Skip to main content ホーム クリエイター lukaskellerstein codex-my-marketplace kubernetes-gke
kubernetes-gke Kubernetes cluster management and operations with focus on Google Kubernetes Engine (GKE). Use when working with Kubernetes clusters, deployments, services, pods, namespaces, GKE-specific features, kubectl commands, YAML manifests, helm charts, or when troubleshooting Kubernetes issues. Includes GKE autopilot, workload identity, config connector, and GCP integration.
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/lukaskellerstein/codex-my-marketplace --skill kubernetes-gkeコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... Create a feature branch following the git flow branching model, commit staged or unstaged changes with a well-crafted commit message, and open a GitHub Pull Request with a meaningful title, description, and assignee. Follows git flow conventions — branches are created from and merged back into `develop`, with `feature/`, `hotfix/`, `release/`, and `bugfix/` prefixes. Use this skill whenever the user wants to commit their work and raise a PR, says things like "commit and open a PR", "create a pull request for my changes", "push this to a branch", "ship this", "submit this for review", or any variation of wanting to save work and create a GitHub PR. Always use this skill even if the user only mentions one part (e.g. "just commit this") — the full branch-commit-PR flow is the default behavior.
ALWAYS use this skill when the user asks to create, draw, design, produce, or generate any visual asset that is not a photograph or illustration. Fires on words like diagram, chart, graph, flowchart, architecture, system map, topology, sequence diagram, state machine, class diagram, ER diagram, C4, UML, BPMN, mind map, org chart, wireframe, mockup, UI sketch, infographic, dashboard, treemap, sankey, heatmap, choropleth, network graph, map, plot, visualization, mermaid, d3, drawio, draw.io, .drawio, or any request to "visualize", "render", "show as a diagram", or produce .drawio / .png / .svg / .pdf architecture artifacts. Fires on domain phrasings like "AWS architecture", "Kubernetes namespaces", "microservices diagram", "identity/auth flow", "repo topology", "dev environment", "system context", "data flow", "pipeline diagram", "network topology", "P&ID", "wiring diagram". Routes to Mermaid for text-based docs diagrams, D3.js for data-driven charts/maps, and Draw.io for architecture/vendor-icon/editable deliv
CONFIG_CONNECTOR.md 5.6 KB PRIVATE_CLUSTERS.md 8.8 KB name kubernetes-gke description Kubernetes cluster management and operations with focus on Google Kubernetes Engine (GKE). Use when working with Kubernetes clusters, deployments, services, pods, namespaces, GKE-specific features, kubectl commands, YAML manifests, helm charts, or when troubleshooting Kubernetes issues. Includes GKE autopilot, workload identity, config connector, and GCP integration.
Kubernetes with GKE Focus
Comprehensive guidance for Kubernetes operations with specialized knowledge of Google Kubernetes Engine (GKE) features and best practices.
Quick Start
Check cluster status
gcloud container clusters list
gcloud container clusters get-credentials CLUSTER_NAME --region REGION
kubectl cluster-info
kubectl get nodes
Common operations
kubectl apply -f deployment.yaml
kubectl get pods -n NAMESPACE
kubectl logs POD_NAME -n NAMESPACE
kubectl scale deployment DEPLOYMENT_NAME --replicas=3 -n NAMESPACE
Core Workflows
1. Application Deployment
Standard deployment pattern:
Create namespace (if needed):
kubectl create namespace my-app
Apply manifests in order:
kubectl apply -f configmap.yaml
kubectl apply -f secret.yaml
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml
kubectl apply -f ingress.yaml
Verify deployment:
kubectl rollout status deployment/my-app -n my-app
kubectl get all -n my-app
2. Troubleshooting Pods Systematic debugging approach:
kubectl get pods -n NAMESPACE
kubectl describe pod POD_NAME -n NAMESPACE
kubectl get events -n NAMESPACE --sort-by='.lastTimestamp'
kubectl logs POD_NAME -n NAMESPACE
kubectl logs POD_NAME -n NAMESPACE --previous
kubectl logs -f POD_NAME -n NAMESPACE
