gcloud

[!IMPORTANT] Architectural Scope and Reference Discipline: Use

SKILL.md

to select the target topology, egress mode, ingress pattern, and governance plane, then consult the authoritative

references/*.md

manual for exact CLI commands, REST/YAML schemas, Common Expression Language (CEL) expressions, and Python Agent Development Kit (ADK) runtime code (

references/*.md

is the single source of truth for all implementation syntax). When remote Model Context Protocol (MCP) tools (such as the Google Developer Knowledge MCP server or Google-managed MCP endpoints) are available, prefer remote MCP tool invocation over raw CLI/REST commands. Do not execute unrequested live mutations against customer projects when asked for architectural designs.

[!CAUTION] Human Approval Gate for Sensitive Operations: Always prompt the user for explicit confirmation before executing commands or applying configurations that grant permissive Identity and Access Management (IAM) bindings (

roles/iap.egressor

,

roles/compute.networkUser

,

roles/networkservices.admin

), modify Organization Policies (

constraints/iam.managed.disableAccessPolicyBinding

), update Unified Access Policy (UAP) or VPC Service Controls (VPC-SC) policies, or delete resources (REST

DELETE ...?force=true

or CLI

--quiet

).

1. Google Cloud SDK, Authentication, and Project Setup:
   • Install the Google Cloud SDK (

     gcloud

     ) and authenticate CLI and Application Default Credentials (

     gcloud auth login && gcloud auth application-default login

     , or set

     GOOGLE_APPLICATION_CREDENTIALS

     ).
   • Select or create the target project (

     gcloud projects create {project_id}

     /

     gcloud config set project {project_id}

     ), set the default region (

     gcloud config set compute/region {region}

     , defaulting to

     us-central1

     ; see Google Cloud Locations), and enable required APIs:
     bash

     gcloud services enable aiplatform.googleapis.com agentregistry.googleapis.com \
       agentidentity.googleapis.com agentidentitycredentials.googleapis.com \
       networkservices.googleapis.com networksecurity.googleapis.com iap.googleapis.com \
       modelarmor.googleapis.com compute.googleapis.com dns.googleapis.com \
       certificatemanager.googleapis.com servicenetworking.googleapis.com

2. Billing, Least-Privilege IAM, and Product Terminology:
   • Verify an active billing account is attached (

     gcloud billing projects describe {project_id} --format="value(billingEnabled)"

     ) across

     {host_project_id}

     ,

     {gov_project_id}

     ,

     {runtime_project_id}

     , and

     {mcp_project_id}

     (required even when evaluating free-tier allowances; review Google Cloud Pricing).
   • Grant explicit least-privilege IAM roles (

     roles/aiplatform.user

     ,

     roles/networkservices.admin

     ,

     roles/compute.networkAdmin

     ,

     roles/compute.networkUser

     ,

     roles/iap.egressor

     , or a custom role with

     networkservices.agentGateways.get,networkservices.agentGateways.use,networkservices.operations.get

     ) rather than primitive

     roles/owner

     or

     roles/editor

     .
   • Use approved product names: Gemini platform, Agent Runtime (

     reasoningEngines

     ), Agent Gateway (

     240.0.0.2:443

     ), Agent Connectivity Template (ACT), Agent Registry, and Unified Access Policy (UAP Policy V2) / Semantic Governance Policy (SGP).

graph TD
    Start["Enterprise Gemini platform Architecture"] --> Q1{"1. Egress Destinations?"}
    Q1 -->|"RFC 1918 + Google APIs Only"| Priv["ACT: vpcEgress = PRIVATE_RANGES_ONLY<br/>• Direct Private Google Access (PGA)"]
    Q1 -->|"Public Internet, VPC-SC, or Non-RFC 1918 PUPI"| All["ACT: vpcEgress = ALL_TRAFFIC<br/>• 100% Egress via AGW VIP 240.0.0.2:443<br/>• Consolidate Core Google APIs FQDNs"]
    All --> Q2{"2. Layer 7 URL List or Cross-Cloud mTLS?"}
    Q2 -->|"No (Standard NAT)"| Nat["Direct Cloud NAT on PSC-I Subnet<br/>• ENDPOINT_TYPE_VM,ENDPOINT_TYPE_SWG"]
    Q2 -->|"Yes (Next-Hop SWP)"| Swp["Next-Hop SWP (NEXT_HOP_ROUTING_MODE) + PBR<br/>• Internal and Google API DEFAULT_ROUTING bypasses<br/>• Default route via SWP ILB IP<br/>• Exclude PSC-I from manual Cloud NAT"]

1. Phase 1 — Scope Verification and Architecture Discovery:
   • Scope Boundaries and Single-Region Discovery: Decline generic Google Cloud IAM/Compute/Storage debugging unrelated to the Gemini platform stack or requests to run broad multi-region live project scanning loops, pointing instead to

     gcloud ai reasoning-engines list --region={region}

     .
   • Architecture Design and Engineering: Identify the project hierarchy (

     Host

     ,

     Governance Hub

     ,

     Runtime Spoke

     ,

     Tool/MCP Spoke

     ), egress mode (

     ALL_TRAFFIC

     vs

     PRIVATE_RANGES_ONLY

     ), policy plane (UAP V2, SGP, Model Armor), and target output format (topology specification,

     gcloud

     CLI commands, or REST/YAML manifests).
2. Phase 2 — Draft Architecture Plan and Resource Mapping:
   • Synthesize the topology diagram, project/VPC layout, IAM bootstrap matrix, and security controls using the Domain Router and Symptom Matrix, and map each manual's canonical REST/YAML schema and CLI commands into the target deployment artifacts.
3. Phase 3 — Post-Deployment and Audit Log Verification:
   • Pair every architecture design with the Post-Deployment and Cloud Audit Log Verification checklist (

     references/topologies_and_project_layouts.md

     ) and runtime query validation (

     references/agent_runtime_and_identity.md

     ).

• Agent Runtime Overview
• Agent Gateway Overview
• Policies Overview
• Agent Identity Overview
• Agent Registry Overview
• Deploy Agent Gateway Runtime
• Private Service Connect Interface