gcloud CLI Setup #

Setup takes about 10 minutes. Run these five commands, then set up project switching.

brew install --cask gcloud-cli
gcloud components install gke-gcloud-auth-plugin
gcloud auth login
gcloud auth application-default login
gcloud config set project funnelstory-infra-staging

Both auth commands are needed. gcloud auth login is for the CLI. application-default login is for Terraform and other SDK clients.

gke-gcloud-auth-plugin is also required. Without it kubectl cannot authenticate and fails with a credential-plugin error.

Switch projects #

Named configurations hold a project and account together, so one command switches both.

1. Create the staging configuration:

   gcloud config configurations create fs-staging
   gcloud config set account <you>@funnelstory.ai
   gcloud config set project funnelstory-infra-staging
   

2. Create the production configuration:

   gcloud config configurations create fs-production
   gcloud config set account <you>@funnelstory.ai
   gcloud config set project funnelstory-infra-production
   

3. Switch between them, and see which is active:

   gcloud config configurations activate fs-staging
   gcloud config configurations list
   

Get a kubectl context #

Both control planes are private. Connect Gateway is the only way in.

# staging
gcloud container fleet memberships get-credentials funnelstory-staging \
  --project=funnelstory-infra-staging

# production
gcloud container fleet memberships get-credentials funnelstory-production \
  --project=funnelstory-infra-production

Each command writes a context and makes it current.

connectgateway_funnelstory-infra-staging_global_funnelstory-staging
connectgateway_funnelstory-infra-production_global_funnelstory-production

Use fleet memberships get-credentials, as above. The similar-looking gcloud container clusters get-credentials writes a context pointing at the private endpoint, which your laptop reaches only when WARP is up and routing the control-plane /28. Connect Gateway works either way.

VPN #

gcloud and kubectl through Connect Gateway reach public Google APIs, so they work without the VPN.

The VPN is for reaching a private IP directly — psql to Cloud SQL, curl to a pod. Set it up once, from the VPN page. The ranges it routes are in the environment reference.

Next: run kubectl config current-context and confirm it names the environment you expect.