# How to Provision GKE Clusters Using Skills: A Complete Guide to Production-Ready Deployment

> Learn to provision GKE clusters with the google skills gke-cluster-creation tool. Deploy production-ready clusters efficiently using pre-built templates and Autopilot. Supports gcloud CLI and MCP API.

- Repository: [Google/skills](https://github.com/google/skills)
- Tags: how-to-guide
- Published: 2026-09-05

---

**The `gke-cluster-creation` skill in the google/skills repository provides a comprehensive, production-ready workflow for provisioning GKE clusters through pre-built templates, defaulting to the Autopilot golden path while supporting both `gcloud` CLI and MCP API creation methods.**

Provisioning Google Kubernetes Engine (GKE) clusters using skills offers a structured, opinionated approach to infrastructure deployment. The `gke-cluster-creation` skill defined in the `google/skills` repository encapsulates best practices for security, networking, and cost optimization into reusable templates, enabling consistent cluster provisioning across development and production environments.

## Understanding the GKE Cluster Creation Skill Workflow

The skill implements an eight-step workflow documented in [`skills/cloud/gke-cluster-creation/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-cluster-creation/SKILL.md). This structured process ensures that cluster provisioning follows organizational standards while remaining flexible enough to accommodate custom requirements.

The workflow progresses through: **discovery** (identifying project and region constraints), **input collection** (gathering workload requirements), **mode selection** (choosing between Autopilot and Standard), **networking configuration** (VPC setup and private endpoint policies), **review** (validating settings against golden-path policies), **creation** (executing the provisioning command), **tracking** (monitoring operation status), and **verification** (confirming node pool readiness and API server accessibility).

## Cluster Deployment Modes and Templates

The skill provides several pre-built templates targeting specific use cases. The **Autopilot golden path** serves as the default mode, offering the safest, most managed experience with Google handling node management and maintenance. Alternative templates include **Autopilot dev/test** for non-production workloads, **Standard Regional** for clusters requiring fine-grained node control, **GPU Inference** for machine learning serving workloads, and **AI Hyper-compute** for training pipelines requiring specialized accelerator support.

According to the source code in [`skills/cloud/gke-cluster-creation/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-cluster-creation/SKILL.md), the skill defaults to Autopilot unless custom requirements—such as specific node machine types or direct node access—are explicitly expressed during the input collection phase.

## Security and Networking Best Practices

The `gke-cluster-creation` skill enforces security hardening through configurations defined in the golden-path policy file located at [`skills/cloud/gke-golden-path/assets/golden-path-autopilot.yaml`](https://github.com/google/skills/blob/main/skills/cloud/gke-golden-path/assets/golden-path-autopilot.yaml). Key security features include **private clusters** with VPC-native IP aliases, **Workload Identity** for secure service account impersonation, **Shielded nodes** with secure boot and integrity monitoring, and **RBAC hardening** that disables insecure system-authenticated binding configurations.

Networking configurations emphasize private endpoint enforcement, master authorized networks, and DNS access controls. These settings align with the "Best Practices → Security & Networking" section of the skill documentation, ensuring that clusters are provisioned with minimal attack surface exposure.

## Creating a Cluster Using the Autopilot Golden Path

The canonical method for provisioning GKE clusters using skills involves applying the golden-path configuration. This policy file encodes recommended defaults for autoscaling, security, networking, logging, and monitoring into a declarative specification.

### Using the gcloud CLI

For most users, the recommended entry point uses the `gcloud` command-line tool with parameters matching the golden-path policy:

```bash
gcloud container clusters create-auto my-cluster \
  --region us-central1 \
  --project my-project-id \
  --release-channel regular \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --enable-dns-access \
  --enable-secret-manager \
  --secret-manager-rotation-interval=120s \
  --scoped-rbs-bindings \
  --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,STORAGE,POD,DEPLOYMENT,STATEFULSET,DAEMONSET,HPA,CADVISOR,KUBELET,DCGM \
  --quiet

```

This command mirrors the configuration defined in [`golden-path-autopilot.yaml`](https://github.com/google/skills/blob/main/golden-path-autopilot.yaml), enabling Secret Manager integration with 120-second rotation intervals, comprehensive monitoring across all control plane components, and scoped RBAC bindings for enhanced security posture.

