Trigger: Use when working with GKE Golden Path — Google Kubernetes Engine configuration and management.
GKE Golden Path Configuration
The golden path is the recommended Autopilot configuration for production
clusters. It defines sensible defaults — when the user requests different
settings, apply them and note relevant trade-offs.
MCP Tools: get_cluster, create_cluster, update_cluster
Rules
- Default to the golden path. Use golden path values unless the user
requests otherwise. When deviating, note trade-offs but respect the user's
choice.
- Day-0 vs Day-1. Flag Day-0 decisions (networking, private nodes,
subnets, IP allocation) prominently — they are hard/impossible to change
after creation.
- Tool preference: MCP > gcloud > kubectl. See the
gke-basics skill's
CLI reference for full coverage matrix and override options. If the user
says "use gcloud" or "use kubectl", respect that for the session.
- Document decisions and rationale, especially for Day-0 choices and
golden path deviations.
Required Inputs
If the user is unsure, use golden path defaults.
- Project ID (required)
- Region (required, e.g.,
us-central1)
- Cluster name (required)
- Environment type: dev/test or production (defaults to production)
- Networking: bring-your-own VPC/subnet or auto-create (default:
auto-create)
- Scale expectations: expected node/pod count, workload types
- Cost constraints: Spot VM tolerance, budget considerations
Always-Apply Defaults
Recommended best practices applied by default. If the user requests a different
setting, apply it and briefly note the security or operational trade-off.
| Setting |
Golden Path Value |
autopilot.enabled |
true |
privateClusterConfig.enablePrivateNodes |
true |
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled |
true |
secretManagerConfig.enabled + rotationInterval: 120s |
true |
rbacBindingConfig.enableInsecureBinding* |
false (both) |
workloadIdentityConfig.workloadPool |
enabled |
networkConfig.datapathProvider |
ADVANCED_DATAPATH |
networkConfig.dnsConfig.clusterDns |
CLOUD_DNS |
autoscaling.autoscalingProfile |
OPTIMIZE_UTILIZATION |
verticalPodAutoscaling.enabled |
true |
monitoringConfig components |
SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER |
loggingConfig components |
SYSTEM_COMPONENTS, WORKLOADS (enabled by default) |
advancedDatapathObservabilityConfig.enableMetrics |
true |
nodeConfig.shieldedInstanceConfig.enableSecureBoot |
true |
nodeConfig.workloadMetadataConfig.mode |
GKE_METADATA |
nodeConfig.gcfsConfig.enabled / gvnic.enabled |
true / true |
addonsConfig.statefulHaConfig.enabled |
true |
| Storage CSI drivers (Filestore, GCS FUSE, Parallelstore) |
enabled |
| Pod Security Standards |
restricted on production namespaces |
Customer-Configurable Settings
These have golden path defaults but customers may deviate with valid
justification. Ask before changing.
| Setting |
Default |
Why Deviate |
dnsEndpointConfig.allowExternalTraffic |
true |
Restrict if cluster only accessed from within VPC |
autoIpamConfig / createSubnetwork |
true / true |
Customer has pre-existing VPC/subnets |
maxPodsPerNode |
48 |
110 for high pod-density (costs more CIDR space) |
subnetwork |
auto-created |
Customer brings existing subnets |
| Maintenance exclusion windows |
configured (NO_MINOR_UPGRADES, 1yr) |
Customer-specific scheduling |
nodeConfig.bootDisk.diskType |
pd-balanced |
pd-ssd for I/O-intensive, pd-standard for cost |
nodeConfig.machineType |
ek-standard-8 (Autopilot) |
Varies by workload; use ComputeClasses |
Guardrails
- Do not request or output secrets (tokens, keys, service account JSON).
- Discover project/cluster context via MCP tools or
gcloud config get-value project — don't ask users to paste project IDs.
- For Day-0 decisions, always ask clarifying questions before proceeding.
- For Day-1 features, propose golden path defaults with trade-offs and let the
customer confirm.
- Do not promise zero downtime; advise PDBs, health probes, replicas, and
staged upgrades.
- When auditing existing clusters, compare against golden path and report
deviations with severity and remediation.
Golden Path Config
See golden-path-autopilot.yaml for the
full cluster-level policy settings.
