{"id":"29a2a353-3ea0-4eea-8a11-9825775ede08","shortId":"rBUeYS","kind":"skill","title":"gke","tagline":"Use when working with GKE, kubectl, Kubernetes manifests, k8s directories, Helm charts, node pools, workload identity, cluster scaling, GPU nodes, database sidecars, or GKE troubleshooting.","description":"# Google Kubernetes Engine (GKE)\n\nGKE is Google Cloud's managed Kubernetes service, handling cluster management, upgrades, scaling, GPU workloads, and production database connectivity via Auth Proxy sidecars.\n\n## Quick Reference\n\n### GPU Pod Spec (Quick)\n\n```yaml\nresources:\n  limits:\n    nvidia.com/gpu: \"1\"   # GPU in limits ONLY — never in requests\n```\n\nAdd toleration for tainted GPU nodes:\n\n```yaml\ntolerations:\n  - key: nvidia.com/gpu\n    operator: Exists\n    effect: NoSchedule\n```\n\n### Workload Identity Binding (2-command pattern)\n\n```bash\n# 1. Annotate the KSA with the GCP SA email\nkubectl annotate serviceaccount KSA_NAME \\\n  --namespace=NAMESPACE \\\n  iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com\n\n# 2. Bind GCP SA to allow KSA impersonation\ngcloud iam service-accounts add-iam-policy-binding \\\n  GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \\\n  --role=\"roles/iam.workloadIdentityUser\" \\\n  --member=\"serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]\"\n```\n\n### AlloyDB Auth Proxy Sidecar (Quick)\n\n```yaml\n- name: alloydb-auth-proxy\n  image: gcr.io/alloydb-connectors/alloydb-auth-proxy:latest\n  args:\n    - \"projects/PROJECT_ID/locations/REGION/clusters/CLUSTER/instances/INSTANCE\"\n    - \"--port=5432\"\n  securityContext:\n    allowPrivilegeEscalation: false\n    runAsNonRoot: true\n    runAsUser: 65532\n    capabilities:\n      drop: [ALL]\n```\n\nSee [alloydb-on-gke.md](references/alloydb-on-gke.md) for the full production pattern.\n\n### kubectl Essentials\n\n```bash\n# Cluster access\ngcloud container clusters get-credentials CLUSTER --region=REGION\nkubectl config use-context CONTEXT_NAME\n\n# Core operations\nkubectl get nodes\nkubectl get pods -A\nkubectl logs -f POD_NAME -n NAMESPACE\nkubectl exec -it POD_NAME -n NAMESPACE -- /bin/sh\nkubectl apply -f manifest.yaml\n```\n\n### Deployment Workflow\n\n1. **Cluster** -- Autopilot (recommended) or Standard mode, always regional for production.\n2. **Workload Identity** -- bind KSA to GSA; never use node service accounts.\n3. **Deploy** -- `kubectl apply` or Helm chart with per-component values (web, workers).\n4. **Scale** -- HPA for pods, VPA for right-sizing, Cluster Autoscaler for nodes.\n5. **Observe** -- `kubectl logs`, `kubectl describe`, `kubectl top`.\n\n### Helm Chart Pattern\n\n```text\nchart/\n  Chart.yaml\n  values.yaml\n  templates/\n    _helpers.tpl\n    web-deployment.yaml\n    web-service.yaml\n    worker-deployment.yaml\n    migration-job.yaml\n```\n\nStructure `values.yaml` with separate sections per component (`web`, `workers`), each specifying `replicaCount`, `image`, `command`, `resources`, and `port`.\n\n## Database on GKE\n\n### AlloyDB on GKE\n\nConnect to AlloyDB via the Auth Proxy sidecar + Workload Identity. The proxy runs as a sidecar and listens on `localhost:5432`. Application connects to `postgresql://user:password@localhost:5432/dbname`.\n\nKey roles for GSA: `roles/alloydb.client`, `roles/secretmanager.secretAccessor`, `roles/storage.objectAdmin`, `roles/logging.logWriter`.\n\nSee **[alloydb-on-gke.md](references/alloydb-on-gke.md)** for full deployment, HPA with queue-depth metrics, CronJob queue monitor, and Job patterns.\n\n### Cloud SQL on GKE\n\nConnect to Cloud SQL via the `cloud-sql-proxy` sidecar. Same Workload Identity pattern; GSA needs `roles/cloudsql.client`.