本文へ移動
cccskills
無料GitHub で公開

gke-golden-path

Provides GKE golden path configuration defaults, production readiness checklists, and cluster default patterns. Use when designing GKE clusters, verifying GKE production readiness, or checking configurations against GKE defaults. Don't use for setting up workload autoscaling specifically (use gke-workload-scaling instead).

インストール方法を見る

含まれるファイル(2)

  • SKILL.md8.4 KB
  • assets/golden-path-autopilot.yaml4.7 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

GKE Golden Path Configuration

The golden path is the recommended Autopilot configuration for production clusters. It defines sensible defaults — when the user requests different settings, apply them and note relevant trade-offs. For setting up autoscaling specifically, use gke-cluster-autoscaler for node autoscaling or gke-workload-scaling for workload autoscaling (HPA/VPA).

MCP Tools: get_cluster, create_cluster, update_cluster

Rules

  1. Default to the golden path. Use golden path values unless the user requests otherwise. When deviating, note trade-offs but respect the user's choice.
  2. Day-0 vs Day-1. Flag Day-0 decisions (networking, private nodes, subnets, IP allocation) prominently — they are hard/impossible to change after creation.
  3. Tool preference: MCP > gcloud > kubectl. MCP is preferred as it directly interfaces with GKE APIs with structured data, reducing shell syntax errors and parsing ambiguities. See the gke-basics skill's CLI reference for full coverage matrix and override options. If the user says "use gcloud" or "use kubectl", respect that for the session.
  4. Document decisions and rationale, especially for Day-0 choices and golden path deviations.

Required Inputs

If the user is unsure, use golden path defaults.

  • Project ID (required)
  • Region (required, e.g., us-central1)
  • Cluster name (required)
  • Environment type: dev/test or production (defaults to production)
  • Networking: bring-your-own VPC/subnet or auto-create (default: auto-create)
  • Scale expectations: expected node/pod count, workload types
  • Cost constraints: Spot VM tolerance, budget considerations

Always-Apply Defaults

Recommended best practices applied by default. If the user requests a different setting, apply it and briefly note the security or operational trade-off.

SettingGolden Path Value
autopilot.enabledtrue
privateClusterConfig.enablePrivateNodestrue
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabledtrue
secretManagerConfig.enabled + rotationInterval: 120strue
rbacBindingConfig.enableInsecureBinding*false (both)
workloadIdentityConfig.workloadPoolenabled
networkConfig.datapathProviderADVANCED_DATAPATH
networkConfig.dnsConfig.clusterDnsCLOUD_DNS
autoscaling.autoscalingProfileOPTIMIZE_UTILIZATION
verticalPodAutoscaling.enabledtrue
monitoringConfig componentsSYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER
loggingConfig componentsSYSTEM_COMPONENTS, WORKLOADS (enabled by default)
advancedDatapathObservabilityConfig.enableMetricstrue
nodeConfig.shieldedInstanceConfig.enableSecureBoottrue
nodeConfig.workloadMetadataConfig.modeGKE_METADATA
nodeConfig.gcfsConfig.enabled / gvnic.enabledtrue / true
addonsConfig.statefulHaConfig.enabledtrue
Storage CSI drivers (Filestore, GCS FUSE, Parallelstore)enabled
Pod Security Standardsrestricted on production namespaces

Customer-Configurable Settings

These have golden path defaults but customers may deviate with valid justification. Ask before changing.

SettingDefaultWhy Deviate
dnsEndpointConfig.allowExternalTraffictrueRestrict if cluster only accessed from within VPC
autoIpamConfig / createSubnetworktrue / trueCustomer has pre-existing VPC/subnets
maxPodsPerNode48 (this golden path's choice)Halves per-node IP consumption (/25 instead of /24). Not a GKE default (Standard defaults to 110, Autopilot to 32); raise for high pod-density at the cost of more CIDR space
subnetworkauto-createdCustomer brings existing subnets
Release channel + maintenance windowsREGULAR channel with a recurring maintenance windowAdd targeted maintenance exclusions (keep under ~6 months) only for critical freezes — see the gke-upgrades skill
nodeConfig.bootDisk.diskTypepd-balancedpd-ssd for I/O-intensive, pd-standard for cost

Note: Autopilot selects node machine types automatically (e.g., ek-standard-8 may appear in describe output); the machine type is not customer-configurable in Autopilot. Steer workload placement via ComputeClasses instead.

