[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P3YYXNMJSYV6G8M41MNN2F":3,"skill-same:01M6P3YYXNMJSYV6G8M41MNN2F":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":27,"commitSha":52,"skillDirectory":53,"forksCount":13,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6P3YYXNMJSYV6G8M41MNN2F","gcp-networking",null,"Configure VPCs, firewall rules, and Cloud NAT. Implement shared VPC and private service connect. Use when designing GCP network infrastructure.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fgcp-networking\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"gcp networking","networking","gcp","configure","relevant","scripts","critical","os","shared","main","community","only","security","access","devops-security","vpc","nat","firewall","network","connect","2026-11-10 10:12:30",false,"---\nname: gcp-networking\ndescription: Configure VPCs, firewall rules, and Cloud NAT. Implement shared VPC and\n  private service connect. Use when designing GCP network infrastructure.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# GCP Networking\n\nDesign, implement, and secure network infrastructure on Google Cloud Platform.\n\n## When to Use\n\n- Building VPC networks for new GCP projects or multi-project architectures\n- Configuring firewall rules to control traffic between services\n- Setting up Cloud NAT for outbound internet access from private instances\n- Deploying load balancers for HTTP(S), TCP\u002FUDP, or internal traffic\n- Implementing Private Service Connect or Shared VPC\n\n## Prerequisites\n\n- Google Cloud SDK (`gcloud`) installed and authenticated\n- Compute Engine API enabled\n- IAM role `roles\u002Fcompute.networkAdmin` for network management\n\n```bash\ngcloud services enable compute.googleapis.com servicenetworking.googleapis.com\n```\n\n## VPC Network Creation\n\n```bash\ngcloud compute networks create prod-vpc \\\n  --subnet-mode=custom --bgp-routing-mode=regional --mtu=1460\n\ngcloud compute networks subnets create us-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.0.0.0\u002F20 \\\n  --enable-private-ip-google-access --enable-flow-logs \\\n  --logging-flow-sampling=0.5\n\ngcloud compute networks subnets create eu-subnet \\\n  --network=prod-vpc --region=europe-west1 --range=10.1.0.0\u002F20 \\\n  --enable-private-ip-google-access --enable-flow-logs\n\n# Subnet with secondary ranges for GKE\ngcloud compute networks subnets create gke-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.2.0.0\u002F20 \\\n  --secondary-range=pods=10.4.0.0\u002F14,services=10.8.0.0\u002F20 \\\n  --enable-private-ip-google-access\n\n# Proxy-only subnet (required for regional L7 LBs)\ngcloud compute networks subnets create proxy-only-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.129.0.0\u002F23 \\\n  --purpose=REGIONAL_MANAGED_PROXY --role=ACTIVE\n```\n\n## Firewall Rules\n\n```bash\ngcloud compute firewall-rules create allow-http-https \\\n  --network=prod-vpc --allow=tcp:80,tcp:443 \\\n  --source-ranges=0.0.0.0\u002F0 --target-tags=http-server --priority=1000\n\ngcloud compute firewall-rules create allow-internal \\\n  --network=prod-vpc --allow=tcp,udp,icmp \\\n  --source-ranges=10.0.0.0\u002F8 --priority=1000\n\ngcloud compute firewall-rules create allow-iap-ssh \\\n  --network=prod-vpc --allow=tcp:22 \\\n  --source-ranges=35.235.240.0\u002F20 --priority=1000\n\ngcloud compute firewall-rules create allow-health-checks \\\n  --network=prod-vpc --allow=tcp:80,tcp:443,tcp:8080 \\\n  --source-ranges=130.211.0.0\u002F22,35.191.0.0\u002F16 \\\n  --target-tags=http-server --priority=900\n\n# List firewall rules\ngcloud compute firewall-rules list --filter=\"network=prod-vpc\" \\\n  --format=\"table(name,direction,priority,allowed[].map().firewall_rule().list():label=ALLOW)\"\n```\n\n## Cloud NAT\n\n```bash\ngcloud