\n\nSee **[cloudsql-on-gke.md](references/cloudsql-on-gke.md)** for pod spec and connection string format.\n\n---\n\n## GPU Workloads\n\n| GPU Type | Machine Series | Notes |\n|---|---|---|\n| NVIDIA T4 | N1 | Cost-effective inference |\n| NVIDIA L4 | G2 | Efficient inference/fine-tuning |\n| NVIDIA A100 (40/80GB) | A2 | Large-scale training, MIG support |\n| NVIDIA H100 (80GB) | A3 | Highest throughput, MIG support |\n\n**Autopilot GPU**: automatic driver install, pay-per-pod billing, MIG enabled by default (v1.29.3+). Simpler operations.\n\n**Standard GPU**: manual driver install via DaemonSet or GPU Operator (`helm install gpu-operator nvidia/gpu-operator`). Full node control.\n\n```yaml\n# Minimal GPU pod spec\nspec:\n  tolerations:\n    - key: nvidia.com/gpu\n      operator: Exists\n      effect: NoSchedule\n  containers:\n    - name: trainer\n      image: nvcr.io/nvidia/pytorch:24.01-py3\n      resources:\n        limits:\n          nvidia.com/gpu: \"1\"  # GPU in limits only; limits == requests for GPU\n```\n\nSee **[gpu.md](references/gpu.md)** for time-sharing, MIG, NAP, Spot GPU, and TPU patterns.\n\n---\n\n<workflow>\n\n## Workflow\n\n### Step 1: Cluster Setup\n\nChoose Autopilot (Google-managed nodes, pay-per-pod) or Standard (full node control). Use regional clusters for production HA. Enable Workload Identity at cluster creation.\n\n### Step 2: Workload Identity Configuration\n\n```bash\n# Create GSA + grant permissions\ngcloud iam service-accounts create GSA_NAME\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n  --member=\"serviceAccount:GSA_NAME@PROJECT_ID.iam.gserviceaccount.com\" \\\n  --role=\"roles/storage.admin\"\n\n# Create KSA + bind to GSA\nkubectl create serviceaccount KSA_NAME --namespace NAMESPACE\ngcloud iam service-accounts add-iam-policy-binding \\\n  GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \\\n  --role=\"roles/iam.workloadIdentityUser\" \\\n  --member=\"serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]\"\n\n# Annotate KSA\nkubectl annotate serviceaccount KSA_NAME \\\n  --namespace=NAMESPACE \\\n  iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com\n```\n\n### Step 3: Deploy Application\n\nApply manifests or install Helm chart. Set resource requests/limits on every container. Add PodDisruptionBudgets for availability during upgrades.\n\n### Step 4: Validate\n\nRun `kubectl get pods -n NAMESPACE` to confirm healthy rollout. Check logs and events for errors.\n\n</workflow>\n\n<guardrails>\n\n## Guardrails\n\n- **Always use Workload Identity** -- never attach permissions via node service account. Bind KSA-to-GSA explicitly.\n- **Set resource requests AND limits** on every container -- prevents noisy-neighbor issues and enables HPA/VPA.\n- **Use PodDisruptionBudgets** -- ensures minimum availability during voluntary disruptions (node upgrades, cluster scaling).\n- **Regional clusters for production** -- zonal clusters are single points of failure.\n- **Autopilot preferred** unless you need GPU node pools or custom machine types.\n- **Never expose workloads without network policies** -- restrict ingress/egress at the namespace level.\n- **GPU in limits only** -- never put `nvidia.com/gpu` in `requests`; limits implicitly equal requests for GPU resources.\n- **Taint GPU nodes** -- use `nvidia.com/gpu=present:NoSchedule` to prevent non-GPU pods from landing on expensive GPU nodes.\n- **Security context: nonroot** -- always set `runAsNonRoot: true`, `runAsUser: 65532`, `runAsGroup: 65532`, `fsGroup: 65532`, `allowPrivilegeEscalation: false`, `capabilities.drop: [ALL]`.