kubectl logs POD_NAME -c CONTAINER_NAME -n NAMESPACE
kubectl exec -it POD_NAME -n NAMESPACE -- /bin/sh
kubectl port-forward POD_NAME 8080:80 -n NAMESPACE
3. Resource Management
kubectl top nodes
kubectl top pods -n NAMESPACE
kubectl get resourcequota -n NAMESPACE
kubectl get limitrange -n NAMESPACE
GKE-Specific Features
Autopilot vs Standard Clusters
Fully managed node pools
Automatic scaling and updates
Pod-based pricing
Limited node customization
Use for: simplified operations, cost optimization
Full control over nodes
Custom node pools
Node-based pricing
Machine type selection
Use for: specific hardware requirements, advanced configurations
Workload Identity Enable workload identity for GCP service access:
gcloud container clusters update CLUSTER_NAME \
--workload-pool=PROJECT_ID.svc.id.goog \
--region=REGION
Create Kubernetes service account:
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-ksa
namespace: default
Bind to GCP service account:
gcloud iam service-accounts add-iam-policy-binding \
GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"
Annotate Kubernetes service account:
kubectl annotate serviceaccount KSA_NAME \
iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
-n NAMESPACE
GKE Ingress Use GKE-managed ingress controller:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
annotations:
kubernetes.io/ingress.class: "gce"
kubernetes.io/ingress.global-static-ip-name: "my-static-ip"
spec:
rules:
- host: example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: my-service
port:
number: 80
For HTTPS with managed certificates:
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
name: my-cert
spec:
domains:
- example.com
- www.example.com
Add annotation to Ingress:
metadata:
annotations:
networking.gke.io/managed-certificates: my-cert
Config Connector Manage GCP resources from Kubernetes:
GKE Networking Network policies for pod security:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-namespace
spec:
podSelector:
matchLabels:
app: my-app
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: allowed-namespace
Control plane is private
Use Cloud NAT for egress
VPC peering for internal access
See PRIVATE_CLUSTERS.md for setup
Manifest Patterns
Deployment Best Practices apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
namespace: production
spec:
replicas: 3
selector:
matchLabels:
app: my-app
template:
metadata:
labels:
app: my-app
version: v1.2.3
spec:
serviceAccountName: my-ksa
containers:
- name: app
image: gcr.io/PROJECT_ID/my-app:v1.2.3
ports:
- containerPort: 8080
name: http
env:
- name: ENV_VAR
valueFrom:
configMapKeyRef:
name: my-config
key: config-key
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: cloud.google.com/gke-nodepool
operator: In
values:
- default-pool
Service Types apiVersion: v1
kind: Service
metadata:
name: my-service
spec:
type: ClusterIP
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
apiVersion: v1
kind: Service
metadata:
name: my-lb-service
annotations:
cloud.google.com/load-balancer-type: "Internal"
spec:
type: LoadBalancer
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
ConfigMaps and Secrets apiVersion: v1
kind: ConfigMap
metadata:
name: my-config
data:
app.properties: |
key1=value1
key2=value2
config.json: |
{
"setting": "value"
}
Secret (use GCP Secret Manager with workload identity when possible):
apiVersion: v1
kind: Secret
metadata:
name: my-secret
type: Opaque
data:
password: BASE64_ENCODED_VALUE
Helm Integration
Basic Helm operations
helm repo add stable https://charts.helm.sh/stable
helm repo update
helm install my-release stable/nginx-ingress -n namespace
helm upgrade my-release stable/nginx-ingress -n namespace
helm list -n namespace
helm uninstall my-release -n namespace
Custom values replicaCount: 3
image:
repository: gcr.io/PROJECT_ID/app
tag: v1.0.0
resources:
requests:
memory: 256Mi
cpu: 250m
Install with custom values:
helm install my-release ./chart -f values.yaml -n namespace
Monitoring and Logging
GKE Observability
gcloud logging read "resource.type=k8s_container" --limit 50
gcloud logging read "resource.type=k8s_container" --limit 50 --format json | jq .
