google/skills · Apache-2.0

gke-golden-path

Provides GKE golden path configuration defaults, production readiness checklists, and cluster default patterns. Use when designing GKE clusters, verifying GKE production readiness, or checking configurations against GKE defaults. Don't use for setting up workload autoscaling specifically (use gke-workload-scaling instead).

cloud stable

GKE Golden Path Configuration

The golden path is the recommended Autopilot configuration for production

clusters. It defines sensible defaults — when the user requests different

settings, apply them and note relevant trade-offs.

> MCP Tools: get_cluster, create_cluster, update_cluster

Rules

Default to the golden path. Use golden path values unless the user

requests otherwise. When deviating, note trade-offs but respect the user's

choice.

Day-0 vs Day-1. Flag Day-0 decisions (networking, private nodes,

subnets, IP allocation) prominently — they are hard/impossible to change

after creation.

Tool preference: MCP > gcloud > kubectl. MCP is preferred as it directly

interfaces with GKE APIs with structured data, reducing shell syntax errors

and parsing ambiguities. See the gke-basics skill's CLI reference for full

coverage matrix and override options. If the user

says "use gcloud" or "use kubectl", respect that for the session.

Document decisions and rationale, especially for Day-0 choices and

golden path deviations.

Required Inputs

If the user is unsure, use golden path defaults.

Project ID (required)
Region (required, e.g., us-central1)
Cluster name (required)
Environment type: dev/test or production (defaults to production)
Networking: bring-your-own VPC/subnet or auto-create (default:

auto-create)

Scale expectations: expected node/pod count, workload types
Cost constraints: Spot VM tolerance, budget considerations

Always-Apply Defaults

Recommended best practices applied by default. If the user requests a different

setting, apply it and briefly note the security or operational trade-off.

Setting | Golden Path Value

------------------------------------------------------------------ | -----------------

autopilot.enabled | true

privateClusterConfig.enablePrivateNodes | true

masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled | true

secretManagerConfig.enabled + rotationInterval: 120s | true

rbacBindingConfig.enableInsecureBinding* | false (both)

workloadIdentityConfig.workloadPool | enabled

networkConfig.datapathProvider | ADVANCED_DATAPATH

networkConfig.dnsConfig.clusterDns | CLOUD_DNS

autoscaling.autoscalingProfile | OPTIMIZE_UTILIZATION

verticalPodAutoscaling.enabled | true

monitoringConfig components | SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER

loggingConfig components | SYSTEM_COMPONENTS, WORKLOADS (enabled by default)

advancedDatapathObservabilityConfig.enableMetrics | true

nodeConfig.shieldedInstanceConfig.enableSecureBoot | true

nodeConfig.workloadMetadataConfig.mode | GKE_METADATA

nodeConfig.gcfsConfig.enabled / gvnic.enabled | true / true

addonsConfig.statefulHaConfig.enabled | true

Storage CSI drivers (Filestore, GCS FUSE, Parallelstore) | enabled

Pod Security Standards | restricted on production namespaces

Customer-Configurable Settings

These have golden path defaults but customers may deviate with valid

justification. Ask before changing.

Setting | Default | Why Deviate

---------------------------------------- | ----------------------------------- | -----------

dnsEndpointConfig.allowExternalTraffic | true | Restrict if cluster only accessed from within VPC

autoIpamConfig / createSubnetwork | true / true | Customer has pre-existing VPC/subnets

maxPodsPerNode | 48 | 110 for high pod-density (costs more CIDR space)

subnetwork | auto-created | Customer brings existing subnets

Maintenance exclusion windows | configured (NO_MINOR_UPGRADES, 1yr) | Customer-specific scheduling

nodeConfig.bootDisk.diskType | pd-balanced | pd-ssd for I/O-intensive, pd-standard for cost

nodeConfig.machineType | ek-standard-8 (Autopilot) | Varies by workload; use ComputeClasses

Guardrails

Do not request or output secrets (tokens, keys, service account JSON).
Discover project/cluster context via MCP tools or `gcloud config get-value

project` — don't ask users to paste project IDs.

For Day-0 decisions, always ask clarifying questions before proceeding.
For Day-1 features, propose golden path defaults with trade-offs and let the

customer confirm.

Do not promise zero downtime; advise PDBs, health probes, replicas, and

staged upgrades.

When auditing existing clusters, compare against golden path and report

deviations with severity and remediation.

Golden Path Config

See [golden-path-autopilot.yaml](./assets/golden-path-autopilot.yaml) for the

full cluster-level policy settings.

Provenance

Authored by Google LLC in google/skills. The content is mirrored here under its upstream license.

agent-platform-alert-configuration Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments. google/skills Apache-2.0 agent-platform-deploy Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a specific model is deployable (`gcloud ai model-garden models list-deployment-config`), query deployment cost, troubleshoot deployment errors (like quota limits), or undeploy/clean up endpoints. Also use when copying and deploying a 1P Tuned Model. Don't use for pure listing/discovery questions of the form "is X deployed?", "list my endpoints", or "which regions have models running?" — for those use `agent-platform-endpoint-management`. Don't use for public Vertex AI deployments (use the `vertex-deploy` skill) or for running model evaluations (use the `agent-platform-eval-flywheel` skill). google/skills Apache-2.0 agent-platform-endpoint-management Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serving endpoints for model deployment on Agent Platform. Also use when troubleshooting endpoint permission, quota, or resource busy errors. Don't use for deploying models to endpoints or for running model evaluations. google/skills Apache-2.0 agent-platform-eval-flywheel Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on Agent Platform eval methodology — including dataset schema, LLM-as-judge scoring, and common failure causes. For fine-tuning, use agent-platform-tuning. For general production deployment, use agent-platform-deploy. google/skills Apache-2.0 agent-platform-inference Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global/regional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations. google/skills Apache-2.0