\n- **Use Spot for fault-tolerant GPU workloads** -- 60-90% discount vs on-demand; combine with checkpointing for training jobs.\n\n</guardrails>\n\n<validation>\n\n### Validation Checkpoint\n\nBefore delivering GKE configurations, verify:\n\n- [ ] Workload Identity is configured (no node SA usage)\n- [ ] Every container has resource requests and limits\n- [ ] PodDisruptionBudgets are defined for production workloads\n- [ ] Cluster is regional (not zonal) for production\n- [ ] Health checks (readiness + liveness probes) are defined\n- [ ] Namespace isolation and network policies are present\n- [ ] GPU resources are in `limits` only (not `requests`)\n- [ ] GPU node pools have `nvidia.com/gpu=present:NoSchedule` taint\n- [ ] Security context sets `runAsNonRoot: true`, `runAsUser: 65532`, `capabilities.drop: [ALL]`\n- [ ] Database connections use Auth Proxy sidecar (not direct IP with credentials)\n\n</validation>\n\n<example>\n\n## Example\n\n**Task:** Deploy a web application with a Service on GKE.\n\n```yaml\n# deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web-app\n  namespace: production\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: web-app\n  template:\n    metadata:\n      labels:\n        app: web-app\n    spec:\n      serviceAccountName: web-app-ksa  # Workload Identity KSA\n      containers:\n        - name: web\n          image: us-central1-docker.pkg.dev/my-project/repo/web-app:v1.2.0\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 250m\n              memory: 256Mi\n            limits:\n              cpu: \"1\"\n              memory: 1Gi\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n            initialDelaySeconds: 5\n            periodSeconds: 10\n          livenessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n            initialDelaySeconds: 15\n            periodSeconds: 20\n---\n# service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: web-app\n  namespace: production\nspec:\n  selector:\n    app: web-app\n  ports:\n    - port: 80\n      targetPort: 8080\n  type: ClusterIP\n---\n# pdb.yaml\napiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n  name: web-app-pdb\n  namespace: production\nspec:\n  minAvailable: 2\n  selector:\n    matchLabels:\n      app: web-app\n```\n\n</example>\n\n---\n\n> **No Gemini CLI extension exists for GKE** -- this skill provides unique value for GKE cluster management, GPU workloads, and production database connectivity patterns.\n\n## References Index\n\nFor detailed guides and configuration examples, refer to the following documents in `references/`:\n\n- **[Cluster Management](references/cluster.md)** -- Autopilot vs Standard, Regional/Zonal setups, Private clusters.\n- **[Node Pools](references/node_pools.md)** -- Creation, specialized pools (GPU, Spot), and management.\n- **[Workload Identity](references/workload_identity.md)** -- Secure GCP API access configuration.\n- **[Autoscaling](references/autoscaling.md)** -- HPA, VPA, and Cluster Autoscaler setups.\n- **[Networking](references/networking.md)** -- Service types, GCE Ingress, and Network Policies.\n- **[Security](references/security.md)** -- Hardening, Pod security contexts, and Secret Manager.\n- **[Terraform Configuration](references/terraform.md)** -- Module examples for Autopilot and Standard.\n- **[kubectl Commands](references/kubectl.md)** -- Essential access and operations commands.\n- **[Troubleshooting](references/troubleshooting.md)** -- Debugging nodes, pods, and network issues.\n- **[Helm Deployment](references/helm_deployment.md)** -- Helm chart patterns for web + worker deployments.\n- **[SAQ Workers](references/saq_workers.md)** -- SAQ worker architecture, queue distribution, and graceful shutdown.