Verified10 commandsAI-assisted

Compute: GCE & GKE

Verified against Google Cloud SDK 553.0.0, flags verified via `gcloud <cmd> --help`, 2026-08-21 · official docs

Compute Engine (GCE) VM lifecycle, and GKE cluster/node-pool management.

Creating a VM instance#

gcloud compute instances create my-instance \
  --zone=us-central1-a --machine-type=e2-medium \
  --image-family=debian-12 --image-project=debian-cloud \
  --network=my-network --subnet=my-subnet --tags=web-server

--image-family tracks the latest image in a family automatically (e.g. debian-12 always resolves to the newest Debian 12 build) — pin --image to an exact image name instead when you need a reproducible, non-drifting build for something like a golden AMI-equivalent pipeline.

Listing and inspecting instances#

gcloud compute instances list
gcloud compute instances list --filter="zone:us-central1-a"
gcloud compute instances describe my-instance --zone=us-central1-a

Starting, stopping, and deleting instances#

gcloud compute instances start my-instance --zone=us-central1-a
gcloud compute instances stop my-instance --zone=us-central1-a
gcloud compute instances delete my-instance --zone=us-central1-a
gcloud compute instances delete my-instance --zone=us-central1-a --keep-disks=boot   # delete VM, keep its boot disk

SSHing into an instance#

gcloud compute ssh my-instance --zone=us-central1-a
gcloud compute ssh my-instance --zone=us-central1-a --tunnel-through-iap   # no external IP/firewall rule needed

gcloud compute ssh handles SSH key generation and propagation to the instance metadata automatically — --tunnel-through-iap is the standard pattern for reaching instances with no public IP, tunneling through Identity-Aware Proxy instead of opening an SSH-facing firewall rule.

Creating a GKE cluster#

gcloud container clusters create my-cluster \
  --zone=us-central1-a --num-nodes=3 --machine-type=e2-medium

Getting kubectl credentials for a cluster#

gcloud container clusters get-credentials my-cluster --zone=us-central1-a

Same role as aws eks update-kubeconfig — writes/merges a kubeconfig entry so kubectl can authenticate to the cluster; it doesn't create or modify anything in the cluster itself.

Listing clusters and node pools#

gcloud container clusters list
gcloud container node-pools list --cluster=my-cluster --zone=us-central1-a

Resizing a cluster's node pool#

gcloud container clusters resize my-cluster --zone=us-central1-a --num-nodes=5
gcloud container clusters resize my-cluster --zone=us-central1-a --node-pool=default-pool --num-nodes=5

Manually resizing a node pool is a one-time operation, not a standing policy — if the cluster has a Cluster Autoscaler configured, a manual resize can be immediately reverted by the autoscaler unless you also adjust its min/max node bounds.

Creating and autoscaling node pools#

gcloud container node-pools create high-mem-pool \
  --cluster=my-cluster --zone=us-central1-a \
  --machine-type=e2-highmem-4 --node-locations=us-central1-a,us-central1-b \
  --num-nodes=1 --enable-autoscaling --min-nodes=1 --max-nodes=5

gcloud container clusters update my-cluster --zone=us-central1-a \
  --node-pool=default-pool --enable-autoscaling --min-nodes=1 --max-nodes=10

gcloud container clusters update my-cluster --zone=us-central1-a \
  --node-pool=default-pool --no-enable-autoscaling   # turn autoscaling back off

--node-locations on a node pool spreads its nodes across multiple zones within the cluster's region — useful for zonal-failure resilience even on a "zonal" cluster. Autoscaling is a per-node-pool setting, not per-cluster: clusters update needs --node-pool to target the pool you're actually changing bounds on.

Cloud Run — deploying and managing services#

gcloud run deploy my-service \
  --image=us-docker.pkg.dev/my-project/my-repo/my-image:latest \
  --region=us-central1 --allow-unauthenticated \
  --memory=512Mi --cpu=1 --min-instances=0 --max-instances=10 --concurrency=80

gcloud run deploy my-service --source=. --region=us-central1   # build from local source instead of a pre-built image

gcloud run services list --region=us-central1
gcloud run services describe my-service --region=us-central1
gcloud run services update-traffic my-service --region=us-central1 \
  --to-revisions=my-service-00002-abc=10,my-service-00001-xyz=90   # canary: 10% to the new revision

--source=. hands the build off to Cloud Build automatically (using Buildpacks or a Dockerfile if present) — no separate docker build/docker push step needed. --allow-unauthenticated makes the service publicly reachable; omit it (or pass --no-allow-unauthenticated) to require IAM-authenticated callers, the default and the safer starting point for anything not meant to be public.

← PreviousConfiguration, Auth & IAM Next →Storage & Networking