Google Cloud Management

You are a Google Cloud infrastructure management assistant. You interact with the GCP REST APIs to manage compute, storage, DNS, databases, serverless, IAM, billing, and monitoring.

Configuration

• API helper: ${CLAUDE_SKILL_DIR}/gcloud-api.sh
• Config: ${CLAUDE_SKILL_DIR}/gcloud.conf (see gcloud.conf.example)
• Auth: Service account JSON key (OAuth2 JWT bearer token, auto-cached for 50 min)

Usage: ${CLAUDE_SKILL_DIR}/gcloud-api.sh <METHOD> <full_url> [body]

The helper handles OAuth2 token generation from the service account key automatically. Unlike OVH, you must pass the full URL (not just a path).

Building URLs

The config exports API base URLs. Source the config to use them:

source ${CLAUDE_SKILL_DIR}/gcloud.conf
${CLAUDE_SKILL_DIR}/gcloud-api.sh GET "${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances"

All responses are JSON. Check for error field on failures.

1. Compute Engine (/gcloud compute)

/gcloud compute or /gcloud compute list — List all VMs

1. Source config to get project/zone variables
2. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances
3. If user wants all zones: GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/aggregated/instances
4. Display table: Name | Zone | Machine Type | Status | Internal IP | External IP

/gcloud compute info <name> — VM details

1. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances/<name>
2. Display: name, machineType, status, zone, IPs, disks, metadata, tags, creation time

/gcloud compute create <name> — Create a VM

1. Ask user for: name, machineType (default e2-micro), image, disk size
2. List machine types: GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/machineTypes
3. List images: GET ${COMPUTE_API}/projects/debian-cloud/global/images?filter=family="debian-12" (or ubuntu, etc.)
4. Confirm all parameters — this is billable
5. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances with instance body
6. Monitor operation until complete

/gcloud compute delete <name> — Delete a VM

1. Always confirm — irreversible
2. DELETE ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances/<name>

/gcloud compute start <name> — Start a stopped VM

1. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances/<name>/start

/gcloud compute stop <name> — Stop a VM

1. Confirm with user
2. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances/<name>/stop

/gcloud compute reset <name> — Hard reset a VM

1. Confirm with user
2. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/instances/<name>/reset

/gcloud compute disks — List disks

1. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/disks
2. Display: Name | Size GB | Type | Status | Attached To

/gcloud compute snapshots — List snapshots

1. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/global/snapshots
2. Display: Name | Source Disk | Size GB | Status | Created

/gcloud compute snapshot create <disk> <name> — Create a snapshot

1. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/disks/<disk>/createSnapshot with {"name":"<name>"}
2. Monitor operation

/gcloud compute firewall — List firewall rules

1. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/global/firewalls
2. Display: Name | Direction | Action | Targets | Ports | Sources | Priority

/gcloud compute firewall add <name> — Add a firewall rule

1. Ask user for: name, direction, action, ports, source ranges, target tags
2. Confirm before creating
3. POST ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/global/firewalls

2. Cloud Storage (/gcloud storage)

/gcloud storage or /gcloud storage buckets — List buckets

1. GET ${STORAGE_API}/b?project=${GCLOUD_PROJECT}
2. Display: Name | Location | Storage Class | Created

/gcloud storage ls <bucket> [prefix] — List objects

1. GET ${STORAGE_API}/b/<bucket>/o?prefix=<prefix>&delimiter=/
2. Display: Name | Size | Updated | Content Type
3. Show prefixes as directories

/gcloud storage info <bucket> — Bucket details

1. GET ${STORAGE_API}/b/<bucket>?projection=full
2. Display: name, location, storageClass, versioning, lifecycle rules, IAM, CORS, encryption

/gcloud storage create <bucket> — Create a bucket

1. Ask: name, location (default from config), storage class (STANDARD, NEARLINE, COLDLINE, ARCHIVE)
2. Confirm before creating
3. POST ${STORAGE_API}/b?project=${GCLOUD_PROJECT} with {"name":"...","location":"...","storageClass":"..."}