\n- **[GPU/TPU Workloads](references/gpu.md)** -- Node pool creation, time-sharing, MIG, NAP, Spot GPU, TPU.\n- **[AlloyDB on GKE](references/alloydb-on-gke.md)** -- Auth Proxy sidecar, Workload Identity, HPA with queue-depth metrics.\n- **[Cloud SQL on GKE](references/cloudsql-on-gke.md)** -- Cloud SQL Auth Proxy sidecar and connection patterns.\n- **[Batch Workloads](references/batch-workloads.md)** -- Jobs, JobSet, ProvisioningRequest, Cloud Batch vs GKE.\n\n---\n\n## Official References\n\n- <https://cloud.google.com/kubernetes-engine/docs>\n- <https://cloud.google.com/kubernetes-engine/docs/best-practices>\n- <https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster>\n\n## Shared Styleguide Baseline\n\n- Use shared styleguides for generic language/framework rules to reduce duplication in this skill.\n- [General Principles](https://github.com/cofin/flow/blob/main/templates/styleguides/general.md)\n- [GCP Scripting](https://github.com/cofin/flow/blob/main/templates/styleguides/cloud/gcp_scripting.md)\n- Keep this skill focused on tool-specific workflows, edge cases, and integration details.","tags":["gke","flow","cofin","agent-skills","ai-agents","beads","claude-code","codex","cursor","developer-tools","gemini-cli","opencode"],"capabilities":["skill","source-cofin","skill-gke","topic-agent-skills","topic-ai-agents","topic-beads","topic-claude-code","topic-codex","topic-cursor","topic-developer-tools","topic-gemini-cli","topic-opencode","topic-plugin","topic-slash-commands","topic-spec-driven-development"],"categories":["flow"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/cofin/flow/gke","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add cofin/flow","source_repo":"https://github.com/cofin/flow","install_from":"skills.sh"}},"qualityScore":"0.455","qualityRationale":"deterministic score 0.46 from registry signals: · indexed on github topic:agent-skills · 11 github stars · SKILL.md body (11,677 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T19:07:37.288Z","embedding":null,"createdAt":"2026-04-23T13:03:59.426Z","updatedAt":"2026-05-18T19:07:37.288Z","lastSeenAt":"2026-05-18T19:07:37.288Z","tsv":"'-90':823 '/alloydb-connectors/alloydb-auth-proxy:latest':155 '/bin/sh':222 '/cofin/flow/blob/main/templates/styleguides/cloud/gcp_scripting.md)':1283 '/cofin/flow/blob/main/templates/styleguides/general.md)':1278 '/gcp-service-account=gsa_name@project_id.iam.gserviceaccount.com':115,637 '/gpu':85,493,768 '/gpu:':65,509 '/gpu=present:noschedule':784,898 '/health':993,1003 '/kubernetes-engine/docs':1251 '/kubernetes-engine/docs/best-practices':1254 '/kubernetes-engine/docs/how-to/hardening-your-cluster':1257 '/my-project/repo/web-app:v1.2.0':975 '/nvidia/pytorch:24.01-py3':504 '1':66,97,229,510,535,987 '10':999 '15':1007 '1gi':989 '2':93,116,240,566,1050 '20':1009 '250m':982 '256mi':984 '3':252,639,946 '4':266,661 '40/80gb':431 '5':280,997 '5432':159,344 '5432/dbname':351 '60':822 '65532':166,805,807,809,906 '80':1030 '8080':978,995,1005,1032 '80gb':441 'a100':430 'a2':432 'a3':442 'access':182,1121,1162 'account':128,251,579,613,690 'add':74,130,586,615,654 'add-iam-policy-bind':129,585,614 'allow':121 'allowprivilegeescal':161,810 'alloydb':141,149,321,326,1209 'alloydb-auth-proxi':148 'alloydb-on-gke.md':171,361 'alway':236,680,800 'annot':98,107,626,629 'api':1120 'apivers':933,1011,1036 'app':941,949,952,956,959,964,1019,1024,1027,1044,1053,1056 'appli':224,255,642 'applic':345,641,925 'apps/v1':934 'architectur':1189 'arg':156 'attach':685 'auth':51,142,150,329,912,1213,1231 'automat':449 'autopilot':231,447,539,736,1098,1155 'autosc':1123 'autoscal':277,1129 