--- name: review-gke description: "[pr-review-focus-area: GKE] GKE cluster hardening and cost review — Autopilot vs Standard, workload identity, node-pool sizing, cluster autoscaler, network policy." user-invocable: true disable-model-invocation: true allowed-tools: - Read - Bash - Grep - Glob argument-hint: "[cluster-name or path to terraform]" --- # GKE Cluster Review Audit a Google Kubernetes Engine cluster for hardening and cost posture — mode (Autopilot vs Standard), workload identity, private control plane, node-pool shape, autoscaler bounds, network policy, and release channel currency. This skill is **read-only** — it only issues `gcloud container clusters describe|list` and Terraform file reads, never `create`, `update`, `upgrade`, or `delete`. ## Invocation The user runs `/review-gke `. - If the argument resolves to a filesystem path, parse Terraform under it for `google_container_cluster` and `google_container_node_pool`. - Otherwise treat the argument as a cluster name and require `gcloud container clusters list` to resolve its location. - If no argument is given, run `gcloud container clusters list --format=json` and ask the user to pick one. Never guess. ## Execution Steps Each step reports **PASS**, **CONCERN**, **FINDING**, **SKIPPED**, or **INCONCLUSIVE**. ### 1. Identify Cluster 1. Probe GCP credentials with the shared helper. Prefer `${CLAUDE_PLUGIN_ROOT}/scripts/cloud-auth-check.sh` and fall back to `plugins/infra/scripts/cloud-auth-check.sh` when running from the plugin dev repo. ```bash AUTH="${CLAUDE_PLUGIN_ROOT:-plugins/infra}/scripts/cloud-auth-check.sh" [ -x "$AUTH" ] || AUTH="plugins/infra/scripts/cloud-auth-check.sh" "$AUTH" gcp ``` If the JSON `status` is `MISSING_CLI`, `UNAUTHENTICATED`, or `EXPIRED`, fall back to Terraform-only review and mark live steps SKIPPED with the `detail` field as the reason. 2. Resolve the cluster: `gcloud container clusters list --filter="name=" --format=json`. 3. Capture full detail: `gcloud container clusters describe --region= --format=json`. Save the JSON object for later steps. 4. Capture node pools: `gcloud container node-pools list --cluster= --region= --format=json`. 5. When Terraform is the source, Read every `.tf` file matched by `grep -rln 'google_container_cluster\|google_container_node_pool' `. Do not fabricate cluster names, regions, or node-pool shapes. ### 2. Hardening Checklist Evaluate each control. Emit a matrix cell colored GREEN (PASS), YELLOW (CONCERN), or RED (FINDING). | Control | Evidence field | | --------------------------- | ------------------------------------------------- | | Shielded nodes | `nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring` + `.enableSecureBoot` | | Workload Identity | `workloadIdentityConfig.workloadPool` | | Private nodes | `privateClusterConfig.enablePrivateNodes` | | Private endpoint | `privateClusterConfig.enablePrivateEndpoint` | | Master authorized networks | `masterAuthorizedNetworksConfig.enabled` + cidrBlocks non-empty | | Release channel | `releaseChannel.channel` in `{REGULAR, STABLE}` | | Binary Authorization | `binaryAuthorization.evaluationMode` != `DISABLED`| | Node auto-upgrade | per node pool `management.autoUpgrade` | | Node auto-repair | per node pool `management.autoRepair` | | Dataplane V2 | `networkConfig.datapathProvider == ADVANCED_DATAPATH` | | Network policy | `networkPolicy.enabled` OR Dataplane V2 in use | | Legacy ABAC off | `legacyAbac.enabled == false` | | Intra-node visibility | `networkConfig.enableIntraNodeVisibility` | | Basic auth disabled | `masterAuth.username == ""` | | Client certificate disabled | `masterAuth.clientCertificateConfig.issueClientCertificate == false` | Any RED cell becomes a FINDING. YELLOW cells (for example, release channel `UNSPECIFIED` or `RAPID`) become CONCERN. ### 3. Cost Checklist Evaluate each lever against the collected data: 1. **Mode selection** — if the cluster is Standard and every node pool is general-purpose with fewer than 3 total nodes, emit CONCERN `consider-autopilot`. 