[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-google-cloud-gke-workload-security":3,"mdc--rdowxv-key":34,"related-repo-google-cloud-gke-workload-security":1913,"related-org-google-cloud-gke-workload-security":2013},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":32,"mdContent":33},"gke-workload-security","audit and harden GKE workload security","Workflows for auditing and hardening the security of GKE workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"google-cloud","Google Cloud","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fgoogle-cloud.png","GoogleCloudPlatform",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Kubernetes","kubernetes",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",{"name":9,"slug":8,"type":16},161,"https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fgke-mcp","2026-07-12T07:39:52.015931",null,78,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":27},[],"https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fgke-mcp\u002Ftree\u002FHEAD\u002Fskills\u002Fgke-workload-security","---\nname: gke-workload-security\ndescription: Workflows for auditing and hardening the security of GKE workloads.\n---\n\n# GKE Workload Security\n\nThis skill provides workflows and best practices for securing GKE workloads. It\ncovers security auditing, Identity and Access Management (Workload Identity),\nNetwork Security (Network Policies), and Node Security.\n\n## Workflows\n\n### 1. Security Audit\n\nAssess the current security posture of your cluster using the provided audit\nscript.\n\n**Capabilities:**\n\n- Checks for Workload Identity.\n- Verifies Network Policy is enabled.\n- Checks if Shielded Nodes are enabled.\n- Checks if Binary Authorization is enabled.\n- Checks for Private Cluster configuration.\n\n**Command:**\n\n```bash\n.\u002Fscripts\u002Faudit_cluster.sh \u003Ccluster-name> \u003Cregion> \u003Cproject-id>\n```\n\n### 2. Configure Workload Identity\n\nWorkload Identity allows Kubernetes Service Accounts (KSAs) to impersonate\nGoogle Service Accounts (GSAs). This is the recommended method for workloads to\naccess Google Cloud APIs.\n\n**Steps:**\n\n1. **Create Namespace and KSA:**\n\n   ```bash\n   kubectl create namespace workload-identity-test-ns\n   kubectl create serviceaccount \u003Cksa-name> \\\n       --namespace workload-identity-test-ns\n   ```\n\n2. **Bind KSA to GSA:**\n\n   ```bash\n   gcloud iam service-accounts add-iam-policy-binding \u003Cgsa-name>@\u003Cproject-id>.iam.gserviceaccount.com \\\n       --role roles\u002Fiam.workloadIdentityUser \\\n       --member \"serviceAccount:\u003Cproject-id>.svc.id.goog[workload-identity-test-ns\u002F\u003Cksa-name>]\"\n   ```\n\n3. **Annotate KSA:**\n\n   ```bash\n   kubectl annotate serviceaccount \u003Cksa-name> \\\n       --namespace workload-identity-test-ns \\\n       iam.gke.io\u002Fgcp-service-account=\u003Cgsa-name>@\u003Cproject-id>.iam.gserviceaccount.com\n   ```\n\n4. **Verify Example Pod:**\n   Use existing asset `assets\u002Fworkload-identity-pod.yaml` to test the\n   configuration. Update the `\u003Cksa-name>` in the file first.\n\n   ```bash\n   kubectl apply -f .\u002Fassets\u002Fworkload-identity-pod.yaml -n workload-identity-test-ns\n   ```\n\n### 3. Implement Network Policies\n\nControl traffic flow between Pods using Network Policies. By default, all\ntraffic is allowed.\n\n**Enable Network Policy Enforcement:**\n\n```bash\ngcloud container clusters update \u003Ccluster-name> \\\n    --update-addons=NetworkPolicy=ENABLED \\\n    --region \u003Cregion>\n```\n\n> [!NOTE]\n> If your cluster uses Dataplane V2 (`--enable-dataplane-v2`), Network Policy enforcement is built-in and this step is not required (and may fail).\n\n**Apply Default Deny Policy:**\nIsolate namespaces by denying all ingress and egress traffic by default.\n\n**Replace \u003Ctarget-namespace> with the namespace you want to isolate.**\n\n```bash\nkubectl apply -f .\u002Fassets\u002Fdefault-deny-netpol.yaml -n \u003Ctarget-namespace>\n```\n\n### 4. Enable Shielded Nodes\n\nEnsure nodes are running with verifiable integrity.\n\n**Command:**\n\n```bash\ngcloud container clusters update \u003Ccluster-name> \\\n    --enable-shielded-nodes \\\n    --region \u003Cregion>\n```\n\n### 5. GKE Sandbox (gVisor)\n\nRun untrusted workloads in a sandbox for extra isolation.\n\n**Enable GKE Sandbox:**\n\n```bash\ngcloud container clusters update \u003Ccluster-name> \\\n    --enable-gke-sandbox \\\n    --region \u003Cregion>\n```\n\n**Run a Sandboxed Pod:**\nAdd `runtimeClassName: gvisor` to your Pod spec.\n\n### 6. Pod Security Standards\n\nEnforce security policies on namespaces using labels.\n\n**Enforce Restricted Profile:**\n\n```bash\nkubectl label --overwrite ns \u003Cnamespace> \\\n    pod-security.kubernetes.io\u002Fenforce=restricted \\\n    pod-security.kubernetes.io\u002Fenforce-version=latest\n```\n\n> [!NOTE]\n> Using `latest` ensures you use the policies corresponding to the cluster's current version. You can pin it to a specific version (e.g., `v1.30`) to lock down the namespace to policies of a specific release.\n\n### 7. Secret Manager Integration (CSI Driver)\n\nMount secrets from Google Cloud Secret Manager directly as volumes in your pods.\n\n**Prerequisites**: Secret Manager CSI driver must be enabled on the cluster.\n\n**Example SecretProviderClass:**\n\n```yaml\napiVersion: secrets-store.csi.x-k8s.io\u002Fv1\nkind: SecretProviderClass\nmetadata:\n  name: my-secret-provider\nspec:\n  provider: gcp\n  parameters:\n    secrets: |\n      - resourceName: \"projects\u002F\u003Cproject-id>\u002Fsecrets\u002Fmy-secret\u002Fversions\u002Flatest\"\n        fileName: \"my-secret-file\"\n```\n\n**Example Pod Spec excerpt:**\n\n```yaml\nspec:\n  containers:\n    - name: my-app\n      volumeMounts:\n        - name: secrets-store-inline\n          mountPath: \"\u002Fmnt\u002Fsecrets\"\n          readOnly: true\n  volumes:\n    - name: secrets-store-inline\n      csi:\n        driver: secrets-store.csi.k8s.io\n        readOnly: true\n        volumeAttributes:\n          secretProviderClass: \"my-secret-provider\"\n```\n\n### 8. Enable Network Policy Logging\n\nIf using GKE Dataplane V2, you can log allowed and denied connections.\n\n**Steps:**\n\n1. Configure the `NetworkLogging` custom resource.\n\n**Example NetworkLogging Manifest:**\n\n```yaml\napiVersion: networking.gke.io\u002Fv1alpha1\nkind: NetworkLogging\nmetadata:\n  name: default\nspec:\n  cluster:\n    allow:\n      log: true\n      delegate: true\n    deny:\n      log: true\n      delegate: true\n```\n\nThis will log connection details to Cloud Logging.\n\n## Best Practices\n\n1. **Least Privilege:** Always use Workload Identity with minimal IAM roles. Avoid using Node default service accounts.\n2. **Network Isolation:** Use Network Policies to restrict Pod-to-Pod communication. Enable Network Policy Logging for visibility.\n3. **Image Security:** Use Binary Authorization to ensure only trusted images are deployed.\n4. **Secret Management**: Use Secret Manager CSI driver instead of default Kubernetes secrets for sensitive data.\n5. **Pod Security**: Enforce `baseline` or `restricted` Pod Security Standards on all non-system namespaces.\n6. **Policy Enforcement**: Consider using **Policy Controller** (Gatekeeper) to enforce custom security and compliance policies across the cluster.\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,47,53,60,67,72,81,111,119,203,209,214,222,622,628,633,641,726,748,758,772,820,826,831,838,919,925,930,938,1019,1037,1043,1048,1056,1126,1154,1160,1165,1175,1183,1340,1348,1593,1599,1604,1611,1627,1635,1810,1815,1821,1907],{"type":40,"tag":41,"props":42,"children":43},"element","h1",{"id":4},[44],{"type":45,"value":46},"text","GKE Workload Security",{"type":40,"tag":48,"props":49,"children":50},"p",{},[51],{"type":45,"value":52},"This skill provides workflows and best practices for securing GKE workloads. It\ncovers security auditing, Identity and Access Management (Workload Identity),\nNetwork Security (Network Policies), and Node Security.",{"type":40,"tag":54,"props":55,"children":57},"h2",{"id":56},"workflows",[58],{"type":45,"value":59},"Workflows",{"type":40,"tag":61,"props":62,"children":64},"h3",{"id":63},"_1-security-audit",[65],{"type":45,"value":66},"1. Security Audit",{"type":40,"tag":48,"props":68,"children":69},{},[70],{"type":45,"value":71},"Assess the current security posture of your cluster using the provided audit\nscript.",{"type":40,"tag":48,"props":73,"children":74},{},[75],{"type":40,"tag":76,"props":77,"children":78},"strong",{},[79],{"type":45,"value":80},"Capabilities:",{"type":40,"tag":82,"props":83,"children":84},"ul",{},[85,91,96,101,106],{"type":40,"tag":86,"props":87,"children":88},"li",{},[89],{"type":45,"value":90},"Checks for Workload Identity.",{"type":40,"tag":86,"props":92,"children":93},{},[94],{"type":45,"value":95},"Verifies Network Policy is enabled.",{"type":40,"tag":86,"props":97,"children":98},{},[99],{"type":45,"value":100},"Checks if Shielded Nodes are enabled.",{"type":40,"tag":86,"props":102,"children":103},{},[104],{"type":45,"value":105},"Checks if Binary Authorization is enabled.",{"type":40,"tag":86,"props":107,"children":108},{},[109],{"type":45,"value":110},"Checks for Private Cluster configuration.",{"type":40,"tag":48,"props":112,"children":113},{},[114],{"type":40,"tag":76,"props":115,"children":116},{},[117],{"type":45,"value":118},"Command:",{"type":40,"tag":120,"props":121,"children":126},"pre",{"className":122,"code":123,"language":124,"meta":125,"style":125},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight",".