compute routers create prod-router \\\n  --network=prod-vpc --region=us-central1\n\ngcloud compute routers nats create prod-nat \\\n  --router=prod-router --region=us-central1 \\\n  --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips \\\n  --min-ports-per-vm=256 --max-ports-per-vm=4096 \\\n  --enable-logging --log-filter=ERRORS_ONLY\n\n# Static NAT IPs (stable egress)\ngcloud compute addresses create nat-ip-1 nat-ip-2 --region=us-central1\ngcloud compute routers nats create prod-nat-static \\\n  --router=prod-router --region=us-central1 \\\n  --nat-all-subnet-ip-ranges --nat-external-ip-pool=nat-ip-1,nat-ip-2\n```\n\n## External HTTP(S) Load Balancer\n\n```bash\ngcloud compute addresses create web-lb-ip --global\n\ngcloud compute health-checks create http web-hc \\\n  --port=80 --request-path=\u002Fhealthz --check-interval=10s --timeout=5s\n\ngcloud compute backend-services create web-backend \\\n  --protocol=HTTP --port-name=http --health-checks=web-hc \\\n  --global --enable-cdn --enable-logging\n\ngcloud compute backend-services add-backend web-backend \\\n  --instance-group=web-mig --instance-group-region=us-central1 \\\n  --balancing-mode=UTILIZATION --max-utilization=0.8 --global\n\ngcloud compute url-maps create web-url-map --default-service=web-backend\n\ngcloud compute ssl-certificates create web-cert \\\n  --domains=app.example.com --global\n\ngcloud compute target-https-proxies create web-proxy \\\n  --url-map=web-url-map --ssl-certificates=web-cert\n\ngcloud compute forwarding-rules create web-https \\\n  --address=web-lb-ip --target-https-proxy=web-proxy --ports=443 --global\n```\n\n## Internal Load Balancer\n\n```bash\ngcloud compute backend-services create internal-backend \\\n  --protocol=TCP --region=us-central1 \\\n  --health-checks=web-hc --health-checks-region=us-central1 \\\n  --load-balancing-scheme=INTERNAL\n\ngcloud compute forwarding-rules create internal-lb \\\n  --region=us-central1 --load-balancing-scheme=INTERNAL \\\n  --network=prod-vpc --subnet=us-subnet \\\n  --backend-service=internal-backend --ports=8080\n```\n\n## Cloud Armor (DDoS and WAF)\n\n```bash\ngcloud compute security-policies create web-armor\n\ngcloud compute security-policies rules create 1000 \\\n  --security-policy=web-armor \\\n  --expression=\"origin.region_code == 'XX'\" --action=deny-403\n\ngcloud compute security-policies rules create 2000 \\\n  --security-policy=web-armor --expression=\"true\" \\\n  --action=rate-based-ban \\\n  --rate-limit-threshold-count=100 \\\n  --rate-limit-threshold-interval-sec=60 --ban-duration-sec=600\n\ngcloud compute backend-services update web-backend \\\n  --security-policy=web-armor --global\n```\n\n## Private Service Connect\n\n```bash\ngcloud compute addresses create psc-google-apis \\\n  --global --purpose=PRIVATE_SERVICE_CONNECT \\\n  --addresses=10.255.255.254 --network=prod-vpc\n\ngcloud compute forwarding-rules create psc-google-apis \\\n  --global --network=prod-vpc --address=psc-google-apis \\\n  --target-google-apis-bundle=all-apis\n```\n\n## Shared VPC\n\n```bash\ngcloud compute shared-vpc enable $HOST_PROJECT_ID\ngcloud compute shared-vpc associated-projects add $SERVICE_PROJECT_ID \\\n  --host-project=$HOST_PROJECT_ID\n```\n\n## Terraform Configuration\n\n```hcl\nresource \"google_compute_network\" \"vpc\" {\n  name                    = \"prod-vpc\"\n  auto_create_subnetworks = false\n  routing_mode            = \"REGIONAL\"\n}\n\nresource \"google_compute_subnetwork\" \"us\" {\n  name                     = \"us-subnet\"\n  ip_cidr_range            = \"10.0.0.0\u002F20\"\n  region                   = \"us-central1\"\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  log_config { aggregation_interval = \"INTERVAL_5_SEC\"; flow_sampling = 0.5 }\n}\n\nresource \"google_compute_firewall\" \"allow_http\" {\n  