GKE Workloads

Module: GKE Workloads

Module flag: gke_workloads Enabled by default: yes

---

Overview

The GKE Workloads module provides Kubernetes workload-level visibility: Deployments, StatefulSets, DaemonSets, CronJobs, Jobs, Services, Ingresses (including Gateway API HTTPRoutes), and NetworkPolicies. All tools are read-only.

For cluster-level management (node pools, bottlenecks, node pool resize), see GKE.

---

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules gke_workloads

---

Required GCP APIs

gcloud services enable container.googleapis.com

---

Required IAM Permissions

Role	Tools that need it
roles/container.viewer	All tools in this module

---

Tools

gcp_gke_list_workloads

Lists all workloads (Deployments, StatefulSets, DaemonSets, CronJobs, Jobs) across namespaces in a cluster.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
location	yes	Region or zone
cluster_name	yes	Cluster name
namespace	no	Filter to a specific namespace

Returns: Workload name, kind, namespace, replicas (desired/ready/available), container images, service account, secret references.

---

gcp_gke_get_workload_details

Gets full specification for a single workload.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
location	yes	Region or zone
cluster_name	yes	Cluster name
namespace	yes	Kubernetes namespace
workload_kind	yes	Deployment, StatefulSet, DaemonSet, CronJob, or Job
workload_name	yes	Workload name

Returns: Container specs (image, env vars, resource requests/limits), node selector, tolerations, affinity, service account, volume mounts.

---

gcp_gke_list_services

Lists Kubernetes Services across namespaces.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
location	yes	Region or zone
cluster_name	yes	Cluster name
namespace	no	Filter to a specific namespace

Returns: Service name, namespace, type (ClusterIP/NodePort/LoadBalancer), selector, ports, NEG annotations.

---

gcp_gke_list_ingresses

Lists Ingress resources and Gateway API HTTPRoutes.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
location	yes	Region or zone
cluster_name	yes	Cluster name
namespace	no	Filter to a specific namespace

Returns: Ingress name, namespace, hosts, TLS configuration, routing rules, load balancer IP.

---

gcp_gke_list_network_policies

Lists NetworkPolicy resources controlling pod-to-pod traffic.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
location	yes	Region or zone
cluster_name	yes	Cluster name
namespace	no	Filter to a specific namespace

Returns: Policy name, namespace, pod selector, ingress rules (from pods/namespaces/IP blocks), egress rules.

---

Prompt Examples

Workload inventory

"List all Deployments in the prod-cluster cluster in us-central1 for project my-project."

Image audit

"Which workloads in prod-cluster are running images with the tag latest instead of a pinned digest?"

Resource limits check

"Which Deployments in namespace backend of prod-cluster do not have CPU and memory limits set?"

Service account audit

"List all workloads in prod-cluster that use the default service account instead of a dedicated one."

Network policy gap

"Which namespaces in prod-cluster have no NetworkPolicy defined (all traffic allowed by default)?"

---

Related Modules

Module flag	Why you'd combine it
gke	Cluster-level details, node pools, bottleneck analysis
gke_mesh	Service-to-service traffic topology via Istio/ASM
networking	NEGs and load balancers fronting GKE Services
iam	Service account bindings for workload identity