# SkillPatch skill: gke-golden-path

This skill provides GKE (Google Kubernetes Engine) golden path configuration defaults and production readiness guidance. It defines recommended Autopilot cluster settings, flags critical Day-0 vs Day-1 decisions, and enforces best-practice defaults for security, networking, monitoring, and autoscaling. It is designed to guide agents through designing and verifying production-grade GKE clusters.

You (the agent) were given this URL and asked to use this skill. This is a **public** skill — no SkillPatch account, API key, or prior setup is required. Two ways to use it:

**1. Use it right now** — the skill's complete file tree (SKILL.md + all reference files) is inlined below; read `SKILL.md` first, then follow it, consulting the other files as it directs.

**2. Install the exact package onto disk** (recommended if you can run a shell — this reproduces the skill byte-for-byte, including any binary assets that can't be inlined):

```bash
mkdir -p .claude/skills/gke-golden-path
curl -sSL https://skillpatch.dev/install_skill/gke-golden-path | tar -xz -C .claude/skills/
```

(`.claude/skills/` is Claude Code's convention; use whatever directory your agent loads skills from.)


---

## Skill files (2)

- `SKILL.md`
- `assets/golden-path-autopilot.yaml`


### `SKILL.md`

```markdown
---
name: gke-golden-path
description: >-
  Provides GKE golden path configuration defaults, production readiness
  checklists, and cluster default patterns. Use when designing GKE clusters,
  verifying GKE production readiness, or checking configurations against
  GKE defaults. Don't use for setting up node autoscaling specifically (use
  gke-scaling instead).
metadata:
  category: Containers
---

# GKE Golden Path Configuration

The golden path is the recommended Autopilot configuration for production
clusters. It defines sensible defaults — when the user requests different
settings, apply them and note relevant trade-offs.

> **MCP Tools:** `get_cluster`, `create_cluster`, `update_cluster`

## Rules

1.  **Default to the golden path.** Use golden path values unless the user
    requests otherwise. When deviating, note trade-offs but respect the user's
    choice.
2.  **Day-0 vs Day-1.** Flag Day-0 decisions (networking, private nodes,
    subnets, IP allocation) prominently — they are hard/impossible to change
    after creation.
3.  **Tool preference: MCP > gcloud > kubectl.** See the `gke-basics` skill's
    CLI reference for full coverage matrix and override options. If the user
    says "use gcloud" or "use kubectl", respect that for the session.
4.  **Document decisions and rationale**, especially for Day-0 choices and
    golden path deviations.

## Required Inputs

If the user is unsure, use golden path defaults.

-   **Project ID** (required)
-   **Region** (required, e.g., `us-central1`)
-   **Cluster name** (required)
-   **Environment type**: dev/test or production (defaults to production)
-   **Networking**: bring-your-own VPC/subnet or auto-create (default:
    auto-create)
-   **Scale expectations**: expected node/pod count, workload types
-   **Cost constraints**: Spot VM tolerance, budget considerations

## Always-Apply Defaults

Recommended best practices applied by default. If the user requests a different
setting, apply it and briefly note the security or operational trade-off.

Setting                                                            | Golden Path Value
------------------------------------------------------------------ | -----------------
`autopilot.enabled`                                                | `true`
`privateClusterConfig.enablePrivateNodes`                          | `true`
`masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled` | `true`
`secretManagerConfig.enabled` + `rotationInterval: 120s`           | `true`
`rbacBindingConfig.enableInsecureBinding*`                         | `false` (both)
`workloadIdentityConfig.workloadPool`                              | enabled
`networkConfig.datapathProvider`                                   | `ADVANCED_DATAPATH`
`networkConfig.dnsConfig.clusterDns`                               | `CLOUD_DNS`
`autoscaling.autoscalingProfile`                                   | `OPTIMIZE_UTILIZATION`
`verticalPodAutoscaling.enabled`                                   | `true`
`monitoringConfig` components                                      | SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER
`advancedDatapathObservabilityConfig.enableMetrics`                | `true`
`nodeConfig.shieldedInstanceConfig.enableSecureBoot`               | `true`
`nodeConfig.workloadMetadataConfig.mode`                           | `GKE_METADATA`
`nodeConfig.gcfsConfig.enabled` / `gvnic.enabled`                  | `true` / `true`
`addonsConfig.statefulHaConfig.enabled`                            | `true`
Storage CSI drivers (Filestore, GCS FUSE, Parallelstore)           | enabled
Pod Security Standards                                             | `restricted` on production namespaces

## Customer-Configurable Settings

These have golden path defaults but customers may deviate with valid
justification. **Ask before changing.**

Setting                                  | Default                             | Why Deviate
---------------------------------------- | ----------------------------------- | -----------
`dnsEndpointConfig.allowExternalTraffic` | `true`                              | Restrict if cluster only accessed from within VPC
`autoIpamConfig` / `createSubnetwork`    | `true` / `true`                     | Customer has pre-existing VPC/subnets
`maxPodsPerNode`                         | `48`                                | `110` for high pod-density (costs more CIDR space)
`subnetwork`                             | auto-created                        | Customer brings existing subnets
Maintenance exclusion windows            | configured (NO_MINOR_UPGRADES, 1yr) | Customer-specific scheduling
`nodeConfig.bootDisk.diskType`           | `pd-balanced`                       | `pd-ssd` for I/O-intensive, `pd-standard` for cost
`nodeConfig.machineType`                 | `ek-standard-8` (Autopilot)         | Varies by workload; use ComputeClasses

## Guardrails

-   Do not request or output secrets (tokens, keys, service account JSON).
-   Discover project/cluster context via MCP tools or `gcloud config get-value
    project` — don't ask users to paste project IDs.
-   For Day-0 decisions, always ask clarifying questions before proceeding.
-   For Day-1 features, propose golden path defaults with trade-offs and let the
    customer confirm.
-   Do not promise zero downtime; advise PDBs, health probes, replicas, and
    staged upgrades.
-   When auditing existing clusters, compare against golden path and report
    deviations with severity and remediation.

## Golden Path Config

See [golden-path-autopilot.yaml](./assets/golden-path-autopilot.yaml) for the
full cluster-level policy settings.

