Back to Home
    GCPGCP 2024Intermediate

    GCP

    Google Cloud Platform essentials: Compute Engine, GKE, Cloud Run, Cloud Storage, IAM, and core CLI commands.

    14 min read
    gcpclouddevopsgoogle-cloud

    gcloud CLI

    2 topics

    Setup & Authentication

    bash
    # Install gcloud SDK (macOS)
brew install --cask google-cloud-sdk

# Authenticate
gcloud auth login
gcloud auth application-default login  # For SDKs/APIs

# Configure project
gcloud config set project MY_PROJECT_ID
gcloud config list

# Manage configurations (switch between projects)
gcloud config configurations create dev
gcloud config configurations activate dev
gcloud config configurations list
    gcloud CLI referenceInstall gcloud SDK

    💡 application-default login sets credentials used by client libraries, not the CLI

    ⚡ Use named configurations to switch between projects/accounts instantly

    Common CLI Patterns

    bash
    # List all projects
gcloud projects list

# Set default region/zone
gcloud config set compute/region us-central1
gcloud config set compute/zone us-central1-a

# Enable an API
gcloud services enable run.googleapis.com
gcloud services enable container.googleapis.com

# Check enabled APIs
gcloud services list --enabled

# View IAM policy for a project
gcloud projects get-iam-policy MY_PROJECT_ID
    gcloud config docs

    💡 Enable APIs before creating resources — missing API is the most common 403 cause

    ⚡ Set default region/zone to avoid --region flag on every command

    Compute Engine

    2 topics

    VM Management

    bash
    # Create a VM
gcloud compute instances create my-vm \
  --machine-type=e2-medium \
  --image-family=debian-12 \
  --image-project=debian-cloud \
  --zone=us-central1-a

# List VMs
gcloud compute instances list

# SSH into a VM
gcloud compute ssh my-vm --zone=us-central1-a

# Stop / start / delete
gcloud compute instances stop my-vm --zone=us-central1-a
gcloud compute instances start my-vm --zone=us-central1-a
gcloud compute instances delete my-vm --zone=us-central1-a

# Copy files to/from VM
gcloud compute scp ./file.txt my-vm:~ --zone=us-central1-a
    Compute Engine docsMachine types

    💡 e2-medium is a cost-effective general-purpose instance — use n2 for predictable performance

    ⚡ gcloud compute ssh handles key management automatically — no manual key setup needed

    Firewall Rules

    bash
    # Allow HTTP/HTTPS traffic
gcloud compute firewall-rules create allow-http \
  --allow=tcp:80,tcp:443 \
  --target-tags=web-server

# Allow SSH from specific IP
gcloud compute firewall-rules create allow-ssh \
  --allow=tcp:22 \
  --source-ranges=203.0.113.0/24

# List firewall rules
gcloud compute firewall-rules list

# Delete a rule
gcloud compute firewall-rules delete allow-http
    Firewall rules overview

    ⚠️ Default network allows all egress and denies all ingress — always restrict SSH source ranges

    💡 Use network tags to target specific VMs instead of opening rules to all instances

    Cloud Run

    2 topics

    Deploy & Manage Services

    bash
    # Deploy from container image
gcloud run deploy my-service \
  --image=gcr.io/MY_PROJECT/my-app:latest \
  --platform=managed \
  --region=us-central1 \
  --allow-unauthenticated

# Deploy from source (buildpacks)
gcloud run deploy my-service \
  --source=. \
  --region=us-central1

# List services
gcloud run services list --region=us-central1

# Update traffic split (canary)
gcloud run services update-traffic my-service \
  --to-revisions=LATEST=90,my-service-v1=10 \
  --region=us-central1

# View logs
gcloud run services logs read my-service --region=us-central1
    Cloud Run docsTraffic management

    💡 --allow-unauthenticated makes the service public; omit it for internal-only services

    ⚡ --source=. lets you skip writing a Dockerfile — buildpacks auto-detect the runtime

