kube-agents skill
A set of agents for Kubernetes and GKE: scheduled fleet audits, fixes through pull requests, replies in Google Chat and Slack
- 124 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The installer creates GCP resources and a cluster under your account, and the `--permission-set` flag sets the rights.
- The agents run on a schedule without a prompt, write to chats and a GitOps repository and open pull requests with infrastructure changes.
- The install runs a script from the network through `curl ... | bash`.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/gke-labs/kube-agents/<RELEASE_VERSION>/install.sh | bashReplace `<RELEASE_VERSION>` with a release tag such as `0.4.0`. The interactive installer creates GCP resources.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The installer creates GCP resources and a cluster under your account, and the `--permission-set` flag sets the rights.
- The agents run on a schedule without a prompt, write to chats and a GitOps repository and open pull requests with infrastructure changes.
- The install runs a script from the network through `curl ... | bash`.
This is third-party code. Review the repository files before installing.
What it does
kube-agents deploys three agents into a GKE cluster. The Planning Agent receives chat messages and hands out work, the Platform Agent owns infrastructure and fleet policies, and a Cluster Agent watches one cluster with read-only access. The `install.sh` installer asks for the GCP project, the cluster (Autopilot or Standard), the chat and the model provider, after which one `terraform apply` creates the GCP resources and installs the Helm chart. The Platform Agent runs audits on a schedule: security and RBAC, workload reliability, networking and VPC, patches and upgrades, wasted spend, configuration drift. Reports arrive in Google Chat or Slack, and the agent proposes fixes as pull requests to a GitOps repository on GitHub or GitLab. The repository holds more than sixty SKILL.md files for the agents: cluster creation, cost, backup, failure diagnosis.
Who it is for. Platform teams and SREs on GKE who want to hand nightly cluster audits and failure triage to an agent while keeping fixes behind human review.
Good fit when
- Every morning a report on RBAC, networking and security across the fleet's clusters lands in Slack.
- A `CrashLoopBackOff` alert reaches the chat, and the agent looks for the cause in logs and metrics.
- Before a GKE upgrade, the agent prepares a readiness report and finds deprecated APIs.
- A team hunts for wasted spend on underused workloads and asks for a BigQuery breakdown.
- Another agent handles the install from a ready prompt: it shows the `--dry-run` result and waits for confirmation.
Not a fit when
- You want manifest checks right in the editor: kube-agents runs as a service in the cluster, not as a hint in Cursor.
- The cloud is different: the installer and Terraform target GCP and GKE.
- Fixes must reach the cluster directly: the agent makes changes only through pull requests.
- Access to a production project is about to be granted without reading the security and IAM documentation: it advises starting there.
Example request
@kube-agents run a full self-health check across the fleet and show warnings and failures by section.Limitations
The project comes from gke-labs and is not officially supported by Google. A GCP project, a GKE cluster and model provider credentials are required: Gemini, Vertex AI, OpenAI, Anthropic and compatible APIs are supported. The install runs `terraform apply` and creates billable GCP resources. The release version in the install command is filled in by hand, and GitLab needs 0.9.0 or newer. The Kubernetes agent reads the cluster without access to Secrets.
How to disable. Run `./uninstall.sh` from the unpacked release or `lifecycle.sh destroy` in `terraform/examples/full-install`: both reverse the install.
FAQ
How do I install kube-agents?
Run `curl -fsSL https://raw.githubusercontent.com/gke-labs/kube-agents/<RELEASE_VERSION>/install.sh | bash`, substituting a release tag such as `0.4.0`. The interactive installer asks for the GCP project, cluster, chat and model provider.
How do I install without prompts, from CI or by an agent?
Add `--non-interactive` and the flags `--gcp-project-id`, `--gke-cluster-name`, `--gcp-region`, `--model-provider`, `--permission-set`. Run with `--dry-run` first to see the summary.
Does the agent change the cluster itself?
