Skip to content

Commit 3ca044f

Browse files
docs: Re-add GKE Code Executor tool doc (#677)
* [8/15] add GKE executor doc * [8/15] add GKE executor doc * [8/15] add GKE executor doc * [8/15] add GKE executor doc * docs: Re-add GKE Code Executor tool doc - from: #621 --------- Co-authored-by: Summer <xiaotongyang@google.com>
1 parent 106d242 commit 3ca044f

File tree

1 file changed

+50
-0
lines changed

1 file changed

+50
-0
lines changed

docs/tools/built-in-tools.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,56 @@ like calculations, data manipulation, or running small scripts.
5757
--8<-- "examples/java/snippets/src/main/java/tools/CodeExecutionAgentApp.java:full_code"
5858
```
5959

60+
### GKE Code Executor
61+
62+
The GKE Code Executor (`GkeCodeExecutor`) provides a secure and scalable method
63+
for running LLM-generated code by leveraging the GKE (Google Kubernetes Engine)
64+
Sandbox environment, which uses gVisor for workload isolation.
65+
66+
For each code execution request, it dynamically creates an ephemeral, sandboxed
67+
Kubernetes Job with a hardened Pod configuration. This is the recommended
68+
executor for production environments on GKE where security and isolation are
69+
critical.
70+
71+
#### System requirements
72+
73+
The following requirements must be met to successfully deploy your ADK project
74+
with the GKE Code Executor tool:
75+
76+
- GKE cluster with a **gVisor-enabled node pool**.
77+
- Agent's service account requires specific **RBAC permissions**, which allow it to:
78+
- Create, watch, and delete **Jobs** for each execution request.
79+
- Manage **ConfigMaps** to inject code into the Job's pod.
80+
- List **Pods** and read their **logs** to retrieve the execution result
81+
- Install the client library with GKE extras: `pip install google-adk[gke]`
82+
83+
For a complete, ready-to-use configuration, see the
84+
[deployment_rbac.yaml](https://github.com/google/adk-python/blob/main/contributing/samples/gke_agent_sandbox/deployment_rbac.yaml)
85+
sample. For more information on deploying ADK workflows to GKE, see
86+
[Deploy to Google Kubernetes Engine (GKE)](/adk-docs/deploy/gke/).
87+
88+
=== "Python"
89+
90+
```py
91+
from google.adk.agents import LlmAgent
92+
from google.adk.code_executors import GkeCodeExecutor
93+
94+
# Initialize the executor, targeting the namespace where its ServiceAccount
95+
# has the required RBAC permissions.
96+
gke_executor = GkeCodeExecutor(
97+
namespace="agent-sandbox",
98+
timeout_seconds=600,
99+
)
100+
101+
# The agent will now use this executor for any code it generates.
102+
gke_agent = LlmAgent(
103+
name="gke_coding_agent",
104+
model="gemini-2.0-flash",
105+
instruction="You are a helpful AI agent that writes and executes Python code.",
106+
code_executor=gke_executor,
107+
)
108+
```
109+
60110
### Vertex AI RAG Engine
61111

62112
The `vertex_ai_rag_retrieval` tool allows the agent to perform private data retrieval using Vertex

0 commit comments

Comments
 (0)