gke-productionize

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GKE Productionize Skill

GKE 投产准备技能

This skill acts as a high-level orchestrator for preparing a GKE cluster and its workloads for production readiness.

[!IMPORTANT] This is a meta-skill or orchestrator skill. You are expected to invoke and run many other specialized skills listed in this document as part of the overall productionization process. Do not attempt to implement all production readiness features directly within this skill; instead, use this skill to assess the environment and then delegate to the specific skills for each domain.

本技能作为高级编排工具，用于协助GKE集群及其工作负载完成生产就绪准备。

[!IMPORTANT] 这是一项元技能或编排技能。在整个投产流程中，您需要调用并运行本文档中列出的许多其他专业技能。请勿尝试直接在本技能中实现所有生产就绪功能；相反，请使用本技能评估环境，然后将各领域的任务委派给对应的专业技能。

Scope

适用范围

This skill is adaptable to:

A single application (already on Kubernetes or not).
A set of applications.
A target cluster.

本技能适用于以下场景：

单个应用（已部署在Kubernetes上或未部署）。
一组应用。
目标集群。

Workflow

工作流程

1. Discovery Phase

1. 发现阶段

Before making recommendations, discover the current state of the environment.

在给出建议前，先了解环境的当前状态。

Cluster Discovery

集群发现

Run these commands to understand the cluster setup:

Check cluster details:

gcloud container clusters describe {cluster_name} --location {location} --project {project}

Check for Autopilot vs Standard: Look for
```
autopilot: true
```
in the describe output.
Check release channel: Look for
```
releaseChannel
```
.

运行以下命令了解集群配置：

查看集群详情：

gcloud container clusters describe {cluster_name}   --location {location} --project {project}

区分Autopilot与Standard模式：在describe输出中查找
```
autopilot: true
```
字段。
查看发布通道：查找
```
releaseChannel
```
字段。

Workload Discovery

工作负载发现

If a specific application is targeted, discover its configuration:

Get deployment/statefulset details:

kubectl get deployment {app_name} -n {namespace} -o yaml

Check for dedicated namespace and labels:
```
kubectl get namespace {namespace} -o yaml
```
(Look for Pod Security Standards labels).

Check for dedicated service account usage:

kubectl get pods -n {namespace} -o custom-columns="NAME:.metadata.name,SERVICE_ACCOUNT:.spec.serviceAccountName"

Check for resource requests and limits.
Check for liveness, readiness, and startup probes.
Check for HPA:
```
kubectl get hpa -n {namespace}
```
Check for PDB:
```
kubectl get pdb -n {namespace}
```

Check for NetworkPolicies:

kubectl get networkpolicy -n {namespace}

如果针对特定应用，需发现其配置信息：

获取Deployment/StatefulSet详情：

kubectl get deployment {app_name} -n   {namespace} -o yaml

检查专用命名空间和标签：
```
kubectl get namespace {namespace}   -o yaml
```
（查找Pod安全标准标签）。

检查专用服务账号的使用情况：

kubectl get pods -n {namespace}   -o   custom-columns="NAME:.metadata.name,SERVICE_ACCOUNT:.spec.serviceAccountName"

检查资源请求与限制。
检查存活探针、就绪探针和启动探针。
检查HPA：
```
kubectl get hpa -n {namespace}
```
检查PDB：
```
kubectl get pdb -n {namespace}
```

检查NetworkPolicies：

kubectl get networkpolicy -n {namespace}

2. Production Readiness Assessment

2. 生产就绪评估

Before implementation, you MUST run the skills for each relevant specialized area listed below and incorporate its guidance into your assessment and plan. Failure to do so will result in a non-compliant production configuration.

在实施前，您必须运行以下列出的各相关专业领域技能，并将其指导内容纳入您的评估和计划中。否则将导致不符合要求的生产配置。

A. App Onboarding (Pre-Kubernetes)

A. 应用接入（Kubernetes部署前）

If the application is not yet running on GKE, you MUST run the

gke-app-onboarding

skill for planning containerization, image building, and basic deployment.

如果应用尚未在GKE上运行，您必须运行

gke-app-onboarding

技能，以规划容器化、镜像构建和基础部署。

B. Scalability & Resource Management

B. 可扩展性与资源管理

Ensure workloads have appropriate resources and autoscaling.

