devops-gcp

Provides operational guidance for Google Cloud Platform DevOps tasks including Cloud Run, IAM, and Terraform.

Updated May 3, 2026
One-click install
npx skills add https://github.com/spikelab/multiplai-cc-mktplace --skill devops-gcp-spikelab
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: devops-gcp
Source: https://github.com/spikelab/multiplai-cc-mktplace/tree/main/plugins/multiplai-dev/skills/devops-gcp
Command: npx skills add https://github.com/spikelab/multiplai-cc-mktplace --skill devops-gcp-spikelab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Working with Google Cloud Platform involves dozens of services, IAM subtleties, and operational pitfalls (startup probe failures, secret leaks in logs, Terraform state drift) that are easy to get wrong without deep operator experience. This Skill gives an AI agent a working operator's knowledge of GCP so it can run the right gcloud commands, follow least-privilege IAM patterns, and know when to escalate before making risky changes. ## Core Features & Use Cases - Task-based reference routing: A lookup table maps tasks (Cloud Run deploys, Cloud SQL migrations, IAM audits, Terraform multi-env, networking, storage) to focused reference files loaded on demand. - Day-to-day command patterns: Ready-to-use gcloud commands for authentication, log reading, Cloud Run inspection and rollback, IAM policy inspection, and Terraform workflows. - Debugging recipes: Step-by-step diagnostic flows for Cloud Run 5xx errors, infrastructure drift detection, cost investigation, and permission-denied IAM issues. - Project conventions auto-discovery: Walks up from the working directory to find a project-owned gcp-conventions.md file that overrides generic patterns. - Use Case: A Cloud Run service starts returning 503s after a deploy. The agent follows the debugging recipe: check revisions and traffic split, read recent ERROR logs, look for startup probe failures, and verify the runtime service account has secretmanager.secretAccessor on its secrets. ## Quick Start Ask the agent to diagnose why your Cloud Run service is returning 503 errors in your GCP project.

Frequently Asked Questions about devops-gcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug a Cloud Run service returning 503 errors?

Check revisions and traffic with gcloud run services describe, then read recent errors via gcloud logging read with severity>=ERROR. Most 503s come from startup probe failures or a runtime service account missing secretmanager.secretAccessor on a secret it reads at boot.

How should service accounts be scoped for Cloud Run services?

Use one dedicated runtime service account per Cloud Run service and one deployer SA per pipeline, granting minimum roles at project scope. Never grant roles/owner or roles/editor, and grant secretmanager.secretAccessor on individual secrets rather than project-wide.

Should I use Workload Identity Federation or service account keys for CI/CD?

Use Workload Identity Federation with short-lived OIDC tokens for CI/CD systems like GitHub Actions. Service account JSON keys are long-lived secrets and their creation should be treated as a security event requiring explicit justification.

How do I detect Terraform drift in GCP infrastructure?

Run terraform plan -refresh-only from the environment directory. A diff under refresh-only means real drift from out-of-band changes, while a diff under regular plan means code diverged from state, and each requires a different response.

Can read-only GCP access still expose secrets through logs?

Yes. The roles/logging.viewer role exposes whatever applications write to stdout and stderr, including JWTs, request bodies, and stack traces with credentials. Either scrub secrets at the log source or treat log read access as read-anything-the-app-logged.

When should I escalate to a human before making GCP changes?

Escalate before modifying IAM bindings beyond established patterns, creating service account keys, changing WIF pool configuration, editing Terraform lifecycle ignore_changes blocks, touching state buckets, or changing anything in projects that own production DNS.