GKE Productionize Skill
This skill acts as a high-level orchestrator for preparing a GKE cluster and its
workloads for production readiness.
[!IMPORTANT] This is a meta-skill or orchestrator skill. You are
expected to invoke and run many other specialized skills listed in this
document as part of the overall productionization process. Do not attempt to
implement all production readiness features directly within this skill;
instead, use this skill to assess the environment and then delegate to the
specific skills for each domain.
Scope
This skill is adaptable to:
- A single application (already on Kubernetes or not).
- A set of applications.
- A target cluster.
Workflow
1. Discovery Phase
Before making recommendations, discover the current state of the environment.
Cluster Discovery
Run these commands to understand the cluster setup:
- Check cluster details:
gcloud container clusters describe {cluster_name} --location {location} --project {project}
- Check for Autopilot vs Standard: Look for
autopilot: true in the describe
output.
- Check release channel: Look for
releaseChannel.
Workload Discovery
If a specific application is targeted, discover its configuration:
- Get deployment/statefulset details:
kubectl get deployment {app_name} -n {namespace} -o yaml
- Check for dedicated namespace and labels:
kubectl get namespace {namespace} -o yaml (Look for Pod Security Standards labels).
- Check for dedicated service account usage:
kubectl get pods -n {namespace} -o custom-columns="NAME:.metadata.name,SERVICE_ACCOUNT:.spec.serviceAccountName"
- Check for resource requests and limits.
- Check for liveness, readiness, and startup probes.
- Check for HPA:
kubectl get hpa -n {namespace}
- Check for PDB:
kubectl get pdb -n {namespace}
- Check for NetworkPolicies:
kubectl get networkpolicy -n {namespace}
2. Production Readiness Assessment
Before implementation, you MUST run the skills for each relevant specialized
area listed below and incorporate its guidance into your assessment and plan.
Failure to do so will result in a non-compliant production configuration.
A. App Onboarding (Pre-Kubernetes)
If the application is not yet running on GKE, you MUST run the
gke-app-onboarding skill for planning containerization, image building, and
basic deployment.
B. Scalability & Resource Management
Ensure workloads have appropriate resources and autoscaling.
- Action: You MUST run the
gke-workload-scaling skill for configuring
HPA, VPA, and resource limits.
C. Observability
Ensure adequate logging and monitoring are in place.
- Action: You MUST run the
gke-observability skill for setting up Cloud
Logging, Monitoring, and Managed Prometheus.
D. Reliability
Ensure high availability and graceful degradation.
- Action: You MUST run the
gke-reliability skill for configuring
regional clusters, PDBs, and health probes.
E. Security
Harden the cluster and workloads.
- Action: You MUST run the
gke-platform-security and
gke-workload-security skills for Workload Identity, Network Policies, and
Shielded Nodes.
- Namespace Isolation: Ensure workloads run in dedicated namespaces with
Pod Security Standards (PSS) enforced via labels.
- Least Privilege: Ensure workloads use dedicated ServiceAccounts instead
of the
default ServiceAccount.
F. Backup & Disaster Recovery
Ensure stateful data is protected.
- Action: You MUST run the
gke-backup-dr skill for configuring Backup
for GKE and restore procedures.
G. Edge Security & Ingress
Secure external access.
- Action: You MUST run the
gke-service-networking skill for Gateway API,
Ingress, and Cloud Armor.
H. Cost Optimization
Ensure efficient use of resources.
- Action: You MUST run the
gke-cost-optimization skill for strategies on
rightsizing, quotas, and Spot VMs.
3. Production Readiness Scoring
After the assessment, provide a summary report with a RAG (Red, Amber, Green)
status for each area and an overall readiness score. This helps prioritize
remediation efforts.
Adaptability Guidelines
- Single App: Focus on Health Probes, HPA, Resource Limits, PDB, and
Workload Identity for that specific app.
- Cluster Wide: Focus on Cluster Autoscaler, Multi-zonal setup, Release
Channels, Maintenance Windows, and default Network Policies.
- Proactive Execution: Proactively execute relevant skills (e.g.,
observability, security, scaling, reliability) to assess and propose
improvements, seeking user confirmation before applying state-changing
implementations.
Source: google/skills → skills/cloud/gke-productionize/SKILL.md
1---2name: gke-productionize3description: Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).4---5
6
7# GKE Productionize Skill
8
9This skill acts as a high-level orchestrator for preparing a GKE cluster and its
10workloads for production readiness.
11
12> [!IMPORTANT] This is a **meta-skill** or **orchestrator skill**. You are
13> expected to invoke and run many other specialized skills listed in this
14> document as part of the overall productionization process. Do not attempt to
15> implement all production readiness features directly within this skill;
16> instead, use this skill to assess the environment and then delegate to the
17> specific skills for each domain.
