How to use the GKE Networking Planner agent skill

What the skill makes the agent do

Once installed, the agent applies a 'golden path' of GKE networking defaults whenever you ask about cluster networking. The defaults are private nodes with no public IPs, VPC-native (Alias IP) routing, Dataplane V2 (eBPF-based, with built-in Network Policy) and Cloud DNS. The skill also explains how to size the pod and service CIDR ranges, since the source notes that VPC, subnet and IP ranges cannot be changed after cluster creation.

• Recommends private, VPC-native clusters with Dataplane V2 and Cloud DNS by default
• Helps size pod CIDR and service CIDR ranges and explains the maxPodsPerNode trade-off
• Explains private cluster access: DNS endpoint, private endpoint and authorized networks
• Covers egress through Cloud NAT, static egress IPs and restricted egress through a firewall appliance
• Gives gcloud commands for getting cluster credentials or creating a cluster in an existing VPC
• Points to other skills for ingress, load balancing and workload security

How to install the gke-networking skill

Download the skill ZIP from this page. Then choose one of the two installation routes below. Both use the same skill files, which are SKILL.md and references/attribution.md.

For a personal setup, unzip the file into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. Alternatively, in the Claude apps, open Settings, go to Capabilities and upload the skill under Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

Check what you need before you start

The skill itself is instructions, but the commands it produces run against real Google Cloud infrastructure. You need a Google Cloud account and a project with GKE permissions. If you want the agent to run commands in a terminal, you also need the gcloud CLI installed.

The skill can also use optional MCP tools: get_cluster, update_cluster, apply_k8s_manifest and get_k8s_resource. The skill uses the network, and it runs no scripts.

• Google Cloud account and project with GKE permissions
• gcloud CLI, required only for commands the agent runs in a terminal
• Optional MCP tools: get_cluster, update_cluster, apply_k8s_manifest, get_k8s_resource

Trigger the skill with natural requests

You don't need special syntax. Describe what you are designing in plain language that mentions GKE and networking. The skill's description lists the kinds of tasks it covers, including designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges and managing VPC-native cluster modes.

Requests for application ingress, load balancing or service networking do not fit this skill. The skill says to use gke-service-networking for those.

• 'Design a private GKE cluster network layout for a new team in our Google Cloud project.'
• 'How big should the pod and service ranges be for about 2,000 pods on 48-pod nodes?'
• 'Set up Dataplane V2 and Cloud DNS for a new GKE cluster and list the settings I need.'
• 'Give me the gcloud command to get credentials for a private cluster through its DNS endpoint.'
• 'How do I create a GKE Autopilot cluster in our existing VPC and subnet?'

Understand the default settings

The skill's golden path sets these values by default. Day-0 means the setting should be decided when the cluster is created. Day-1 means it can be set shortly after.

Pod CIDR sizing follows a simple rule: with maxPodsPerNode set to 48, each node uses a /25 (128 IPs) from the pod CIDR, and with 110 each node uses a /24 (256 IPs). A larger maxPodsPerNode means fewer nodes fit in a given CIDR. The default pod CIDR is /17 (about 32K pod IPs) and the default service CIDR is /20 (about 4K service IPs).

• privateClusterConfig.enablePrivateNodes = true (Day-0): nodes have no public IPs
• masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled = true (Day-0)
• controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic = true (Day-0)
• networkConfig.datapathProvider = ADVANCED_DATAPATH, which is Dataplane V2 (Day-0)
• networkConfig.dnsConfig.clusterDns = CLOUD_DNS (Day-0)
• ipAllocationPolicy.autoIpamConfig.enabled = true (Day-0)
• defaultMaxPodsConstraint.maxPodsPerNode = 48, with 110 for high density (Day-0)

Create a cluster in an existing VPC

If you already have network infrastructure, the skill provides a command that creates an Autopilot cluster (create-auto) in your existing VPC and subnet, using your own secondary ranges for pods and services. Replace the placeholders in braces with your own names before running it. The source warns that the VPC, subnet and IP ranges cannot be changed after the cluster is created, so check them carefully first.

Safety notes before running commands

The skill runs no scripts, but it does use the network, and the commands it suggests can create or change Google Cloud resources. The skill's own description warns that its commands assume Google Cloud and Kubernetes knowledge and could create costly or hard-to-undo infrastructure. Review every command before you run it, and do not run creation commands in a project you cannot afford to change.

The skill requires a tag on gcloud commands run directly in a terminal. It sets CLOUDSDK_METRICS_REQUEST_ATTRIBUTION inline on each command so usage can be attributed to the skill. The tag does not persist, because the skill says not to use gcloud config set for this purpose.

• Read each command the agent proposes and confirm the project, region and names
• Do not treat the defaults as a substitute for checking your organisation's security policies
• Expect the skill to cover only Google Cloud and GKE, not other clouds or self-managed Kubernetes

Tips for better results

Give the agent your numbers. Pod density, expected node count and the size of your existing subnets make the IP sizing advice concrete. Name the region and whether you need private access, because the access patterns differ between the DNS endpoint, the private endpoint and authorized networks.

For application exposure or workload isolation, ask the agent for the right skill. The source points to gke-workload-security for default-deny policies and gke-multitenancy for per-team allow policies.

• Provide pod density and node counts for sizing questions
• Name your region and your existing VPC and subnet, if any
• Ask for the matching skill when your question is about ingress, load balancing or security