skills.rest
google
googleOFFICIAL
Explore all skills by this author →
Website𝕏@GoogleOSSGitHub

gke-service-networking

Configures GKE Gateway API, Ingress, Cloud Armor, NEGs, and Private Service Connect networking.

19.1k|1.5k|Updated Mar 31, 2026
Search Tags:#kubernetes#load balancing#gke#Ingress#Gateway API#Cloud Armor#private service connect
One-click install
npx skills add https://github.com/google/skills --skill gke-service-networking
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gke-service-networking
Source: https://github.com/google/skills/tree/main/skills/cloud/gke-service-networking
Command: npx skills add https://github.com/google/skills --skill gke-service-networking

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

Exposing applications running on Google Kubernetes Engine to the internet or internal networks requires coordinating many moving parts—Gateway API routes, Ingress, WAF policies, SSL certificates, load balancer backends, and private connectivity—and misconfiguring any of them leads to broken traffic, security gaps, or unexpected costs.

Core Features & Use Cases

  • Gateway API and Ingress Templates: Deployable manifests for external Gateways, HTTPRoutes with weighted traffic splitting for canary rollouts, and standard GCE Ingress.
  • Security and TLS: Cloud Armor WAF security policies via BackendConfig, Google-managed SSL certificates, and Certificate Manager integration through the networking.gke.io/certmap annotation.
  • Load Balancing and Private Connectivity: Container-native load balancing with NEGs, Private Service Connect ServiceAttachments, and Topology Aware Routing for cost and latency optimization.
  • Use Case: You need to expose a new GKE service publicly with HTTPS, a WAF policy, and a 90/10 canary split between two backend versions—apply the provided Gateway, HTTPRoute, BackendConfig, and certificate templates after replacing the placeholders.

Quick Start

Ask the agent to configure a GKE Gateway with an HTTPRoute, a Google-managed SSL certificate, and a Cloud Armor security policy for your service.

Frequently Asked Questions about gke-service-networking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Gateway API on GKE?▼

Apply a Gateway manifest using the gke-l7-global-external-managed GatewayClass with an HTTP listener, then attach an HTTPRoute via parentRefs that routes path prefixes to a Service backendRef. Gateway API is enabled by default on GKE 1.26+ clusters.

How to set up canary deployments with GKE HTTPRoute?▼

Define an HTTPRoute with multiple backendRefs and weight fields, such as 90 for the primary service and 10 for the canary. The Gateway splits traffic across the backend Services according to those weights.

When do I need to add the NEG annotation manually on GKE?▼

Add cloud.google.com/neg manually for standalone NEGs you manage yourself, or when the cluster uses Shared VPC, GKE Network Policy, or is not VPC-native. Internal Ingress and qualifying external Ingress clusters get the annotation automatically.

Why is my GKE ManagedCertificate stuck in Provisioning?▼

The certificate stays in Provisioning until the domain's A or AAAA records point at the load balancer IP address. After DNS is correct, provisioning can still take 15 to 60 minutes to complete.

What are the requirements for Private Service Connect on GKE?▼

The backing Service must be an internal passthrough Network Load Balancer, meaning type LoadBalancer with the networking.gke.io/load-balancer-type Internal annotation. A ClusterIP or external LoadBalancer Service will not work with a ServiceAttachment.

When should I use gke-networking instead of this skill?▼

Use gke-networking for core cluster IP planning, Dataplane V2 network policies, and node NAT egress. This skill covers edge networking concerns like Gateways, Ingress, Cloud Armor, NEGs, PSC, and SSL certificates.

Related Skills

Explore More Software Engineering Skills→
wangx7wangx7

gke-networking

Configure private VPC-native GKE clusters with Dataplane V2 and Gateway API.

Community
Intermediate
webrix-aiwebrix-ai
1

performance-monitoring

Set up performance monitoring with dashboards, alerts, and SLO tracking.

Official
Advanced
YukiIto1999YukiIto1999

securing-kubernetes-on-cloud

Apply layered security controls to managed Kubernetes clusters on cloud platforms.

Community
Advanced
JNZader-VaultJNZader-Vault

kubernetes

Manage Kubernetes manifests and deployment strategies with kubectl, kustomize, and helm.

Official
Advanced