How to use the GKE Backup & Disaster Recovery agent skill

What the gke-backup-dr skill makes the agent do

Once installed, the agent knows how to set up Backup for GKE on Google Kubernetes Engine clusters. That covers enabling the BackupRestore cluster add-on, creating backup plans, triggering manual backups, and restoring a cluster or selected namespaces from a backup.

The skill is steered toward safe choices. It asks the agent to explicitly include persistent volume data and secrets, to encrypt backups with customer-managed keys where possible, and to avoid restoring into production without explicit confirmation. The skill itself is instructions and command examples. If you ask, the agent runs the gcloud commands in a terminal.

• Enable the BackupRestore add-on on a cluster
• Create backup plans with retention and schedules
• Trigger manual backups
• Create restore plans and execute restores
• Check restore status

Install the gke-backup-dr skill

Download the skill ZIP from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

The folder contains SKILL.md, the main instructions, and references/attribution.md, which the skill requires the agent to read before running Google Cloud commands.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Prepare your Google Cloud environment

The skill needs the gcloud CLI with the beta component installed, a Google Cloud project with GKE and Backup for GKE permissions, and optionally a Cloud KMS key for customer-managed encryption (CMEK), which the source recommends. Install the beta component with the command below if you do not have it yet.

• gcloud CLI with the beta component
• A Google Cloud project with GKE and Backup for GKE permissions
• Cloud KMS key for CMEK encryption (optional but recommended)

Ask for what you need in plain language

You do not need to remember flags. The skill's description tells the agent when to use it: backup policies, disaster recovery, and GKE cluster restores. Describe the outcome you want and name the cluster, project and location. Mention the namespaces if you want to limit scope.

Be explicit about the parts that matter most. If you want volume data and secrets protected, say so, because the source notes both default to false and a plan without them creates config-only backups.

• "Set up Backup for GKE on my cluster prod-east in project acme-platform, protecting the orders and payments namespaces daily with 30-day retention."
• "Trigger a manual backup of the orders backup plan now."
• "Restore the payments namespace from last night's backup into the staging cluster, and show me the conflict policy before running it."
• "Check the status of restore orders-restore-1."

Understand the safety rules before any restore

A restore writes into a live cluster. Depending on the conflict policy, it can overwrite or delete existing resources. The skill asks the agent to validate the restore in a non-production cluster first, to keep the safe defaults unless you explicitly need to revert live resources, and to get your explicit confirmation before restoring into production, stating which policy is in effect.

Two policy options are especially risky. The source says delete-and-restore deletes entire conflicting namespaces and everything in them before restoring, and use-backup-version deletes the existing version of a cluster-scoped resource first, which for a CRD deletes all of its custom resources.

• Safe defaults: use-existing-version and fail-on-conflict
• Test restores in a non-production target cluster first
• Never restore into production without explicit confirmation

Safety notes: scripts and network use

The skill does not run scripts. It does use the network, because the commands call Google Cloud APIs. Before the agent runs any gcloud, REST API or MCP command, the skill requires it to follow the usage attribution instructions in references/attribution.md. Commands run directly in a terminal are prefixed with a metrics environment variable that tags the skill and version. The source says this tag carries no user data and that the agent should not use gcloud config set for it.

• Runs scripts: no
• Uses network: yes
• Terminal commands are tagged inline, not saved in your gcloud config

Tips for reliable backups

The source's golden path is a good starting point for production: enable the add-on, pass both volume and secret flags explicitly, set a retention period, and enable CMEK. Prefer selected namespaces over all namespaces when you can. Application data also needs its own care: the skill recommends quiescing the database or pausing writes, for example with pre-backup hooks or database tools, before a backup.

Use the CSI driver for volume snapshots, since the skill recommends it for capturing persistent volume data. If you are unsure of a backup plan's behaviour, ask the agent to describe the plan before it creates anything.

• Pass --include-volume-data and --include-secrets explicitly
• Set retention, for example --backup-retain-days=30
• Use CMEK with --encryption-key
• Back up selected namespaces rather than the whole cluster
• Quiesce databases before backups