GKE Service Networking
Configure secure GKE traffic routing, load balancing, edge protection, and private service connectivity.
The skill is narrowly focused on GKE service exposure, routing, WAF, certificates, NEGs, and PSC, with no evidence of malware, credential theft, or covert exfiltration. However, its examples can create public load balancers, certificates, Cloud Armor policies, and PSC attachments without confirmation, least-privilege guidance, data-flow disclosure, or rollback instructions, so points are deducted.
The workflows are internally readable and include some prerequisites and Kubernetes manifests. There is no test suite, CI execution evidence, verification command set, abnormal-input handling, or diagnostic failure feedback, and several GKE, Gateway, certificate, and PSC details are insufficiently constrained. Static calibration therefore limits the score.
The description clearly covers Gateway API, Ingress, Cloud Armor, NEGs, PSC, and managed certificates, while excluding core cluster IP planning, Dataplane V2 network policies, and node NAT egress. Inputs, outputs, trigger boundaries, non-fit cases, and environment requirements remain incomplete, with no Chinese-language or mainland-China reachability guidance, so points are deducted.
The document has a readable workflow structure and practical examples. The repository README supplies installation guidance, Apache-2.0 licensing, official organization provenance, issue reporting, and contribution paths. The skill lacks its own dependency notes, compatibility matrix, changelog, explicit maintenance ownership, and troubleshooting section, preventing a high score.
The manifest fragments provide a useful starting point for the main service-networking objects. However, they contain many placeholders and omit complete ordering, DNS, IAM, network prerequisites, state validation, and rollback steps. Broad recommendations such as always enabling Cloud Armor and NEGs are not sufficiently conditional, so substantial user rework may remain.
The evidence consists primarily of the selected SKILL.md plus repository README and license text. The pinned revision makes the material auditable, but there is no skill-specific test suite, CI result, third-party citation, or reproducible execution record. Static review therefore supports only limited verification.
- Do not apply the example manifests directly to production; confirm scope, permissions, cost, and rollback for Gateway, Ingress, certificate, Cloud Armor, and PSC changes.
- Verify the GKE version, GatewayClass, certificate integration method, PSC API resources, and network prerequisites because the skill lacks a complete compatibility matrix and troubleshooting procedure.
- ACCEPT_AUTOMATIC automatically accepts PSC connections; assess consumer admission and network-isolation risks before using it.
- If operation depends on Google Cloud control-plane access or overseas documentation/services, separately verify mainland-China reachability and establish an alternative operations path.
What does this skill do, and when should you use it?
This skill helps expose applications running on Google Kubernetes Engine to the internet or internal networks. It covers Gateway API, standard GKE Ingress, Cloud Armor, container-native load balancing, Private Service Connect, and Google-managed SSL certificates. It recommends Gateway API and supplies Kubernetes manifest examples for the main workflows. It does not cover core cluster IP planning, Dataplane V2 network policies, or node NAT egress.
It guides users through writing Gateway and HTTPRoute manifests, or configuring standard GKE Ingress; attaching Cloud Armor security policies to Services through BackendConfig; creating ManagedCertificate resources or using Certificate Manager certificate maps; enabling or verifying NEG-based container-native load balancing with the cloud.google.com/neg annotation; and creating an internal load balancer plus ServiceAttachment for Private Service Connect consumers in another VPC. The overall repository can be installed with npx skills add google/skills, with individual skills selectable during installation.
- A GKE team needs modern Kubernetes routing for an HTTP application exposed to the internet.
- A team needs a simpler or legacy GKE service-exposure configuration using standard Ingress.
- A public-facing GKE endpoint needs Cloud Armor WAF and DDoS protection.
- A GKE service needs Google-managed SSL certificates with automated provisioning and renewal.
- A workload needs load balancers to target Pods directly through container-native load balancing.
- A service in one VPC must be consumed securely from another VPC without VPC peering.
What are this skill's strengths and limitations?
- Covers service exposure, edge security, certificates, NEGs, and PSC in one focused workflow.
- Includes manifest examples for Gateway API, Ingress, BackendConfig, ManagedCertificate, Service, and ServiceAttachment.
- Clearly defines its boundary with the separate gke-networking skill.
- The repository is Apache-2.0 licensed and marked as under active development.
- Requires an existing GKE cluster and related Google Cloud networking resources.
- Provides no concrete kubectl, gcloud, or Terraform commands and does not document permission setup.
- Some workflows use legacy Ingress or Legacy ManagedCertificate concepts, so users must choose the approach matching their deployment.
- The source provides no test suite, version compatibility matrix, or troubleshooting guide.
How do you install this skill?
Install the repository in an Agent Skills-compatible client with: npx skills add google/skills. The README states that the installer lets users select specific skills from the repository; it does not document a separate command or destination for installing only this folder.
How do you use this skill?
Give a request focused on GKE service networking, such as: “Create Gateway API Gateway and HTTPRoute manifests for my GKE service, and configure Cloud Armor and a Google-managed certificate.” Use it with an existing GKE cluster. Gateway API must be enabled; the source states that it is enabled by default in GKE 1.24 and later. Generate or modify the relevant Kubernetes manifests and apply them to the target cluster; the source does not provide specific kubectl commands.
How does this skill compare with similar options?
The skill distinguishes Gateway API from standard GKE Ingress and recommends Gateway API. For core cluster networking, it points users to gke-networking instead.