/gke-cluster-creation

name: gke-cluster-creation
description: >-
  Plans and executes GKE cluster creation, provisioning, and production
  readiness audits using pre-defined templates (Autopilot, Standard Regional,
  GPU/AI Inference, AI Hypercompute). Use when creating GKE clusters,
  provisioning GKE environments, selecting cluster modes, or auditing GKE
  clusters. Don't use for application onboarding or deployment configuration
  (use gke-app-onboarding instead).
metadata:
  category: Containers

GKE Cluster Creation

This reference guides creating Google Kubernetes Engine (GKE) clusters by providing a set of best-practice templates and guiding through mode selection and customization. The **golden path Autopilot** configuration is the default for all new clusters.

> **MCP Tools:** `list_clusters`, `create_cluster`, `get_cluster`, > `list_operations`, `get_operation`

Workflow

1. **Discover context**: Use `list_clusters` to see existing clusters. Use `gcloud config get-value project` if project unknown. 2. **Gather inputs**: `project_id`, `location` (region or zone), `cluster_name`, environment type. If missing essential details, ask the user before taking action. 3. **Select mode & explain trade-offs**: If the user hasn't specified a template or mode, present the available templates (e.g., Autopilot, Standard Regional, GPU Inference, AI Hypercompute) and explain key trade-offs (Cost vs. Availability, Autopilot vs. Standard node management). 4. **Configure networking**: auto-create subnet (default) or bring-your-own. 5. **Review golden path settings**: present the default configuration block (`gcloud` command or `create_cluster` JSON payload) and confirm with the user before creation. 6. **Create**: Use MCP `create_cluster` tool or `gcloud` CLI. 7. **Track**: Use `get_operation` to monitor creation progress. 8. **Verify**: Use `get_cluster` with `readMask="*"` to confirm golden path settings applied.

Mode Selection

| Criteria | Autopilot (Golden Path) | Standard | | ------------------ | ------------------------- | ------------------------- | | Node management | Google-managed | Self-managed | | Pricing | Pay per pod resource | Pay per node (VM) | : : request : : | Node customization | Via ComputeClasses | Full control | | DaemonSets | Allowed (with | Full control | : : restrictions) : : | GPU/TPU | Supported via | Supported via node pools | : : ComputeClasses : : | Best for | Most production workloads | Kernel tuning, custom OS, | : : : privileged workloads :

> **Rule**: Default to Autopilot unless the customer has a specific requirement > that Autopilot cannot satisfy.

Best Practices

When guiding the user or generating configurations, adhere to these GKE best practices:

Security & Networking

1. **Private Clusters**: Default to private clusters (`enablePrivateNodes: true`) with a private control plane and restricted public endpoints (`enable-master-authorized-networks`) to minimize attack surface. 2. **VPC-Native Networking**: Use VPC-native clusters (`useIpAliases: true` / `--enable-ip-alias`) to enable alias IP ranges and pod-level firewall rules. 3. **Workload Identity**: Prefer Workload Identity (`workloadPool: <PROJECT_ID>.svc.id.goog`) for securely granting GKE workloads access to Google Cloud services instead of static service account keys. 4. **Shielded GKE Nodes**: Enable Shielded GKE Nodes (`--enable-shielded-nodes`, `--enable-secure-boot`) against rootkits and bootkits. 5. **Least Privilege (RBAC)**: Institute strict Role-Based Access Control limits (`scoped-rbs-bindings`).

Cost Optimization

1. **Autoscaling**: Enable Cluster Autoscaler and Horizontal/Vertical Pod Autoscaler (`--enable-autoscaling`, `--enable-vertical-pod-autoscaling`) to adjust resources based on demand. 2. **Right-Sizing & Spot VMs**: Choose appropriate machine types and node counts. Consider Spot VMs (`--spot`) for fault-tolerant, non-critical batch or inference workloads.

High Availability & Reliability

1. **Regional Clusters**: Use Regional Clusters for production environments to ensure control plane replication across multiple zones (`--region` instead of `--zone`). *Note: Standard regional creates nodes across 3 zones by default.* 2. **Pod Disruption Budgets**: Recommend setting Pod Disruption Budgets for application stability during node maintenance. 3. **Release Channels**: Subscribe to a release channel (`REGULAR` or `STABLE`) for automated, safer cluster upgrades.

Templates

1. Golden Path Autopilot (Production)

This is the default. All settings match `../gke-golden-path/assets/golden-path-autopilot.yaml`.

**Via gcloud:**

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --project <PROJECT_ID> \
  --release-channel regular \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-dns-access \
  --enable-secret-manager \
  --secret-manager-rotation-interval=120s \
  --scoped-rbs-bindings \
  --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,STORAGE,POD,DEPLOYMENT,STATEFULSET,DAEMONSET,HPA,CADVISOR,KUBELET,DCGM \
  --quiet

**Via MCP (`create_cluster`):**

{
  "parent": "projects/<PROJECT_ID>/locations/<REGION>",
  "cluster": {
    "name": "<CLUSTER_NAME>",
    "autopilot": { "enabled": true },
    "privateClusterConfig": { "enablePrivateNodes": true },
    "masterAuthorizedNetworksConfig": {
      "privateEndpointEnforcementEnabled": true
    },
    "releaseChannel": { "channel":