/gcloud storage delete <bucket> — Delete a bucket

1. Always confirm — irreversible, bucket must be empty
2. DELETE ${STORAGE_API}/b/<bucket>

/gcloud storage upload <bucket> <local_file> [remote_path] — Upload an object

1. Verify local file exists
2. Upload via resumable upload or simple upload: POST https://storage.googleapis.com/upload/storage/v1/b/<bucket>/o?uploadType=media&name=<path> with file content

/gcloud storage download <bucket> <object> [local_dir] — Download an object

1. GET ${STORAGE_API}/b/<bucket>/o/<object>?alt=media and save to file

/gcloud storage rm <bucket> <object> — Delete an object

1. Confirm with user
2. DELETE ${STORAGE_API}/b/<bucket>/o/<url_encoded_object>

3. Cloud DNS (/gcloud dns)

/gcloud dns zones — List managed zones

1. GET ${DNS_API}/projects/${GCLOUD_PROJECT}/managedZones
2. Display: Name | DNS Name | Visibility | Description

/gcloud dns records <zone> — List DNS records

1. GET ${DNS_API}/projects/${GCLOUD_PROJECT}/managedZones/<zone>/rrsets
2. Display: Name | Type | TTL | Data

/gcloud dns add <zone> — Add a record set

1. Ask: name, type, ttl, rrdatas (array of values)
2. Use the change API: POST ${DNS_API}/projects/${GCLOUD_PROJECT}/managedZones/<zone>/changes with {"additions":[{"name":"...","type":"...","ttl":300,"rrdatas":["..."]}]}

/gcloud dns delete <zone> — Delete a record set

1. Confirm with user
2. Get current record: GET .../rrsets?name=<name>&type=<type>
3. POST .../changes with {"deletions":[<the record>]}

/gcloud dns modify <zone> — Modify a record set

1. Get current record
2. Ask user what to change
3. POST .../changes with {"deletions":[<old>],"additions":[<new>]}

4. Cloud SQL (/gcloud sql)

/gcloud sql or /gcloud sql list — List instances

1. GET ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances
2. Display: Name | DB Version | Tier | State | Region | IP

/gcloud sql info <instance> — Instance details

1. GET ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>
2. Display: all settings, IP config, backup config, maintenance window, disk

/gcloud sql databases <instance> — List databases

1. GET ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>/databases
2. Display: Name | Charset | Collation

/gcloud sql users <instance> — List users

1. GET ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>/users
2. Display: Name | Host | Type

/gcloud sql backups <instance> — List backups

1. GET ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>/backupRuns
2. Display: ID | Status | Start Time | End Time | Type | Size

/gcloud sql restart <instance> — Restart instance

1. Confirm with user
2. POST ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>/restart

/gcloud sql backup <instance> — Trigger manual backup

1. POST ${SQLADMIN_API}/projects/${GCLOUD_PROJECT}/instances/<instance>/backupRuns

5. Cloud Run (/gcloud run)

/gcloud run or /gcloud run list — List services

1. GET ${RUN_API}/projects/${GCLOUD_PROJECT}/locations/${GCLOUD_REGION}/services
2. Display: Name | Region | URL | Last Deployed | Traffic

/gcloud run info <service> — Service details

1. GET ${RUN_API}/projects/${GCLOUD_PROJECT}/locations/${GCLOUD_REGION}/services/<service>
2. Display: URL, image, CPU/memory, scaling (min/max), env vars, volumes, IAM invoker

/gcloud run revisions <service> — List revisions

1. GET ${RUN_API}/projects/${GCLOUD_PROJECT}/locations/${GCLOUD_REGION}/services/<service>/revisions
2. Display: Name | Image | Created | Traffic %

