Guides gcloud use from a Centaur sandbox for Google Cloud tasks such as Cloud Run, Cloud Build, storage, and IAM. It explains how the proxy supplies credentials, how to identify the active principal, and how to interpret common access and API errors.
Use the gcloud CLI from a Centaur sandbox, where iron-proxy injects Google Cloud credentials on the wire. Use before any gcloud command, Google Cloud deploy, Cloud Run, Cloud Build, Artifact Registry, Cloud Storage, or IAM task, and whenever gcloud reports no credentialed account, asks you to run `gcloud auth login`, or a Google API returns 401, 403, or SERVICE_DISABLED.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
The sandbox has no local Google login. When the current principal holds a GCP credential grant, iron-proxy adds a real Authorization header to each Google API request as it leaves the sandbox. So gcloud auth list shows no credentialed account even when access works. Never report "no GCP credentials" or "no authenticated account" because of gcloud auth list or gcloud config get-value account. Make a real call first.
gcloud refuses to send requests without a local credential. Give it a placeholder token, which the proxy replaces:
printf 'placeholder' > /tmp/gcp-placeholder-token
export CLOUDSDK_AUTH_ACCESS_TOKEN_FILE=/tmp/gcp-placeholder-token
gcloud run services list --project=<project> --region=<region>
Set the variable in the same shell command as the gcloud call, because shell state does not persist between tool calls. --access-token-file=/tmp/gcp-placeholder-token on a single command works too. With the variable set, gcloud auth print-access-token prints placeholder. Scripts that pass that value in an Authorization header still work, because the proxy overwrites the header.
--project. There is no default project.SERVICE_DISABLED for an API in a project you did not name (often Cloud Resource Manager), gcloud billed the request to the wrong quota project. Retry with --billing-project=<a project where that API is enabled>.gcloud storage ls gs://<bucket-you-cannot-read> → <principal> does not have storage.objects.list access.gcloud auth print-identity-token fails with No identity token can be obtained from the current credentials. Calls to private Cloud Run services work only for hosts where the deployment configured an ID-token credential. Anything else, including smoke tests that call print-identity-token, has to be run by a human from an authenticated shell. Give them the exact command.gcloud config get-value account get an empty value. Read the script before running it, and pass the account explicitly or hand that step to a human.bq fails TLS verification through the proxy. Use gcloud or a Google client library instead.GOOGLE_APPLICATION_CREDENTIALS. They work when the proxy handles the token exchange for that credential. If you see invalid_grant: account not found or signing errors for mock@creds.com, switch to gcloud. Signed URLs and signBlob never work.| Symptom | Meaning | Action |
|---|---|---|
You do not currently have an active account selected | No placeholder token was set. | Set CLOUDSDK_AUTH_ACCESS_TOKEN_FILE and retry. |
401 ACCESS_TOKEN_TYPE_UNSUPPORTED, Invalid Credentials | The proxy did not inject a usable token for that host, usually because the principal has no GCP grant covering it. | Report the missing grant. Follow the auth-failure-log-triage skill for proxy evidence. |
403 PERMISSION_DENIED naming a permission | The injected identity lacks IAM for that action. | Report the principal, the permission, and the resource. Offer the gcloud ... add-iam-policy-binding command for an owner to run. Do not retry with another identity. |
SERVICE_DISABLED for the target project | The API is off in that project. | Ask an owner to run gcloud services enable <api> --project=<project>, unless you were asked to enable it and have serviceusage.services.enable. |
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Investigate authentication, permission, credential, OAuth, token, secret, and API proxy failures by checking live VictoriaLogs evidence first. Summarize relevant status codes and error details, and distinguish upstream denials from local proxy or secret resolution problems.
Use an authenticated Centaur MCP deployment to find and call team-approved tools. It checks identity when permissions matter, follows the deployment’s current CLI help, and summarizes consequential changes with relevant identifiers or links.
Use this skill to translate a Console administrator’s request into Centaur permission changes. It can create supported principals and secrets, grant or revoke access, adjust Slack and sandbox permissions, and manage Slack Connect allowlists while checking for unsafe personal credential sharing.
Investigate Centaur incidents using VictoriaLogs for runtime logs and VictoriaMetrics for deployment and health metrics. The skill correlates a narrow time window with relevant code and workflow status, then reports a supported cause or bounded hypotheses and the evidence still needed.
Answer internal history and project context questions by searching indexed company information and checking relevant live sources such as Slack, Linear, Google Docs, Drive, Calendar, or Granola. Reconcile the evidence and cite dates or source links when available.
Build a new external service integration as a packaged Python CLI. The skill guides the project layout, API client, command-line interface, credential declarations, health check, and tests so the tool can be installed and used by agents.