name    = \"allow-http-https\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"; ports = [\"80\", \"443\"] }\n  source_ranges = [\"0.0.0.0\u002F0\"]\n  target_tags   = [\"http-server\"]\n}\n\nresource \"google_compute_firewall\" \"allow_iap\" {\n  name    = \"allow-iap-ssh\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"; ports = [\"22\"] }\n  source_ranges = [\"35.235.240.0\u002F20\"]\n}\n\nresource \"google_compute_router\" \"router\" {\n  name    = \"prod-router\"\n  region  = \"us-central1\"\n  network = google_compute_network.vpc.id\n}\n\nresource \"google_compute_router_nat\" \"nat\" {\n  name                               = \"prod-nat\"\n  router                             = google_compute_router.router.name\n  region                             = \"us-central1\"\n  nat_ip_allocate_option             = \"AUTO_ONLY\"\n  source_subnetwork_ip_ranges_to_nat = \"ALL_SUBNETWORKS_ALL_IP_RANGES\"\n  min_ports_per_vm                   = 256\n  log_config { enable = true; filter = \"ERRORS_ONLY\" }\n}\n\nresource \"google_compute_security_policy\" \"waf\" {\n  name = \"web-armor\"\n  rule {\n    action   = \"deny(403)\"\n    priority = 1000\n    match { expr { expression = \"evaluatePreconfiguredExpr('xss-v33-stable')\" } }\n  }\n  rule {\n    action   = \"allow\"\n    priority = 2147483647\n    match { versioned_expr = \"SRC_IPS_V1\"; config { src_ip_ranges = [\"*\"] } }\n  }\n}\n```\n\n## Common Operations\n\n```bash\ngcloud compute networks list\ngcloud compute networks subnets list --network=prod-vpc\ngcloud compute networks subnets describe us-subnet --region=us-central1\ngcloud network-management connectivity-tests create test-web-to-db \\\n  --source-instance=projects\u002F${PROJECT_ID}\u002Fzones\u002Fus-central1-a\u002Finstances\u002Fweb \\\n  --destination-instance=projects\u002F${PROJECT_ID}\u002Fzones\u002Fus-central1-a\u002Finstances\u002Fdb \\\n  --destination-port=5432 --protocol=TCP\n```\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| Instance cannot reach internet | No external IP and no Cloud NAT | Configure Cloud NAT on the subnet's router |\n| Firewall rule not taking effect | Wrong target tags or priority | Verify tags match instance; check priority ordering |\n| Load balancer returns 502 | Backend failing health checks | Check health check path\u002Fport; allow `130.211.0.0\u002F22`, `35.191.0.0\u002F16` |\n| Cannot reach Google APIs from private VM | Private Google Access disabled | Enable `--enable-private-ip-google-access` on subnet |\n| Cloud NAT port exhaustion | Too many connections per VM | Increase `--min-ports-per-vm`; enable dynamic port allocation |\n| Shared VPC project cannot create VMs | Missing `compute.networkUser` role | Grant `roles\u002Fcompute.networkUser` on host project |\n| SSL cert stuck PROVISIONING | DNS not pointing to LB IP | Update A record to reserved static IP; wait up to 60 min |\n\n## Related Skills\n\n- **gcp-compute** - Compute Engine instances that use VPC networks and firewall rules\n- **gcp-gke** - GKE clusters deployed in VPC subnets with secondary ranges\n- **gcp-cloud-sql** - Private IP database connectivity through VPC peering\n- **terraform-gcp** - Provision networking resources with Infrastructure as Code\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# GCP Networking\n\nDesign, implement, and secure network infrastructure on Google Cloud Platform.