Workload metrics automatically collected
Create custom dashboards in Cloud Console
Set up alerts for pod crashes, resource limits
Common kubectl monitoring
kubectl get pods -n namespace -w
kubectl describe all -n namespace
kubectl top pod POD_NAME -n namespace
kubectl describe node NODE_NAME
Security Best Practices
Pod Security securityContext:
runAsNonRoot: true
runAsUser: 1000
Read-only root filesystem: securityContext:
readOnlyRootFilesystem: true
securityContext:
capabilities:
drop:
- ALL
Use network policies to restrict traffic
Use workload identity instead of service account keys
GKE Security Features
Binary Authorization : Enforce deployment policiesShielded GKE Nodes : Secure boot and integrity monitoringPod Security Policies/Standards : Enforce pod security requirementsPrivate clusters : Isolate control plane
Backup and Disaster Recovery
Velero for backups
velero install \
--provider gcp \
--plugins velero/velero-plugin-for-gcp:v1.5.0 \
--bucket BUCKET_NAME \
--secret-file ./credentials-velero
velero backup create my-backup --include-namespaces my-namespace
velero restore create --from-backup my-backup
velero schedule create daily-backup --schedule="0 2 * * *" --include-namespaces my-namespace
Performance Optimization
Node Pool Configuration For compute-intensive workloads:
gcloud container node-pools create compute-pool \
--cluster CLUSTER_NAME \
--machine-type n2-standard-8 \
--num-nodes 3 \
--enable-autoscaling \
--min-nodes 2 \
--max-nodes 10 \
--region REGION
For memory-intensive workloads:
gcloud container node-pools create memory-pool \
--cluster CLUSTER_NAME \
--machine-type n2-highmem-8 \
--num-nodes 2 \
--enable-autoscaling \
--min-nodes 1 \
--max-nodes 5 \
--region REGION
Horizontal Pod Autoscaling apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: my-app-hpa
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: my-app
minReplicas: 2
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 70
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: 80
Vertical Pod Autoscaling apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: my-app-vpa
spec:
targetRef:
apiVersion: apps/v1
kind: Deployment
name: my-app
updatePolicy:
updateMode: "Auto"
Common Issues and Solutions
ImagePullBackOff Cause : Cannot pull container image
Solutions :
Verify image exists: gcloud container images list --repository=gcr.io/PROJECT_ID
Check permissions: Ensure node service account has Storage Object Viewer role
For Artifact Registry: Configure authentication
CrashLoopBackOff Cause : Container crashes repeatedly
Solutions :
Check logs: kubectl logs POD_NAME --previous
Verify environment variables and secrets
Check resource limits
Review liveness/readiness probes
Pending Pods Cause : Cannot schedule pod
Solutions :
Check node resources: kubectl top nodes
Review pod events: kubectl describe pod POD_NAME
Check resource requests vs available capacity
Verify node selectors and taints
OOMKilled Cause : Container exceeded memory limit
Solutions :
Increase memory limits
Review application memory usage
Consider VPA for automatic adjustment
Quick Reference
Essential kubectl commands
kubectl config get-contexts
kubectl config use-context CONTEXT_NAME
kubectl get all -n namespace
kubectl get pods -o wide -n namespace
kubectl get svc,deploy,ing -n namespace
kubectl edit deployment DEPLOYMENT_NAME -n namespace
kubectl set image deployment/DEPLOYMENT_NAME CONTAINER=IMAGE -n namespace
kubectl describe pod POD_NAME -n namespace
kubectl exec -it POD_NAME -n namespace -- bash
kubectl logs -f POD_NAME -n namespace
kubectl delete pod POD_NAME -n namespace
kubectl delete -f manifest.yaml
GKE CLI commands
gcloud container clusters list
gcloud container clusters describe CLUSTER_NAME --region REGION
gcloud container clusters resize CLUSTER_NAME --num-nodes 3 --region REGION
gcloud container node-pools list --cluster CLUSTER_NAME --region REGION
gcloud container node-pools describe POOL_NAME --cluster CLUSTER_NAME --region REGION
gcloud container operations list
gcloud container operations describe OPERATION_ID --region REGION
Advanced Topics For detailed information on advanced features, see:
Package Requirements This skill requires the following tools:
kubectl - Kubernetes command-line toolgcloud - Google Cloud SDKOptional: helm - Kubernetes package manager
Optional: velero - Backup and restore tool
