본문으로 건너뛰기
cccskills
무료GitHub에 공개

gke-networking

Plans, configures, and manages core GKE cluster networking. Covers private clusters, VPC-native configurations, DNS, node egress, Dataplane V2, and IP planning. Use when designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges, or managing VPC- native cluster modes. Don't use for application ingress, load balancing, or service networking (use gke-service-networking instead).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila
연동 도구Google Cloud
설치 방법 보기

포함된 파일(1)

  • SKILL.md5.8 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

GKE Networking

This reference covers networking configuration for GKE clusters. The golden path enforces private, VPC-native clusters with Dataplane V2.

MCP Tools: get_cluster, update_cluster, apply_k8s_manifest, get_k8s_resource

Golden Path Networking Defaults

SettingGolden Path ValueDay-0/1Notes
privateClusterConfig.enablePrivateNodestrueDay-0Nodes have no public IPs
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabledtrueDay-0Control plane only reachable via private endpoint or DNS
controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffictrueDay-0Allows DNS-based access from outside VPC
networkConfig.datapathProviderADVANCED_DATAPATH (Dataplane V2)Day-0eBPF-based, built-in Network Policy
networkConfig.dnsConfig.clusterDnsCLOUD_DNSDay-0Managed DNS, more reliable than kube-dns
networkConfig.enableIntraNodeVisibilitytrueDay-1VPC Flow Logs for intra-node traffic
ipAllocationPolicy.autoIpamConfig.enabledtrueDay-0Automatic IP range management
ipAllocationPolicy.createSubnetworktrueDay-0Auto-create dedicated subnet
defaultMaxPodsConstraint.maxPodsPerNode48Day-0Conservative default; 110 for high density

Private Cluster Access Patterns

The golden path creates a private cluster. Users access it via:

  1. DNS endpoint (default): allowExternalTraffic: true enables access via the cluster's DNS endpoint from outside the VPC. No VPN required.
  2. Private endpoint: Direct access from within the VPC or via Cloud VPN/Interconnect.
  3. Authorized networks: Add specific CIDRs to masterAuthorizedNetworksConfig for IP-based access control.
# Access private cluster via DNS endpoint (golden path default)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --dns-endpoint \
  --quiet

# Access via private endpoint (from within VPC)
gcloud container clusters get-credentials {cluster_name} \
  --region {region} --internal-ip \
  --quiet

Bring-Your-Own VPC/Subnet

If the customer has existing network infrastructure:

gcloud container clusters create-auto {cluster_name} \
  --region {region} \
  --network {vpc_name} \
  --subnetwork {subnet_name} \
  --cluster-secondary-range-name {pod_range} \
  --services-secondary-range-name {svc_range} \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet

Day-0 Warning: VPC, subnet, and IP ranges cannot be changed after cluster creation.

VPC-Native Mode Benefits

VPC-native clusters route traffic natively using GCP Alias IP ranges. Key benefits to cover:

  1. Scalability: Traffic routes natively inside the VPC, bypassing the need for custom routes and avoiding custom route limit bottlenecks.
  2. Direct VPC Integration: Direct resource integration across GCP networks without complex bridging or routing tunnels.
  3. Avoiding IP Exhaustion: Supports discontiguous IP ranges and optimizes allocation, reducing the risk of exhausting subnet IP ranges.

IP Planning

ResourceGolden PathNotes
Pod CIDR/17 (auto)~32K pod IPs; size based on maxPodsPerNode
Service CIDR/20 (auto)~4K service IPs
Node subnetauto-created/20 recommended for growth
Max pods/node48Each node gets a /25 pod range; set to 110
: : : for /24 per node :

Pod CIDR sizing rule of thumb:

  • maxPodsPerNode=48 -> each node uses a /25 (128 IPs) from pod CIDR
  • maxPodsPerNode=110 -> each node uses a /24 (256 IPs) from pod CIDR
  • Larger maxPodsPerNode = fewer nodes fit in a given CIDR

Egress

  • Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs) to allow private nodes to reach the internet without public IP exposure.
  • For static egress IPs: configure Cloud NAT with manual IP allocation to maintain a consistent source IP for external allowlists or partner firewalls.
  • For restricted egress: route through a firewall appliance via custom routes to inspect and filter outbound traffic according to organization security policies.

Network Policy

Dataplane V2 (golden path) provides built-in Network Policy enforcement — no additional addon needed. Apply default-deny per namespace, then allow specific flows.

See the gke-workload-security skill for default-deny policy and the gke-multitenancy skill for per-team allow policies.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

agent-platform-alert-configuration

무료

Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

agent-platform-deploy

무료

Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a specific model is deployable (`gcloud ai model-garden models list-deployment-config`), query deployment cost, troubleshoot deployment errors (like quota limits), or undeploy/clean up endpoints. Also use when copying and deploying a 1P Tuned Model. Don't use for pure listing/discovery questions of the form "is X deployed?", "list my endpoints", or "which regions have models running?" — for those use `agent-platform-endpoint-management`. Don't use for public Vertex AI deployments (use the `vertex-deploy` skill) or for running model evaluations (use the `agent-platform-eval-flywheel` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

agent-platform-endpoint-management

무료

Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serving endpoints for model deployment on Agent Platform. Also use when troubleshooting endpoint permission, quota, or resource busy errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

agent-platform-eval-flywheel

무료

Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on Agent Platform eval methodology — including dataset schema, LLM-as-judge scoring, and common failure causes. For fine-tuning, use agent-platform-tuning. For general production deployment, use agent-platform-deploy.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

agent-platform-inference

무료

Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global/regional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

agent-platform-migrate-from-ai-studio

무료

Guides agents and users through migrating from Gemini API in Google AI Studio to Gemini Enterprise Agent Platform (formerly Vertex AI). Use this skill when moving applications to Google Cloud, to leverage Cloud credits, or to unify inferencing with other Cloud infrastructure (IAM, billing, telemetry).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

vaila-multimodaltoolbox의 스킬 모두 보기

이 스킬의 문제 신고