Skip to content
Get packs

Guide · Agent skill

How to use the GKE Service Networking agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The gke-service-networking skill is a set of instructions and ready-made Kubernetes and gcloud templates that teaches an AI agent how to expose applications running on Google Kubernetes Engine (GKE) to the internet or to private networks. It is written for platform engineers, DevOps engineers and developers who run GKE. After this guide you will know what the skill covers, how to install it, how to ask for work in plain language, and what safety checks to keep in place.

GKE Service Networkinggoogle/skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
  2. 2Check prerequisites. Confirm gcloud and kubectl are installed and authenticated, and that your cluster is VPC-native with Gateway API enabled.
  3. 3Describe the goal. Ask the agent in plain language what you want, such as exposing a service or adding HTTPS, and name the app and cluster.
  4. 4Review the proposed commands. Read each gcloud and kubectl command and the edited manifests before approving them, especially any that create public load balancers or firewall rules.
  5. 5Fill in the placeholders. Replace every # Replace ... placeholder in the asset templates with your own names, domains and Service details.
  6. 6Apply and verify. Apply the manifests with kubectl apply -f and check the Gateway, Ingress or load balancer status before sending real traffic.

What is an agent skill, and what does this one do?

An agent skill is a folder with a SKILL.md file of instructions, plus optional templates and reference files, that an AI agent loads when a task matches its description. This skill is not a program. The agent still runs the commands for you, using your own gcloud and kubectl tools.

Once installed, the agent knows how to configure Gateway API resources, standard Ingress, Cloud Armor security policies, Google-managed SSL certificates and container-native load balancing on GKE. It can also help troubleshoot Ingress and load-balancer 502/5xx errors, backend health-check failures, connection draining and TLS/SSL policy problems.

  • Gateway API: an external Gateway, HTTPRoutes and weighted traffic splitting for canary rollouts.
  • Standard GCE Ingress routing traffic to a Service.
  • Cloud Armor: create a security policy and add rules such as blocking an IP range.
  • Google-managed certificates for Ingress, and CertificateMap or Secret references for Gateway.
  • Container-native load balancing (NEGs), Private Service Connect and Topology Aware Routing.

How do you install the GKE Service Networking skill?

Download the skill ZIP from this page and unzip it. For a personal skill that works in every project, unzip it into ~/.claude/skills/. For a skill that only applies to one project, unzip it into that project's .claude/skills/ folder.

In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

  • Personal install: ~/.claude/skills/ (available across your projects).
  • Project install: .claude/skills/ inside the project folder.
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP.

What do you need before you start?

The skill assumes you already run GKE. Check these items before asking the agent to change anything.

  • The gcloud CLI and kubectl installed and authenticated.
  • A Google Cloud project with a GKE cluster. VPC-native is recommended.
  • Gateway API enabled on the cluster. It is on by default for new clusters running GKE 1.26+. On older supported versions the skill says to enable it with --gateway-api=standard.
  • Some workflows, such as Private Service Connect, need specific Service types described below.

How do you trigger the skill with a natural request?

You do not need to type the skill name. Describe the task in plain words that match the skill's scope, such as exposing a service, adding HTTPS or debugging a 502. The agent should load the skill when the request matches its description.

Be specific about the cluster, the app and the goal. The more concrete the request, the more precise the manifests will be.

  • "Expose my checkout Service on GKE through a Gateway with HTTP, and send 10% of traffic to app-v2."
  • "Add a Google-managed certificate for shop.example.com to my existing Ingress."
  • "Our Ingress returns 502 errors and the backend health checks are failing. Help me find out why."
  • "Create a Cloud Armor policy that blocks 203.0.113.0/24 and attach it to my backend."

How do the templates work?

The skill ships deployable manifests in its assets/ folder. Each one has # Replace ... placeholders that you must edit before applying. Key files include gateway.yaml, gateway-https.yaml, httproute.yaml, httproute-traffic-split.yaml, ingress.yaml, managed-certificate.yaml, backendconfig.yaml and service-attachment.yaml.

A typical Gateway setup applies the Gateway and HTTPRoute with kubectl, as in the skill's example.

  • Replace every placeholder before applying anything.
  • Use the traffic split pattern only for canary rollouts, with weights such as 90/10 across backend Services.
kubectl apply -f assets/gateway.yaml kubectl apply -f assets/httproute.yaml

What safety notes should you follow?

This skill runs scripts and uses the network, and some commands create public load balancers and firewall rules. Review every command the agent proposes before it runs, especially in production. Do not let an agent apply changes to production without a review step.

The skill also asks the agent to tag gcloud commands with an attribution variable so usage can be traced to the skill. The tag is set inline on each command and is not saved with gcloud config set.

  • Read the proposed gcloud and kubectl commands before approving them.
  • Check whether a change exposes a service publicly before applying it.
  • Test in a non-production cluster first.
  • Do not use this skill for core cluster IP planning, Dataplane V2 network policies or node NAT egress. Use the separate gke-networking skill for those.

What people use it for

  • Expose a web app on GKE through an external Gateway with an HTTP listener.
  • Run a canary rollout by sending 10% of traffic to a new backend Service with weighted HTTPRoute rules.
  • Attach a Google-managed certificate to an Ingress for an HTTPS domain.
  • Add a Cloud Armor rule that denies traffic from an abusive IP range.
  • Publish an internal service to another VPC through Private Service Connect.

Frequently asked questions

Is the GKE Service Networking skill free?

The skill is published under the Apache-2.0 licence. The skill itself is instructions and templates, but the Google Cloud resources it creates, such as load balancers, are billed by Google Cloud under your own account.

What do I need to install and use the skill?

You need the gcloud CLI, kubectl, access to a Google Cloud project with a GKE cluster (VPC-native recommended), and Gateway API enabled on the cluster. Gateway API is on by default for new GKE 1.26+ clusters.

Where do I put the skill so my agent finds it?

Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can upload the ZIP under Settings → Capabilities → Skills.

Why does my Ingress return 502 errors?

The skill's troubleshooting workflow covers 502/5xx responses and failing backend health checks. Ask the agent to check the backend health and Service configuration, and review each command it proposes before running it.

Can the skill set up Private Service Connect for any Service?

No. The backing Service must be an internal passthrough Network Load Balancer, meaning type LoadBalancer with the networking.gke.io/load-balancer-type: "Internal" annotation. A ClusterIP or external LoadBalancer Service will not work with a ServiceAttachment.

How does this compare with the gke-networking skill?

The gke-service-networking skill covers edge routing, load balancers, certificates and private endpoints. The separate gke-networking skill covers core cluster IP planning, Dataplane V2 network policies and node NAT egress, so use that one for those topics.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you run GKE and want an agent to write and adjust Gateway, Ingress, Cloud Armor and certificate configuration, or to help debug load-balancer errors, while you keep control of each command. Skip it if you have no Kubernetes experience, are not on GKE, or want changes applied to production without review, because misapplied templates can expose services publicly.

Download the skill