gcloudManage Google Cloud with the gcloud CLI
gcloud is Google Cloud's CLI: authenticate, choose a project and default zone, then manage Compute Engine VMs, GKE clusters, Cloud Storage, IAM and more. Named configurations switch between projects cleanly, and --filter/--format shape its output.
gcloud [GROUP...] COMMAND [--project P] [--zone Z] [--filter EXPR] [--format FORMAT]You work in a lab project and a production project and never want to run a lab command against production by accident.
gcloudThe Google Cloud CLI, part of the Cloud SDK.
gcloud keeps its state in a configuration directory (~/.config/gcloud): named configurations with properties such as core/account, core/project and compute/zone, plus OAuth credentials from gcloud auth login (or a service account, or the VM's attached service account through the metadata server). Each command calls a Google API over HTTPS, for example compute.googleapis.com, with an OAuth access token, and Google checks IAM role bindings on the project, folder or organisation. APIs must be enabled per project first, otherwise calls fail with an 'API has not been used in project' error. Note that gcloud auth login authorises the CLI itself, while gcloud auth application-default login creates separate credentials for SDKs and tools such as Terraform. --filter and --format are gcloud's own projection language, not JMESPath.
auth login / auth listAuthorise the CLI as a user; show credentialed accountsauth application-default loginCredentials for SDKs and Terraform (ADC), separate from the CLI'sconfig set KEY VALUESet defaults like project or compute/zone in the active configurationconfig configurationscreate, activate, list: named configurations per project/environment--project / --zone / --regionPer-command overrides--filter EXPRFilter resources, e.g. status=RUNNING AND labels.env=prod--format FORMATOutput shape: json, yaml, table(...), value(...)compute ssh VM --zone ZSSH with automatic key management (or IAP tunnelling)clusters get-credentialscontainer clusters get-credentials: add a GKE cluster to ~/.kube/configservices enable APIEnable an API (compute, container...) in the projectRelying on gcloud auth login for Terraform or an SDKThat login authorises only the gcloud CLI; libraries look for Application Default Credentials.
gcloud auth application-default login locally; a service account or workload identity in automationDownloading service account JSON keys for CILong-lived private keys that are copied around and rarely rotated.
Workload Identity Federation (OIDC) for CI, attached service accounts for VMs, Workload Identity for GKESwitching projects with gcloud config set project back and forthEasy to forget which project is active and run a command in the wrong one.
Named configurations per environment, or --project on every command in scriptsTry these on a Linux machine of your own. Each task has a hint and a solution.
No gcloud in the sandbox. gcloud's value() format prints tab-separated fields; produce the same shape from ~/data/servers.txt: name and IP of running servers, tab-separated.
Write the command that lists only the names of RUNNING instances labelled env=prod.
Write the commands to create and switch to a configuration named lab using project devops-devops-lab and zone us-central1-a.
gcloudManage Google Cloud with the gcloud CLI
gcloud is Google Cloud's CLI: authenticate, choose a project and default zone, then manage Compute Engine VMs, GKE clusters, Cloud Storage, IAM and more. Named configurations switch between projects cleanly, and --filter/--format shape its output.
gcloud [GROUP...] COMMAND [--project P] [--zone Z] [--filter EXPR] [--format FORMAT]You work in a lab project and a production project and never want to run a lab command against production by accident.
gcloudThe Google Cloud CLI, part of the Cloud SDK.
gcloud keeps its state in a configuration directory (~/.config/gcloud): named configurations with properties such as core/account, core/project and compute/zone, plus OAuth credentials from gcloud auth login (or a service account, or the VM's attached service account through the metadata server). Each command calls a Google API over HTTPS, for example compute.googleapis.com, with an OAuth access token, and Google checks IAM role bindings on the project, folder or organisation. APIs must be enabled per project first, otherwise calls fail with an 'API has not been used in project' error. Note that gcloud auth login authorises the CLI itself, while gcloud auth application-default login creates separate credentials for SDKs and tools such as Terraform. --filter and --format are gcloud's own projection language, not JMESPath.
auth login / auth listAuthorise the CLI as a user; show credentialed accountsauth application-default loginCredentials for SDKs and Terraform (ADC), separate from the CLI'sconfig set KEY VALUESet defaults like project or compute/zone in the active configurationconfig configurationscreate, activate, list: named configurations per project/environment--project / --zone / --regionPer-command overrides--filter EXPRFilter resources, e.g. status=RUNNING AND labels.env=prod--format FORMATOutput shape: json, yaml, table(...), value(...)compute ssh VM --zone ZSSH with automatic key management (or IAP tunnelling)clusters get-credentialscontainer clusters get-credentials: add a GKE cluster to ~/.kube/configservices enable APIEnable an API (compute, container...) in the projectRelying on gcloud auth login for Terraform or an SDKThat login authorises only the gcloud CLI; libraries look for Application Default Credentials.
gcloud auth application-default login locally; a service account or workload identity in automationDownloading service account JSON keys for CILong-lived private keys that are copied around and rarely rotated.
Workload Identity Federation (OIDC) for CI, attached service accounts for VMs, Workload Identity for GKESwitching projects with gcloud config set project back and forthEasy to forget which project is active and run a command in the wrong one.
Named configurations per environment, or --project on every command in scriptsTry these on a Linux machine of your own. Each task has a hint and a solution.
No gcloud in the sandbox. gcloud's value() format prints tab-separated fields; produce the same shape from ~/data/servers.txt: name and IP of running servers, tab-separated.
Write the command that lists only the names of RUNNING instances labelled env=prod.
Write the commands to create and switch to a configuration named lab using project devops-devops-lab and zone us-central1-a.