```


### `assets/golden-path-autopilot.yaml`

```
# Golden Path Autopilot Configuration (cluster-level policy settings only)
# Condensed from `gcloud container clusters describe` export.
# Full export: resources/recommended-ap.yaml
#
# Autopilot manages all node pools, node config, and provisioning defaults
# automatically. Only cluster-level policy decisions are shown here.

# --- Addons ---
addonsConfig:
  dnsCacheConfig:
    enabled: true
  gcePersistentDiskCsiDriverConfig:
    enabled: true
  gcpFilestoreCsiDriverConfig:
    enabled: true
  gcsFuseCsiDriverConfig:
    enabled: true
  gkeBackupAgentConfig: {}
  httpLoadBalancing: {}
  kubernetesDashboard:
    disabled: true
  networkPolicyConfig:
    disabled: true
  parallelstoreCsiDriverConfig:
    enabled: true
  rayOperatorConfig: {}
  statefulHaConfig:
    enabled: true

# --- Cluster Mode ---
autopilot:
  enabled: true

# --- Autoscaling ---
autoscaling:
  autoscalingProfile: OPTIMIZE_UTILIZATION
  enableNodeAutoprovisioning: true
  resourceLimits:
  - maximum: '1000000000'
    resourceType: cpu
  - maximum: '1000000000'
    resourceType: memory
  - maximum: '1000000000'
    resourceType: nvidia-tesla-t4
  - maximum: '1000000000'
    resourceType: nvidia-tesla-a100

# --- Security ---
binaryAuthorization:
  evaluationMode: DISABLED
controlPlaneEndpointsConfig:
  dnsEndpointConfig:
    allowExternalTraffic: true          # Customer-configurable
  ipEndpointsConfig:
    authorizedNetworksConfig:
      privateEndpointEnforcementEnabled: true
masterAuthorizedNetworksConfig:
  privateEndpointEnforcementEnabled: true
privateClusterConfig:
  enablePrivateNodes: true
rbacBindingConfig:
  enableInsecureBindingSystemAuthenticated: false
  enableInsecureBindingSystemUnauthenticated: false
secretManagerConfig:
  enabled: true
  rotationConfig:
    enabled: true
    rotationInterval: 120s
shieldedNodes:
  enabled: true
workloadIdentityConfig:
  workloadPool: <PROJECT_ID>.svc.id.goog

# --- Networking ---
networkConfig:
  datapathProvider: ADVANCED_DATAPATH
  defaultEnablePrivateNodes: true
  dnsConfig:
    clusterDns: CLOUD_DNS
    clusterDnsDomain: cluster.local
    clusterDnsScope: CLUSTER_SCOPE
  enableIntraNodeVisibility: true
  gatewayApiConfig:
    channel: CHANNEL_STANDARD

# --- IP Allocation ---
ipAllocationPolicy:
  autoIpamConfig:
    enabled: true                       # Customer-configurable
  createSubnetwork: true                # Customer-configurable
  stackType: IPV4
  useIpAliases: true
defaultMaxPodsConstraint:
  maxPodsPerNode: '48'                  # Customer-configurable (48 or 110)

# --- Logging ---
loggingConfig:
  componentConfig:
    enableComponents:
    - SYSTEM_COMPONENTS
    - WORKLOADS

# --- Monitoring ---
monitoringConfig:
  advancedDatapathObservabilityConfig:
    enableMetrics: true
  componentConfig:
    enableComponents:
    - SYSTEM_COMPONENTS
    - STORAGE
    - POD
    - DEPLOYMENT
    - STATEFULSET
    - DAEMONSET
    - HPA
    - JOBSET
    - CADVISOR
    - KUBELET
    - DCGM
    - APISERVER
    - SCHEDULER
    - CONTROLLER_MANAGER
  managedPrometheusConfig:
    enabled: true

# --- Maintenance ---
maintenancePolicy:
  window:
    maintenanceExclusions:
      blackout-1:
        maintenanceExclusionOptions:
          scope: NO_MINOR_UPGRADES
        # 1-year exclusion window (customer-configurable dates)

# --- Upgrades ---
releaseChannel:
  channel: REGULAR

# --- Scaling ---
verticalPodAutoscaling:
  enabled: true

# --- Node Config & Pools ---
# Autopilot manages all node pools, node config (disk, machine type, shielded
# instances, gvnic, gcfs, workload metadata mode), and upgrade strategy
# automatically. These are not user-configurable in Autopilot mode.
# See resources/recommended-ap.yaml for the full describe output.

```