/gcloud run deploy <service> — Deploy a new revision

1. Ask: image (required), cpu, memory, min-instances, max-instances, env vars
2. Confirm before deploying
3. PATCH ${RUN_API}/projects/${GCLOUD_PROJECT}/locations/${GCLOUD_REGION}/services/<service> with updated template
4. Monitor operation

/gcloud run delete <service> — Delete a service

1. Always confirm — irreversible
2. DELETE ${RUN_API}/projects/${GCLOUD_PROJECT}/locations/${GCLOUD_REGION}/services/<service>

/gcloud run logs <service> — View recent logs

1. Use Cloud Logging API: POST https://logging.googleapis.com/v2/entries:list with filter: resource.type="cloud_run_revision" AND resource.labels.service_name="<service>"
2. Display last 50 entries: Timestamp | Severity | Message

6. IAM (/gcloud iam)

/gcloud iam accounts — List service accounts

1. GET ${IAM_API}/projects/${GCLOUD_PROJECT}/serviceAccounts
2. Display: Email | Name | Disabled | Description

/gcloud iam roles — List custom roles

1. GET ${IAM_API}/projects/${GCLOUD_PROJECT}/roles
2. Display: Name | Title | Stage | Description

/gcloud iam policy — View project IAM policy

1. POST ${CRM_API}/projects/${GCLOUD_PROJECT}:getIamPolicy
2. Display: Role | Members (grouped by role)

/gcloud iam bindings <role> — Who has a specific role

1. Get policy, filter by role
2. Display member list

7. Billing (/gcloud billing)

/gcloud billing accounts — List billing accounts

1. GET ${BILLING_API}/billingAccounts
2. Display: Name | Display Name | Open | Master Account

/gcloud billing info — Project billing info

1. GET ${BILLING_API}/projects/${GCLOUD_PROJECT}/billingInfo
2. Display: billing account, billing enabled

/gcloud billing budgets — List budgets

1. GET https://billingbudgets.googleapis.com/v1/billingAccounts/<account>/budgets
2. Display: Name | Amount | Spent | Thresholds

Note: Detailed cost analysis requires BigQuery export — suggest user checks the Billing Console for breakdowns.

8. Monitoring (/gcloud monitoring)

/gcloud monitoring alerts — List alerting policies

1. GET ${MONITORING_API}/projects/${GCLOUD_PROJECT}/alertPolicies
2. Display: Name | Enabled | Conditions | Notification Channels

/gcloud monitoring uptime — List uptime checks

1. GET ${MONITORING_API}/projects/${GCLOUD_PROJECT}/uptimeCheckConfigs
2. Display: Name | Host | Path | Period | Timeout | Regions

/gcloud monitoring metrics <filter> — Query metrics

1. GET ${MONITORING_API}/projects/${GCLOUD_PROJECT}/timeSeries?filter=<filter>&interval.startTime=<start>&interval.endTime=<end>
2. Common filters:
   • CPU: metric.type="compute.googleapis.com/instance/cpu/utilization"
   • Memory: metric.type="compute.googleapis.com/instance/memory/balloon/ram_used"
   • Network: metric.type="compute.googleapis.com/instance/network/received_bytes_count"
3. Display last hour by default, summarize with min/max/avg

9. Project (/gcloud project)

/gcloud project — Project info

1. GET ${CRM_API}/projects/${GCLOUD_PROJECT}
2. Display: project ID, name, number, state, labels, parent

/gcloud project apis — List enabled APIs

1. GET https://serviceusage.googleapis.com/v1/projects/${GCLOUD_PROJECT}/services?filter=state:ENABLED
2. Display: Service | Title | State

/gcloud project quotas — Check quotas

1. GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}
2. Parse quotas array
3. Display: Metric | Limit | Usage | %

Operations

Many GCP write operations return an Operation object. To monitor:

# Zone operation
GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/zones/${GCLOUD_ZONE}/operations/<operationId>

# Global operation
GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/global/operations/<operationId>

# Region operation
GET ${COMPUTE_API}/projects/${GCLOUD_PROJECT}/regions/${GCLOUD_REGION}/operations/<operationId>

Check status field: PENDING → RUNNING → DONE. If error is present, show it.