\u002Fscripts\u002Faudit_cluster.sh \u003Ccluster-name> \u003Cregion> \u003Cproject-id>\n","bash","",[127],{"type":40,"tag":128,"props":129,"children":130},"code",{"__ignoreMap":125},[131],{"type":40,"tag":132,"props":133,"children":136},"span",{"class":134,"line":135},"line",1,[137,143,149,155,161,166,170,175,180,184,188,193,198],{"type":40,"tag":132,"props":138,"children":140},{"style":139},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[141],{"type":45,"value":142},".\u002Fscripts\u002Faudit_cluster.sh",{"type":40,"tag":132,"props":144,"children":146},{"style":145},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[147],{"type":45,"value":148}," \u003C",{"type":40,"tag":132,"props":150,"children":152},{"style":151},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[153],{"type":45,"value":154},"cluster-nam",{"type":40,"tag":132,"props":156,"children":158},{"style":157},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[159],{"type":45,"value":160},"e",{"type":40,"tag":132,"props":162,"children":163},{"style":145},[164],{"type":45,"value":165},">",{"type":40,"tag":132,"props":167,"children":168},{"style":145},[169],{"type":45,"value":148},{"type":40,"tag":132,"props":171,"children":172},{"style":151},[173],{"type":45,"value":174},"regio",{"type":40,"tag":132,"props":176,"children":177},{"style":157},[178],{"type":45,"value":179},"n",{"type":40,"tag":132,"props":181,"children":182},{"style":145},[183],{"type":45,"value":165},{"type":40,"tag":132,"props":185,"children":186},{"style":145},[187],{"type":45,"value":148},{"type":40,"tag":132,"props":189,"children":190},{"style":151},[191],{"type":45,"value":192},"project-i",{"type":40,"tag":132,"props":194,"children":195},{"style":157},[196],{"type":45,"value":197},"d",{"type":40,"tag":132,"props":199,"children":200},{"style":145},[201],{"type":45,"value":202},">\n",{"type":40,"tag":61,"props":204,"children":206},{"id":205},"_2-configure-workload-identity",[207],{"type":45,"value":208},"2. Configure Workload Identity",{"type":40,"tag":48,"props":210,"children":211},{},[212],{"type":45,"value":213},"Workload Identity allows Kubernetes Service Accounts (KSAs) to impersonate\nGoogle Service Accounts (GSAs). This is the recommended method for workloads to\naccess Google Cloud APIs.",{"type":40,"tag":48,"props":215,"children":216},{},[217],{"type":40,"tag":76,"props":218,"children":219},{},[220],{"type":45,"value":221},"Steps:",{"type":40,"tag":223,"props":224,"children":225},"ol",{},[226,316,442,558],{"type":40,"tag":86,"props":227,"children":228},{},[229,234],{"type":40,"tag":76,"props":230,"children":231},{},[232],{"type":45,"value":233},"Create Namespace and KSA:",{"type":40,"tag":120,"props":235,"children":237},{"className":122,"code":236,"language":124,"meta":125,"style":125},"kubectl create namespace workload-identity-test-ns\nkubectl create serviceaccount \u003Cksa-name> \\\n    --namespace workload-identity-test-ns\n",[238],{"type":40,"tag":128,"props":239,"children":240},{"__ignoreMap":125},[241,264,303],{"type":40,"tag":132,"props":242,"children":243},{"class":134,"line":135},[244,249,254,259],{"type":40,"tag":132,"props":245,"children":246},{"style":139},[247],{"type":45,"value":248},"kubectl",{"type":40,"tag":132,"props":250,"children":251},{"style":151},[252],{"type":45,"value":253}," create",{"type":40,"tag":132,"props":255,"children":256},{"style":151},[257],{"type":45,"value":258}," namespace",{"type":40,"tag":132,"props":260,"children":261},{"style":151},[262],{"type":45,"value":263}," workload-identity-test-ns\n",{"type":40,"tag":132,"props":265,"children":267},{"class":134,"line":266},2,[268,272,276,281,285,290,294,298],{"type":40,"tag":132,"props":269,"children":270},{"style":139},[271],{"type":45,"value":248},{"type":40,"tag":132,"props":273,"children":274},{"style":151},[275],{"type":45,"value":253},{"type":40,"tag":132,"props":277,"children":278},{"style":151},[279],{"type":45,"value":280}," serviceaccount",{"type":40,"tag":132,"props":282,"children":283},{"style":145},[284],{"type":45,"value":148},{"type":40,"tag":132,"props":286,"children":287},{"style":151},[288],{"type":45,"value":289},"ksa-nam",{"type":40,"tag":132,"props":291,"children":292},{"style":157},[293],{"type":45,"value":160},{"type":40,"tag":132,"props":295,"children":296},{"style":145},[297],{"type":45,"value":165},{"type":40,"tag":132,"props":299,"children":300},{"style":157},[301],{"type":45,"value":302}," \\\n",{"type":40,"tag":132,"props":304,"children":306},{"class":134,"line":305},3,[307,312],{"type":40,"tag":132,"props":308,"children":309},{"style":151},[310],{"type":45,"value":311},"    --namespace",{"type":40,"tag":132,"props":313,"children":314},{"style":151},[315],{"type":45,"value":263},{"type":40,"tag":86,"props":317,"children":318},{},[319,324],{"type":40,"tag":76,"props":320,"children":321},{},[322],{"type":45,"value":323},"Bind KSA to GSA:",{"type":40,"tag":120,"props":325,"children":327},{"className":122,"code":326,"language":124,"meta":125,"style":125},"gcloud iam service-accounts add-iam-policy-binding \u003Cgsa-name>@\u003Cproject-id>.iam.gserviceaccount.com \\\n    --role roles\u002Fiam.workloadIdentityUser \\\n    --member \"serviceAccount:\u003Cproject-id>.svc.id.goog[workload-identity-test-ns\u002F\u003Cksa-name>]\"\n",[328],{"type":40,"tag":128,"props":329,"children":330},{"__ignoreMap":125},[331,402,419],{"type":40,"tag":132,"props":332,"children":333},{"class":134,"line":135},[334,339,344,349,354,358,363,367,371,376,381,385,389,393,398],{"type":40,"tag":132,"props":335,"children":336},{"style":139},[337],{"type":45,"value":338},"gcloud",{"type":40,"tag":132,"props":340,"children":341},{"style":151},[342],{"type":45,"value":343}," iam",{"type":40,"tag":132,"props":345,"children":346},{"style":151},[347],{"type":45,"value":348}," service-accounts",{"type":40,"tag":132,"props":350,"children":351},{"style":151},[352],{"type":45,"value":353}," add-iam-policy-binding",{"type":40,"tag":132,"props":355,"children":356},{"style":145},[357],{"type":45,"value":148},{"type":40,"tag":132,"props":359,"children":360},{"style":151},[361],{"type":45,"value":362},"gsa-nam",{"type":40,"tag":132,"props":364,"children":365},{"style":157},[366],{"type":45,"value":160},{"type":40,"tag":132,"props":368,"children":369},{"style":145},[370],{"type":45,"value":165},{"type":40,"tag":132,"props":372,"children":373},{"style":151},[374],{"type":45,"value":375},"@",{"type":40,"tag":132,"props":377,"children":378},{"style":145},[379],{"type":45,"value":380},"\u003C",{"type":40,"tag":132,"props":382,"children":383},{"style":151},[384],{"type":45,"value":192},{"type":40,"tag":132,"props":386,"children":387},{"style":157},[388],{"type":45,"value":197},{"type":40,"tag":132,"props":390,"children":391},{"style":145},[392],{"type":45,"value":165},{"type":40,"tag":132,"props":394,"children":395},{"style":151},[396],{"type":45,"value":397},".iam.gserviceaccount.com",{"type":40,"tag":132,"props":399,"children":400},{"style":157},[401],{"type":45,"value":302},{"type":40,"tag":132,"props":403,"children":404},{"class":134,"line":266},[405,410,415],{"type":40,"tag":132,"props":406,"children":407},{"style":151},[408],{"type":45,"value":409},"    --role",{"type":40,"tag":132,"props":411,"children":412},{"style":151},[413],{"type":45,"value":414}," roles\u002Fiam.workloadIdentityUser",{"type":40,"tag":132,"props":416,"children":417},{"style":157},[418],{"type":45,"value":302},{"type":40,"tag":132,"props":420,"children":421},{"class":134,"line":305},[422,427,432,437],{"type":40,"tag":132,"props":423,"children":424},{"style":151},[425],{"type":45,"value":426},"    --member",{"type":40,"tag":132,"props":428,"children":429},{"style":145},[430],{"type":45,"value":431}," \"",{"type":40,"tag":132,"props":433,"children":434},{"style":151},[435],{"type":45,"value":436},"serviceAccount:\u003Cproject-id>.svc.id.goog[workload-identity-test-ns\u002F\u003Cksa-name>]",{"type":40,"tag":132,"props":438,"children":439},{"style":145},[440],{"type":45,"value":441},"\"\n",{"type":40,"tag":86,"props":443,"children":444},{},[445,450],{"type":40,"tag":76,"props":446,"children":447},{},[448],{"type":45,"value":449},"Annotate KSA:",{"type":40,"tag":120,"props":451,"children":453},{"className":122,"code":452,"language":124,"meta":125,"style":125},"kubectl annotate serviceaccount \u003Cksa-name> \\\n    --namespace workload-identity-test-ns \\\n    iam.gke.io\u002Fgcp-service-account=\u003Cgsa-name>@\u003Cproject-id>.iam.gserviceaccount.com\n",[454],{"type":40,"tag":128,"props":455,"children":456},{"__ignoreMap":125},[457,493,509],{"type":40,"tag":132,"props":458,"children":459},{"class":134,"line":135},[460,464,469,473,477,481,485,489],{"type":40,"tag":132,"props":461,"children":462},{"style":139},[463],{"type":45,"value":248},{"type":40,"tag":132,"props":465,"children":466},{"style":151},[467],{"type":45,"value":468}," annotate",{"type":40,"tag":132,"props":470,"children":471},{"style":151},[472],{"type":45,"value":280},{"type":40,"tag":132,"props":474,"children":475},{"style":145},[476],{"type":45,"value":148},{"type":40,"tag":132,"props":478,"children":479},{"style":151},[480],{"type":45,"value":289},{"type":40,"tag":132,"props":482,"children":483},{"style":157},[484],{"type":45,"value":160},{"type":40,"tag":132,"props":486,"children":487},{"style":145},[488],{"type":45,"value":165},{"type":40,"tag":132,"props":490,"children":491},{"style":157},[492],{"type":45,"value":302},{"type":40,"tag":132,"props":494,"children":495},{"class":134,"line":266},[496,500,505],{"type":40,"tag":132,"props":497,"children":498},{"style":151},[499],{"type":45,"value":311},{"type":40,"tag":132,"props":501,"children":502},{"style":151},[503],{"type":45,"value":504}," workload-identity-test-ns",{"type":40,"tag":132,"props":506,"children":507},{"style":157},[508],{"type":45,"value":302},{"type":40,"tag":132,"props":510,"children":511},{"class":134,"line":305},[512,517,521,525,529,533,537,541,545,549,553],{"type":40,"tag":132,"props":513,"children":514},{"style":151},[515],{"type":45,"value":516},"    iam.gke.io\u002Fgcp-service-account=",{"type":40,"tag":132,"props":518,"children":519},{"style":145},[520],{"type":45,"value":380},{"type":40,"tag":132,"props":522,"children":523},{"style":151},[524],{"type":45,"value":362},{"type":40,"tag":132,"props":526,"children":527},{"style":157},[528],{"type":45,"value":160},{"type":40,"tag":132,"props":530,"children":531},{"style":145},[532],{"type":45,"value":165},{"type":40,"tag":132,"props":534,"children":535},{"style":151},[536],{"type":45,"value":375},{"type":40,"tag":132,"props":538,"children":539},{"style":145},[540],{"type":45,"value":380},{"type":40,"tag":132,"props":542,"children":543},{"style":151},[544],{"type":45,"value":192},{"type":40,"tag":132,"props":546,"children":547},{"style":157},[548],{"type":45,"value":197},{"type":40,"tag":132,"props":550,"children":551},{"style":145},[552],{"type":45,"value":165},{"type":40,"tag":132,"props":554,"children":555},{"style":151},[556],{"type":45,"value":557},".iam.gserviceaccount.com\n",{"type":40,"tag":86,"props":559,"children":560},{},[561,566,568,574,576,582,584],{"type":40,"tag":76,"props":562,"children":563},{},[564],{"type":45,"value":565},"Verify Example Pod:",{"type":45,"value":567},"\nUse existing asset ",{"type":40,"tag":128,"props":569,"children":571},{"className":570},[],[572],{"type":45,"value":573},"assets\u002Fworkload-identity-pod.yaml",{"type":45,"value":575}," to test the\nconfiguration. Update the ",{"type":40,"tag":128,"props":577,"children":579},{"className":578},[],[580],{"type":45,"value":581},"\u003Cksa-name>",{"type":45,"value":583}," in the file first.",{"type":40,"tag":120,"props":585,"children":587},{"className":122,"code":586,"language":124,"meta":125,"style":125},"kubectl apply -f .\u002Fassets\u002Fworkload-identity-pod.yaml -n workload-identity-test-ns\n",[588],{"type":40,"tag":128,"props":589,"children":590},{"__ignoreMap":125},[591],{"type":40,"tag":132,"props":592,"children":593},{"class":134,"line":135},[594,598,603,608,613,618],{"type":40,"tag":132,"props":595,"children":596},{"style":139},[597],{"type":45,"value":248},{"type":40,"tag":132,"props":599,"children":600},{"style":151},[601],{"type":45,"value":602}," apply",{"type":40,"tag":132,"props":604,"children":605},{"style":151},[606],{"type":45,"value":607}," -f",{"type":40,"tag":132,"props":609,"children":610},{"style":151},[611],{"type":45,"value":612}," .\u002Fassets\u002Fworkload-identity-pod.yaml",{"type":40,"tag":132,"props":614,"children":615},{"style":151},[616],{"type":45,"value":617}," -n",{"type":40,"tag":132,"props":619,"children":620},{"style":151},[621],{"type":45,"value":263},{"type":40,"tag":61,"props":623,"children":625},{"id":624},"_3-implement-network-policies",[626],{"type":45,"value":627},"3. Implement Network Policies",{"type":40,"tag":48,"props":629,"children":630},{},[631],{"type":45,"value":632},"Control traffic flow between Pods using Network Policies. By default, all\ntraffic is allowed.",{"type":40,"tag":48,"props":634,"children":635},{},[636],{"type":40,"tag":76,"props":637,"children":638},{},[639],{"type":45,"value":640},"Enable Network Policy Enforcement:",{"type":40,"tag":120,"props":642,"children":644},{"className":122,"code":643,"language":124,"meta":125,"style":125},"gcloud container clusters update \u003Ccluster-name> \\\n    --update-addons=NetworkPolicy=ENABLED \\\n    --region \u003Cregion>\n",[645],{"type":40,"tag":128,"props":646,"children":647},{"__ignoreMap":125},[648,690,702],{"type":40,"tag":132,"props":649,"children":650},{"class":134,"line":135},[651,655,660,665,670,674,678,682,686],{"type":40,"tag":132,"props":652,"children":653},{"style":139},[654],{"type":45,"value":338},{"type":40,"tag":132,"props":656,"children":657},{"style":151},[658],{"type":45,"value":659}," container",{"type":40,"tag":132,"props":661,"children":662},{"style":151},[663],{"type":45,"value":664}," clusters",{"type":40,"tag":132,"props":666,"children":667},{"style":151},[668],{"type":45,"value":669}," update",{"type":40,"tag":132,"props":671,"children":672},{"style":145},[673],{"type":45,"value":148},{"type":40,"tag":132,"props":675,"children":676},{"style":151},[677],{"type":45,"value":154},{"type":40,"tag":132,"props":679,"children":680},{"style":157},[681],{"type":45,"value":160},{"type":40,"tag":132,"props":683,"children":684},{"style":145},[685],{"type":45,"value":165},{"type":40,"tag":132,"props":687,"children":688},{"style":157},[689],{"type":45,"value":302},{"type":40,"tag":132,"props":691,"children":692},{"class":134,"line":266},[693,698],{"type":40,"tag":132,"props":694,"children":695},{"style":151},[696],{"type":45,"value":697},"    --update-addons=NetworkPolicy=ENABLED",{"type":40,"tag":132,"props":699,"children":700},{"style":157},[701],{"type":45,"value":302},{"type":40,"tag":132,"props":703,"children":704},{"class":134,"line":305},[705,710,714,718,722],{"type":40,"tag":132,"props":706,"children":707},{"style":151},[708],{"type":45,"value":709},"    --region",{"type":40,"tag":132,"props":711,"children":712},{"style":145},[713],{"type":45,"value":148},{"type":40,"tag":132,"props":715,"children":716},{"style":151},[717],{"type":45,"value":174},{"type":40,"tag":132,"props":719,"children":720},{"style":157},[721],{"type":45,"value":179},{"type":40,"tag":132,"props":723,"children":724},{"style":145},[725],{"type":45,"value":202},{"type":40,"tag":727,"props":728,"children":729},"blockquote",{},[730],{"type":40,"tag":48,"props":731,"children":732},{},[733,738,740,746],{"type":40,"tag":132,"props":734,"children":735},{},[736],{"type":45,"value":737},"!NOTE",{"type":45,"value":739},"\nIf your cluster uses Dataplane V2 (",{"type":40,"tag":128,"props":741,"children":743},{"className":742},[],[744],{"type":45,"value":745},"--enable-dataplane-v2",{"type":45,"value":747},"), Network Policy enforcement is built-in and this step is not required (and may fail).",{"type":40,"tag":48,"props":749,"children":750},{},[751,756],{"type":40,"tag":76,"props":752,"children":753},{},[754],{"type":45,"value":755},"Apply Default Deny Policy:",{"type":45,"value":757},"\nIsolate namespaces by denying all ingress and egress traffic by default.",{"type":40,"tag":48,"props":759,"children":760},{},[761],{"type":40,"tag":76,"props":762,"children":763},{},[764,766],{"type":45,"value":765},"Replace ",{"type":40,"tag":767,"props":768,"children":769},"target-namespace",{},[770],{"type":45,"value":771}," with the namespace you want to isolate.",{"type":40,"tag":120,"props":773,"children":775},{"className":122,"code":774,"language":124,"meta":125,"style":125},"kubectl apply -f .