gcloud CLI

Local Directory Structure

~/.config/gcloud/
├── application_default_credentials.json   # ADC — used by SDKs, Terraform
├── credentials.db                          # OAuth tokens per account
├── properties                              # active config values
└── configurations/
    ├── config_default
    ├── config_praxedo-dev
    └── config_praxedo-prod

Three Auth Layers

This is the biggest footgun coming from AWS/Azure. There are three separate credential types:

Layer	Used by	Command
User account (OAuth)	`gcloud` CLI commands	`gcloud auth login`
ADC (Application Default Credentials)	SDKs, Terraform, local app code	`gcloud auth application-default login`
Service Account key	CI/CD, non-interactive	`gcloud auth activate-service-account`

gcloud auth login does not set ADC. If you run Terraform or a Python SDK locally, you need both logins.

Azure's az login covers both CLI and SDK in one shot — GCP does not.

Named Configurations

Equivalent to AWS ~/.aws/config [profile foo]. Each named config is a file under ~/.config/gcloud/configurations/ holding an account + project + region.

# Create
gcloud config configurations create praxedo-dev

# Activate
gcloud config configurations activate praxedo-dev

# Set values in the active config
gcloud config set account you@theodo.com
gcloud config set project praxedo-dev-PROJECT_ID
gcloud config set compute/region europe-west1

# List all configs
gcloud config configurations list

# Show current config values
gcloud config list

One-shot override without switching:

gcloud projects list --configuration=personal
# or
CLOUDSDK_ACTIVE_CONFIG_NAME=personal gcloud projects list

Multiple Accounts

gcloud auth login another@theodo.com   # browser flow — adds a second logged-in account
gcloud auth list                        # list all authenticated accounts
gcloud config set account another@theodo.com  # switch active account in current config
gcloud auth revoke another@theodo.com   # remove an account

Multiple accounts can be logged in simultaneously. The active config determines which one is used.

No separate tool needed (unlike aws-sso-util). gcloud auth login already goes through Google/Workspace SSO. If the org uses Okta federated into Cloud Identity, the browser flow handles it transparently.

For Workforce Identity Federation (direct OIDC/SAML from Okta without Cloud Identity):

gcloud auth login --workforce-pool-user-project=PROJECT_ID

Setup (Personal Account + Terraform)

# 1. Install (Arch)
yay -S google-cloud-cli

# 2. CLI login
gcloud auth login

# 3. ADC login (Terraform + SDKs)
gcloud auth application-default login

# 4. Named config
gcloud config configurations create myproject
gcloud config set account you@gmail.com
gcloud config set project YOUR_PROJECT_ID
gcloud config set compute/region europe-west1

# 5. Verify
gcloud auth list
gcloud config list
gcloud projects list

Useful Commands

# Explore your setup
gcloud organizations list
gcloud resource-manager folders list --organization=ORG_ID
gcloud projects list --filter="parent.id=ORG_ID"
gcloud organizations get-iam-policy ORG_ID

# Project info
gcloud projects describe PROJECT_ID

# Enable a component
gcloud components install beta gke-gcloud-auth-plugin cloud-sql-proxy kubectl
gcloud components update

Components Reference

Category	Components	When you need them
Core (installed)	`core`, `bq`, `gsutil`	Always
Local emulators	`pubsub-emulator`, `bigtable`, `cloud-firestore-emulator`, `cloud-spanner-emulator`, `cloud-datastore-emulator`	Local dev/test without hitting real GCP (like LocalStack)
Proxies	`cloud-sql-proxy`, `cloud-run-proxy`	Secure local→cloud tunnels (Cloud SQL without IP whitelisting)
Kubernetes / GKE	`kubectl`, `gke-gcloud-auth-plugin`, `kustomize`, `istioctl`, `skaffold`, `minikube`	Any GKE work — `gke-gcloud-auth-plugin` is required for `kubectl` against GKE
IaC	`terraform-tools`	`gcloud terraform vet` — policy validation for Terraform plans
CLI tiers	`alpha`, `beta`, `preview`	Unlock pre-GA commands — install `beta` routinely
Security / SBOM	`local-extract`, `sbom-extractor`, `docker-credential-gcr`	Container image scanning, Artifact Registry Docker auth
Spanner / Bigtable	`cbt`, `spanner-cli`, `spanner-migration-tool`	Only if using those services
Anthos / GitOps	`nomos`, `config-connector`, `kpt`, `anthos-auth`	Multi-cluster / hybrid Kubernetes at scale
App Engine	`app-engine-go`, `app-engine-java`, `app-engine-python`	Legacy PaaS — skip unless needed

Minimal install for GCP/GKE work:

gcloud components install beta gke-gcloud-auth-plugin cloud-sql-proxy kubectl

Shell QoL

# Tab completion — add to ~/.bashrc or ~/.zshrc
source "$(gcloud info --format='value(installation.sdk_root)')/completion.bash.inc"

# Quick config switchers
alias gcdev='gcloud config configurations activate praxedo-dev'
alias gcprod='gcloud config configurations activate praxedo-prod'

# Show active config in prompt
gcloud config configurations list --filter="is_active=true" --format="value(name)"

Keyboard shortcuts

M'Goun