'avail':657,717 'baselin':1260 'bash':96,180,570 'batch':1237,1244 'bill':456 'bind':92,117,133,243,589,599,618,691 'capabilities.drop':812,907 'capabl':167 'case':1294 'chart':13,258,289,292,647,1178 'chart.yaml':293 'check':673,871 'checkpoint':831,836 'choos':538 'cli':1059 'cloud':34,378,384,389,1224,1229,1243 'cloud-sql-proxi':388 'cloud.google.com':1250,1253,1256 'cloud.google.com/kubernetes-engine/docs':1249 'cloud.google.com/kubernetes-engine/docs/best-practices':1252 'cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster':1255 'cloudsql-on-gke.md':401 'cluster':18,40,181,185,189,230,276,536,555,563,723,726,730,863,1071,1095,1104,1128 'clusterip':1034 'combin':829 'command':94,314,1159,1165 'compon':262,307 'config':193 'configur':569,840,845,1086,1122,1150 'confirm':670 'connect':49,324,346,382,407,910,1078,1235 'contain':184,498,653,704,851,969 'containerport':977 'context':196,197,798,901,1145 'control':482,552 'core':199 'cost':421 'cost-effect':420 'cpu':981,986 'creat':571,580,597,603 'creation':564,1108,1200 'credenti':188,919 'cronjob':372 'custom':745 'daemonset':470 'databas':22,48,318,909,1077 'debug':1168 'default':460 'defin':859,876 'deliv':838 'demand':828 'deploy':227,253,365,640,922,936,1175,1183 'deployment.yaml':932 'depth':370,1222 'describ':285 'detail':1083,1297 'direct':916 'directori':11 'discount':824 'disrupt':720 'distribut':1191 'document':1092 'driver':450,467 'drop':168 'duplic':1270 'edg':1293 'effect':88,422,496 'effici':427 'email':105 'enabl':458,559,711 'engin':29 'ensur':715 'equal':773 'error':678 'essenti':179,1161 'event':676 'everi':652,703,850 'exampl':920,1087,1153 'exec':216 'exist':87,495,1061 'expens':794 'explicit':696 'expos':749 'extens':1060 'f':210,225 'failur':735 'fals':162,811 'fault':818 'fault-toler':817 'focus':1287 'follow':1091 'format':409 'fsgroup':808 'full':175,364,480,550 'g2':426 'gce':1135 'gcloud':124,183,575,583,609 'gcp':103,118,1119,1279 'gcr.io':154 'gcr.io/alloydb-connectors/alloydb-auth-proxy:latest':153 'gemini':1058 'general':1274 'generic':1265 'get':187,202,205,665 'get-credenti':186 'github.com':1277,1282 'github.com/cofin/flow/blob/main/templates/styleguides/cloud/gcp_scripting.md)':1281 'github.com/cofin/flow/blob/main/templates/styleguides/general.md)':1276 'gke':1,6,25,30,31,320,323,381,839,930,1063,1070,1211,1227,1246 'googl':27,33,541 'google-manag':540 'gpu':20,44,56,67,78,410,412,448,465,472,477,485,511,518,529,741,760,776,779,789,795,820,884,892,1073,1111,1207 'gpu-oper':476 'gpu.md':520 'gpu/tpu':1195 'grace':1193 'grant':573 'gsa':246,355,397,572,581,601,695 'gsa_name@project_id.iam.gserviceaccount.com':134,594,619 'guardrail':679 'guid':1084 'h100':440 'ha':558 'handl':39 'harden':1142 'health':870 'healthi':671 'helm':12,257,288,474,646,1174,1177 'helpers.tpl':296 'highest':443 'hpa':268,366,1125,1218 'hpa/vpa':712 'httpget':991,1001 'iam':125,131,576,587,610,616 'iam.gke.io':114,636 'iam.gke.io/gcp-service-account=gsa_name@project_id.iam.gserviceaccount.com':113,635 'id':591 'ident':17,91,242,333,395,561,568,683,843,967,1116,1217 'imag':152,313,501,972 'imperson':123 'implicit':772 'index':1081 'infer':423 'inference/fine-tuning':428 'ingress':1136 'ingress/egress':755 'initialdelaysecond':996,1006 'instal':451,468,475,645 'integr':1296 'ip':917 'isol':878 'issu':709,1173 'job':376,834,1240 'jobset':1241 'k8s':10 'keep':1284 'key':82,352,490 'kind':935,1013,1038 'ksa':100,109,122,244,598,605,627,631,693,965,968 'ksa-to-gsa':692 'kubectl':7,106,178,192,201,204,208,215,223,254,282,284,286,602,628,664,1158 'kubernet':8,28,37 'l4':425 'label':955 'land':792 'language/framework':1266 'larg':434 'large-scal':433 