\u002Fassets\u002Fdefault-deny-netpol.yaml -n \u003Ctarget-namespace>\n",[776],{"type":40,"tag":128,"props":777,"children":778},{"__ignoreMap":125},[779],{"type":40,"tag":132,"props":780,"children":781},{"class":134,"line":135},[782,786,790,794,799,803,807,812,816],{"type":40,"tag":132,"props":783,"children":784},{"style":139},[785],{"type":45,"value":248},{"type":40,"tag":132,"props":787,"children":788},{"style":151},[789],{"type":45,"value":602},{"type":40,"tag":132,"props":791,"children":792},{"style":151},[793],{"type":45,"value":607},{"type":40,"tag":132,"props":795,"children":796},{"style":151},[797],{"type":45,"value":798}," .\u002Fassets\u002Fdefault-deny-netpol.yaml",{"type":40,"tag":132,"props":800,"children":801},{"style":151},[802],{"type":45,"value":617},{"type":40,"tag":132,"props":804,"children":805},{"style":145},[806],{"type":45,"value":148},{"type":40,"tag":132,"props":808,"children":809},{"style":151},[810],{"type":45,"value":811},"target-namespac",{"type":40,"tag":132,"props":813,"children":814},{"style":157},[815],{"type":45,"value":160},{"type":40,"tag":132,"props":817,"children":818},{"style":145},[819],{"type":45,"value":202},{"type":40,"tag":61,"props":821,"children":823},{"id":822},"_4-enable-shielded-nodes",[824],{"type":45,"value":825},"4. Enable Shielded Nodes",{"type":40,"tag":48,"props":827,"children":828},{},[829],{"type":45,"value":830},"Ensure nodes are running with verifiable integrity.",{"type":40,"tag":48,"props":832,"children":833},{},[834],{"type":40,"tag":76,"props":835,"children":836},{},[837],{"type":45,"value":118},{"type":40,"tag":120,"props":839,"children":841},{"className":122,"code":840,"language":124,"meta":125,"style":125},"gcloud container clusters update \u003Ccluster-name> \\\n    --enable-shielded-nodes \\\n    --region \u003Cregion>\n",[842],{"type":40,"tag":128,"props":843,"children":844},{"__ignoreMap":125},[845,884,896],{"type":40,"tag":132,"props":846,"children":847},{"class":134,"line":135},[848,852,856,860,864,868,872,876,880],{"type":40,"tag":132,"props":849,"children":850},{"style":139},[851],{"type":45,"value":338},{"type":40,"tag":132,"props":853,"children":854},{"style":151},[855],{"type":45,"value":659},{"type":40,"tag":132,"props":857,"children":858},{"style":151},[859],{"type":45,"value":664},{"type":40,"tag":132,"props":861,"children":862},{"style":151},[863],{"type":45,"value":669},{"type":40,"tag":132,"props":865,"children":866},{"style":145},[867],{"type":45,"value":148},{"type":40,"tag":132,"props":869,"children":870},{"style":151},[871],{"type":45,"value":154},{"type":40,"tag":132,"props":873,"children":874},{"style":157},[875],{"type":45,"value":160},{"type":40,"tag":132,"props":877,"children":878},{"style":145},[879],{"type":45,"value":165},{"type":40,"tag":132,"props":881,"children":882},{"style":157},[883],{"type":45,"value":302},{"type":40,"tag":132,"props":885,"children":886},{"class":134,"line":266},[887,892],{"type":40,"tag":132,"props":888,"children":889},{"style":151},[890],{"type":45,"value":891},"    --enable-shielded-nodes",{"type":40,"tag":132,"props":893,"children":894},{"style":157},[895],{"type":45,"value":302},{"type":40,"tag":132,"props":897,"children":898},{"class":134,"line":305},[899,903,907,911,915],{"type":40,"tag":132,"props":900,"children":901},{"style":151},[902],{"type":45,"value":709},{"type":40,"tag":132,"props":904,"children":905},{"style":145},[906],{"type":45,"value":148},{"type":40,"tag":132,"props":908,"children":909},{"style":151},[910],{"type":45,"value":174},{"type":40,"tag":132,"props":912,"children":913},{"style":157},[914],{"type":45,"value":179},{"type":40,"tag":132,"props":916,"children":917},{"style":145},[918],{"type":45,"value":202},{"type":40,"tag":61,"props":920,"children":922},{"id":921},"_5-gke-sandbox-gvisor",[923],{"type":45,"value":924},"5. GKE Sandbox (gVisor)",{"type":40,"tag":48,"props":926,"children":927},{},[928],{"type":45,"value":929},"Run untrusted workloads in a sandbox for extra isolation.",{"type":40,"tag":48,"props":931,"children":932},{},[933],{"type":40,"tag":76,"props":934,"children":935},{},[936],{"type":45,"value":937},"Enable GKE Sandbox:",{"type":40,"tag":120,"props":939,"children":941},{"className":122,"code":940,"language":124,"meta":125,"style":125},"gcloud container clusters update \u003Ccluster-name> \\\n    --enable-gke-sandbox \\\n    --region \u003Cregion>\n",[942],{"type":40,"tag":128,"props":943,"children":944},{"__ignoreMap":125},[945,984,996],{"type":40,"tag":132,"props":946,"children":947},{"class":134,"line":135},[948,952,956,960,964,968,972,976,980],{"type":40,"tag":132,"props":949,"children":950},{"style":139},[951],{"type":45,"value":338},{"type":40,"tag":132,"props":953,"children":954},{"style":151},[955],{"type":45,"value":659},{"type":40,"tag":132,"props":957,"children":958},{"style":151},[959],{"type":45,"value":664},{"type":40,"tag":132,"props":961,"children":962},{"style":151},[963],{"type":45,"value":669},{"type":40,"tag":132,"props":965,"children":966},{"style":145},[967],{"type":45,"value":148},{"type":40,"tag":132,"props":969,"children":970},{"style":151},[971],{"type":45,"value":154},{"type":40,"tag":132,"props":973,"children":974},{"style":157},[975],{"type":45,"value":160},{"type":40,"tag":132,"props":977,"children":978},{"style":145},[979],{"type":45,"value":165},{"type":40,"tag":132,"props":981,"children":982},{"style":157},[983],{"type":45,"value":302},{"type":40,"tag":132,"props":985,"children":986},{"class":134,"line":266},[987,992],{"type":40,"tag":132,"props":988,"children":989},{"style":151},[990],{"type":45,"value":991},"    --enable-gke-sandbox",{"type":40,"tag":132,"props":993,"children":994},{"style":157},[995],{"type":45,"value":302},{"type":40,"tag":132,"props":997,"children":998},{"class":134,"line":305},[999,1003,1007,1011,1015],{"type":40,"tag":132,"props":1000,"children":1001},{"style":151},[1002],{"type":45,"value":709},{"type":40,"tag":132,"props":1004,"children":1005},{"style":145},[1006],{"type":45,"value":148},{"type":40,"tag":132,"props":1008,"children":1009},{"style":151},[1010],{"type":45,"value":174},{"type":40,"tag":132,"props":1012,"children":1013},{"style":157},[1014],{"type":45,"value":179},{"type":40,"tag":132,"props":1016,"children":1017},{"style":145},[1018],{"type":45,"value":202},{"type":40,"tag":48,"props":1020,"children":1021},{},[1022,1027,1029,1035],{"type":40,"tag":76,"props":1023,"children":1024},{},[1025],{"type":45,"value":1026},"Run a Sandboxed Pod:",{"type":45,"value":1028},"\nAdd ",{"type":40,"tag":128,"props":1030,"children":1032},{"className":1031},[],[1033],{"type":45,"value":1034},"runtimeClassName: gvisor",{"type":45,"value":1036}," to your Pod spec.",{"type":40,"tag":61,"props":1038,"children":1040},{"id":1039},"_6-pod-security-standards",[1041],{"type":45,"value":1042},"6. Pod Security Standards",{"type":40,"tag":48,"props":1044,"children":1045},{},[1046],{"type":45,"value":1047},"Enforce security policies on namespaces using labels.",{"type":40,"tag":48,"props":1049,"children":1050},{},[1051],{"type":40,"tag":76,"props":1052,"children":1053},{},[1054],{"type":45,"value":1055},"Enforce Restricted Profile:",{"type":40,"tag":120,"props":1057,"children":1059},{"className":122,"code":1058,"language":124,"meta":125,"style":125},"kubectl label --overwrite ns \u003Cnamespace> \\\n    pod-security.kubernetes.io\u002Fenforce=restricted \\\n    pod-security.kubernetes.io\u002Fenforce-version=latest\n",[1060],{"type":40,"tag":128,"props":1061,"children":1062},{"__ignoreMap":125},[1063,1106,1118],{"type":40,"tag":132,"props":1064,"children":1065},{"class":134,"line":135},[1066,1070,1075,1080,1085,1089,1094,1098,1102],{"type":40,"tag":132,"props":1067,"children":1068},{"style":139},[1069],{"type":45,"value":248},{"type":40,"tag":132,"props":1071,"children":1072},{"style":151},[1073],{"type":45,"value":1074}," label",{"type":40,"tag":132,"props":1076,"children":1077},{"style":151},[1078],{"type":45,"value":1079}," --overwrite",{"type":40,"tag":132,"props":1081,"children":1082},{"style":151},[1083],{"type":45,"value":1084}," ns",{"type":40,"tag":132,"props":1086,"children":1087},{"style":145},[1088],{"type":45,"value":148},{"type":40,"tag":132,"props":1090,"children":1091},{"style":151},[1092],{"type":45,"value":1093},"namespac",{"type":40,"tag":132,"props":1095,"children":1096},{"style":157},[1097],{"type":45,"value":160},{"type":40,"tag":132,"props":1099,"children":1100},{"style":145},[1101],{"type":45,"value":165},{"type":40,"tag":132,"props":1103,"children":1104},{"style":157},[1105],{"type":45,"value":302},{"type":40,"tag":132,"props":1107,"children":1108},{"class":134,"line":266},[1109,1114],{"type":40,"tag":132,"props":1110,"children":1111},{"style":151},[1112],{"type":45,"value":1113},"    