    Environment & Scaling Config

    bash
    # Set environment variables
gcloud run services update my-service \
  --set-env-vars=DATABASE_URL=postgres://...,LOG_LEVEL=info \
  --region=us-central1

# Set secrets from Secret Manager
gcloud run services update my-service \
  --set-secrets=API_KEY=my-secret:latest \
  --region=us-central1

# Configure scaling
gcloud run services update my-service \
  --min-instances=1 \
  --max-instances=10 \
  --concurrency=80 \
  --region=us-central1
    Cloud Run environment variablesCloud Run scaling

    ⚠️ min-instances=0 means cold starts — set min-instances=1 for latency-sensitive services

    💡 Use Secret Manager references instead of plain env vars for sensitive values

    GKE (Kubernetes)

    1 topic

    Cluster Management

    bash
    # Create an Autopilot cluster (recommended)
gcloud container clusters create-auto my-cluster \
  --region=us-central1

# Create a Standard cluster
gcloud container clusters create my-cluster \
  --num-nodes=3 \
  --machine-type=e2-standard-2 \
  --region=us-central1

# Get kubectl credentials
gcloud container clusters get-credentials my-cluster \
  --region=us-central1

# List clusters
gcloud container clusters list

# Delete cluster
gcloud container clusters delete my-cluster --region=us-central1
    GKE docsAutopilot overview

    💡 Autopilot manages node pools automatically — prefer it unless you need custom node configs

    ⚡ get-credentials updates kubeconfig so kubectl works immediately after

    Cloud Storage

    2 topics

    Buckets & Objects

    bash
    # Create a bucket
gcloud storage buckets create gs://my-bucket --location=US

# Upload files
gcloud storage cp ./file.txt gs://my-bucket/
gcloud storage cp -r ./dist/ gs://my-bucket/dist/

# Download files
gcloud storage cp gs://my-bucket/file.txt .

# List objects
gcloud storage ls gs://my-bucket/

# Delete object
gcloud storage rm gs://my-bucket/file.txt

# Sync local directory
gcloud storage rsync ./dist gs://my-bucket/dist --recursive
    Cloud Storage docsgsutil vs gcloud storage

    💡 Use rsync for deployments — it only uploads changed files, much faster than cp -r

    ⚠️ Bucket names are globally unique — prefix with your project ID to avoid conflicts

    Access Control

    bash
    # Make bucket publicly readable
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member=allUsers \
  --role=roles/storage.objectViewer

# Grant a service account access
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member=serviceAccount:my-sa@MY_PROJECT.iam.gserviceaccount.com \
  --role=roles/storage.objectAdmin

# Uniform bucket-level access (recommended)
gcloud storage buckets update gs://my-bucket \
  --uniform-bucket-level-access
    Cloud Storage IAM

    ⚠️ allUsers makes objects public to the internet — only use for static website hosting

    💡 Uniform bucket-level access disables per-object ACLs, simplifying permission management

    IAM & Service Accounts

    2 topics

    Service Accounts

    bash
    # Create a service account
gcloud iam service-accounts create my-sa \
  --display-name='My Service Account'

# Grant a role to the service account
gcloud projects add-iam-policy-binding MY_PROJECT \
  --member=serviceAccount:my-sa@MY_PROJECT.iam.gserviceaccount.com \
  --role=roles/storage.admin

# Create and download a key (avoid when possible)
gcloud iam service-accounts keys create key.json \
  --iam-account=my-sa@MY_PROJECT.iam.gserviceaccount.com

# List service accounts
gcloud iam service-accounts list
    IAM overviewPredefined roles

    ⚠️ Avoid service account key files — prefer Workload Identity or Application Default Credentials

    💡 Grant the minimum role needed — use predefined roles before creating custom ones

    Workload Identity (GKE)

    bash
    # Enable Workload Identity on cluster
gcloud container clusters update my-cluster \
  --workload-pool=MY_PROJECT.svc.id.goog \
  --region=us-central1

