gke-basics

devopsgoogle12K installs

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, configuring Workload Identity, or deciding between Autopilot and Standard modes. Don't use for specialized GKE networking (use gke-networking), advanced security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

Install

npx skills add https://github.com/google/skills --skill gke-basics

SKILL.md

---name: gke-basicsmetadata: version: 1.1.1category: Containersdescription: >----

GKE Basics & Critical Gotchas

Routing Note: For Workload Identity KSA/GSA setup, open gke-workload-identity/SKILL.md. For cluster security flags (--database-encryption-key, --security-posture, RBAC, Shielded Nodes, Binary Authorization), open gke-platform-security/SKILL.md. For cluster upgrades or maintenance windows, open gke-upgrades/SKILL.md. For generating Kubernetes YAML manifests (Deployment, StatefulSet, Service, HTTPRoute, PodDisruptionBudget), open gke-manifest-generation/SKILL.md.

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

Key Selection Rules: Autopilot vs. Standard

Default to Autopilot for almost all workloads.
Use Standard ONLY if:
- Custom node OS kernel parameters (sysctl) are required.
- Custom node taints or specific hardware node pools are required.
- DaemonSets require raw hostPath mounts to the host OS filesystem.
When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
For advanced cluster architecture or complex node pool creation planning, refer to gke-cluster-creation.

Critical Gotchas & Best Practices

Private Autopilot Clusters:
- Use --enable-private-nodes for private node IP addresses.
- Use --enable-private-endpoint to disable public IP access to the control plane.
- Restrict control plane access with --enable-master-authorized-networks and --master-authorized-networks=CIDR_BLOCK:
```
gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
  --enable-private-nodes \
  --enable-private-endpoint \
  --enable-master-authorized-networks \
  --master-authorized-networks=CIDR_BLOCK
```
Workload Identity (IAM Binding):
- Never mount raw GCP Service Account JSON keys in Pods; open gke-workload-identity/SKILL.md for KSA/GSA setup.
Autopilot Resource Requests:
- In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
- Resource requests equal limits automatically. Omit limits to allow Autopilot to set defaults matching requests.
Cluster Credentials:
- Always explicitly specify --region (for regional clusters) or --zone (for zonal clusters) when fetching credentials:
```
gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet
```

Reference Directory

Core Concepts: Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.
CLI Usage & Tool Reference: Tool preference hierarchy (MCP vs gcloud vs kubectl), gcloud container commands, and user preference overrides.
Client Libraries: Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.
MCP Usage: Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.
Infrastructure as Code: Terraform examples for google_container_cluster (Autopilot), Kubernetes provider resources, and YAML samples.

Related skills

azure-diagnosticsmicrosoft608KDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, troubleshoot functions, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, a azure-preparemicrosoft608KPrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up az azure-aimicrosoft608KUse for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.azure-deploymicrosoft607KExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\",