Create named profile

Isolate creds per env; use yc --profile prod or YC_PROFILE in CI

yc config profile create prod && yc config profile activate prod
tool
yc32 commands
tags
yccloudci

More yc commands

  • Mint short-lived IAM token
    export YC_TOKEN=$(yc iam create-token)

    OAuth->IAM token, ~12h TTL; feed to API/Terraform via YC_TOKEN env

  • Service account for CI
    yc iam service-account create --name sa-ci --description 'CI deployer'

    Create SA for pipelines; bind least-privilege roles separately

  • Authorized key for SA
    yc iam key create --service-account-name sa-ci --output key.json

    Authorized key JSON for non-interactive auth; note: rotate & vault it

  • Grant role to SA
    yc resource-manager folder add-access-binding <id> --role editor --service-account-name sa-ci

    Scope-bind a role at folder level; prefer narrow roles over editor

  • Write kubeconfig for cluster
    yc managed-kubernetes cluster get-credentials <name> --external --force

    Merge external endpoint into kubeconfig; drop --external for internal VPC

all 32 yc commands