Skip to content
GKE Basics & Critical Gotchas

GKE Basics & Critical Gotchas

by Google
Apache-2.0
Repository Docs
markdown Development
google-cloudgkekubernetesautopilotworkload-identity

Summary

Google's official GKE skill — when Autopilot beats Standard, Workload Identity instead of JSON keys, Autopilot's 250m CPU rounding, and private-cluster flags.

Features

  • Autopilot-by-default with the three explicit reasons to pick Standard
  • Workload Identity binding instead of mounted service-account keys
  • Autopilot's 250m CPU increment and requests-equal-limits behaviour
  • Private cluster and master-authorised-network flags in full
  • Explicit hand-off to the specialised GKE networking, security and upgrade skills

Install This Skill

Add this skill to your favorite AI agent in a few steps.

Any AI agent

This skill is plain instructions — it works with any assistant that accepts custom instructions or system prompts.

  1. Copy the skill content with the button below.
  2. Paste it into your agent's instruction file or system prompt (for example AGENTS.md, .cursorrules, or a custom instructions field).
  3. Ask the agent to apply the skill whenever the task matches.

Skill Content

Markdown Content

Copy this content and use it with your preferred AI agent

---
name: gke-basics
metadata:
  category: Containers
description: >-
  Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection,
  and workload deployment. Use when creating GKE clusters, fetching kubectl credentials,
  configuring Workload Identity, or deciding between Autopilot and Standard modes.
  Don't use for specialized GKE networking (use gke-networking), advanced security hardening
  (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).
---

# GKE Basics & Critical Gotchas

Managed Kubernetes platform on Google Cloud. Defaults to Autopilot mode unless Standard is explicitly required.

## Key Selection Rules: Autopilot vs. Standard

* **Default to Autopilot** for almost all workloads.
* **Use Standard ONLY if:**
  * Custom node OS kernel parameters (`sysctl`) are required.
  * Custom node taints or specific hardware node pools are required.
  * DaemonSets require raw `hostPath` mounts to the host OS filesystem.
* When explaining why Standard is required over Autopilot, explicitly cite all matching restrictions (e.g., custom sysctls and custom node taints).
* *For advanced cluster architecture or complex node pool creation planning, refer to `gke-cluster-creation`.*

## Critical Gotchas & Best Practices

1. **Private Autopilot Clusters:**
   * Use `--enable-private-nodes` for private node IP addresses.
   * Use `--enable-private-endpoint` to disable public IP access to the control plane.
   * Restrict control plane access with `--enable-master-authorized-networks` and `--master-authorized-networks=CIDR_BLOCK`:
     ```bash
     gcloud container clusters create-auto CLUSTER_NAME --region=REGION \
       --enable-private-nodes \
       --enable-private-endpoint \
       --enable-master-authorized-networks \
       --master-authorized-networks=CIDR_BLOCK
     ```

2. **Workload Identity (IAM Binding):**
   * Never mount raw GCP Service Account JSON keys in Pods.
   * Annotate the Kubernetes ServiceAccount (`KSA`) to bind to the Google Service Account (`GSA`):
     ```yaml
     metadata:
       annotations:
         iam.gke.io/gcp-service-account: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com
     ```

3. **Autopilot Resource Requests:**
   * In Autopilot, CPU requests must be specified in increments of 250m (0.25 vCPU). If an unaligned CPU request (e.g., 300m) is requested, round up to the nearest 250m increment (500m / 0.5 vCPU).
   * Resource requests equal limits automatically. Omit `limits` to allow Autopilot to set defaults matching `requests`.

4. **Cluster Credentials:**
   * Always explicitly specify `--region` (for regional clusters) or `--zone` (for zonal clusters) when fetching credentials:
     ```bash
     gcloud container clusters get-credentials CLUSTER_NAME --region=REGION --quiet
     ```

## Reference Directory

-   [Core Concepts](references/core-concepts.md): Architecture, cluster modes (Autopilot vs Standard), networking, scaling, and security model.

-   [CLI Usage & Tool Reference](references/cli-reference.md): Tool preference hierarchy (MCP vs gcloud vs kubectl), `gcloud container` commands, and user preference overrides.

-   [Client Libraries](references/client-library-usage.md): Official Kubernetes and Google Cloud Container client libraries in Python, Go, Node.js, and Java.

-   [MCP Usage](references/mcp-usage.md): Connecting to and using the 23 structured GKE MCP tools for cluster management, K8s resources, and diagnostics.

-   [Infrastructure as Code](references/iac-usage.md): Terraform examples for `google_container_cluster` (Autopilot), Kubernetes provider resources, and YAML samples.

Usage Instructions

Learn how to use this skill with different AI agents.

Generic Instructions

Install from the official Google skills repository:

npx skills add google/skills --skill gke-basics

Example Usage

"Create a private Autopilot cluster in us-central1, wire up Workload Identity for the billing service account, and deploy this manifest."

Description

Most GKE mistakes are made in the first ten minutes: reaching for Standard mode out of habit, mounting a service-account JSON key into a pod, or requesting 300m of CPU on Autopilot and quietly paying for 500m.

This official Google skill is written as a decision guide rather than a tutorial. It defaults to Autopilot and names the only three reasons to choose Standard — custom sysctl kernel parameters, custom node taints or specific hardware node pools, and DaemonSets needing raw hostPath mounts — and asks the agent to cite which one applies. From there it covers private Autopilot clusters (--enable-private-nodes, --enable-private-endpoint, master authorised networks), Workload Identity binding a Kubernetes ServiceAccount to a Google Service Account via annotation, Autopilot's 250m CPU increment rule and its requests-equal-limits behaviour, and always passing --region or --zone when fetching credentials.

It is deliberately scoped: specialised networking, security hardening and upgrades live in sibling skills (gke-networking, gke-platform-security, gke-workload-security, gke-upgrades), so the agent knows when to hand off rather than guess.

Related Skills

Skill: Genkit for JavaScript

by Genkit (Google)

New

The official Genkit skill for Node.js and TypeScript — flows, Dotprompt files, tools and the beta agent API with sessions, interrupts and branching.

Development

Skill: Superpowers

by Jesse Vincent

New

An agentic software-development methodology: composable skills that push a coding agent through spec, plan, TDD and review instead of straight into code.

Development

Skill: SkillHone

by Tencent

New

Tencent's skill-evolution harness: it rewrites a whole skill folder — SKILL.md, scripts and references together — and lands every decision as a real Git issue, PR and wiki entry you can review.

Development

Skill: OpenSearch Launchpad

by OpenSearch Project

New

Take an OpenSearch search application from requirements to a running cluster — BM25, dense and sparse vectors, hybrid retrieval, agentic search and RAG, with relevance evaluation built in.

Development
2 views
Browse all skills →