pod-security.kubernetes.io\u002Fenforce=restricted",{"type":40,"tag":132,"props":1115,"children":1116},{"style":157},[1117],{"type":45,"value":302},{"type":40,"tag":132,"props":1119,"children":1120},{"class":134,"line":305},[1121],{"type":40,"tag":132,"props":1122,"children":1123},{"style":151},[1124],{"type":45,"value":1125},"    pod-security.kubernetes.io\u002Fenforce-version=latest\n",{"type":40,"tag":727,"props":1127,"children":1128},{},[1129],{"type":40,"tag":48,"props":1130,"children":1131},{},[1132,1136,1138,1144,1146,1152],{"type":40,"tag":132,"props":1133,"children":1134},{},[1135],{"type":45,"value":737},{"type":45,"value":1137},"\nUsing ",{"type":40,"tag":128,"props":1139,"children":1141},{"className":1140},[],[1142],{"type":45,"value":1143},"latest",{"type":45,"value":1145}," ensures you use the policies corresponding to the cluster's current version. You can pin it to a specific version (e.g., ",{"type":40,"tag":128,"props":1147,"children":1149},{"className":1148},[],[1150],{"type":45,"value":1151},"v1.30",{"type":45,"value":1153},") to lock down the namespace to policies of a specific release.",{"type":40,"tag":61,"props":1155,"children":1157},{"id":1156},"_7-secret-manager-integration-csi-driver",[1158],{"type":45,"value":1159},"7. Secret Manager Integration (CSI Driver)",{"type":40,"tag":48,"props":1161,"children":1162},{},[1163],{"type":45,"value":1164},"Mount secrets from Google Cloud Secret Manager directly as volumes in your pods.",{"type":40,"tag":48,"props":1166,"children":1167},{},[1168,1173],{"type":40,"tag":76,"props":1169,"children":1170},{},[1171],{"type":45,"value":1172},"Prerequisites",{"type":45,"value":1174},": Secret Manager CSI driver must be enabled on the cluster.",{"type":40,"tag":48,"props":1176,"children":1177},{},[1178],{"type":40,"tag":76,"props":1179,"children":1180},{},[1181],{"type":45,"value":1182},"Example SecretProviderClass:",{"type":40,"tag":120,"props":1184,"children":1188},{"className":1185,"code":1186,"language":1187,"meta":125,"style":125},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","apiVersion: secrets-store.csi.x-k8s.io\u002Fv1\nkind: SecretProviderClass\nmetadata:\n  name: my-secret-provider\nspec:\n  provider: gcp\n  parameters:\n    secrets: |\n      - resourceName: \"projects\u002F\u003Cproject-id>\u002Fsecrets\u002Fmy-secret\u002Fversions\u002Flatest\"\n        fileName: \"my-secret-file\"\n","yaml",[1189],{"type":40,"tag":128,"props":1190,"children":1191},{"__ignoreMap":125},[1192,1211,1228,1241,1259,1272,1290,1303,1322,1331],{"type":40,"tag":132,"props":1193,"children":1194},{"class":134,"line":135},[1195,1201,1206],{"type":40,"tag":132,"props":1196,"children":1198},{"style":1197},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1199],{"type":45,"value":1200},"apiVersion",{"type":40,"tag":132,"props":1202,"children":1203},{"style":145},[1204],{"type":45,"value":1205},":",{"type":40,"tag":132,"props":1207,"children":1208},{"style":151},[1209],{"type":45,"value":1210}," secrets-store.csi.x-k8s.io\u002Fv1\n",{"type":40,"tag":132,"props":1212,"children":1213},{"class":134,"line":266},[1214,1219,1223],{"type":40,"tag":132,"props":1215,"children":1216},{"style":1197},[1217],{"type":45,"value":1218},"kind",{"type":40,"tag":132,"props":1220,"children":1221},{"style":145},[1222],{"type":45,"value":1205},{"type":40,"tag":132,"props":1224,"children":1225},{"style":151},[1226],{"type":45,"value":1227}," SecretProviderClass\n",{"type":40,"tag":132,"props":1229,"children":1230},{"class":134,"line":305},[1231,1236],{"type":40,"tag":132,"props":1232,"children":1233},{"style":1197},[1234],{"type":45,"value":1235},"metadata",{"type":40,"tag":132,"props":1237,"children":1238},{"style":145},[1239],{"type":45,"value":1240},":\n",{"type":40,"tag":132,"props":1242,"children":1244},{"class":134,"line":1243},4,[1245,1250,1254],{"type":40,"tag":132,"props":1246,"children":1247},{"style":1197},[1248],{"type":45,"value":1249},"  name",{"type":40,"tag":132,"props":1251,"children":1252},{"style":145},[1253],{"type":45,"value":1205},{"type":40,"tag":132,"props":1255,"children":1256},{"style":151},[1257],{"type":45,"value":1258}," my-secret-provider\n",{"type":40,"tag":132,"props":1260,"children":1262},{"class":134,"line":1261},5,[1263,1268],{"type":40,"tag":132,"props":1264,"children":1265},{"style":1197},[1266],{"type":45,"value":1267},"spec",{"type":40,"tag":132,"props":1269,"children":1270},{"style":145},[1271],{"type":45,"value":1240},{"type":40,"tag":132,"props":1273,"children":1275},{"class":134,"line":1274},6,[1276,1281,1285],{"type":40,"tag":132,"props":1277,"children":1278},{"style":1197},[1279],{"type":45,"value":1280},"  provider",{"type":40,"tag":132,"props":1282,"children":1283},{"style":145},[1284],{"type":45,"value":1205},{"type":40,"tag":132,"props":1286,"children":1287},{"style":151},[1288],{"type":45,"value":1289}," gcp\n",{"type":40,"tag":132,"props":1291,"children":1293},{"class":134,"line":1292},7,[1294,1299],{"type":40,"tag":132,"props":1295,"children":1296},{"style":1197},[1297],{"type":45,"value":1298},"  parameters",{"type":40,"tag":132,"props":1300,"children":1301},{"style":145},[1302],{"type":45,"value":1240},{"type":40,"tag":132,"props":1304,"children":1306},{"class":134,"line":1305},8,[1307,1312,1316],{"type":40,"tag":132,"props":1308,"children":1309},{"style":1197},[1310],{"type":45,"value":1311},"    secrets",{"type":40,"tag":132,"props":1313,"children":1314},{"style":145},[1315],{"type":45,"value":1205},{"type":40,"tag":132,"props":1317,"children":1319},{"style":1318},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1320],{"type":45,"value":1321}," |\n",{"type":40,"tag":132,"props":1323,"children":1325},{"class":134,"line":1324},9,[1326],{"type":40,"tag":132,"props":1327,"children":1328},{"style":151},[1329],{"type":45,"value":1330},"      - resourceName: \"projects\u002F\u003Cproject-id>\u002Fsecrets\u002Fmy-secret\u002Fversions\u002Flatest\"\n",{"type":40,"tag":132,"props":1332,"children":1334},{"class":134,"line":1333},10,[1335],{"type":40,"tag":132,"props":1336,"children":1337},{"style":151},[1338],{"type":45,"value":1339},"        fileName: \"my-secret-file\"\n",{"type":40,"tag":48,"props":1341,"children":1342},{},[1343],{"type":40,"tag":76,"props":1344,"children":1345},{},[1346],{"type":45,"value":1347},"Example Pod Spec excerpt:",{"type":40,"tag":120,"props":1349,"children":1351},{"className":1185,"code":1350,"language":1187,"meta":125,"style":125},"spec:\n  containers:\n    - name: my-app\n      volumeMounts:\n        - name: secrets-store-inline\n          mountPath: \"\u002Fmnt\u002Fsecrets\"\n          readOnly: true\n  volumes:\n    - name: secrets-store-inline\n      csi:\n        driver: secrets-store.csi.k8s.io\n        readOnly: true\n        volumeAttributes:\n          secretProviderClass: \"my-secret-provider\"\n",[1352],{"type":40,"tag":128,"props":1353,"children":1354},{"__ignoreMap":125},[1355,1366,1378,1400,1412,1433,1458,1476,1488,1507,1519,1537,1554,1567],{"type":40,"tag":132,"props":1356,"children":1357},{"class":134,"line":135},[1358,1362],{"type":40,"tag":132,"props":1359,"children":1360},{"style":1197},[1361],{"type":45,"value":1267},{"type":40,"tag":132,"props":1363,"children":1364},{"style":145},[1365],{"type":45,"value":1240},{"type":40,"tag":132,"props":1367,"children":1368},{"class":134,"line":266},[1369,1374],{"type":40,"tag":132,"props":1370,"children":1371},{"style":1197},[1372],{"type":45,"value":1373},"  containers",{"type":40,"tag":132,"props":1375,"children":1376},{"style":145},[1377],{"type":45,"value":1240},{"type":40,"tag":132,"props":1379,"children":1380},{"class":134,"line":305},[1381,1386,1391,1395],{"type":40,"tag":132,"props":1382,"children":1383},{"style":145},[1384],{"type":45,"value":1385},"    -",{"type":40,"tag":132,"props":1387,"children":1388},{"style":1197},[1389],{"type":45,"value":1390}," name",{"type":40,"tag":132,"props":1392,"children":1393},{"style":145},[1394],{"type":45,"value":1205},{"type":40,"tag":132,"props":1396,"children":1397},{"style":151},[1398],{"type":45,"value":1399}," my-app\n",{"type":40,"tag":132,"props":1401,"children":1402},{"class":134,"line":1243},[1403,1408],{"type":40,"tag":132,"props":1404,"children":1405},{"style":1197},[1406],{"type":45,"value":1407},"      volumeMounts",{"type":40,"tag":132,"props":1409,"children":1410},{"style":145},[1411],{"type":45,"value":1240},{"type":40,"tag":132,"props":1413,"children":1414},{"class":134,"line":1261},[1415,1420,1424,1428],{"type":40,"tag":132,"props":1416,"children":1417},{"style":145},[1418],{"type":45,"value":1419},"        -",{"type":40,"tag":132,"props":1421,"children":1422},{"style":1197},[1423],{"type":45,"value":1390},{"type":40,"tag":132,"props":1425,"children":1426},{"style":145},[1427],{"type":45,"value":1205},{"type":40,"tag":132,"props":1429,"children":1430},{"style":151},[1431],{"type":45,"value":1432}," secrets-store-inline\n",{"type":40,"tag":132,"props":1434,"children":1435},{"class":134,"line":1274},[1436,1441,1445,1449,1454],{"type":40,"tag":132,"props":1437,"children":1438},{"style":1197},[1439],{"type":45,"value":1440},"          mountPath",{"type":40,"tag":132,"props":1442,"children":1443},{"style":145},[1444],{"type":45,"value":1205},{"type":40,"tag":132,"props":1446,"children":1447},{"style":145},[1448],{"type":45,"value":431},{"type":40,"tag":132,"props":1450,"children":1451},{"style":151},[1452],{"type":45,"value":1453},"\u002Fmnt\u002Fsecrets",{"type":40,"tag":132,"props":1455,"children":1456},{"style":145},[1457],{"type":45,"value":441},{"type":40,"tag":132,"props":1459,"children":1460},{"class":134,"line":1292},[1461,1466,1470],{"type":40,"tag":132,"props":1462,"children":1463},{"style":1197},[1464],{"type":45,"value":1465},"          readOnly",{"type":40,"tag":132,"props":1467,"children":1468},{"style":145},[1469],{"type":45,"value":1205},{"type":40,"tag":132,"props":1471,"children":1473},{"style":1472},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[1474],{"type":45,"value":1475}," true\n",{"type":40,"tag":132,"props":1477,"children":1478},{"class":134,"line":1305},[1479,1484],{"type":40,"tag":132,"props":1480,"children":1481},{"style":1197},[1482],{"type":45,"value":1483},"  volumes",{"type":40,"tag":132,"props":1485,"children":1486},{"style":145},[1487],{"type":45,"value":1240},{"type":40,"tag":132,"props":1489,"children":1490},{"class":134,"line":1324},[1491,1495,1499,1503],{"type":40,"tag":132,"props":1492,"children":1493},{"style":145},[1494],{"type":45,"value":1385},{"type":40,"tag":132,"props":1496,"children":1497},{"style":1197},[1498],{"type":45,"value":1390},{"type":40,"tag":132,"props":1500,"children":1501},{"style":145},[1502],{"type":45,"value":1205},{"type":40,"tag":132,"props":1504,"children":1505},{"style":151},[1506],{"type":45,"value":1432},{"type":40,"tag":132,"props":1508,"children":1509},{"class":134,"line":1333},[1510,1515],{"type":40,"tag":132,"props":1511,"children":1512},{"style":1197},[1513],{"type":45,"value":1514},"      csi",{"type":40,"tag":132,"props":1516,"children":1517},{"style":145},[1518],{"type":45,"value":1240},{"type":40,"tag":132,"props":1520,"children":1522},{"class":134,"line":1521},11,[1523,1528,1532],{"type":40,"tag":132,"props":1524,"children":1525},{"style":1197},[1526],{"type":45,"value":1527},"        driver",{"type":40,"tag":132,"props":1529,"children":1530},{"style":145},[1531],{"type":45,"value":1205},{"type":40,"tag":132,"props":1533,"children":1534},{"style":151},[1535],{"type":45,"value":1536}," secrets-store.csi.k8s.io\n",{"type":40,"tag":132,"props":1538,"children":1540},{"class":134,"line":1539},12,[1541,1546,1550],{"type":40,"tag":132,"props":1542,"children":1543},{"style":1197},[1544],{"type":45,"value":1545},"        readOnly",{"type":40,"tag":132,"props":1547,"children":1548},{"style":145},[1549],{"type":45,"value":1205},{"type":40,"tag":132,"props":1551,"children":1552},{"style":1472},[1553],{"type":45,"value":1475},{"type":40,"tag":132,"props":1555,"children":1557},{"class":134,"line":1556},13,[1558,1563],{"type":40,"tag":132,"props":1559,"children":1560},{"style":1197},[1561],{"type":45,"value":1562},"        volumeAttributes",{"type":40,"tag":132,"props":1564,"children":1565},{"style":145},[1566],{"type":45,"value":1240},{"type":40,"tag":132,"props":1568,"children":1570},{"class":134,"line":1569},14,[1571,1576,1580,1584,1589],{"type":40,"tag":132,"props":1572,"children":1573},{"style":1197},[1574],{"type":45,"value":1575},"          secretProviderClass",{"type":40,"tag":132,"props":1577,"children":1578},{"style":145},[1579],{"type":45,"value":1205},{"type":40,"tag":132,"props":1581,"children":1582},{"style":145},[1583],{"type":45,"value":431},{"type":40,"tag":132,"props":1585,"children":1586},{"style":151},[1587],{"type":45,"value":1588},"my-secret-provider",{"type":40,"tag":132,"props":1590,"children":1591},{"style":145},[1592],{"type":45,"value":441},{"type":40,"tag":61,"props":1594,"children":1596},{"id":1595},"_8-enable-network-policy-logging",[1597],{"type":45,"value":1598},"8. Enable Network Policy Logging",{"type":40,"tag":48,"props":1600,"children":1601},{},[1602],{"type":45,"value":1603},"If using GKE Dataplane V2, you can log allowed and denied connections.",{"type":40,"tag":48,"props":1605,"children":1606},{},[1607],{"type":40,"tag":76,"props":1608,"children":1609},{},[1610],{"type":45,"value":221},{"type":40,"tag":223,"props":1612,"children":1613},{},[1614],{"type":40,"tag":86,"props":1615,"children":1616},{},[1617,1619,1625],{"type":45,"value":1618},"Configure the ",{"type":40,"tag":128,"props":1620,"children":1622},{"className":1621},[],[1623],{"type":45,"value":1624},"NetworkLogging",{"type":45,"value":1626}," custom resource.",{"type":40,"tag":48,"props":1628,"children":1629},{},[1630],{"type":40,"tag":76,"props":1631,"children":1632},{},[1633],{"type":45,"value":1634},"Example NetworkLogging Manifest:",{"type":40,"tag":120,"props":1636,"children":1638},{"className":1185,"code":1637,"language":1187,"meta":125,"style":125},"apiVersion: networking.gke.io\u002Fv1alpha1\nkind: NetworkLogging\nmetadata:\n  name: default\nspec:\n  cluster:\n    allow:\n      log: true\n      delegate: true\n    deny:\n      log: true\n      delegate: true\n",[1639],{"type":40,"tag":128,"props":1640,"children":1641},{"__ignoreMap":125},[1642,1658,1674,1685,1701,1712,1724,1736,1752,1768,1780,1795],{"type":40,"tag":132,"props":1643,"children":1644},{"class":134,"line":135},[1645,1649,1653],{"type":40,"tag":132,"props":1646,"children":1647},{"style":1197},[1648],{"type":45,"value":1200},{"type":40,"tag":132,"props":1650,"children":1651},{"style":145},[1652],{"type":45,"value":1205},{"type":40,"tag":132,"props":1654,"children":1655},{"style":151},[1656],{"type":45,"value":1657}," networking.gke.io\u002Fv1alpha1\n",{"type":40,"tag":132,"props":1659,"children":1660},{"class":134,"line":266},[1661,1665,1669],{"type":40,"tag":132,"props":1662,"children":1663},{"style":1197},[1664],{"type":45,"value":1218},{"type":40,"tag":132,"props":1666,"children":1667},{"style":145},[1668],{"type":45,"value":1205},{"type":40,"tag":132,"props":1670,"children":1671},{"style":151},[1672],{"type":45,"value":1673}," NetworkLogging\n",{"type":40,"tag":132,"props":1675,"children":1676},{"class":134,"line":305},[1677,1681],{"type":40,"tag":132,"props":1678,"children":1679},{"style":1197},[1680],{"type":45,"value":1235},{"type":40,"tag":132,"props":1682,"children":1683},{"style":145},[1684],{"type":45,"value":1240},{"type":40,"tag":132,"props":1686,"children":1687},{"class":134,"line":1243},[1688,1692,1696],{"type":40,"tag":132,"props":1689,"children":1690},{"style":1197},[1691],{"type":45,"value":1249},{"type":40,"tag":132,"props":1693,"children":1694},{"style":145},[1695],{"type":45,"value":1205},{"type":40,"tag":132,"props":1697,"children":1698},{"style":151},[1699],{"type":45,"value":1700}," default\n",{"type":40,"tag":132,"props":1702,"children":1703},{"class":134,"line":1261},[1704,1708],{"type":40,"tag":132,"props":1705,"children":1706},{"style":1197},[1707],{"type":45,"value":1267},{"type":40,"tag":132,"props":1709,"children":1710},{"style":145},[1711],{"type":45,"value":1240},{"type":40,"tag":132,"props":1713,"children":1714},{"class":134,"line":1274},[1715,1720],{"type":40,"tag":132,"props":1716,"children":1717},{"style":1197},[1718],{"type":45,"value":1719},"  cluster",{"type":40,"tag":132,"props":1721,"children":1722},{"style":145},[1723],{"type":45,"value":1240},{"type":40,"tag":132,"props":1725,"children":1726},{"class":134,"line":1292},[1727,1732],{"type":40,"tag":132,"props":1728,"children":1729},{"style":1197},[1730],{"type":45,"value":1731},"    allow",{"type":40,"tag":132,"props":1733,"children":1734},{"style":145},[1735],{"type":45,"value":1240},{"type":40,"tag":132,"props":1737,"children":1738},{"class":134,"line":1305},[1739,1744,1748],{"type":40,"tag":132,"props":1740,"children":1741},{"style":1197},[1742],{"type":45,"value":1743},"      log",{"type":40,"tag":132,"props":1745,"children":1746},{"style":145},[1747],{"type":45,"value":1205},{"type":40,"tag":132,"props":1749,"children":1750},{"style":1472},[1751],{"type":45,"value":1475},{"type":40,"tag":132,"props":1753,"children":1754},{"class":134,"line":1324},[1755,1760,1764],{"type":40,"tag":132,"props":1756,"children":1757},{"style":1197},[1758],{"type":45,"value":1759},"      