GKE Golden Path
FreeStreamline GKE cluster configurations with best practices.
Free · Opens the source repo
What GKE Golden Path does
The GKE Golden Path skill provides a structured approach to configuring Google Kubernetes Engine (GKE) clusters, ensuring that best practices are followed from the outset. It offers sensible defaults for production-ready configurations, which help users avoid common pitfalls when setting up their clusters. By utilizing this skill, developers and DevOps teams can focus on their application logic rather than the intricacies of GKE setup, leading to more efficient deployments.
This skill emphasizes the importance of Day-0 decisions, which are critical and often irreversible once a cluster is created. Users are guided to make informed choices regarding networking, node configurations, and other foundational aspects of their GKE clusters. The built-in defaults are designed to enhance security and operational efficiency, significantly reducing the risk of misconfigurations that could lead to downtime or security vulnerabilities.
The GKE Golden Path skill is particularly useful for teams looking to standardize their GKE deployments across different environments. It promotes consistency by documenting decisions and their rationales, making it easier for teams to onboard new members and maintain clarity in their infrastructure. The skill also provides a clear path for auditing existing clusters against the recommended configurations, helping teams identify and remediate deviations effectively.
While the GKE Golden Path skill is robust, it is not intended for setting up workload autoscaling, which should be managed with the dedicated gke-workload-scaling skill. Users should also be aware that while the skill provides a comprehensive framework, it may not cover every unique use case, particularly those requiring highly customized configurations.
When to use it
Use this skill when designing new GKE clusters or verifying existing configurations against best practices.
When not to use it
Avoid this skill for workload autoscaling tasks; use the gke-workload-scaling skill instead.
What you can build with it
Setting Up a New GKE Cluster
When creating a new GKE cluster, this skill provides the recommended defaults to ensure a secure and efficient setup.
Auditing Existing Clusters
Use this skill to compare existing GKE cluster configurations against the golden path defaults, identifying any deviations and their severity.
Documenting Infrastructure Decisions
This skill helps teams document their configuration choices and the rationale behind them, improving team communication and onboarding.
How to install GKE Golden Path
View source1. Install with the skills CLI
npx skills add google/skills/gke-golden-path --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by googleGKE Golden Path Configuration
The golden path is the recommended Autopilot configuration for production clusters. It defines sensible defaults — when the user requests different settings, apply them and note relevant trade-offs.
MCP Tools:
get_cluster,create_cluster,update_cluster
Rules
- Default to the golden path. Use golden path values unless the user requests otherwise. When deviating, note trade-offs but respect the user's choice.
- Day-0 vs Day-1. Flag Day-0 decisions (networking, private nodes, subnets, IP allocation) prominently — they are hard/impossible to change after creation.
- Tool preference: MCP > gcloud > kubectl. MCP is preferred as it directly
interfaces with GKE APIs with structured data, reducing shell syntax errors
and parsing ambiguities. See the
gke-basicsskill's CLI reference for full coverage matrix and override options. If the user says "use gcloud" or "use kubectl", respect that for the session. - Document decisions and rationale, especially for Day-0 choices and golden path deviations.
Required Inputs
If the user is unsure, use golden path defaults.
- Project ID (required)
- Region (required, e.g.,
us-central1) - Cluster name (required)
- Environment type: dev/test or production (defaults to production)
- Networking: bring-your-own VPC/subnet or auto-create (default: auto-create)
- Scale expectations: expected node/pod count, workload types
- Cost constraints: Spot VM tolerance, budget considerations
Always-Apply Defaults
Recommended best practices applied by default. If the user requests a different setting, apply it and briefly note the security or operational trade-off.
| Setting | Golden Path Value |
|---|---|
autopilot.enabled | true |
privateClusterConfig.enablePrivateNodes | true |
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled | true |
secretManagerConfig.enabled + rotationInterval: 120s | true |
rbacBindingConfig.enableInsecureBinding* | false (both) |
workloadIdentityConfig.workloadPool | enabled |
networkConfig.datapathProvider | ADVANCED_DATAPATH |
networkConfig.dnsConfig.clusterDns | CLOUD_DNS |
autoscaling.autoscalingProfile | OPTIMIZE_UTILIZATION |
verticalPodAutoscaling.enabled | true |
monitoringConfig components | SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER |
loggingConfig components | SYSTEM_COMPONENTS, WORKLOADS (enabled by default) |
advancedDatapathObservabilityConfig.enableMetrics | true |
nodeConfig.shieldedInstanceConfig.enableSecureBoot | true |
nodeConfig.workloadMetadataConfig.mode | GKE_METADATA |
nodeConfig.gcfsConfig.enabled / gvnic.enabled | true / true |
addonsConfig.statefulHaConfig.enabled | true |
| Storage CSI drivers (Filestore, GCS FUSE, Parallelstore) | enabled |
| Pod Security Standards | restricted on production namespaces |
Customer-Configurable Settings
These have golden path defaults but customers may deviate with valid justification. Ask before changing.
| Setting | Default | Why Deviate |
|---|---|---|
dnsEndpointConfig.allowExternalTraffic | true | Restrict if cluster only accessed from within VPC |
autoIpamConfig / createSubnetwork | true / true | Customer has pre-existing VPC/subnets |
maxPodsPerNode | 48 | 110 for high pod-density (costs more CIDR space) |
subnetwork | auto-created | Customer brings existing subnets |
| Maintenance exclusion windows | configured (NO_MINOR_UPGRADES, 1yr) | Customer-specific scheduling |
nodeConfig.bootDisk.diskType | pd-balanced | pd-ssd for I/O-intensive, pd-standard for cost |
nodeConfig.machineType | ek-standard-8 (Autopilot) | Varies by workload; use ComputeClasses |
Guardrails
- Do not request or output secrets (tokens, keys, service account JSON).
- Discover project/cluster context via MCP tools or
gcloud config get-value project— don't ask users to paste project IDs. - For Day-0 decisions, always ask clarifying questions before proceeding.
- For Day-1 features, propose golden path defaults with trade-offs and let the customer confirm.
- Do not promise zero downtime; advise PDBs, health probes, replicas, and staged upgrades.
- When auditing existing clusters, compare against golden path and report deviations with severity and remediation.
Golden Path Config
See golden-path-autopilot.yaml for the full cluster-level policy settings.
Frequently asked questions about GKE Golden Path
Similar skills
Turborepo
Optimized build system for JavaScript/TypeScript monorepos.
Azure Pipelines Validation
Streamline your Azure DevOps pipeline changes locally.
Azure Developer CLI
Streamline your Azure project workflows with best practices.
Azure Container Registry CLI
Manage Azure Container Registry resources with ease.
Aspire
Build and orchestrate polyglot distributed applications seamlessly.
Vercel CLI
Manage and deploy Vercel projects from the command line.