# Bind Kubernetes SA to GCP SA
gcloud iam service-accounts add-iam-policy-binding my-sa@MY_PROJECT.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member='serviceAccount:MY_PROJECT.svc.id.goog[my-ns/my-ksa]'

# Annotate the Kubernetes service account
kubectl annotate serviceaccount my-ksa \
  --namespace=my-ns \
  iam.gke.io/gcp-service-account=my-sa@MY_PROJECT.iam.gserviceaccount.com
    Workload Identity docs

    ⚡ Workload Identity lets pods call GCP APIs without key files — no secret rotation needed

    💡 This is the recommended auth method for GKE workloads in production

    Artifact Registry & Cloud Build

    2 topics

    Container Images

    bash
    # Create a Docker repository
gcloud artifacts repositories create my-repo \
  --repository-format=docker \
  --location=us-central1

# Configure Docker auth
gcloud auth configure-docker us-central1-docker.pkg.dev

# Build and push image
docker build -t us-central1-docker.pkg.dev/MY_PROJECT/my-repo/my-app:latest .
docker push us-central1-docker.pkg.dev/MY_PROJECT/my-repo/my-app:latest

# List images
gcloud artifacts docker images list \
  us-central1-docker.pkg.dev/MY_PROJECT/my-repo
    Artifact Registry docs

    💡 Artifact Registry replaces Container Registry (gcr.io) — use it for new projects

    ⚡ auth configure-docker only needs to run once per machine

    Cloud Build

    yaml
    # cloudbuild.yaml — build, push, deploy to Cloud Run
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - build
      - -t
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/my-app:$SHORT_SHA'
      - .

  - name: 'gcr.io/cloud-builders/docker'
    args:
      - push
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/my-app:$SHORT_SHA'

  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args:
      - run
      - deploy
      - my-service
      - --image=us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/my-app:$SHORT_SHA
      - --region=us-central1

images:
  - 'us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/my-app:$SHORT_SHA'
    Cloud Build docscloudbuild.yaml reference

    ⚡ $PROJECT_ID and $SHORT_SHA are built-in substitutions — no hardcoding needed

    💡 Trigger builds on git push via Cloud Build triggers for a simple CI/CD pipeline

    Related Articles

    Background reading and deeper explanations for this sheet.

    AWS AI & App Modernization Guide: SageMaker, Bedrock, ECS/EKS, and Lambda in Practice

    AWS offers multiple paths to build intelligent, scalable applications—but choosing the right service can feel overwhelming. In this practical guide, you’ll learn what SageMaker, Bedrock, ECS/EKS, and Lambda are best at, how they fit together, and how to apply them in real-world architectures with beginner-friendly clarity and technical depth.

    keyword overlap

    Intro to Agentic AI on Google Cloud: Build Practical Agents with Indexes

    Agentic AI is moving from demos to production, and Google Cloud gives you the building blocks to do it safely and at scale. In this hands-on guide, you’ll learn what agentic AI really is, how indexes power memory and retrieval, and how to build a beginner-friendly yet production-aware workflow on GCP.

    keyword overlap

    Scaling AI APIs with FastAPI, Docker, and Load Balancers: A Practical Guide for Production

    Building an AI API is easy—keeping it fast and reliable under real traffic is the hard part. In this practical guide, you’ll learn how to scale FastAPI services with Docker and load balancers, from local setup to production architecture, with real-world examples, code, and deployment tips.

    keyword overlap

    Build an Agentic App with FastAPI and Azure AI Foundry: A Practical Beginner-to-Pro Guide

    Learn how to design, build, and deploy an agentic application using FastAPI and Azure AI Foundry with practical, real-world examples. This guide walks you from architecture and setup to tool-calling, memory, observability, and production deployment patterns.

    keyword overlap

    codesips.com
    All SheetsLearning PathsArchitectureDiagramsCategoriesBlogCommunityRequestsAdmin Login

    © 2026 codesips.com. All rights reserved.