Every skill is a SKILL.md bundle. The Platform Agent’s live in agents/platform/skills/; the Cluster Agent’s live in agents/cluster/skills/ and are scaffolded into each per-cluster profile. An agent loads them on demand based on the description: field in each skill’s frontmatter — clicking through to source below gives you the full procedure the agent follows.
For how skills are structured and invoked, see Concepts → Skills.
Generated from the name and description frontmatter of every agents/platform/skills/*/SKILL.md and agents/cluster/skills/*/SKILL.md.
| Skill |
Description |
cluster-agent-lifecycle |
Create, delegate to, and tear down per-cluster Cluster Agent Hermes profiles. Use whenever a GKE cluster is onboarded, deleted or taken out of management, or whenever a single-cluster runtime debugging/operations task should be delegated to that cluster’s Cluster Agent. Not for a request to delete or change a resource on a cluster (a namespace, a workload; not the cluster itself): that is submit-suggestion’s “Deleting a resource” or its pull request path; this skill manages Cluster Agent profiles only. |
gke-cluster-creation |
Plans GKE cluster creation and provisioning as a pull request in the GitOps repository’s format, and audits production readiness, using pre-defined templates (Autopilot, Standard Regional, GPU/AI Inference, AI Hypercompute). Use when creating GKE clusters, provisioning GKE environments, selecting cluster modes, or auditing GKE clusters. Don’t use for application onboarding or deployment configuration (use gke-app-onboarding instead). |
gke-multitenancy |
Plans and configures multi-tenancy on GKE. Covers namespace isolation, RBAC planning for teams, resource quotas, LimitRanges, network isolation, and cost allocation. Use when designing GKE multi-tenancy, configuring GKE namespaces, setting up resource quotas, or isolating GKE teams. Don’t use for single-tenant cluster configuration or general deployment instructions (use gke-basics or gke-app-onboarding instead). |
manage-cluster |
Bring an existing GKE cluster under management on user request (e.g. “manage my cluster <name> in <location>”) by creating its Cluster Agent profile, or take one out of management by excluding it. Use whenever a user asks to manage/onboard/watch a specific existing cluster, or to stop managing, exclude or offboard one. |
| Skill |
Description |
gke-app-onboarding |
Manages GKE application onboarding, covering containerization, deployment manifests, and migration. Use when onboarding or deploying an application to GKE for the first time, or containerizing an app for GKE. Don’t use for general GKE cluster administration or upgrades (use gke-basics or gke-upgrades instead). |
gke-batch-hpc |
Runs batch and HPC workloads on GKE, utilizing job queues and parallel processing. Use when running GKE batch jobs, configuring GKE HPC, or setting up GKE job queues. Don’t use for standard web application deployments (use gke-app-onboarding instead). |
gke-workload-scaling |
Specific workflows for scaling GKE workloads using HPA and VPA, as well as best practices for autoscaling configuration. |
gke-workload-security |
Workflows for auditing and hardening the security of GKE workloads. |
gke-workload-troubleshooting |
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts. |
workload-rebalancing |
Orchestrate cross-cluster workload rebalancing using the kanban board with the validation-then-declare pattern. Use when fleet utilization shows one cluster overutilized and another with headroom and a workload should move. |
| Skill |
Description |
capacity-obtainability |
Check GKE quota and live hardware obtainability before recommending capacity, and plan future capacity windows for deadline-bound batch jobs. Use when a cluster design, capacity plan, scale-up decision, GPU/TPU batch schedule, or a free-standing availability question needs live evidence: regional quota verification (gcloud compute regions describe), reservations, capacity obtainability advice (gcloud beta compute advice capacity / capacity-history) across zones and provisioning models, and future window advice (gcloud beta compute advice calendar-mode) for “when will this shape be obtainable”. For handling an inbound cluster-autoscaler stockout alert end to end — triage, GitOps remediation, Pull Request — use the gke-stockout-investigator plugin skill instead. |
gce-compute-fleet-audit |
Audits standalone GCE virtual machines, Managed Instance Groups (MIGs), serial console boot failures, sole-tenant node group headroom, and orphaned disk snapshots. |
gke-cluster-autoscaler |
Trigger on mention of GKE cluster autoscaler, node autoscaling, node pool auto-creation / node auto-provisioning. Provides guidance on enabling and optimizing cluster autoscaler, best practices, and troubleshooting issues such as nodes not scaling up or down, zonal stockouts, or capacity buffers. Do not use for ComputeClass-specific YAML generation or priority configuration (defer to gke-compute-classes skill). |
gke-compute-classes |
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation. |
gke-cost-analysis |
Answer natural language questions and perform analysis on GKE cluster and workload costs using BigQuery billing exports, cost allocation data, and live cluster monitoring metrics. Use when querying GKE costs across projects, namespaces, or workloads, analyzing billing reports in BigQuery (bq), checking cluster cost budgets (gcloud billing), or diagnosing cost drivers like pod requests vs. actual utilization (kubectl top). Don’t use for applying cost optimization changes, creating rightsizing manifests (VPA/MPA), or selecting ComputeClasses (use gke-cost-optimization instead). |
