$ CloudsLink
/

Setup & configuration

Almost every command is scoped to a project — set it once with gcloud config.

Sign in

auth login is for the CLI itself; application-default login creates the credentials that SDKs and Terraform pick up.

$ gcloud auth login
$ gcloud auth application-default login

Set the active project

$ gcloud projects list
$ gcloud config set project my-project
$ gcloud config list

Set default region and zone

$ gcloud config set compute/region us-west1 && gcloud config set compute/zone us-west1-a

Enable an API

Most "permission denied" errors on a fresh project are actually a disabled API.

$ gcloud services enable run.googleapis.com artifactregistry.googleapis.com

Cloud Storage

gcloud storage replaces the older gsutil and is significantly faster for bulk transfers.

List buckets and objects

$ gcloud storage ls
$ gcloud storage ls --recursive gs://my-bucket/logs/

Copy files up or down

$ gcloud storage cp ./report.pdf gs://my-bucket/reports/
$ gcloud storage cp gs://my-bucket/reports/report.pdf .

Sync a directory

$ gcloud storage rsync ./dist gs://my-bucket --recursive \
    --delete-unmatched-destination-objects

Create a bucket

$ gcloud storage buckets create gs://my-new-bucket --location us-west1

Generate a signed URL

Temporary access to a private object; requires a service-account key or impersonation.

$ gcloud storage sign-url gs://my-bucket/reports/report.pdf --duration 24h \
    --impersonate-service-account signer@my-project.iam.gserviceaccount.com

Delete objects or a bucket

$ gcloud storage rm --recursive gs://my-bucket/logs/
$ gcloud storage buckets delete gs://my-bucket

Compute Engine

List instances

$ gcloud compute instances list

Create an instance

$ gcloud compute instances create web-1 \
    --machine-type e2-micro --zone us-west1-a \
    --image-family debian-12 --image-project debian-cloud

SSH into an instance

Handles key creation and propagation for you.

$ gcloud compute ssh web-1 --zone us-west1-a

Stop, start, delete

Stopped instances don't bill for compute, but attached disks still bill.

$ gcloud compute instances stop web-1 --zone us-west1-a
$ gcloud compute instances start web-1 --zone us-west1-a
$ gcloud compute instances delete web-1 --zone us-west1-a

Open a port with a firewall rule

$ gcloud compute firewall-rules create allow-ssh \
    --allow tcp:22 --source-ranges 203.0.113.0/24

IAM

Create a service account

$ gcloud iam service-accounts create ci-deployer --display-name "CI deployer"

Grant a role

$ gcloud projects add-iam-policy-binding my-project \
    --member serviceAccount:ci-deployer@my-project.iam.gserviceaccount.com \
    --role roles/storage.objectViewer

See who has access

$ gcloud projects get-iam-policy my-project \
    --flatten 'bindings[].members' \
    --format 'table(bindings.role, bindings.members)'

Create a service-account key

Prefer workload identity federation where possible — keys are long-lived secrets.

$ gcloud iam service-accounts keys create key.json \
    --iam-account ci-deployer@my-project.iam.gserviceaccount.com

Cloud Run & Functions

Deploy to Cloud Run from source

Builds the container with Cloud Build and deploys in one step.

$ gcloud run deploy my-app --source . --region us-west1 --allow-unauthenticated

List services and get a URL

$ gcloud run services list --region us-west1
$ gcloud run services describe my-app --region us-west1 --format 'value(status.url)'

Deploy a Cloud Function

$ gcloud functions deploy my-fn --gen2 --runtime python312 \
    --region us-west1 --trigger-http --entry-point handler

Update environment variables

$ gcloud run services update my-app --region us-west1 \
    --update-env-vars STAGE=prod,LOG_LEVEL=info

GKE

Connect kubectl to a cluster

$ gcloud container clusters get-credentials my-cluster --region us-west1

List clusters

$ gcloud container clusters list

Resize a node pool

$ gcloud container clusters resize my-cluster --region us-west1 \
    --node-pool default-pool --num-nodes 3

Artifact Registry

Log Docker in to Artifact Registry

$ gcloud auth configure-docker us-west1-docker.pkg.dev

Create a Docker repository

$ gcloud artifacts repositories create my-repo \
    --repository-format docker --location us-west1

Tag and push an image

$ docker tag my-app:latest us-west1-docker.pkg.dev/my-project/my-repo/my-app:latest
$ docker push us-west1-docker.pkg.dev/my-project/my-repo/my-app:latest

Logging

Tail logs live

$ gcloud logging tail 'resource.type="cloud_run_revision"'

Read recent errors

--freshness limits how far back to look; the filter language matches the Logs Explorer.

$ gcloud logging read 'severity>=ERROR' --limit 20 --freshness 1h

BigQuery

BigQuery ships with its own bq tool, installed alongside gcloud.

Run a query

$ bq query --use_legacy_sql=false \
    'SELECT name, COUNT(*) AS n FROM `my-project.mydataset.events` GROUP BY name ORDER BY n DESC LIMIT 10'

List datasets and inspect a table

$ bq ls
$ bq show --schema mydataset.events

Load a CSV into a table

$ bq load --autodetect --source_format=CSV mydataset.events ./events.csv

No commands match "" — try a service name or verb like rsync, deploy, tail.