Back to Details

gke-golden-path

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

GKE Golden Path Configuration

GKE黄金路径配置

The golden path is the recommended Autopilot configuration for production clusters. It defines sensible defaults — when the user requests different settings, apply them and note relevant trade-offs.
MCP Tools: 
get_cluster
, 
create_cluster
, 
update_cluster
黄金路径是针对生产集群推荐的Autopilot配置。它定义了合理的默认值——当用户要求不同设置时，应用这些设置并记录相关的权衡。
MCP工具： 
get_cluster
, 
create_cluster
, 
update_cluster

Rules

规则

  1. Default to the golden path. Use golden path values unless the user requests otherwise. When deviating, note trade-offs but respect the user's choice.
  2. Day-0 vs Day-1. Flag Day-0 decisions (networking, private nodes, subnets, IP allocation) prominently — they are hard/impossible to change after creation.
  3. Tool preference: MCP > gcloud > kubectl. See the 
    gke-basics
    skill's CLI reference for full coverage matrix and override options. If the user says "use gcloud" or "use kubectl", respect that for the session.
  4. Document decisions and rationale, especially for Day-0 choices and golden path deviations.
  1. 默认遵循黄金路径。除非用户另有要求，否则使用黄金路径值。当偏离时，记录权衡但尊重用户的选择。
  2. Day-0与Day-1区分。突出标记Day-0决策（网络、私有节点、子网、IP分配）——这些在集群创建后很难/无法更改。
  3. 工具优先级：MCP > gcloud > kubectl。有关完整的覆盖矩阵和覆盖选项，请参阅
    gke-basics
    技能的CLI参考。如果用户要求“使用gcloud”或“使用kubectl”，则在会话中遵循该要求。
  4. 记录决策及理由，尤其是Day-0选择和偏离黄金路径的情况。

Required Inputs

必填输入

If the user is unsure, use golden path defaults.
  • Project ID (required)
  • Region (required, e.g., 
    us-central1
    )
  • Cluster name (required)
  • Environment type: dev/test or production (defaults to production)
  • Networking: bring-your-own VPC/subnet or auto-create (default: auto-create)
  • Scale expectations: expected node/pod count, workload types
  • Cost constraints: Spot VM tolerance, budget considerations
如果用户不确定，请使用黄金路径默认值。
  • 项目ID（必填）
  • 区域（必填，例如：
    us-central1
    ）
  • 集群名称（必填）
  • 环境类型：开发/测试或生产（默认值为生产）
  • 网络配置：自带VPC/子网或自动创建（默认：自动创建）
  • 扩缩预期：预期节点/ Pod数量、工作负载类型
  • 成本限制：对Spot VM的容忍度、预算考量

Always-Apply Defaults

始终应用的默认值

Recommended best practices applied by default. If the user requests a different setting, apply it and briefly note the security or operational trade-off.
SettingGolden Path Value
autopilot.enabled
true
privateClusterConfig.enablePrivateNodes
true
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled
true
secretManagerConfig.enabled
+ 
rotationInterval: 120s
true
rbacBindingConfig.enableInsecureBinding*
false
(both)
workloadIdentityConfig.workloadPool
enabled
networkConfig.datapathProvider
ADVANCED_DATAPATH
networkConfig.dnsConfig.clusterDns
CLOUD_DNS
autoscaling.autoscalingProfile
OPTIMIZE_UTILIZATION
verticalPodAutoscaling.enabled
true
monitoringConfig
components		SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER
advancedDatapathObservabilityConfig.enableMetrics
true
nodeConfig.shieldedInstanceConfig.enableSecureBoot
true
nodeConfig.workloadMetadataConfig.mode
GKE_METADATA
nodeConfig.gcfsConfig.enabled
/ 
gvnic.enabled
true
/ 
true
addonsConfig.statefulHaConfig.enabled
true
Storage CSI drivers (Filestore, GCS FUSE, Parallelstore)enabled
Pod Security Standards
restricted
on production namespaces
默认应用的推荐最佳实践。如果用户要求不同的设置，应用该设置并简要说明安全或运维方面的权衡。
设置黄金路径值
autopilot.enabled
true
privateClusterConfig.enablePrivateNodes
true
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled
true
secretManagerConfig.enabled
+ 
rotationInterval: 120s
true
rbacBindingConfig.enableInsecureBinding*
false
(两者均为)
workloadIdentityConfig.workloadPool
已启用
networkConfig.datapathProvider
ADVANCED_DATAPATH
networkConfig.dnsConfig.clusterDns
CLOUD_DNS
autoscaling.autoscalingProfile
OPTIMIZE_UTILIZATION
verticalPodAutoscaling.enabled
true
monitoringConfig
components		SYSTEM_COMPONENTS, STORAGE, POD, DEPLOYMENT, STATEFULSET, DAEMONSET, HPA, JOBSET, CADVISOR, KUBELET, DCGM, APISERVER, SCHEDULER, CONTROLLER_MANAGER
advancedDatapathObservabilityConfig.enableMetrics
true
nodeConfig.shieldedInstanceConfig.enableSecureBoot
true
nodeConfig.workloadMetadataConfig.mode
GKE_METADATA
nodeConfig.gcfsConfig.enabled
/ 
gvnic.enabled
true
/ 
true
addonsConfig.statefulHaConfig.enabled
true
Storage CSI drivers (Filestore, GCS FUSE, Parallelstore)已启用
Pod Security Standards
restricted
on production namespaces