gke-cost-optimization |
Optimizes GKE costs, rightsizes workloads, and configures Spot VMs, CUDs, cost allocation, and resource quotas. Use when optimizing GKE cluster or workload costs, configuring GKE cost allocation or quotas, rightsizing CPU/memory requests, or selecting Spot VMs and machine types. Don’t use for general compute class provisioning or GPU Selection (use gke-compute-classes instead). |
gke-productionize |
Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don’t use for deep-dive single-domain implementation (use specific domain skills like gke-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead). |
| Skill |
Description |
gke-backup-dr |
Configures Backup for GKE: the BackupRestore cluster addon, BackupPlan and RestorePlan resources, restore workflows, and CMEK-encrypted backups. Use for backup policies, disaster recovery, or GKE cluster restores. Don’t use for database backups. |
gke-platform-security |
Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (–database-encryption-key), Security Posture (–security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don’t use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security). |
gke-workload-identity |
Configures and diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 “iam.serviceAccounts.getAccessToken” / permission denied, “could not find default credentials”, or GKE metadata server unreachable) by verifying cluster and node-pool Workload Identity configuration, the Kubernetes ServiceAccount (KSA) to IAM binding (direct principal binding and legacy Google ServiceAccount impersonation), target-resource IAM roles, and gke-metadata-server health. Use when setting up KSA/GSA bindings (roles/iam.workloadIdentityUser, iam.gke.io/gcp-service-account) or when a Pod cannot authenticate to Google Cloud APIs. Don’t use for in-cluster Kubernetes RBAC errors (API-server authorization), general workload crashes (use gke-workload-troubleshooting), or Pod Security Standards and NetworkPolicies (use gke-workload-security). |
| Skill |
Description |
gcp-networking-fabric-audit |
Audits VPC subnet IPAM capacity, Cloud NAT port exhaustion, Private Service Connect routing, VPC peering MTU mismatches, Cloud Armor WAF policies, and management ports open to the whole internet. |
gke-networking |
Plans, configures, and manages core GKE cluster networking. Covers private clusters, VPC-native configurations, DNS, node egress, Dataplane V2, and IP planning. Use when designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges, or managing VPC- native cluster modes. Don’t use for application ingress, load balancing, or service networking (use gke-service-networking instead). |
gke-service-networking |
Configures GKE edge networking, traffic routing, load balancing, and private service endpoints. Use when configuring Gateway API manifests, standard Ingress, Cloud Armor WAF security policies, Container-Native Load Balancing (NEGs), Private Service Connect (PSC), or Google-managed SSL certificates on GKE. Don’t use for core cluster IP planning, Dataplane V2 network policies, or node NAT egress (use gke-networking instead). |
gke-storage |
Guidance on managing storage in Google Kubernetes Engine (GKE) clusters. |
| Skill |
Description |
gke-ai-troubleshooting-handle-disruption-gpu-tpu |
Diagnoses, predicts, and mitigates node disruptions during Compute Engine host maintenance and hardware or software maintenance events for GPU and TPU workloads on GKE. Use when diagnosing node disruptions, predicting host maintenance events on GPU/TPU nodepools, inspecting node interruption PromQL metrics, auditing node taints, or configuring workload protection strategies (graceful termination, opportunistic maintenance, PodDisruptionBudgets). Don’t use for general GKE cluster creation, network policy configuration, or non-disruption workload deployment. |
gke-ai-troubleshooting-jobset-interruption |
Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don’t use for general GKE cluster creation, basic workload deployment, or non-JobSet application issues. |
gke-ai-troubleshooting-tpu-vbar-oom |
Diagnoses and prevents vbar_control_agent segfaults, out-of-memory (OOM) errors, and TPU device initialization failures on TPU v6e nodes in GKE caused by race conditions during TPU device resets or high-frequency metrics polling. Use when troubleshooting vbar_control_agent crashes, memory cgroup OOMs in serial console logs, tpu-device-plugin metrics checksum corruption errors, or custom TPU metrics collection conflicts on GKE TPU v6e nodes. Don’t use for general non-TPU container OOM troubleshooting or standard GKE node lifecycle operations. |
gke-golden-path |
Provides GKE golden path configuration defaults, production readiness checklists, and cluster default patterns. Use when designing GKE clusters, verifying GKE production readiness, or checking configurations against GKE defaults. Don’t use for setting up workload autoscaling specifically (use gke-workload-scaling instead). |
gke-inference |