'level':759 'limit':62,69,506,513,515,701,762,771,856,888,985 'listen':341 'live':873 'livenessprob':1000 'localhost':343,350 'log':209,283,674 'machin':414,746 'manag':36,41,542,1072,1096,1114,1148 'manifest':9,643 'manifest.yaml':226 'manual':466 'matchlabel':948,1052 'member':137,592,622 'memori':983,988 'metadata':937,954,1015,1040 'metric':371,1223 'mig':437,445,457,526,1204 'migration-job.yaml':300 'minavail':1049 'minim':484 'minimum':716 'mode':235 'modul':1152 'monitor':374 'n':213,220,667 'n1':419 'name':110,147,198,212,219,499,582,606,632,938,970,1016,1041 'namespac':111,112,214,221,607,608,633,634,668,758,877,942,1020,1046 'namespace/ksa_name':140,625 'nap':527,1205 'need':398,740 'neighbor':708 'network':752,880,1131,1138,1172 'never':71,247,684,748,764 'node':14,21,79,203,249,279,481,543,551,688,721,742,780,796,847,893,1105,1169,1198 'noisi':707 'noisy-neighbor':706 'non':788 'non-gpu':787 'nonroot':799 'noschedul':89,497 'note':416 'nvcr.io':503 'nvcr.io/nvidia/pytorch:24.01-py3':502 'nvidia':417,424,429,439 'nvidia.com':64,84,492,508,767,783,897 'nvidia.com/gpu':83,491,766 'nvidia.com/gpu:':63,507 'nvidia.com/gpu=present:noschedule':782,896 'nvidia/gpu-operator':479 'observ':281 'offici':1247 'on-demand':826 'oper':86,200,463,473,478,494,1164 'password':349 'path':992,1002 'pattern':95,177,290,377,396,532,1079,1179,1236 'pay':453,545 'pay-per-pod':452,544 'pdb':1045 'pdb.yaml':1035 'per':261,306,454,546 'per-compon':260 'periodsecond':998,1008 'permiss':574,686 'pod':57,206,211,218,270,404,455,486,547,666,790,1143,1170 'poddisruptionbudget':655,714,857,1039 'point':733 'polici':132,588,617,753,881,1139 'policy/v1':1037 'pool':15,743,894,1106,1110,1199 'port':158,317,976,994,1004,1028,1029 'prefer':737 'present':883 'prevent':705,786 'principl':1275 'privat':1103 'probe':874 'product':47,176,239,557,728,861,869,943,1021,1047,1076 'project':584,590 'project_id.svc.id.goog':139,624 'projects/project_id/locations/region/clusters/cluster/instances/instance':157 'provid':1066 'provisioningrequest':1242 'proxi':52,143,151,330,335,391,913,1214,1232 'put':765 'queue':369,373,1190,1221 'queue-depth':368,1220 'quick':54,59,145 'readi':872 'readinessprob':990 'recommend':232 'reduc':1269 'refer':55,1080,1088,1094,1248 'references/alloydb-on-gke.md':172,362,1212 'references/autoscaling.md':1124 'references/batch-workloads.md':1239 'references/cloudsql-on-gke.md':402,1228 'references/cluster.md':1097 'references/gpu.md':521,1197 'references/helm_deployment.md':1176 'references/kubectl.md':1160 'references/networking.md':1132 'references/node_pools.md':1107 'references/saq_workers.md':1186 'references/security.md':1141 'references/terraform.md':1151 'references/troubleshooting.md':1167 'references/workload_identity.md':1117 'region':190,191,237,554,725,865 'regional/zonal':1101 'replica':945 'replicacount':312 'request':73,516,699,770,774,854,891,980 'requests/limits':650 'resourc':61,315,505,649,698,777,853,885,979 'restrict':754 'right':274 'right-siz':273 'role':135,353,595,620 'roles/alloydb.client':356 'roles/cloudsql.client':399 'roles/iam.workloadidentityuser':136,621 'roles/logging.logwriter':359 'roles/secretmanager.secretaccessor':357 'roles/storage.admin':596 'roles/storage.objectadmin':358 'rollout':672 'rule':1267 'run':336,663 'runasgroup':806 'runasnonroot':163,802,903 'runasus':165,804,905 'sa':104,119,848 'saq':1184,1187 'scale':19,43,267,435,724 'script':1280 'secret':1147 'section':305 'secur':797,900,1118,1140,1144 'securitycontext':160 'see':170,360,400,519 'selector':947,1023,1051 'separ':304 'seri':415 'servic':38,127,250,578,612,689,928,1014,1133 'service-account':126,577,611 