delegate",{"type":40,"tag":132,"props":1761,"children":1762},{"style":145},[1763],{"type":45,"value":1205},{"type":40,"tag":132,"props":1765,"children":1766},{"style":1472},[1767],{"type":45,"value":1475},{"type":40,"tag":132,"props":1769,"children":1770},{"class":134,"line":1333},[1771,1776],{"type":40,"tag":132,"props":1772,"children":1773},{"style":1197},[1774],{"type":45,"value":1775},"    deny",{"type":40,"tag":132,"props":1777,"children":1778},{"style":145},[1779],{"type":45,"value":1240},{"type":40,"tag":132,"props":1781,"children":1782},{"class":134,"line":1521},[1783,1787,1791],{"type":40,"tag":132,"props":1784,"children":1785},{"style":1197},[1786],{"type":45,"value":1743},{"type":40,"tag":132,"props":1788,"children":1789},{"style":145},[1790],{"type":45,"value":1205},{"type":40,"tag":132,"props":1792,"children":1793},{"style":1472},[1794],{"type":45,"value":1475},{"type":40,"tag":132,"props":1796,"children":1797},{"class":134,"line":1539},[1798,1802,1806],{"type":40,"tag":132,"props":1799,"children":1800},{"style":1197},[1801],{"type":45,"value":1759},{"type":40,"tag":132,"props":1803,"children":1804},{"style":145},[1805],{"type":45,"value":1205},{"type":40,"tag":132,"props":1807,"children":1808},{"style":1472},[1809],{"type":45,"value":1475},{"type":40,"tag":48,"props":1811,"children":1812},{},[1813],{"type":45,"value":1814},"This will log connection details to Cloud Logging.",{"type":40,"tag":54,"props":1816,"children":1818},{"id":1817},"best-practices",[1819],{"type":45,"value":1820},"Best Practices",{"type":40,"tag":223,"props":1822,"children":1823},{},[1824,1834,1844,1854,1864,1890],{"type":40,"tag":86,"props":1825,"children":1826},{},[1827,1832],{"type":40,"tag":76,"props":1828,"children":1829},{},[1830],{"type":45,"value":1831},"Least Privilege:",{"type":45,"value":1833}," Always use Workload Identity with minimal IAM roles. Avoid using Node default service accounts.",{"type":40,"tag":86,"props":1835,"children":1836},{},[1837,1842],{"type":40,"tag":76,"props":1838,"children":1839},{},[1840],{"type":45,"value":1841},"Network Isolation:",{"type":45,"value":1843}," Use Network Policies to restrict Pod-to-Pod communication. Enable Network Policy Logging for visibility.",{"type":40,"tag":86,"props":1845,"children":1846},{},[1847,1852],{"type":40,"tag":76,"props":1848,"children":1849},{},[1850],{"type":45,"value":1851},"Image Security:",{"type":45,"value":1853}," Use Binary Authorization to ensure only trusted images are deployed.",{"type":40,"tag":86,"props":1855,"children":1856},{},[1857,1862],{"type":40,"tag":76,"props":1858,"children":1859},{},[1860],{"type":45,"value":1861},"Secret Management",{"type":45,"value":1863},": Use Secret Manager CSI driver instead of default Kubernetes secrets for sensitive data.",{"type":40,"tag":86,"props":1865,"children":1866},{},[1867,1872,1874,1880,1882,1888],{"type":40,"tag":76,"props":1868,"children":1869},{},[1870],{"type":45,"value":1871},"Pod Security",{"type":45,"value":1873},": Enforce ",{"type":40,"tag":128,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":45,"value":1879},"baseline",{"type":45,"value":1881}," or ",{"type":40,"tag":128,"props":1883,"children":1885},{"className":1884},[],[1886],{"type":45,"value":1887},"restricted",{"type":45,"value":1889}," Pod Security Standards on all non-system namespaces.",{"type":40,"tag":86,"props":1891,"children":1892},{},[1893,1898,1900,1905],{"type":40,"tag":76,"props":1894,"children":1895},{},[1896],{"type":45,"value":1897},"Policy Enforcement",{"type":45,"value":1899},": Consider using ",{"type":40,"tag":76,"props":1901,"children":1902},{},[1903],{"type":45,"value":1904},"Policy Controller",{"type":45,"value":1906}," (Gatekeeper) to enforce custom security and compliance policies across the cluster.",{"type":40,"tag":1908,"props":1909,"children":1910},"style",{},[1911],{"type":45,"value":1912},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1914,"total":2012},[1915,1927,1942,1955,1972,1983,1999],{"slug":1916,"name":1916,"fn":1917,"description":1918,"org":1919,"tags":1920,"stars":24,"repoUrl":25,"updatedAt":1926},"custom-golden-image-discovery","discover golden base images for GKE nodes","Expert at discovering golden base images for GKE custom nodes using technical specs or context clues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1921,1924,1925],{"name":1922,"slug":1923,"type":16},"Deployment","deployment",{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},"2026-07-12T07:39:30.888879",{"slug":1928,"name":1928,"fn":1929,"description":1930,"org":1931,"tags":1932,"stars":24,"repoUrl":25,"updatedAt":1941},"gke-ai-troubleshooting-handle-disruption-gpu-tpu","diagnose GPU and TPU workload disruptions","Diagnose and predict node disruption during Compute Engine host maintenance for GPU and TPU workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1933,1936,1937,1938],{"name":1934,"slug":1935,"type":16},"Debugging","debugging",{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"name":1939,"slug":1940,"type":16},"Performance","performance","2026-07-28T05:34:18.149515",{"slug":1943,"name":1943,"fn":1944,"description":1945,"org":1946,"tags":1947,"stars":24,"repoUrl":25,"updatedAt":1954},"gke-ai-troubleshooting-jobset-interruption","diagnose GKE JobSet interruptions","Systematically diagnose GKE JobSet interruptions, restarts, and preemptions for AI\u002FML training workloads. Identifies preemption events, maintenance interruptions, bad host VMs, unhealthy pods, and coordinator worker failures.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1948,1949,1950,1951],{"name":1934,"slug":1935,"type":16},{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"name":1952,"slug":1953,"type":16},"Observability","observability","2026-07-12T07:40:04.511878",{"slug":1956,"name":1956,"fn":1957,"description":1958,"org":1959,"tags":1960,"stars":24,"repoUrl":25,"updatedAt":1971},"gke-ai-troubleshooting-skill-creation-guide","create GKE troubleshooting skill bundles","Expert instructions for building high-quality GKE troubleshooting skills. Codifies Step 0 context rules, zero-hallucination signatures, and explicit LQL\u002FPromQL query requirements.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1961,1964,1967,1968],{"name":1962,"slug":1963,"type":16},"Documentation","documentation",{"name":1965,"slug":1966,"type":16},"Engineering","engineering",{"name":9,"slug":8,"type":16},{"name":1969,"slug":1970,"type":16},"Technical Writing","technical-writing","2026-07-12T07:39:50.73484",{"slug":1973,"name":1973,"fn":1974,"description":1975,"org":1976,"tags":1977,"stars":24,"repoUrl":25,"updatedAt":1982},"gke-ai-troubleshooting-tpu-connection-failure-vbar-oom","diagnose GKE TPU connection failures","Diagnose and prevent `vbar_control_agent` segfaults and OOMs caused by race conditions during TPU device resets and frequent metrics collection (e.g. every 3s). Use when TPU slice initialization fails or `vbar_control_agent` crashes on TPU v6e nodes.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1978,1979,1980,1981],{"name":1934,"slug":1935,"type":16},{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"name":1939,"slug":1940,"type":16},"2026-07-12T07:39:49.482979",{"slug":1984,"name":1984,"fn":1985,"description":1986,"org":1987,"tags":1988,"stars":24,"repoUrl":25,"updatedAt":1998},"gke-app-onboarding","containerize and deploy apps to GKE","Workflows for containerizing and deploying applications to GKE for the first time.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1989,1992,1993,1994,1995],{"name":1990,"slug":1991,"type":16},"Containers","containers",{"name":1922,"slug":1923,"type":16},{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"name":1996,"slug":1997,"type":16},"Onboarding","onboarding","2026-07-12T07:39:41.935837",{"slug":2000,"name":2000,"fn":2001,"description":2002,"org":2003,"tags":2004,"stars":24,"repoUrl":25,"updatedAt":2011},"gke-backup-dr","configure GKE backup and disaster recovery","Workflows for configuring Backup for GKE and disaster recovery.