Deploys and optimizes AI/ML inference workloads on GKE, using GPUs, TPUs, and model servers. Use when deploying GKE inference servers, configuring GKE GPU resources for inference, or deploying LLMs on GKE. Don’t use for generic batch jobs or HPC task queues (use gke-batch-hpc instead). |
gke-tpu-dynamic-slices-monitoring |
Monitors, troubleshoots, and manages GKE TPU Dynamic Slices custom resources. Use when checking TPU slice lifecycle states, troubleshooting slice provisioning failures, validating single-slice or multi-slice (JobSet) workload manifests, or diagnosing stuck finalizers and the slice controller for the platform operator to clear. Don’t use for generic GKE cluster node pool creation or standard non-TPU workload management (use gke-basics or gke-cluster-creation instead). |
gke-tpu-metrics-monitoring |
Monitors and troubleshoots GKE TPU workloads, nodes, and node pools using GKE system metrics and PromQL. Use when monitoring TensorCore duty cycle, TPU memory, node readiness, multi-host TPU node pool availability, host maintenance or preemption interruptions, and calculating MTTR or MTBI metrics for GKE TPUs. Don’t use for general non-TPU GKE workload monitoring or non-metric TPU debugging. |
| Skill |
Description |
gke-alert-configuration |
Configures alerting policies in Terraform for Google Kubernetes Engine (GKE) clusters, workloads, and services using PromQL and Google Cloud Managed Service for Prometheus. Use when writing, analyzing, validating, or deploying Terraform alerting policies to monitor GKE service latency, traffic, error rates using Multi-Window Multi-Burn-Rate SLO alerts, memory saturation, and cluster health such as CrashLoopBackOff and Node NotReady conditions. Don’t use for non-GKE compute runtimes such as standalone Compute Engine VMs or standalone Cloud Run services without GKE. |
gke-basics |
Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don’t use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), cluster upgrades (use gke-upgrades), or deleting a resource (use submit-suggestion’s “Deleting a resource”). |
gke-observability |
Workflows for setting up and auditing observability (logging, monitoring, tracing) on GKE. |
kube-agents-observability |
Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent. |
| Skill |
Description |
fleet-upgrade-verification |
Reports every GKE cluster’s control-plane and node-pool versions against a target version or each cluster’s release-channel default, naming the members that lag and by how many minors, and answers whether one cluster is current for its channel (–cluster); run again during a rollout, it shows which members started, completed or stalled since the previous run; with –readiness, it also grades each member on what would stop the upgrade, naming drain-blocking PodDisruptionBudgets, fail-closed admission webhooks in the upgrade’s path or able to refuse the control plane’s bootstrap RBAC writes (ClusterRoles and ClusterRoleBindings; Roles and RoleBindings in kube-system and kube-public) with an unreachable backend, maintenance exclusions and windows, node-pool version skew, and what the per-entry rules of the upgrade-failure catalogue find, each a blocker or a risk that does not block (a zonal control plane is one). Scans the linked GitOps repositories’ manifests for apiVersions the target removes, with each hit’s replacement. Read-only against GCP, the clusters and Git, from gcloud container, kubectl get and repository reads, plus the audit log through gcloud logging read when a registered rule reads it, keeping only its own record of each run and per-member kubeconfig files; the executed counterpart to gke-upgrades’ advice. |
gke-reliability |
Workflows for ensuring high availability and reliability of GKE workloads. |
gke-upgrades |
Plans, executes, and validates Google Kubernetes Engine (GKE) cluster upgrades and maintenance operations for both Standard and Autopilot clusters. Produces upgrade plans, pre/post-upgrade checklists, maintenance runbooks with gcloud commands, release channel strategy, and troubleshooting guides. Handles node pool upgrade strategies (surge, blue-green), version compatibility, PDB management, and workload-specific concerns (stateful, GPU, operators). Use this skill whenever the user mentions GKE upgrades, Kubernetes version bumps, node pool maintenance, GKE patching, cluster version management, release channel selection, maintenance windows, surge upgrades, stuck upgrades, or any GKE lifecycle management task — even casual mentions like “we need to upgrade our clusters” or “plan our next GKE maintenance” or “our upgrade is stuck.” Don’t use for GKE cluster creation, application onboarding, general networking/routing setup, or security policy configurations (use gke-basics or relevant GKE skills instead). |
| Skill |
Description |
gcp-config-connector |
Authors Config Connector (KCC) manifests for Google Cloud resource changes and hands them to submit-suggestion as a pull request under the GitOps repository’s clusters/<cluster>/provisioning/ path. Use when a request creates or changes a GKE cluster or node pool (create, grow, autoscale, adopt), a Cloud SQL instance (add a read replica, resize), or a VPC firewall rule on an install whose GitOps repository holds Config Connector YAML. Decides create versus acquire read-only, validates every field with kubectl explain against the customer’s CRDs, and never applies. Don’t use for Kubernetes workload manifests (use gke-manifest-generation) or Terraform HCL. |
gitops-helm-chart |
