Console, Cloud Shell and the gcloud CLI

GCP Basics · Foundations – Regions, Resource Hierarchy, gcloud and Billing · Lesson 3 of 5

Use the console to explore, Cloud Shell for a ready-made terminal, and gcloud with named configurations to script everything against the right project.

There are four ways to work with Google Cloud; all of them call the same REST APIs.

flowchart LR
  Y["You"] --> C["Google Cloud console"]
  Y --> S["Cloud Shell"]
  Y --> L["gcloud on your laptop"]
  S --> A["Google Cloud APIs"]
  C --> A
  L --> A
  T["Terraform / client libraries"] --> A
  %% step C: The console is the web UI: good for exploring, dashboards and one-off changes.
  %% step S: Cloud Shell is a free browser terminal with gcloud, kubectl, terraform and 5 GB of persistent home disk.
  %% step L: The Google Cloud CLI on your laptop runs the same commands after gcloud init.
  %% step T: Terraform and client libraries call the APIs directly; use them for repeatable changes.
  %% step A: Every path ends at the same APIs, checked by the same IAM permissions.

Cloud Shell

A small VM with the Google Cloud CLI (gcloud, gsutil, bq), kubectl, terraform, git and Docker pre-installed.
5 GB persistent home directory; the VM itself is recycled after about 20 minutes of inactivity, and the home disk is deleted after 120 days without use.
Already authenticated as you, so gcloud works immediately.

gcloud basics

gcloud init                                  # log in, pick project, region, zone
gcloud auth login                            # user credentials for gcloud itself
gcloud auth application-default login        # credentials for code / Terraform (ADC)
gcloud config set project dl-lab-dev
gcloud compute instances list --format="table(name,zone,status)"

Commands follow gcloud GROUP SUBGROUP ACTION NAME --flags. Add --help to any level, and use --format (json, yaml, table(...), value(...)) and --filter to shape output for scripts.

Named configurations

A configuration is a named set of properties (account, project, region, zone). Use one per environment to avoid running a command against production by mistake.

gcloud config configurations create prod
gcloud config set project dl-lab-prod
gcloud config configurations activate dev
gcloud config list                           # what is active right now

You can also override per command with --project=dl-lab-prod, or per shell with the environment variable CLOUDSDK_CORE_PROJECT.

Two kinds of credentials

Credential	Used by	Set with
gcloud user credentials	`gcloud` commands	`gcloud auth login`
Application Default Credentials (ADC)	client libraries, Terraform	`gcloud auth application-default login`, or a service account on the VM

Command	Meaning
`gcloud config list`	Active account, project, region
`gcloud config configurations list`	All named configurations
`gcloud components update`	Update the CLI (not needed in Cloud Shell)

Traps: gcloud auth login does not set ADC for Terraform; a forgotten default project is the most common cause of “resource not found”; never download service account keys just to use the CLI.