1---2name: gke-golden-path3description: **Trigger**: Use when working with GKE Golden Path — Google Kubernetes Engine configuration and management.4---56**Trigger**: Use when working with GKE Golden Path — Google Kubernetes Engine configuration and management.78# GKE Golden Path Configuration910The golden path is the recommended Autopilot configuration for production11clusters. It defines sensible defaults — when the user requests different12settings, apply them and note relevant trade-offs.1314> **MCP Tools:** `get_cluster`, `create_cluster`, `update_cluster`1516## Rules17181. **Default to the golden path.** Use golden path values unless the user19 requests otherwise. When deviating, note trade-offs but respect the user's20 choice.212. **Day-0 vs Day-1.** Flag Day-0 decisions (networking, private nodes,22 subnets, IP allocation) prominently — they are hard/impossible to change23 after creation.243. **Tool preference: MCP > gcloud > kubectl.** See the `gke-basics` skill's25 CLI reference for full coverage matrix and override options. If the user26 says "use gcloud" or "use kubectl", respect that for the session.274. **Document decisions and rationale**, especially for Day-0 choices and28 golden path deviations.2930## Required Inputs3132If the user is unsure, use golden path defaults.3334- **Project ID** (required)35- **Region** (required, e.g., `us-central1`)36- **Cluster name** (required)37- **Environment type**: dev/test or production (defaults to production)38- **Networking**: bring-your-own VPC/subnet or auto-create (default:39 auto-create)40- **Scale expectations**: expected node/pod count, workload types41- **Cost constraints**: Spot VM tolerance, budget considerations4243## Always-Apply Defaults4445Recommended best practices applied by default. If the user requests a different46setting, apply it and briefly note the security or operational trade-off.4748Setting | Golden Path Value49------------------------------------------------------------------ | -----------------50`autopilot.enabled` | `true`51`privateClusterConfig.enablePrivateNodes` | `true`52`masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled` | `true`53`secretManagerConfig.enabled` + `rotationInterval: 120s` | `true`54`rbacBindingConfig.enableInsecureBinding*` | `false` (both)55`workloadIdentityConfig.workloadPool` | enabled56`networkConfig.datapathProvider` | `ADVANCED_DATAPATH`57`networkConfig.dnsConfig.clusterDns` | `CLOUD_DNS`58`autoscaling.autoscalingProfile` | `OPTIMIZE_UTILIZATION`59`verticalPodAutoscaling.enabled` | `true`60`monitoringConfig` components | SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER61`loggingConfig` components | SYSTEM_COMPONENTS, WORKLOADS (enabled by default)62`advancedDatapathObservabilityConfig.enableMetrics` | `true`63`nodeConfig.shieldedInstanceConfig.enableSecureBoot` | `true`64`nodeConfig.workloadMetadataConfig.mode` | `GKE_METADATA`65`nodeConfig.gcfsConfig.enabled` / `gvnic.enabled` | `true` / `true`66`addonsConfig.statefulHaConfig.enabled` | `true`67Storage CSI drivers (Filestore, GCS FUSE, Parallelstore) | enabled68Pod Security Standards | `restricted` on production namespaces6970## Customer-Configurable Settings7172These have golden path defaults but customers may deviate with valid73justification. **Ask before changing.**7475Setting | Default | Why Deviate76---------------------------------------- | ----------------------------------- | -----------77`dnsEndpointConfig.allowExternalTraffic` | `true` | Restrict if cluster only accessed from within VPC78`autoIpamConfig` / `createSubnetwork` | `true` / `true` | Customer has pre-existing VPC/subnets79`maxPodsPerNode` | `48` | `110` for high pod-density (costs more CIDR space)80`subnetwork` | auto-created | Customer brings existing subnets81Maintenance exclusion windows | configured (NO_MINOR_UPGRADES, 1yr) | Customer-specific scheduling82`nodeConfig.bootDisk.diskType` | `pd-balanced` | `pd-ssd` for I/O-intensive, `pd-standard` for cost83`nodeConfig.machineType` | `ek-standard-8` (Autopilot) | Varies by workload; use ComputeClasses8485## Guardrails8687- Do not request or output secrets (tokens, keys, service account JSON).88- Discover project/cluster context via MCP tools or `gcloud config get-value89 project` — don't ask users to paste project IDs.90- For Day-0 decisions, always ask clarifying questions before proceeding.91- For Day-1 features, propose golden path defaults with trade-offs and let the92 customer confirm.93- Do not promise zero downtime; advise PDBs, health probes, replicas, and94 staged upgrades.95- When auditing existing clusters, compare against golden path and report96 deviations with severity and remediation.9798## Golden Path Config99100See [golden-path-autopilot.yaml](./assets/golden-path-autopilot.yaml) for the101full cluster-level policy settings.
LoopyLuci