Installs or upgrades a third-party Helm chart (cert-manager, ingress-nginx, external-dns, an operator) on a cluster by adding it to the GitOps repository in the form the repository’s reconciler already syncs: an Argo CD Application, a Flux HelmRelease, a Config Sync RootSync, or kustomize helmCharts. Opens one pull request through submit-suggestion, pins the chart version, and carries or names everything the chart needs outside the cluster. Never runs helm. Use when a request asks to install, add, deploy, or upgrade a chart or a packaged third-party component. Don’t use for kube-agents itself (an operator upgrades it with the installer), plain workload YAML (use gke-manifest-generation), or Google Cloud resources (use gcp-config-connector). |
gke-manifest-generation |
Generates and updates secure, production-ready Kubernetes YAML manifests optimized for GKE Autopilot and GKE Standard clusters. Use when creating or modifying GKE deployment manifests, configuring container security contexts, setting CPU/memory resource limits, defining readiness/liveness/startup probes, mounting secrets and volumes, configuring GKE Gateway API routes, targeting Spot VMs, or deploying AI model inference workloads (vLLM, TGI, Gemma). Don’t use for live cluster operations, pod troubleshooting (use gke-workload-troubleshooting), Google Cloud resources as Config Connector manifests, a new cluster included (use gcp-config-connector), cluster shape and template advice (use gke-cluster-creation), third-party Helm charts (use gitops-helm-chart), or deleting a resource (use submit-suggestion’s “Deleting a resource”). |
submit-suggestion |
Propose declarative configuration updates securely by committing file changes and submitting pull requests (merge requests on GitLab) for SRE review, including a request to delete a resource, which its “Deleting a resource” section answers with a stated stop, never a pull request. Not for fleet-audit finding fixes — the fleet-audit skill opens and tracks those PRs itself. |
| Skill |
Description |
fleet-audit |
Publish the findings of an autonomous fleet audit as one continuously-rewritten issue per audit stream on the GitOps repository’s forge, and propose fixes as narrow remediation pull requests (merge requests on GitLab). |
fleet-audit-reports |
Answer a question about a past autonomous fleet audit from the on-pod report store — what a stream last found, how many criticals are open, what changed between two runs, which clusters were skipped or only partly covered, and when each stream last ran. Never the answer to a request to run an audit: a run collects, publishes and opens its fixes through the fleet-audit skill. |
github-issue-resolver |
Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target repository (on GitHub or GitLab) strictly within authorized scope. |
inspect-repository |
Read and analyze the source of any repository on GitHub or on another forge this install serves (GitLab) — public or one this install has a token for — without a local checkout. Clones broker-side and pulls file content back; use it to answer questions about code, not to change it. |
kube-agents-feedback |
File a bug report, feature request, or question about kube-agents itself on the user’s behalf, through the project’s public feedback form, exactly once, after the user has confirmed the exact text in chat. A submission becomes a public GitHub issue on gke-labs/kube-agents. Not for telling a user where to report — the persona bullet owns that answer without a skill. |
pr-conversation |
Answer a reviewer who addressed you on one of your own pull requests — read the thread, answer or amend the branch, and reply in the thread. |
version-control |
Read and change a hosted repository through forge-neutral verbs. Version control here is abstracted — remote operations go through vcs.py, local operations use a credential-free VCS binary on a working copy that vcs.py puts on disk. Covers history, file modes, proposals and issues, so no forge CLI is needed. |
| Skill |
Description |
gke-load-bearing-change |
Establish whether an out-of-band change to a live object is load-bearing — whether the state the manifests declare would still run if the change were undone — before recommending a revert. Read-only. For drift triage, emergency hotfixes found in a cluster, and any decision between a declared state and a live one. |
gke-observability |
Workflows for setting up and auditing observability (logging, monitoring, tracing) on GKE. |
gke-reliability |
Workflows for ensuring high availability and reliability of GKE workloads. |
gke-stall-detection |
Read-only detection of controllers that stopped making progress without erroring — observedGeneration lag, stuck progress conditions, repeating warning events, and references to objects that do not exist — in one namespace or one kind. |
gke-storage |
Guidance on managing storage in Google Kubernetes Engine (GKE) clusters. |
gke-workload-scaling |
Specific workflows for scaling GKE workloads using HPA and VPA, as well as best practices for autoscaling configuration. |
gke-workload-security |
Workflows for auditing and hardening the security of GKE workloads. |
gke-workload-troubleshooting |
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts. |
See Concepts → Skills for the process. New skills land under agents/platform/skills/<name>/SKILL.md; if they should also run on schedule, add an entry to agents/platform/cron/jobs.json.