gcloud

Activate service account Auth as SA in CI; note: prefer workload identity over long-lived key files gcloud auth activate-service-account --key-file=key.json && gcloud config set project <id> #gcloud#ci#secrets#cloud GKE kubeconfig credentials Fetch GKE kubeconfig; modern: needs gke-gcloud-auth-plugin in PATH since k8s 1.26 gcloud container clusters get-credentials <cluster> --region <id> --project <id> #gcloud#k8s#cloud List instances with external IP Custom table of running VMs and public IPs via --format/--filter projections gcloud compute instances list --format="table(name,status,EXTERNAL_IP)" --filter="status=RUNNING" #gcloud#network#cloud Flatten IAM bindings by member Audit who has which role; --flatten explodes nested bindings into rows gcloud projects get-iam-policy <id> --flatten="bindings[].members" --format="table(bindings.role,bindings.members)" #gcloud#security#cloud Read recent error logs Pull last hour of errors across project; --freshness avoids full scan gcloud logging read 'severity>=ERROR' --limit 20 --freshness=1h --format='value(timestamp,resource.type,textPayload)' #gcloud#observability#troubleshooting#cloud SSH via IAP tunnel Reach a VM with no public IP through Identity-Aware Proxy; no bastion needed gcloud compute ssh <name> --zone <id> --tunnel-through-iap #gcloud#network#security#cloud Read secret payload Print latest Secret Manager version to stdout; pin a version in CI for repeatability gcloud secrets versions access latest --secret=<name> --project <id> #gcloud#secrets#ci#cloud Storage rsync to bucket Mirror dir to GCS; -d deletes extras, modern replacement for gsutil rsync gcloud storage rsync -r -d ./build gs://<name>/site #gcloud#disk#cloud