Guardrails

  • Do not request or output secrets (tokens, keys, service account JSON).
  • Resolve project/cluster context from the conversation, MCP tools, or gcloud config get-value project; ask the user only if it cannot be resolved.
  • For Day-0 decisions, always ask clarifying questions before proceeding.
  • For Day-1 features, propose golden path defaults with trade-offs and let the customer confirm.
  • Do not promise zero downtime — see Upgrade Disruption below for what to advise instead.
  • When auditing existing clusters, compare against golden path and report deviations with severity and remediation.

Upgrade Disruption

Never promise zero downtime for node upgrades, on any configuration. Node upgrades cordon and drain nodes, which evicts Pods. Draining honors PodDisruptionBudgets and terminationGracePeriodSeconds for up to one hour, after which GKE forcefully evicts the remaining Pods so the upgrade can proceed. A PDB narrows the window; it cannot veto the upgrade. Say so plainly rather than implying the disruption can be eliminated.

What to recommend, all four — not a subset:

  • PodDisruptionBudgets with minAvailable set so eviction cannot take the last healthy replica. A PDB that can never be satisfied stalls the drain for an hour and then loses anyway.

  • At least 2 replicas, spread across zones with topology spread constraints. A single-replica Deployment has downtime by definition.

  • Readiness probes that reflect real serving health, so traffic drains before the Pod dies.

  • Surge upgrade settings on the node pool. Surge is the default strategy; the default is maxSurge=1, maxUnavailable=0 — one extra node is created and made ready before an old one is drained.

    SettingControlsDefault
    maxSurgeAdditional nodes added per zone during the upgrade1
    maxUnavailableNodes simultaneously unavailable per zone0

    Nodes upgraded at once is the sum of the two, capped at 20 (Autopilot) and 100 (Standard). Multi-zone node pools upgrade one zone at a time. Raising maxUnavailable trades availability for speed; raising maxSurge trades cost for availability.

Caveat: externalTrafficPolicy: Local does not work with parallel node drains, so it constrains aggressive surge configurations.

For rollback procedures and maintenance windows, see the gke-upgrades skill.

Golden Path Config

See golden-path-autopilot.yaml for the full cluster-level policy settings.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments.

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a specific model is deployable (`gcloud ai model-garden models list-deployment-config`), query deployment cost, troubleshoot deployment errors (like quota limits), or undeploy/clean up endpoints. Also use when copying and deploying a 1P Tuned Model. Don't use for pure listing/discovery questions of the form "is X deployed?", "list my endpoints", or "which regions have models running?" — for those use `agent-platform-endpoint-management`. Don't use for running model evaluations (use `agent-platform-eval-flywheel` skill).

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serving endpoints for model deployment on Agent Platform. Also use when troubleshooting endpoint permission, quota, or resource busy errors. Don't use for deploying models to endpoints or for running model evaluations.

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when generating synthetic user scenarios, evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on Agent Platform eval methodology — including dataset schema, LLM-as-judge scoring, and common failure causes. For fine-tuning, use agent-platform-tuning. For general production deployment, use agent-platform-deploy.

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global/regional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations.

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

Guides agents and users through migrating from Gemini API in Google AI Studio to Gemini Enterprise Agent Platform (formerly Vertex AI). Use this skill when moving applications to Google Cloud, to leverage Cloud credits, or to unify inferencing with other Cloud infrastructure (IAM, billing, telemetry).

日本語の概要は準備中です。原文の説明を表示しています。

google/skills2.1万2026年10月10日 更新

google のスキルをすべて見る

このスキルの問題を報告する