zones by
    default.*
2.  **Pod Disruption Budgets**: Recommend setting Pod Disruption Budgets for
    application stability during node maintenance.
3.  **Release Channels**: Subscribe to a release channel (`REGULAR` or `STABLE`)
    for automated, safer cluster upgrades.

## Templates

### 1. Golden Path Autopilot (Production)

This is the default. All settings match
`../gke-golden-path/assets/golden-path-autopilot.yaml`.

**Via gcloud:**

```bash
gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel regular \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-dns-access \
  --enable-secret-manager \
  --secret-manager-rotation-interval=120s \
  --scoped-rbs-bindings \
  --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,STORAGE,POD,DEPLOYMENT,STATEFULSET,DAEMONSET,HPA,CADVISOR,KUBELET,DCGM \

From google/skills, Apache-2.0.

More from google/skills