gcloud CLI Essential Commands: 100 Must-Know Commands (Setup, Auth, GCE/GKE/BQ)

The gcloud CLI is the core tool for operating GCP. This article rounds up 100 must-know commands covering authentication, projects, GCE, GKE, Cloud Run, Cloud Storage, BigQuery, IAM, and networking. It's also useful for ACE exam prep.

Setup and Authentication

# Install (macOS)
brew install --cask google-cloud-sdk

# Initial setup
gcloud init

# Log in
gcloud auth login
gcloud auth application-default login  # ADC

# Service Account auth
gcloud auth activate-service-account --key-file=key.json

# Current credentials
gcloud auth list
gcloud config list

# Component management
gcloud components install kubectl
gcloud components update

Configuration (Profiles)

gcloud config configurations create dev
gcloud config configurations activate dev
gcloud config set project DEV_PROJECT_ID
gcloud config set compute/region asia-northeast1
gcloud config set compute/zone asia-northeast1-a
gcloud config set account [email protected]
gcloud config configurations list

Projects and Organization

gcloud projects list
gcloud projects create my-project --folder=FOLDER_ID
gcloud projects describe my-project
gcloud projects delete my-project
gcloud config set project my-project
gcloud organizations list
gcloud organizations describe ORG_ID
gcloud resource-manager folders list --organization=ORG_ID

# Enable APIs
gcloud services enable compute.googleapis.com
gcloud services list --enabled

IAM

# List roles
gcloud iam roles list --filter="name:storage"

# Project IAM
gcloud projects get-iam-policy PROJECT
gcloud projects add-iam-policy-binding PROJECT \
  --member=user:[email protected] --role=roles/viewer
gcloud projects remove-iam-policy-binding PROJECT \
  --member=user:[email protected] --role=roles/viewer

# Service Account
gcloud iam service-accounts create my-sa --display-name="My SA"
gcloud iam service-accounts keys create key.json [email protected]
gcloud iam service-accounts list

# Impersonation
gcloud auth print-access-token --impersonate-service-account=my-sa@PROJECT.iam.gserviceaccount.com

Compute Engine

# Create a VM
gcloud compute instances create my-vm \
  --zone=asia-northeast1-a \
  --machine-type=e2-medium \
  --image-family=debian-12 \
  --image-project=debian-cloud \
  --tags=http-server

# Operations
gcloud compute instances list
gcloud compute instances describe my-vm --zone=asia-northeast1-a
gcloud compute instances start my-vm --zone=asia-northeast1-a
gcloud compute instances stop my-vm --zone=asia-northeast1-a
gcloud compute instances delete my-vm --zone=asia-northeast1-a

# SSH
gcloud compute ssh my-vm --zone=asia-northeast1-a

# Snapshot
gcloud compute disks snapshot my-disk --snapshot-names=snap-$(date +%Y%m%d)

# Instance Group
gcloud compute instance-groups managed create my-mig \
  --template=my-template --size=3 --zone=asia-northeast1-a

GKE

# Cluster
gcloud container clusters create my-cluster \
  --region=asia-northeast1 \
  --num-nodes=3 \
  --machine-type=e2-medium \
  --enable-autoscaling --min-nodes=1 --max-nodes=10 \
  --enable-autorepair \
  --release-channel=stable

# Autopilot
gcloud container clusters create-auto my-autopilot \
  --region=asia-northeast1

# Auth + kubectl config
gcloud container clusters get-credentials my-cluster --region=asia-northeast1

# Node Pool
gcloud container node-pools create spot-pool \
  --cluster=my-cluster --region=asia-northeast1 \
  --spot --num-nodes=3

Cloud Run

gcloud run deploy my-service \
  --image=asia-northeast1-docker.pkg.dev/PROJECT/repo/app:v1 \
  --region=asia-northeast1 \
  --platform=managed \
  --allow-unauthenticated \
  --memory=512Mi --cpu=1 \
  --min-instances=0 --max-instances=10

gcloud run services list
gcloud run services describe my-service --region=asia-northeast1
gcloud run revisions list --service=my-service --region=asia-northeast1

# Job
gcloud run jobs create my-job --image=... --region=asia-northeast1
gcloud run jobs execute my-job --region=asia-northeast1

Cloud Storage (gsutil / gcloud storage)

# New CLI (recommended)
gcloud storage buckets create gs://my-bucket --location=asia-northeast1 --uniform-bucket-level-access
gcloud storage cp file.txt gs://my-bucket/
gcloud storage ls gs://my-bucket/
gcloud storage rm gs://my-bucket/file.txt

# Legacy
gsutil mb -l asia-northeast1 gs://my-bucket
gsutil cp file.txt gs://my-bucket/
gsutil iam ch user:[email protected]:roles/storage.objectViewer gs://my-bucket
gsutil lifecycle set lifecycle.json gs://my-bucket

BigQuery (bq)

bq query --use_legacy_sql=false 'SELECT COUNT(*) FROM `project.dataset.table`'
bq ls dataset
bq show dataset.table
bq load --source_format=CSV dataset.table gs://bucket/file.csv schema.json
bq mk --table dataset.new_table schema.json
bq cp source.table dest.table
bq extract dataset.table gs://bucket/export-*.csv

Pub/Sub

gcloud pubsub topics create my-topic
gcloud pubsub topics publish my-topic --message="Hello"
gcloud pubsub subscriptions create my-sub --topic=my-topic
gcloud pubsub subscriptions pull my-sub --auto-ack
gcloud pubsub subscriptions list

Networking

# VPC
gcloud compute networks create my-vpc --subnet-mode=custom
gcloud compute networks subnets create my-subnet \
  --network=my-vpc --range=10.0.0.0/24 --region=asia-northeast1

# Firewall
gcloud compute firewall-rules create allow-ssh \
  --network=my-vpc --allow=tcp:22 --source-ranges=0.0.0.0/0

# Load Balancer
gcloud compute backend-services create my-backend --global --protocol=HTTPS
gcloud compute url-maps create my-lb --default-service=my-backend

# Cloud DNS
gcloud dns managed-zones create my-zone --dns-name=example.com. --description="My zone"

Cloud SQL

gcloud sql instances create my-sql \
  --database-version=POSTGRES_15 \
  --tier=db-f1-micro \
  --region=asia-northeast1

gcloud sql databases create mydb --instance=my-sql
gcloud sql users create admin --instance=my-sql --password=...

# Cloud SQL Auth Proxy
cloud_sql_proxy -instances=PROJECT:asia-northeast1:my-sql=tcp:5432

Handy Tips

• gcloud --help for help
• gcloud cheat-sheet for the cheat sheet
• --format=json for scripting
• --filter='status=RUNNING' to narrow results
• --log-http for HTTP debugging
• gcloud beta / alpha to use new features
• Environment variables: CLOUDSDK_CORE_PROJECT / CLOUDSDK_COMPUTE_REGION

Google Cloud is a trademark of Google LLC. For the latest, see the official gcloud Reference.