No. The agent's Kubernetes rights are read-only, and it proposes infrastructure changes as pull requests to a GitOps repository that a person approves.
Which audits run on a schedule?
Security and RBAC, reliability, the GCE fleet, networking and VPC, AI workload security, capacity, upgrade readiness, wasted spend and configuration drift. The jobs live in `agents/platform/cron/jobs.json`.
Which model providers are supported?
Gemini, Vertex AI, OpenAI, Anthropic and OpenAI-compatible APIs through the LiteLLM gateway. The `--model-provider` flag sets the provider.
Discussion
No questions or reviews yet.
Related
SkillsKubeShark skill: the agent finds the failure mode first, then writes manifests, Helm and Kustomize to official practice with a rollback plan
OpenCode agents on Kubernetes: tasks and shared settings live in manifests, and kubeoc attaches to a live agent
Agent Skills for Google products
Agent Skills for Google products and technologies
Official Google skill collection for working with Google Cloud, BigQuery, GKE, ads and analytics from an agent
A Go MCP server for Kubernetes: read any cluster resource and pod logs, with apply and exec in write mode
A large base of DevOps, security, infrastructure and compliance skills for AI agents
An open-source Kubernetes UI with a built-in MCP server: the agent inspects the cluster, diagnoses breakages and operates it with RBAC in mind
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| kube-agents (this card) | no | 124 | ||
| kubectl-ai | yes | not required | 7,598 | turns requests into kubectl commands in the terminal; kube-agents walks the fleet on a schedule and runs audits and GitOps pull requests |
| GKE MCP Server | yes | not required | 169 | provides MCP tools for GKE; kube-agents deploys its own agents with scheduled audits and chat |
README in short
The project describes three agent tiers, a table of scheduled audits, a skill catalog by area, isolation measures (gVisor sandbox, a credential broker) and an architecture diagram with a Kubernetes operator.
README badge
Original SKILL.md
---
name: gke-cost-analysis
metadata:
category: CloudObservabilityAndMonitoring
description: >-
Answer natural language questions and perform analysis on GKE cluster and
workload costs using BigQuery billing exports, cost allocation data, and live
cluster monitoring metrics. Use when querying GKE costs across projects,
namespaces, or workloads, analyzing billing reports in BigQuery (`bq`), checking
cluster cost budgets (`gcloud billing`), or diagnosing cost drivers like pod
requests vs. actual utilization (`kubectl top`). Don't use for applying cost
optimization changes, creating rightsizing manifests (VPA/MPA), or selecting
ComputeClasses (use gke-cost-optimization instead).
---
# GKE Cost Analysis
This skill provides guidance on answering natural language questions about
GKE-related costs, billing reports, and utilization analysis.
## Overview
When users ask about GKE costs (e.g., "What are my costs across projects?",
"What's my most expensive namespace?", "Why is my cluster cost spiking?"), use
this skill to provide a structured and expert response using BigQuery billing
exports, cost allocation metadata, and live cluster metrics.
## Instructions
When handling a cost-related question:
1. **Provide a Direct Answer**: Address the specific cost question or
analytical request clearly and concisely.
2. **Explain BigQuery Integration**: Explain how to query BigQuery for
historical cost breakdown. Note that GKE costs originate from the GCP
Billing Detailed BigQuery Export (`gcp_billing_export_resource_v1_*`).
3. **Check & Verify Cost Allocation**: Explain that GKE Cost Allocation must be
enabled on the cluster (`--enable-cost-allocation`) for namespace, label,
and workload-level billing granularity. If queries return empty labels,
provide the `gcloud` command to enable it.
4. **Analyze Pricing Drivers & Utilization**: When diagnosing cost drivers,
explain whether the cluster is in Autopilot (billed by requested pod
CPU/memory) or Standard mode (billed by underlying VM node size + control
plane fees), and compare live utilization (`kubectl top`) against
provisioned requests.