Customer-Configurable Settings

客户可配置的设置

These have golden path defaults but customers may deviate with valid justification. Ask before changing.
SettingDefaultWhy Deviate
dnsEndpointConfig.allowExternalTraffic
true
Restrict if cluster only accessed from within VPC
autoIpamConfig
/ 
createSubnetwork
true
/ 
true
Customer has pre-existing VPC/subnets
maxPodsPerNode
48
110
for high pod-density (costs more CIDR space)
subnetwork
auto-createdCustomer brings existing subnets
Maintenance exclusion windowsconfigured (NO_MINOR_UPGRADES, 1yr)Customer-specific scheduling
nodeConfig.bootDisk.diskType
pd-balanced
pd-ssd
for I/O-intensive, 
pd-standard
for cost
nodeConfig.machineType
ek-standard-8
(Autopilot)		Varies by workload; use ComputeClasses
这些设置有黄金路径默认值，但客户可在有合理理由的情况下偏离。更改前请询问。
SettingDefaultWhy Deviate
dnsEndpointConfig.allowExternalTraffic
true
Restrict if cluster only accessed from within VPC
autoIpamConfig
/ 
createSubnetwork
true
/ 
true
Customer has pre-existing VPC/subnets
maxPodsPerNode
48
110
for high pod-density (costs more CIDR space)
subnetwork
auto-createdCustomer brings existing subnets
Maintenance exclusion windowsconfigured (NO_MINOR_UPGRADES, 1yr)Customer-specific scheduling
nodeConfig.bootDisk.diskType
pd-balanced
pd-ssd
for I/O-intensive, 
pd-standard
for cost
nodeConfig.machineType
ek-standard-8
(Autopilot)		Varies by workload; use ComputeClasses

Guardrails

防护措施

  • Do not request or output secrets (tokens, keys, service account JSON).
  • Discover project/cluster context via MCP tools or 
    gcloud config get-value project
    — don't ask users to paste project IDs.
  • For Day-0 decisions, always ask clarifying questions before proceeding.
  • For Day-1 features, propose golden path defaults with trade-offs and let the customer confirm.
  • Do not promise zero downtime; advise PDBs, health probes, replicas, and staged upgrades.
  • When auditing existing clusters, compare against golden path and report deviations with severity and remediation.
  • Do not request or output secrets (tokens, keys, service account JSON).
  • Discover project/cluster context via MCP tools or 
    gcloud config get-value project
    — don't ask users to paste project IDs.
  • For Day-0 decisions, always ask clarifying questions before proceeding.
  • For Day-1 features, propose golden path defaults with trade-offs and let the customer confirm.
  • Do not promise zero downtime; advise PDBs, health probes, replicas, and staged upgrades.
  • When auditing existing clusters, compare against golden path and report deviations with severity and remediation.

Golden Path Config

黄金路径配置

See golden-path-autopilot.yaml for the full cluster-level policy settings.
See golden-path-autopilot.yaml for the full cluster-level policy settings.