GKE Cluster Networking Planner
Design private, VPC-native GKE networks with practical IP and egress guidance.
The skill clearly concerns private clusters, network policy, ingress, and egress, but its listed MCP tools include update_cluster and apply_k8s_manifest without documenting least privilege, pre-execution confirmation, data flows, sensitive-data handling, rollback, or recovery. This supports 13/25.
Defaults, gcloud commands, and YAML examples make the happy path understandable. However, there are no version prerequisites, parameter validation, tests, abnormal-input handling, or diagnosable failure messages, and several product behaviors are not verified within the files. Score: 8/20, within the static-review ceiling.
The description clearly targets GKE network design, private clusters, Gateway API, IP planning, and ingress/egress, while excluding basic routing without dedicated network configuration. Inputs, outputs, non-fit boundaries, semantic trigger details, Chinese support, and mainland-China reachability are not sufficiently specified. Score: 10/15.
The skill is readable and organized progressively around defaults, access patterns, IP planning, ingress, egress, and security. The README supplies installation, support, active-development, and contribution information, and the repository states Apache-2.0 licensing. The skill lacks its own version, changelog, named maintainer, dependency versions, FAQ, explicit limitations, and detailed post-install configuration notes. Score: 8/15.
It covers common GKE networking tasks and offers reusable commands, Gateway, BackendConfig, and sizing examples that can support core planning. Static files contain no execution evidence or tests; examples depend on environment-specific prerequisites and network changes require substantial review. Score: 7/15, constrained by static calibration.
The fixed revision, official organization provenance, README, license, and inspectable configuration examples provide some traceability. The skill has no official-document citations, committed test suite, CI coverage, or independent corroboration, so key claims cannot be independently reproduced from the supplied files. Score: 3/10.
- Before executing update_cluster or apply_k8s_manifest, confirm the target cluster, change scope, required permissions, impact, and rollback plan.
- Private clusters, DNS endpoints, Cloud NAT, IP ranges, and Gateway settings may depend on GKE version, region, existing VPC design, and organization policy; golden-path defaults should not be treated as universally applicable.
- The files do not address mainland-China reachability or Chinese-language operation. Validate access to Google Cloud control-plane and supporting services before relying on the skill in that environment.
What does this skill do, and when should you use it?
This skill focuses on core networking for GKE clusters, excluding application ingress, load balancing, and service networking. Its recommended path uses private nodes, private control-plane access, Dataplane V2, Cloud DNS, and automatic IP management. It covers private-cluster access, existing VPC integration, VPC-native networking, IP sizing, egress, and network policy. It is most suitable for teams making GKE network decisions during cluster design and creation.
It plans and configures private GKE clusters, VPC-native networking, Dataplane V2, Cloud DNS, node egress, and Pod, Service, and node-subnet address ranges. It provides gcloud container clusters create-auto and get-credentials examples for cluster creation and access, including DNS endpoint, private endpoint, and authorized-network patterns. It identifies get_cluster, update_cluster, apply_k8s_manifest, and get_k8s_resource as MCP tools for reading or changing cluster and Kubernetes resources. It recommends Cloud NAT for internet access from private nodes, with options for manually allocated static egress IPs or firewall-appliance routing.
- A platform engineer needs to size Pod, Service, and node-subnet ranges before creating a GKE cluster.
- A cloud architect is designing a private GKE cluster whose nodes have no public IP addresses.
- A GKE administrator needs to choose DNS endpoint, private endpoint, or authorized-network control-plane access.
- A network engineer must connect GKE to an existing VPC and subnet using existing secondary ranges.
- A security or operations team needs Cloud NAT, static egress IPs, or inspected outbound traffic for private nodes.
What are this skill's strengths and limitations?
- Covers private clusters, VPC-native mode, Dataplane V2, DNS, egress, and IP planning in one focused reference.
- Provides concrete golden-path defaults, including private nodes, Cloud DNS, automatic IP management, and 48 Pods per node.
- Includes actionable access commands for DNS and private control-plane endpoints.
- Highlights irreversible Day-0 network decisions before cluster creation.
- Does not cover application ingress, load balancing, or service networking.
- The source provides no test suite, version compatibility matrix, or detailed troubleshooting procedure.
- Its recommended IP sizes and defaults may need adjustment for actual cluster scale and density.
- It assumes access to gcloud or MCP tooling but does not document authentication, permissions, or a complete runtime setup.
How do you install this skill?
Install the collection with: npx skills add google/skills. The installer lets you select individual skills from the repository; this skill is located at skills/cloud/gke-networking. The source does not document a separate command for installing only this subdirectory or a specific destination directory for a client.
How do you use this skill?
After loading the skill in an Agent Skills-compatible client, use a request such as: “Design a private VPC-native network for a GKE cluster, size the IP ranges, and configure Cloud NAT.” For actual operations, combine the documented gcloud commands with get_cluster, update_cluster, apply_k8s_manifest, and get_k8s_resource. Decide the VPC, subnet, and IP ranges before cluster creation because the source warns that they cannot be changed afterward.
How does this skill compare with similar options?
The skill explicitly excludes application ingress, load balancing, and service networking, directing those scenarios to gke-service-networking. It is therefore a core cluster-networking reference rather than a complete GKE traffic-management guide. For default-deny and team-specific network policies, it points to gke-workload-security and gke-multitenancy.