\n\n## When to Use\n\n- Building VPC networks for new GCP projects or multi-project architectures\n- Configuring firewall rules to control traffic between services\n- Setting up Cloud NAT for outbound internet access from private instances\n- Deploying load balancers for HTTP(S), TCP\u002FUDP, or internal traffic\n- Implementing Private Service Connect or Shared VPC\n\n## Prerequisites\n\n- Google Cloud SDK (`gcloud`) installed and authenticated\n- Compute Engine API enabled\n- IAM role `roles\u002Fcompute.networkAdmin` for network management\n\n```bash\ngcloud services enable compute.googleapis.com servicenetworking.googleapis.com\n```\n\n## VPC Network Creation\n\n```bash\ngcloud compute networks create prod-vpc \\\n  --subnet-mode=custom --bgp-routing-mode=regional --mtu=1460\n\ngcloud compute networks subnets create us-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.0.0.0\u002F20 \\\n  --enable-private-ip-google-access --enable-flow-logs \\\n  --logging-flow-sampling=0.5\n\ngcloud compute networks subnets create eu-subnet \\\n  --network=prod-vpc --region=europe-west1 --range=10.1.0.0\u002F20 \\\n  --enable-private-ip-google-access --enable-flow-logs\n\n# Subnet with secondary ranges for GKE\ngcloud compute networks subnets create gke-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.2.0.0\u002F20 \\\n  --secondary-range=pods=10.4.0.0\u002F14,services=10.8.0.0\u002F20 \\\n  --enable-private-ip-google-access\n\n# Proxy-only subnet (required for regional L7 LBs)\ngcloud compute networks subnets create proxy-only-subnet \\\n  --network=prod-vpc --region=us-central1 --range=10.129.0.0\u002F23 \\\n  --purpose=REGIONAL_MANAGED_PROXY --role=ACTIVE\n```\n\n## Firewall Rules\n\n```bash\ngcloud compute firewall-rules create allow-http-https \\\n  --network=prod-vpc --allow=tcp:80,tcp:443 \\\n  --source-ranges=0.0.0.0\u002F0 --target-tags=http-server --priority=1000\n\ngcloud compute firewall-rules create allow-internal \\\n  --network=prod-vpc --allow=tcp,udp,icmp \\\n  --source-ranges=10.0.0.0\u002F8 --priority=1000\n\ngcloud compute firewall-rules create allow-iap-ssh \\\n  --network=prod-vpc --allow=tcp:22 \\\n  --source-ranges=35.235.240.0\u002F20 --priority=1000\n\ngcloud compute firewall-rules create allow-health-checks \\\n  --network=prod-vpc --allow=tcp:80,tcp:443,tcp:8080 \\\n  --source-ranges=130.211.0.0\u002F22,35.191.0.0\u002F16 \\\n  --target-tags=http-server --priority=900\n\n# List firewall rules\ngcloud compute firewall-rules list --filter=\"network=prod-vpc\" \\\n  --format=\"table(name,direction,priority,allowed[].map().firewall_rule().list():label=ALLOW)\"\n```\n\n## Cloud NAT\n\n```bash\ngcloud compute routers create prod-router \\\n  --network=prod-vpc --region=us-central1\n\ngcloud compute routers nats create prod-nat \\\n  --router=prod-router --region=us-central1 \\\n  --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips \\\n  --min-ports-per-vm=256 --max-ports-per-vm=4096 \\\n  --enable-logging --log-filter=ERRORS_ONLY\n\n# Static NAT IPs (stable egress)\ngcloud compute addresses create nat-ip-1 nat-ip-2 --region=us-central1\ngcloud compute routers nats create prod-nat-static \\\n  --router=prod-router --region=us-central1 \\\n  --nat-all-subnet-ip-ranges --nat-external-ip-pool=nat-ip-1,nat-ip-2\n```\n\n## External HTTP(S) Load Balancer\n\n```bash\ngcloud compute addresses create web-lb-ip --global\n\ngcloud compute health-checks create http web-hc \\\n  --port=80 --request-path=\u002Fhealthz --check-interval=10s --timeout=5s\n\ngcloud compute backend-services create web-backend \\\n  --protocol=HTTP --port-name=http --health-checks=web-hc \\\n  --global --enable-cdn --enable-logging\n\ngcloud compute backend-services add-backend web-backend \\\n  --instance-group=web-mig --instance-group-region=us-central1 \\\n  --balancing-mode=UTILIZATION --max-utilization=0.8 --global\n\ngcloud compute url-maps create web-url-map --default-service=web-backend\n\ngcloud compute ssl-certificates create web-cert \\\n  --domains=app.example.com --global\n\ngcloud compute target-https-proxies create web-proxy \\\n  --url-map=web-url-map --ssl-certificates=web-cert\n\ngcloud compute forwarding-rules create web-https \\\n  --address=web-lb-ip --target-https-proxy=web-proxy --ports=443 --global\n```\n\n## Internal Load Balancer\n\n```bash\ngcloud compute backend-services create internal-backend \\\n  --protocol=TCP --region=us-central1 \\\n  --health-checks=web-hc --health-checks-region=us-central1 \\\n  --load-balancing-scheme=INTERNAL\n\ngcloud compute forwarding-rules create internal-lb \\\n  --region=us-central1 --load-balancing-scheme=INTERNAL \\\n  --network=prod-vpc --subnet=us-subnet \\\n  --backend-service=internal-backend --ports=8080\n```\n\n## Cloud Armor (DDoS and WAF)\n\n```bash\ngcloud compute security-policies create web-armor\n\ngcloud compute security-policies rules create 1000 \\\n  --security-policy=web-armor \\\n  --expression=\"origin.region_code == 'XX'\" --action=deny-403\n\ngcloud compute security-policies rules create 2000 \\\n  --security-policy=web-armor --expression=\"true\" \\\n  --action=rate-based-ban \\\n  --rate-limit-threshold-count=100 \\\n  --rate-limit-threshold-interval-sec=60 --ban-duration-sec=600\n\ngcloud compute backend-services update web-backend \\\n  --security-policy=web-armor --global\n```\n\n## Private Service Connect\n\n```bash\ngcloud compute addresses create psc-google-apis \\\n  --global --purpose=PRIVATE_SERVICE_CONNECT \\\n  --addresses=10.255.255.254 --network=prod-vpc\n\ngcloud compute forwarding-rules create psc-google-apis \\\n  --global --network=prod-vpc --address=psc-google-apis \\\n  --target-google-apis-bundle=all-apis\n```\n\n## Shared VPC\n\n```bash\ngcloud compute shared-vpc enable $HOST_PROJECT_ID\ngcloud compute shared-vpc associated-projects add $SERVICE_PROJECT_ID \\\n  --host-project=$HOST_PROJECT_ID\n```\n\n## Terraform Configuration\n\n```hcl\nresource \"google_compute_network\" \"vpc\" {\n  name                    = \"prod-vpc\"\n  auto_create_subnetworks = false\n  routing_mode            = \"REGIONAL\"\n}\n\nresource \"google_compute_subnetwork\" \"us\" {\n  name                     = \"us-subnet\"\n  ip_cidr_range            = \"10.0.0.0\u002F20\"\n  region                   = \"us-central1\"\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  log_config { aggregation_interval = \"INTERVAL_5_SEC\"; flow_sampling = 0.5 }\n}\n\nresource \"google_compute_firewall\" \"allow_http\" {\n  name    = \"allow-http-https\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"; ports = [\"80\", \"443\"] }\n  source_ranges = [\"0.0.0.0\u002F0\"]\n  target_tags   = [\"http-server\"]\n}\n\nresource \"google_compute_firewall\" \"allow_iap\" {\n  name    = \"allow-iap-ssh\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"; ports = [\"22\"] }\n  source_ranges = [\"35.235.240.0\u002F20\"]\n}\n\nresource \"google_compute_router\" \"router\" {\n  name    = \"prod-router\"\n  region  = \"us-central1\"\n  network = google_compute_network.vpc.id\n}\n\nresource \"google_compute_router_nat\" \"nat\" {\n  name                               = \"prod-nat\"\n  router                             = google_compute_router.router.name\n  region                             = \"us-central1\"\n  nat_ip_allocate_option             = \"AUTO_ONLY\"\n  source_subnetwork_ip_ranges_to_nat = \"ALL_SUBNETWORKS_ALL_IP_RANGES\"\n  min_ports_per_vm                   = 256\n  log_config { enable = true; filter = \"ERRORS_ONLY\" }\n}\n\nresource \"google_compute_security_policy\" \"waf\" {\n  name = \"web-armor\"\n  rule {\n    action   = \"deny(403)\"\n    priority = 1000\n    match { expr { expression = \"evaluatePreconfiguredExpr('xss-v33-stable')\" } }\n  }\n  rule {\n    action   = \"allow\"\n    priority = 2147483647\n    match { versioned_expr = \"SRC_IPS_V1\"; config { src_ip_ranges = [\"*\"] } }\n  }\n}\n```\n\n## Common Operations\n\n```bash\ngcloud compute networks list\ngcloud compute networks subnets list --network=prod-vpc\ngcloud compute networks subnets describe us-subnet --region=us-central1\ngcloud network-management connectivity-tests create test-web-to-db \\\n  --source-instance=projects\u002F${PROJECT_ID}\u002Fzones\u002Fus-central1-a\u002Finstances\u002Fweb \\\n  --destination-instance=projects\u002F${PROJECT_ID}\u002Fzones\u002Fus-central1-a\u002Finstances\u002Fdb \\\n  --destination-port=5432 --protocol=TCP\n```\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| Instance cannot reach internet | No external IP and no Cloud NAT | Configure Cloud NAT on the subnet's router |\n| Firewall rule not taking effect | Wrong target tags or priority | Verify tags match instance; check priority ordering |\n| Load balancer returns 502 | Backend failing health checks | Check health check path\u002Fport; allow `130.211.0.0\u002F22`, `35.191.0.0\u002F16` |\n| Cannot reach Google APIs from private VM | Private Google Access disabled | Enable `--enable-private-ip-google-access` on subnet |\n| Cloud NAT port exhaustion | Too many connections per VM | Increase `--min-ports-per-vm`; enable dynamic port allocation |\n| Shared VPC project cannot create VMs | Missing `compute.networkUser` role | Grant `roles\u002Fcompute.networkUser` on host project |\n| SSL cert stuck PROVISIONING | DNS not pointing to LB IP | Update A record to reserved static IP; wait up to 60 min |\n\n## Related Skills\n\n- **gcp-compute** - Compute Engine instances that use VPC networks and firewall rules\n- **gcp-gke** - GKE clusters deployed in VPC subnets with secondary ranges\n- **gcp-cloud-sql** - Private IP database connectivity through VPC peering\n- **terraform-gcp** - Provision networking resources with Infrastructure as Code\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":24,"source":43,"license":14,"category":44,"metadata":45,"date_added":48,"description":7,"source_repo":49,"source_type":28,"compatibility":50,"license_source":51},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":46,"version":47},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fgcp-networking","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-networking",{"tool":63,"command":64},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-networking",{"tool":66,"command":67},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-networking","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fgcp-networking\u002FSKILL.md",true,[],[72,94,118,143,171,195],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[84,85,86,87,88,89,74,90,32,31,21,29,28,27,91,24,92,23,22,93],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","active","scope","implementing",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[101,102,103,104,105,106,107,108,109,110,111,112,113,29,114,28,115,116,24,117],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[125,126,127,128,129,130,131,132,133,134,135,136,137,28,27,138,139,140,141,142],"transcript","youtube transcript","youtube","safe","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":160,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[149,152,155],{"categoryNo":150,"categoryName":151,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":153,"categoryName":154,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[125,126,127,161,128,162,129,130,132,163,164,165,166,135,167,28,27,168,169,170],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":153,"categoryName":154,"taxonomyType":81,"taxonomyTypeDesc":82},[127,182,183,105,128,184,185,186,187,132,165,188,189,190,191,27,192,138,193,194],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[201],{"categoryNo":150,"categoryName":151,"taxonomyType":81,"taxonomyTypeDesc":82},[203,127,204,205,128,162,163,206,207,164,165,166,135,208,167,28,27,168,209,141],"youtube full","full","google","server","dlp","credits","automatic"]