'service.yaml':1010 'serviceaccount':108,138,593,604,623,630 'serviceaccountnam':961 'set':648,697,801,902 'setup':537,1102,1130 'share':525,1203,1258,1262 'shutdown':1194 'sidecar':23,53,144,331,339,392,914,1215,1233 'simpler':462 'singl':732 'size':275 'skill':1065,1273,1286 'skill-gke' 'source-cofin' 'spec':58,405,487,488,944,960,1022,1048 'special':1109 'specif':1291 'specifi':311 'spot':528,815,1112,1206 'sql':379,385,390,1225,1230 'standard':234,464,549,1100,1157 'step':534,565,638,660 'string':408 'structur':301 'styleguid':1259,1263 'support':438,446 't4':418 'taint':77,778,899 'targetport':1031 'task':921 'templat':295,953 'terraform':1149 'text':291 'throughput':444 'time':524,1202 'time-shar':523,1201 'toler':75,81,489,819 'tool':1290 'tool-specif':1289 'top':287 'topic-agent-skills' 'topic-ai-agents' 'topic-beads' 'topic-claude-code' 'topic-codex' 'topic-cursor' 'topic-developer-tools' 'topic-gemini-cli' 'topic-opencode' 'topic-plugin' 'topic-slash-commands' 'topic-spec-driven-development' 'tpu':531,1208 'train':436,833 'trainer':500 'troubleshoot':26,1166 'true':164,803,904 'type':413,747,1033,1134 'uniqu':1067 'unless':738 'upgrad':42,659,722 'us-central1-docker.pkg.dev':974 'us-central1-docker.pkg.dev/my-project/repo/web-app:v1.2.0':973 'usag':849 'use':2,195,248,553,681,713,781,814,911,1261 'use-context':194 'user':348 'v1':1012 'v1.29.3':461 'valid':662,835 'valu':263,1068 'values.yaml':294,302 'verifi':841 'via':50,327,386,469,687 'voluntari':719 'vpa':271,1126 'vs':825,1099,1245 'web':264,308,924,940,951,958,963,971,1018,1026,1043,1055,1181 'web-app':939,950,957,1017,1025,1054 'web-app-ksa':962 'web-app-pdb':1042 'web-deployment.yaml':297 'web-service.yaml':298 'without':751 'work':4 'worker':265,309,1182,1185,1188 'worker-deployment.yaml':299 'workflow':228,533,1292 'workload':16,45,90,241,332,394,411,560,567,682,750,821,842,862,966,1074,1115,1196,1216,1238 'yaml':60,80,146,483,931 'zonal':729,867","prices":[{"id":"504e122a-e828-4d16-a593-b9c750781264","listingId":"29a2a353-3ea0-4eea-8a11-9825775ede08","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"cofin","category":"flow","install_from":"skills.sh"},"createdAt":"2026-04-23T13:03:59.426Z"}],"sources":[{"listingId":"29a2a353-3ea0-4eea-8a11-9825775ede08","source":"github","sourceId":"cofin/flow/gke","sourceUrl":"https://github.com/cofin/flow/tree/main/skills/gke","isPrimary":false,"firstSeenAt":"2026-04-23T13:03:59.426Z","lastSeenAt":"2026-05-18T19:07:37.288Z"}],"details":{"listingId":"29a2a353-3ea0-4eea-8a11-9825775ede08","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"cofin","slug":"gke","github":{"repo":"cofin/flow","stars":11,"topics":["agent-skills","ai-agents","beads","claude-code","codex","context-driven-development","cursor","developer-tools","gemini-cli","opencode","plugin","slash-commands","spec-driven-development","subagents","tdd","workflow"],"license":"apache-2.0","html_url":"https://github.com/cofin/flow","pushed_at":"2026-04-27T19:07:26Z","description":"Context-Driven Development toolkit for AI agents — spec-first planning, TDD workflow, and Beads integration.","skill_md_sha":"dc4e5621003e769890462e1bddf382f500452aca","skill_md_path":"skills/gke/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/cofin/flow/tree/main/skills/gke"},"layout":"multi","source":"github","category":"flow","frontmatter":{"name":"gke","description":"Use when working with GKE, kubectl, Kubernetes manifests, k8s directories, Helm charts, node pools, workload identity, cluster scaling, GPU nodes, database sidecars, or GKE troubleshooting."},"skills_sh_url":"https://skills.sh/cofin/flow/gke"},"updatedAt":"2026-05-18T19:07:37.288Z"}}