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2005,2006,2007,2008],{"name":1922,"slug":1923,"type":16},{"name":9,"slug":8,"type":16},{"name":18,"slug":19,"type":16},{"name":2009,"slug":2010,"type":16},"Operations","operations","2026-07-12T07:39:34.806995",25,{"items":2014,"total":2195},[2015,2031,2047,2067,2081,2090,2104,2121,2138,2151,2167,2177],{"slug":2016,"name":2016,"fn":2017,"description":2018,"org":2019,"tags":2020,"stars":2028,"repoUrl":2029,"updatedAt":2030},"kb-search","search and extract local knowledge base documents","Allows listing, searching and extracting information from local knowledge base documents for information about tables\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2021,2022,2025],{"name":1962,"slug":1963,"type":16},{"name":2023,"slug":2024,"type":16},"Knowledge Base","knowledge-base",{"name":2026,"slug":2027,"type":16},"Search","search",6749,"https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fknowledge-catalog","2026-07-12T07:38:52.157375",{"slug":2032,"name":2033,"fn":2034,"description":2035,"org":2036,"tags":2037,"stars":2028,"repoUrl":2029,"updatedAt":2046},"knowledgecatalogdiscoveryagent","knowledge_catalog_discovery_agent","search and rank Knowledge Catalog data entries","Analyzes user queries, extracts relevant predicates, and utilizes Knowledge Catalog Search to find and rank the most relevant data entries. Engages with the user throughout the process.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2038,2041,2042,2045],{"name":2039,"slug":2040,"type":16},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":16},{"name":2043,"slug":2044,"type":16},"Knowledge Management","knowledge-management",{"name":2026,"slug":2027,"type":16},"2026-07-12T07:38:22.196851",{"slug":2048,"name":2048,"fn":2049,"description":2050,"org":2051,"tags":2052,"stars":2064,"repoUrl":2065,"updatedAt":2066},"contributing","contribute to Cloud Foundation Fabric","End-to-end workflow for contributing to Cloud Foundation Fabric: triaging GitHub issues, proactive feature development, validating with tests and Policy Troubleshooter, and submitting sanitized Pull Requests. Use when addressing a Fabric GitHub issue, developing a module or FAST stage change, or preparing a branch for a pull request.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2053,2056,2057,2060,2061],{"name":2054,"slug":2055,"type":16},"Automation","automation",{"name":1965,"slug":1966,"type":16},{"name":2058,"slug":2059,"type":16},"GitHub","github",{"name":9,"slug":8,"type":16},{"name":2062,"slug":2063,"type":16},"Pull Requests","pull-requests",2062,"https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fcloud-foundation-fabric","2026-07-31T06:23:36.935005",{"slug":2068,"name":2068,"fn":2069,"description":2070,"org":2071,"tags":2072,"stars":2064,"repoUrl":2065,"updatedAt":2080},"fabric-builder","generate Terraform code for Google Cloud","Generates idiomatic Cloud Foundation Fabric (CFF) Terraform code using CFF modules. Use when users ask to create GCP resources, use Fabric modules, or generate Terraform code for Google Cloud.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2073,2074,2077],{"name":9,"slug":8,"type":16},{"name":2075,"slug":2076,"type":16},"Infrastructure as Code","infrastructure-as-code",{"name":2078,"slug":2079,"type":16},"Terraform","terraform","2026-07-12T07:38:23.514555",{"slug":2082,"name":2082,"fn":2083,"description":2084,"org":2085,"tags":2086,"stars":2064,"repoUrl":2065,"updatedAt":2089},"fast-0-org-setup-prereqs","prepare prerequisites for FAST 0-org-setup","Guides the user step-by-step through the prerequisites for the FAST 0-org-setup stage, supporting both Standard GCP and Google Cloud Dedicated (GCD) environments. Use when a user asks to prepare or run prerequisites for 0-org-setup or bootstrap the FAST landing zone.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2087,2088],{"name":9,"slug":8,"type":16},{"name":2009,"slug":2010,"type":16},"2026-07-12T07:38:28.127148",{"slug":2091,"name":2091,"fn":2092,"description":2093,"org":2094,"tags":2095,"stars":2101,"repoUrl":2102,"updatedAt":2103},"agent-aware-cli","design agent-aware command-line interfaces","Guide for designing and implementing command-line interfaces (CLIs) that are equally usable by human developers and automated coding agents. Use when the user wants to build a CLI, apply CLI best practices, or use Go with Cobra and Viper.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2096,2099,2100],{"name":2097,"slug":2098,"type":16},"CLI","cli",{"name":1965,"slug":1966,"type":16},{"name":9,"slug":8,"type":16},1150,"https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fvertex-ai-creative-studio","2026-07-12T07:39:08.41406",{"slug":2105,"name":2105,"fn":2106,"description":2107,"org":2108,"tags":2109,"stars":2101,"repoUrl":2102,"updatedAt":2120},"build-mcp-genmedia","build and configure GenAI MCP servers","Builds the mcp-genmedia Go MCP servers (nanobanana, veo, lyria, gemini-multimodal, chirp3-hd, avtool) from source and wires them into settings.json. Use this skill whenever the MCP tools are missing or broken — typically at the start of a new session, after a container restart, or when \u002Ftmp has been wiped. The prebuilt binaries in \u002Fworkspace\u002F.local\u002Fbin\u002F have no exec bit and live on a noexec mount; this skill compiles fresh executables into \u002Ftmp\u002Fbin\u002F where execution is allowed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2110,2113,2114,2117],{"name":2111,"slug":2112,"type":16},"API Development","api-development",{"name":9,"slug":8,"type":16},{"name":2115,"slug":2116,"type":16},"LLM","llm",{"name":2118,"slug":2119,"type":16},"MCP","mcp","2026-07-12T07:39:10.911302",{"slug":2122,"name":2122,"fn":2123,"description":2124,"org":2125,"tags":2126,"stars":2101,"repoUrl":2102,"updatedAt":2137},"genmedia-audio-engineer","synthesize and mix audio content","Expert in audio synthesis, music generation, and mixing. Use when creating podcasts, background scores, or multi-track audio layering using mcp-chirp3-go, mcp-lyria-go, mcp-gemini-go, mcp-nanobanana-go, and mcp-avtool-go.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2127,2130,2133,2134],{"name":2128,"slug":2129,"type":16},"Audio","audio",{"name":2131,"slug":2132,"type":16},"Creative","creative",{"name":9,"slug":8,"type":16},{"name":2135,"slug":2136,"type":16},"Vertex AI","vertex-ai","2026-07-12T07:39:16.623879",{"slug":2139,"name":2139,"fn":2140,"description":2141,"org":2142,"tags":2143,"stars":2101,"repoUrl":2102,"updatedAt":2150},"genmedia-image-artist","generate and edit AI images","Expert in AI image generation and editing. Use when the user needs high-quality textures, character-consistent visuals, or image-to-image editing using mcp-nanobanana-go.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2144,2145,2146,2149],{"name":2131,"slug":2132,"type":16},{"name":9,"slug":8,"type":16},{"name":2147,"slug":2148,"type":16},"Image Generation","image-generation",{"name":2135,"slug":2136,"type":16},"2026-07-12T07:39:15.372822",{"slug":2152,"name":2152,"fn":2153,"description":2154,"org":2155,"tags":2156,"stars":2101,"repoUrl":2102,"updatedAt":2166},"genmedia-producer","produce multi-step media content","Expert media production assistant. Use when requested to help with storyboarding, podcast creation, audio assembly, or complex multi-step media workflows using the GenMedia MCP servers (Veo, Lyria, Gemini TTS, NanoBanana).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2157,2158,2159,2160,2163],{"name":2128,"slug":2129,"type":16},{"name":2131,"slug":2132,"type":16},{"name":9,"slug":8,"type":16},{"name":2161,"slug":2162,"type":16},"Media","media",{"name":2164,"slug":2165,"type":16},"Video","video","2026-07-12T07:39:09.672849",{"slug":2168,"name":2168,"fn":2169,"description":2170,"org":2171,"tags":2172,"stars":2101,"repoUrl":2102,"updatedAt":2176},"genmedia-video-editor","edit and compose video content","Expert in video composition, editing, and format conversion. Use when the user wants to generate high-quality video, overlay images on video, concatenate clips, create GIFs, or sync audio to video using mcp-avtool-go and mcp-veo-go.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2173,2174,2175],{"name":2131,"slug":2132,"type":16},{"name":9,"slug":8,"type":16},{"name":2164,"slug":2165,"type":16},"2026-07-12T07:39:13.749081",{"slug":2178,"name":2178,"fn":2179,"description":2180,"org":2181,"tags":2182,"stars":2101,"repoUrl":2102,"updatedAt":2194},"genmedia-voice-director","generate expressive text-to-speech with Gemini","Expert in casting, directing, and generating expressive text-to-speech using Gemini TTS. Use this when the user needs virtual voice actor personas, expressive speech generation, or multiple variations of a voiceover (like \"take 3 on the bounce\").",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2183,2184,2185,2188,2191],{"name":2128,"slug":2129,"type":16},{"name":2131,"slug":2132,"type":16},{"name":2186,"slug":2187,"type":16},"Gemini","gemini",{"name":2189,"slug":2190,"type":16},"Speech","speech",{"name":2192,"slug":2193,"type":16},"Text-to-Speech","text-to-speech","2026-07-12T07:39:17.86673",80]