# gcloud CLI Cheat Sheet — Compute: GCE & GKE

> **Tool:** Google Cloud CLI (gcloud)
> **Category:** Cloud CLIs
> **Verified against:** Google Cloud SDK 553.0.0, flags verified via `gcloud <cmd> --help`, 2026-08-21
> **Official docs:** https://cloud.google.com/sdk/gcloud/reference

Compute Engine (GCE) VM lifecycle, and GKE cluster/node-pool management.

## Creating a VM instance

```bash
gcloud compute instances create my-instance \
  --zone=us-central1-a --machine-type=e2-medium \
  --image-family=debian-12 --image-project=debian-cloud \
  --network=my-network --subnet=my-subnet --tags=web-server
```

`--image-family` tracks the latest image in a family automatically (e.g. `debian-12` always resolves to the newest Debian 12 build) — pin `--image` to an exact image name instead when you need a reproducible, non-drifting build for something like a golden AMI-equivalent pipeline.

## Listing and inspecting instances

```bash
gcloud compute instances list
gcloud compute instances list --filter="zone:us-central1-a"
gcloud compute instances describe my-instance --zone=us-central1-a
```

## Starting, stopping, and deleting instances

```bash
gcloud compute instances start my-instance --zone=us-central1-a
gcloud compute instances stop my-instance --zone=us-central1-a
gcloud compute instances delete my-instance --zone=us-central1-a
gcloud compute instances delete my-instance --zone=us-central1-a --keep-disks=boot   # delete VM, keep its boot disk
```

## SSHing into an instance

```bash
gcloud compute ssh my-instance --zone=us-central1-a
gcloud compute ssh my-instance --zone=us-central1-a --tunnel-through-iap   # no external IP/firewall rule needed
```

`gcloud compute ssh` handles SSH key generation and propagation to the instance metadata automatically — `--tunnel-through-iap` is the standard pattern for reaching instances with no public IP, tunneling through Identity-Aware Proxy instead of opening an SSH-facing firewall rule.

## Creating a GKE cluster

```bash
gcloud container clusters create my-cluster \
  --zone=us-central1-a --num-nodes=3 --machine-type=e2-medium
```

## Getting kubectl credentials for a cluster

```bash
gcloud container clusters get-credentials my-cluster --zone=us-central1-a
```

Same role as `aws eks update-kubeconfig` — writes/merges a kubeconfig entry so `kubectl` can authenticate to the cluster; it doesn't create or modify anything in the cluster itself.

## Listing clusters and node pools

```bash
gcloud container clusters list
gcloud container node-pools list --cluster=my-cluster --zone=us-central1-a
```

## Resizing a cluster's node pool

```bash
gcloud container clusters resize my-cluster --zone=us-central1-a --num-nodes=5
gcloud container clusters resize my-cluster --zone=us-central1-a --node-pool=default-pool --num-nodes=5
```

Manually resizing a node pool is a one-time operation, not a standing policy — if the cluster has a Cluster Autoscaler configured, a manual resize can be immediately reverted by the autoscaler unless you also adjust its min/max node bounds.

## Creating and autoscaling node pools

```bash
gcloud container node-pools create high-mem-pool \
  --cluster=my-cluster --zone=us-central1-a \
  --machine-type=e2-highmem-4 --node-locations=us-central1-a,us-central1-b \
  --num-nodes=1 --enable-autoscaling --min-nodes=1 --max-nodes=5

gcloud container clusters update my-cluster --zone=us-central1-a \
  --node-pool=default-pool --enable-autoscaling --min-nodes=1 --max-nodes=10

gcloud container clusters update my-cluster --zone=us-central1-a \
  --node-pool=default-pool --no-enable-autoscaling   # turn autoscaling back off
```

`--node-locations` on a node pool spreads its nodes across multiple zones within the cluster's region — useful for zonal-failure resilience even on a "zonal" cluster. Autoscaling is a per-node-pool setting, not per-cluster: `clusters update` needs `--node-pool` to target the pool you're actually changing bounds on.

## Cloud Run — deploying and managing services

```bash
gcloud run deploy my-service \
  --image=us-docker.pkg.dev/my-project/my-repo/my-image:latest \
  --region=us-central1 --allow-unauthenticated \
  --memory=512Mi --cpu=1 --min-instances=0 --max-instances=10 --concurrency=80

gcloud run deploy my-service --source=. --region=us-central1   # build from local source instead of a pre-built image

gcloud run services list --region=us-central1
gcloud run services describe my-service --region=us-central1
gcloud run services update-traffic my-service --region=us-central1 \
  --to-revisions=my-service-00002-abc=10,my-service-00001-xyz=90   # canary: 10% to the new revision
```

`--source=.` hands the build off to Cloud Build automatically (using Buildpacks or a Dockerfile if present) — no separate `docker build`/`docker push` step needed. `--allow-unauthenticated` makes the service publicly reachable; omit it (or pass `--no-allow-unauthenticated`) to require IAM-authenticated callers, the default and the safer starting point for anything not meant to be public.