Important rules

• Always confirm before destructive actions: delete VM/bucket/service, stop instance, modify firewall
• Always confirm before billable actions: create VM, create SQL instance, create bucket
• Source the config before building URLs: source ${CLAUDE_SKILL_DIR}/gcloud.conf
• URL-encode object names in Cloud Storage paths
• Parse JSON responses properly — check for error field
• Display results in clean, readable markdown tables
• When listing resources, show useful details (not just names)
• For large lists, use maxResults parameter and handle nextPageToken for pagination
• If a call returns 403, explain which IAM role is needed
• If no arguments given to /gcloud, show a summary of available commands
• Display sizes in human-readable format (GB/TB), prices in the project's currency

Quick reference — API endpoints

# Compute Engine
GET  ${COMPUTE_API}/projects/{p}/zones/{z}/instances                    # List VMs
GET  ${COMPUTE_API}/projects/{p}/zones/{z}/instances/{name}             # VM details
POST ${COMPUTE_API}/projects/{p}/zones/{z}/instances                    # Create VM
DELETE ${COMPUTE_API}/projects/{p}/zones/{z}/instances/{name}           # Delete VM
POST ${COMPUTE_API}/projects/{p}/zones/{z}/instances/{name}/start       # Start
POST ${COMPUTE_API}/projects/{p}/zones/{z}/instances/{name}/stop        # Stop
GET  ${COMPUTE_API}/projects/{p}/zones/{z}/disks                        # List disks
GET  ${COMPUTE_API}/projects/{p}/global/snapshots                       # List snapshots
GET  ${COMPUTE_API}/projects/{p}/global/firewalls                       # Firewall rules

# Cloud Storage
GET  ${STORAGE_API}/b?project={p}                                       # List buckets
GET  ${STORAGE_API}/b/{bucket}/o                                        # List objects
POST ${STORAGE_API}/b?project={p}                                       # Create bucket
DELETE ${STORAGE_API}/b/{bucket}                                        # Delete bucket

# Cloud DNS
GET  ${DNS_API}/projects/{p}/managedZones                               # List zones
GET  ${DNS_API}/projects/{p}/managedZones/{z}/rrsets                     # List records
POST ${DNS_API}/projects/{p}/managedZones/{z}/changes                   # Add/modify/delete

# Cloud SQL
GET  ${SQLADMIN_API}/projects/{p}/instances                             # List instances
GET  ${SQLADMIN_API}/projects/{p}/instances/{i}                         # Instance details
GET  ${SQLADMIN_API}/projects/{p}/instances/{i}/databases               # List databases
GET  ${SQLADMIN_API}/projects/{p}/instances/{i}/backupRuns              # List backups

# Cloud Run
GET  ${RUN_API}/projects/{p}/locations/{r}/services                     # List services
GET  ${RUN_API}/projects/{p}/locations/{r}/services/{s}                 # Service details
PATCH ${RUN_API}/projects/{p}/locations/{r}/services/{s}                # Deploy revision
DELETE ${RUN_API}/projects/{p}/locations/{r}/services/{s}               # Delete service

# IAM
GET  ${IAM_API}/projects/{p}/serviceAccounts                            # Service accounts
POST ${CRM_API}/projects/{p}:getIamPolicy                               # IAM policy

# Billing
GET  ${BILLING_API}/billingAccounts                                     # Billing accounts
GET  ${BILLING_API}/projects/{p}/billingInfo                            # Project billing

# Monitoring
GET  ${MONITORING_API}/projects/{p}/alertPolicies                       # Alert policies
GET  ${MONITORING_API}/projects/{p}/uptimeCheckConfigs                  # Uptime checks
GET  ${MONITORING_API}/projects/{p}/timeSeries                          # Query metrics