2. **Node-pool rightsizing** — for each pool, compare `initialNodeCount * machineType CPU` against scheduled pod requests if known; otherwise emit INCONCLUSIVE with a note. 3. **Spot / preemptible coverage** — any pool named with `batch`, `ci`, or `dev` that is not `spot: true` → CONCERN. 4. **Autoscaler bounds** — for each pool with `autoscaling.enabled=true`, check `minNodeCount >= 1` (HA) and `maxNodeCount` is neither unset nor absurdly large (>100 without justification) → CONCERN. 5. **Idle pools** — pools with `initialNodeCount=0` and `autoscaling.enabled=false` → FINDING `dead-pool`. 6. **Disk shape** — node config `diskType == pd-standard` on control-plane-critical pools → CONCERN (prefer `pd-balanced` or `pd-ssd`). ### 4. Version and EOL 1. Extract `currentMasterVersion` and `currentNodeVersion` from cluster JSON. 2. Derive the minor version (for example `1.29.5-gke.1000` → `1.29`). 3. Compare to the channel's supported window as reported by `gcloud container get-server-config --region= --format=json` (`validMasterVersions`, `channels[].defaultVersion`, `channels[].validVersions`). 4. If the cluster's minor is older than the channel's oldest valid minor, emit FINDING `eol-soon`. If equal to the oldest valid minor, emit CONCERN. Do not fabricate EOL dates. If `get-server-config` is unavailable, mark this step INCONCLUSIVE. ### 5. Hand-Off At the end of the report, print a short next-steps block: - Recommend `/review-kubernetes-rbac` against the cluster's context for in-cluster permission review. - Recommend `/review-observability` for dashboards and alert coverage. - Recommend `/review-costs` if cost CONCERNs dominate. Do not invoke these skills automatically. ## Output Format ``` ## GKE Review — () ### Hardening Matrix | Control | Status | Evidence | | ------------------------- | ------ | ------------------------------- | | Shielded nodes | GREEN | integrity+secureBoot on | | Workload Identity | RED | workloadPool unset | | Private nodes | GREEN | enablePrivateNodes=true | | Master authorized nets | YELLOW | enabled, 0.0.0.0/0 present | | Release channel | GREEN | REGULAR | | Binary Authorization | RED | evaluationMode=DISABLED | ### Cost Matrix | Lever | Status | Note | | --------------------- | ------ | --------------------------------- | | Mode (Autopilot/Std) | GREEN | Standard, 12 nodes | | Spot coverage | YELLOW | pool 'ci' is on-demand | | Autoscaler bounds | GREEN | min=1 max=20 | | Idle pools | RED | pool 'legacy' has 0 nodes, no AS | ### Version & EOL - Master: 1.27.11-gke.1000 → FINDING: older than channel minimum (1.28) - Nodes: 1.27.11-gke.1000 → FINDING ### Next Steps - /review-kubernetes-rbac - /review-observability **Verdict: NEEDS-HARDENING** (2 RED hardening, 1 RED cost, 2 version findings) ``` ## Verdict - **HARDENED** — zero RED cells anywhere, no EOL findings. - **NEEDS-HARDENING** — one or more RED cells, or the cluster version is at or past channel EOL. - **INCONCLUSIVE** — cluster could not be described and no Terraform is available to fall back to. ## Rules 1. **Read-only.** Only `gcloud container clusters describe|list`, `gcloud container node-pools list`, and `gcloud container get-server-config` are permitted. Never call `clusters create|update|upgrade|delete`, `node-pools create|update|delete`, or any `gcloud * create|update|delete` variant. 2. **No kubectl mutation.** If `kubectl` is used to fetch context metadata, only `kubectl config current-context` and `kubectl config view` are allowed. No `apply`, `delete`, `patch`, `edit`, `create`, or `exec`. 3. **Graceful skip.** Missing `gcloud`, missing credentials, or cluster-not-found must resolve to SKIPPED with a reason; if Terraform is available, continue in static mode. 4. **Never fabricate.** Do not invent cluster names, region/zone strings, machine types, node counts, version numbers, or EOL dates. When unknown, emit INCONCLUSIVE. 5. **Cross-skill handoff.** Mention `/review-kubernetes-rbac` and `/review-observability` in the output; never invoke them. $ARGUMENTS