gke-service-networking

Files (10)

• SKILL.md
• backendconfig.yaml · assets/
• gateway-https.yaml · assets/
• gateway.yaml · assets/
• httproute-traffic-split.yaml · assets/
• httproute.yaml · assets/
• ingress.yaml · assets/
• managed-certificate.yaml · assets/
• service-attachment.yaml · assets/
• attribution.md · references/

SKILL.md (first lines)

# GKE Service Networking Skill

This skill provides workflows for exposing applications running on GKE securely
to the internet or internal networks.

Deployable manifest templates live in `assets/` — edit the `# Replace ...`
placeholders before applying.

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:gke-service-networking)"`
and append `agent-skills/1.0 (skill:gke-service-networking)` to `User-Agent` headers.

## Workflows

### 1. Configure Gateway API (Recommended)

The Gateway API is the modern way to manage routing in Kubernetes.

**Prerequisites**: Gateway API must be enabled on the cluster (enabled by
default on new clusters running GKE 1.26+; on older supported versions enable it
with `--gateway-api=standard`).

**Templates:**

-   `assets/gateway.yaml` — external Gateway using the
    `gke-l7-global-external-managed` GatewayClass with an HTTP listener.
-   `assets/httproute.yaml` — HTTPRoute attaching to the Gateway via
    `parentRefs` and routing a path prefix to a Service `backendRef`.
-   `assets/httproute-traffic-split.yaml` — HTTPRoute demonstrating weighted
    traffic splitting (e.g. 90/10) for canary deployments across backend
    services.

```bash
kubectl apply -f assets/gateway.yaml
kubectl apply -f assets/httproute.yaml
```

**Traffic Splitting (Canary Deployments):**

HTTPRoute supports weighted traffic splitting across multiple backend Services
for canary rollouts:

```yaml
spec:
  rules:
    - backendRefs:
        - name: app-v1
          port: 80
          weight: 90
        - name: app-v2
          port: 80
          weight: 10
```

### 2. Configure Standard GKE Ingress

Use standard Ingress for simpler use cases or legacy setups.

**Template:** `assets/ingress.yaml` — GCE Ingress (`kubernetes.io/ingress.class:
"gce"` annotation) routing to a Service.

### 3. Secure with Cloud Armor

Cloud Armor provides WAF and DDoS protection.

1.  Create a Security Policy in Cloud Armor:

    ```bash
    gcloud compute security-policies create {security_policy_name} \
      --description "WAF policy for {app_name}"

    # Example rule: block an abusive IP range
    gcloud compute security-policies rules create 1000 \
      --security-policy {security_policy_name} \
      --action deny-403 \
      --src-ip-ranges "203.0.113.0/24" \
      --description "Block abusive range"
    ```

2.  Reference it in a `BackendConfig`: `assets/backendconfig.yaml` (sets
    `spec.securityPolicy.name`).

3.  Associate the `BackendConfig` with your `Service` via annotations:

    ```yaml
    # In your Kubernetes Service manifest metadata.annotations:
    cloud.google.com/backend-config: '{"default": "{backend_config_name}"}'
    # Or for specific port mappings:
    cloud.google.com/backend-config: '{"ports": {"80": "{backend_config_name}"}}'
    ```

### 4. Configure Google-Managed SSL Certificates

Automatically provision and renew SSL certificates.

**Legacy Ingress approach:** apply `assets/managed-certificate.yaml` (a
`ManagedCertificate` listing your domains), then reference it in the Ingress
annotations:

```yaml
networking.gke.io/managed-certificates: {certificate_name}
```

**Gateway API approach:** for standard Certificate Manager integration, create a
`CertificateMap` and reference it in the Gateway metadata annotations using the
exact annotation `networking.gke.io/certmap` (spelled without any hyphens in
`certmap`):

```yaml
metadata:
  annotations:
    networking.gke.io/certmap: {certificate_map_name}
```

From google/skills, Apache-2.0.

More from google/skills