Google Cloud CLI

Use gcloud for bounded account, project, IAM, API, billing, logging, and audit operations.

Defaults

Google Cloud is the default cloud for Fmind projects. Resolve the project and region from explicit project configuration, or ask when unset. Prefer Cloud Run for services; use GKE only when the project explicitly adopts Kubernetes. Existing project choices take precedence.

Workflow

1. Resolve identity and scope: inspect the named configuration, account, project, and billing project; never activate another configuration just to make a command work.

   gcloud config configurations list --format='table(name,is_active)'
   gcloud config configurations describe <configuration> --format=json
   gcloud config get auth/impersonate_service_account --configuration <configuration>
   gcloud config get auth/access_token_file --configuration <configuration>
   gcloud projects describe <project-id> --format='json(projectId,projectNumber,lifecycleState)'

2. Pin every consequential call: pass --configuration, --account, --project, and --billing-project (plus --impersonate-service-account for an approved chain) so terminal defaults cannot redirect the operation.
3. Start read-only and bounded: use supported --filter and --limit on listings and selected fields in --format; for logs, constrain time and resource before projecting message fields. Keep full IAM policies or configuration when required for the review; a limited listing is not an exhaustive audit. --quiet controls prompts, not output volume.
4. Authorize mutations: API enablement, IAM, billing, deletion, and production changes need explicit authority.

Gotchas

• --quiet is not authority: it suppresses prompts; it neither makes an operation safe nor approves it.
• Overrides replace the account: CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT, CLOUDSDK_AUTH_ACCESS_TOKEN_FILE, and --impersonate-service-account change the effective principal; prove which is active first.
• Firebase reuses ADC: the global firebase CLI (firebase-tools) authenticates with gcloud Application Default Credentials, so skip firebase login; pass --project <id> and --json, and treat deploy like any mutation.
• Failures are findings: on an auth, permission, or quota error report the missing principal, denied permission, or exhausted quota; do not switch configurations, broaden IAM, create keys, or move spend to another project.

Official Skills

Upstream: google/skills (skills/cloud), listed and installed through Google catalog; its CLI guardrail skill applies to every gcloud call. That skill is also named gcloud: preview it and apply its guardrails, but never install it under that name (vendor-skill policy).

Documentation

• gcloud reference · Authenticate for the gcloud CLI
• Releases: gcloud release notes
• Companion skills: Google catalog (which upstream skill), cloud-run (deployment), infra-as-code (provisioned infrastructure).