gke-productionize

Files (2)

• SKILL.md
• attribution.md · references/

SKILL.md (first lines)

# GKE Productionize Skill

This skill acts as a high-level orchestrator for preparing a GKE cluster and its
workloads for production readiness.

> [!IMPORTANT]
> This is a **meta-skill** or **orchestrator skill**. You are
> expected to invoke and run many other specialized skills listed in this
> document as part of the overall productionization process. Do not attempt to
> implement all production readiness features directly within this skill;
> instead, use this skill to assess the environment and then delegate to the
> specific skills for each domain.

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:gke-productionize)"`
and append `agent-skills/1.0 (skill:gke-productionize)` to `User-Agent` headers.

## Scope

This skill is adaptable to:

-   A single application (already on Kubernetes or not).
-   A set of applications.
-   A target cluster.

## Workflow

### 1. Discovery Phase

Before making recommendations, discover the current state of the environment.

#### Cluster Discovery

Run these commands to understand the cluster setup:

-   Check cluster details: `gcloud container clusters describe {cluster_name}
    --location {location} --project {project}`
-   Check for Autopilot vs Standard: Look for the following block in the
    describe output:

    ```yaml
    autopilot:
      enabled: true
    ```
-   Check release channel: Look for `releaseChannel`.

#### Workload Discovery

If a specific application is targeted, discover its configuration:

-   Get deployment/statefulset details: `kubectl get deployment {app_name} -n
    {namespace} -o yaml`
-   Check for dedicated namespace and labels: `kubectl get namespace {namespace}
    -o yaml` (Look for Pod Security Standards labels).
-   Check for dedicated service account usage: `kubectl get pods -n {namespace}
    -o
    custom-columns="NAME:.metadata.name,SERVICE_ACCOUNT:.spec.serviceAccountName"`
-   Check for resource requests and limits.
-   Check for liveness, readiness, and startup probes.
-   Check for HPA: `kubectl get hpa -n {namespace}`
-   Check for PDB: `kubectl get pdb -n {namespace}`
-   Check for NetworkPolicies: `kubectl get networkpolicy -n {namespace}`

### 2. Production Readiness Assessment

**Before implementation, you MUST run the skills for each relevant specialized
area listed below and incorporate its guidance into your assessment and plan.
Failure to do so will result in a non-compliant production configuration.**

#### A. App Onboarding (Pre-Kubernetes)

If the application is not yet running on GKE, you MUST run the
`gke-app-onboarding` skill for planning containerization, image building, and
basic deployment.

#### B. Scalability & Resource Management

Ensure workloads have appropriate resources and autoscaling.

-   **Action**: You MUST run the `gke-workload-scaling` skill for configuring
    HPA, VPA, and resource limits.

#### C. Observability

Ensure adequate logging and monitoring are in place.

-   **Action**: You MUST run the `gke-observability` skill for setting up Cloud
    Logging, Monitoring, and Managed Prometheus.

#### D. Reliability

Ensure high availability and graceful degradation.

-   **Action**: You MUST run the `gke-reliability` skill for configuring
    regional clusters, PDBs, and health probes.

#### E. Security

Harden the cluster and workloads.

-   **Action**: You MUST run the `gke-platform-security` and
    `gke-workload-security` skills for Workload Identity, Network Policies, and
    Shielded Nodes.
-   **Namespace Isolation**: Ensure workloads run in dedicated namespaces with
    Pod Security Standards (PSS) enforced via labels.
-   **Least Privilege**: Ensure workloads use dedicated ServiceAccounts instead
    of the `default` ServiceAccount.

#### F. Backup & Disaster Recovery

Ensure stateful data is protected.

-   **Action**: You MUST run the `gke-backup-dr` skill for configuring Backup
    for GKE and restore procedures.

From google/skills, Apache-2.0.

More from google/skills