### Using the MCP create_cluster API

For programmatic provisioning, the skill supports the MCP `create_cluster` API. The following JSON payload achieves identical results to the `gcloud` command:

```json
{
  "parent": "projects/my-project-id/locations/us-central1",
  "cluster": {
    "name": "my-cluster",
    "autopilot": { "enabled": true },
    "privateClusterConfig": { "enablePrivateNodes": true },
    "masterAuthorizedNetworksConfig": {
      "privateEndpointEnforcementEnabled": true
    },
    "releaseChannel": { "channel": "REGULAR" },
    "secretManagerConfig": {
      "enabled": true,
      "rotationConfig": { "enabled": true, "rotationInterval": "120s" }
    },
    "rbacBindingConfig": {
      "enableInsecureBindingSystemAuthenticated": false,
      "enableInsecureBindingSystemUnauthenticated": false
    }
  }
}

```

Send this payload to the `create_cluster` MCP tool or any client library wrapping the GKE API to provision a cluster that complies with the skill's golden-path standards.

## Cost Optimization and High Availability Features

The skill incorporates cost optimization strategies through **autoscaling** configurations, **Spot VM** support for fault-tolerant workloads, and **right-sizing** recommendations based on actual resource utilization patterns documented in [`skills/cloud/gke-cluster-creation/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-cluster-creation/SKILL.md).

For high availability, the skill advocates for **regional clusters** spanning multiple zones, **Pod Disruption Budgets** to ensure application continuity during maintenance, and **release channel subscriptions** (defaulting to the "regular" channel) to automate Kubernetes version upgrades with tested stability guarantees. These features appear under the "Best Practices → High Availability & Reliability" section of the skill documentation.

## Summary

- The `gke-cluster-creation` skill in `google/skills` provides an eight-step workflow for standardized GKE provisioning.
- **Autopilot golden path** serves as the default deployment mode, encoding security and operational best practices.
- Cluster creation supports both `gcloud` CLI commands and the MCP `create_cluster` API using configurations from [`golden-path-autopilot.yaml`](https://github.com/google/skills/blob/main/golden-path-autopilot.yaml).
- Built-in templates address specific use cases including GPU inference, AI training, and development environments.
- Security defaults include private nodes, Workload Identity, and hardened RBAC policies.

## Frequently Asked Questions

### What is the difference between Autopilot and Standard mode in the GKE cluster creation skill?

**Autopilot mode** provides a fully managed experience where Google handles node provisioning, scaling, and maintenance, making it the skill's default "golden path" recommendation. **Standard mode** grants direct control over node configuration, machine types, and cluster autoscaler settings, suitable for workloads requiring specific kernel tuning or custom node images. The skill guides users toward Autopilot unless they explicitly require Standard-specific capabilities.

### Where are the golden-path configuration policies stored in the repository?

The canonical Autopilot policy file resides at [`skills/cloud/gke-golden-path/assets/golden-path-autopilot.yaml`](https://github.com/google/skills/blob/main/skills/cloud/gke-golden-path/assets/golden-path-autopilot.yaml) within the `google/skills` repository. This YAML file encodes all recommended defaults including security hardening, networking policies, autoscaling parameters, and monitoring configurations. Reference documentation for extending these policies appears in [`skills/cloud/gke-golden-path/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gke-golden-path/SKILL.md).

### How does the skill handle cost optimization for GKE clusters?

The skill implements cost optimization through three primary mechanisms: **autoscaling** to match resource allocation with actual demand, **Spot VM** support for interruptible workloads at reduced pricing, and **right-sizing** recommendations based on historical usage patterns. These settings are automatically applied when using the Autopilot golden path template, though users can customize them during the input collection phase of the workflow.

### Can I use the skill to create private clusters with restricted API server access?

Yes, the skill's golden-path configuration defaults to private clusters with restricted API server access. The `enablePrivateNodes` and `enableMasterAuthorizedNetworks` settings, combined with `privateEndpointEnforcementEnabled` in the `masterAuthorizedNetworksConfig`, ensure that the control plane endpoint is only accessible through authorized networks or private Google Cloud connections, eliminating public internet exposure.