Action: You MUST run the
```
gke-workload-scaling
```
skill for configuring HPA, VPA, and resource limits.

确保工作负载拥有合适的资源配置和自动扩缩容能力。

操作：您必须运行
```
gke-workload-scaling
```
技能来配置HPA、VPA和资源限制。

C. Observability

C. 可观测性

Ensure adequate logging and monitoring are in place.

Action: You MUST run the
```
gke-observability
```
skill for setting up Cloud Logging, Monitoring, and Managed Prometheus.

确保已部署足够的日志和监控能力。

操作：您必须运行
```
gke-observability
```
技能来设置Cloud Logging、Monitoring和Managed Prometheus。

D. Reliability

D. 可靠性

Ensure high availability and graceful degradation.

Action: You MUST run the
```
gke-reliability
```
skill for configuring regional clusters, PDBs, and health probes.

确保高可用性和优雅降级能力。

操作：您必须运行
```
gke-reliability
```
技能来配置区域集群、PDB和健康探针。

E. Security

E. 安全性

Harden the cluster and workloads.

Action: You MUST run the
```
gke-platform-security
```
and
```
gke-workload-security
```
skills for Workload Identity, Network Policies, and Shielded Nodes.
Namespace Isolation: Ensure workloads run in dedicated namespaces with Pod Security Standards (PSS) enforced via labels.
Least Privilege: Ensure workloads use dedicated ServiceAccounts instead of the
```
default
```
ServiceAccount.

强化集群和工作负载的安全防护。

操作：您必须运行
```
gke-platform-security
```
和
```
gke-workload-security
```
技能来配置Workload Identity、Network Policies和Shielded Nodes。
命名空间隔离：确保工作负载运行在已通过标签强制实施Pod安全标准（PSS）的专用命名空间中。
最小权限原则：确保工作负载使用专用ServiceAccount而非
```
default
```
ServiceAccount。

F. Backup & Disaster Recovery

F. 备份与灾难恢复

Ensure stateful data is protected.

Action: You MUST run the
```
gke-backup-dr
```
skill for configuring Backup for GKE and restore procedures.

确保有状态数据得到保护。

操作：您必须运行
```
gke-backup-dr
```
技能来配置GKE备份和恢复流程。

G. Edge Security & Ingress

G. 边缘安全与Ingress

Secure external access.

Action: You MUST run the
```
gke-service-networking
```
skill for Gateway API, Ingress, and Cloud Armor.

保障外部访问的安全性。

操作：您必须运行
```
gke-service-networking
```
技能来配置Gateway API、Ingress和Cloud Armor。

H. Cost Optimization

H. 成本优化

Ensure efficient use of resources.

Action: You MUST run the
```
gke-cost-optimization
```
skill for strategies on rightsizing, quotas, and Spot VMs.

确保资源得到高效利用。

操作：您必须运行
```
gke-cost-optimization
```
技能来实施资源合理配置、配额管理和Spot VMs等优化策略。

3. Production Readiness Scoring

3. 生产就绪评分

After the assessment, provide a summary report with a RAG (Red, Amber, Green) status for each area and an overall readiness score. This helps prioritize remediation efforts.

评估完成后，提供一份汇总报告，针对每个领域给出RAG（红、黄、绿）状态以及整体就绪评分。这有助于确定整改工作的优先级。

Adaptability Guidelines

适配指南

Single App: Focus on Health Probes, HPA, Resource Limits, PDB, and Workload Identity for that specific app.
Cluster Wide: Focus on Cluster Autoscaler, Multi-zonal setup, Release Channels, Maintenance Windows, and default Network Policies.
Proactive Execution: Proactively execute relevant skills (e.g., observability, security, scaling, reliability) to assess and propose improvements, seeking user confirmation before applying state-changing implementations.

单个应用：重点关注该特定应用的健康探针、HPA、资源限制、PDB和Workload Identity。
集群范围：重点关注Cluster Autoscaler、多可用区配置、发布通道、维护窗口和默认Network Policies。
主动执行：主动运行相关技能（如可观测性、安全性、扩缩容、可靠性）进行评估并提出改进建议，在执行会改变系统状态的操作前需征得用户确认。