18
19## Scope
20
21This skill is adaptable to:
22
23- A single application (already on Kubernetes or not).
24- A set of applications.
25- A target cluster.
26
27## Workflow
28
29### 1. Discovery Phase
30
31Before making recommendations, discover the current state of the environment.
32
33#### Cluster Discovery
34
35Run these commands to understand the cluster setup:
36
37- Check cluster details: `gcloud container clusters describe {cluster_name}
38 --location {location} --project {project}`
39- Check for Autopilot vs Standard: Look for `autopilot: true` in the describe
40 output.
41- Check release channel: Look for `releaseChannel`.
42
43#### Workload Discovery
44
45If a specific application is targeted, discover its configuration:
46
47- Get deployment/statefulset details: `kubectl get deployment {app_name} -n
48 {namespace} -o yaml`
49- Check for dedicated namespace and labels: `kubectl get namespace {namespace}
50 -o yaml` (Look for Pod Security Standards labels).
51- Check for dedicated service account usage: `kubectl get pods -n {namespace}
52 -o
53 custom-columns="NAME:.metadata.name,SERVICE_ACCOUNT:.spec.serviceAccountName"`
54- Check for resource requests and limits.
55- Check for liveness, readiness, and startup probes.
56- Check for HPA: `kubectl get hpa -n {namespace}`
57- Check for PDB: `kubectl get pdb -n {namespace}`
58- Check for NetworkPolicies: `kubectl get networkpolicy -n {namespace}`
59
60### 2. Production Readiness Assessment
61
62**Before implementation, you MUST run the skills for each relevant specialized
63area listed below and incorporate its guidance into your assessment and plan.
64Failure to do so will result in a non-compliant production configuration.**
65
66#### A. App Onboarding (Pre-Kubernetes)
67
68If the application is not yet running on GKE, you MUST run the
69`gke-app-onboarding` skill for planning containerization, image building, and
70basic deployment.
71
72#### B. Scalability & Resource Management
73
74Ensure workloads have appropriate resources and autoscaling.
75
76- **Action**: You MUST run the `gke-workload-scaling` skill for configuring
77 HPA, VPA, and resource limits.
78
79#### C. Observability
80
81Ensure adequate logging and monitoring are in place.
82
83- **Action**: You MUST run the `gke-observability` skill for setting up Cloud
84 Logging, Monitoring, and Managed Prometheus.
85
86#### D. Reliability
87
88Ensure high availability and graceful degradation.
89
90- **Action**: You MUST run the `gke-reliability` skill for configuring
91 regional clusters, PDBs, and health probes.
92
93#### E. Security
94
95Harden the cluster and workloads.
96
97- **Action**: You MUST run the `gke-platform-security` and
98 `gke-workload-security` skills for Workload Identity, Network Policies, and
99 Shielded Nodes.
100- **Namespace Isolation**: Ensure workloads run in dedicated namespaces with
101 Pod Security Standards (PSS) enforced via labels.
102- **Least Privilege**: Ensure workloads use dedicated ServiceAccounts instead
103 of the `default` ServiceAccount.
104
105#### F. Backup & Disaster Recovery
106
107Ensure stateful data is protected.
108
109- **Action**: You MUST run the `gke-backup-dr` skill for configuring Backup
110 for GKE and restore procedures.
111
112#### G. Edge Security & Ingress
113
114Secure external access.
115
116- **Action**: You MUST run the `gke-service-networking` skill for Gateway API,
117 Ingress, and Cloud Armor.
118
119#### H. Cost Optimization
120
121Ensure efficient use of resources.
122
123- **Action**: You MUST run the `gke-cost-optimization` skill for strategies on
124 rightsizing, quotas, and Spot VMs.
125
126### 3. Production Readiness Scoring
127
128After the assessment, provide a summary report with a RAG (Red, Amber, Green)
129status for each area and an overall readiness score. This helps prioritize
130remediation efforts.
131
132## Adaptability Guidelines
133
134- **Single App**: Focus on Health Probes, HPA, Resource Limits, PDB, and
135 Workload Identity for that specific app.
136- **Cluster Wide**: Focus on Cluster Autoscaler, Multi-zonal setup, Release
137 Channels, Maintenance Windows, and default Network Policies.
138- **Proactive Execution**: Proactively execute relevant skills (e.g.,
139 observability, security, scaling, reliability) to assess and propose
140 improvements, seeking user confirmation before applying state-changing
141 implementations.
142
143---
144
145**Source:** [`google/skills`](https://github.com/google/skills) → `skills/cloud/gke-productionize/SKILL.md`
thedixitjain