Yandex Cloud CLI

Yandex Cloud CLI

Quick Reference

## Installation (see references/installation.md for full guide)
curl -sSL https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash  # Linux/macOS
## Windows: iex (New-Object System.Net.WebClient).DownloadString('https://storage.yandexcloud.net/yandexcloud-yc/install.ps1')

## Initialize (interactive)
yc init              # Russia region
yc init --region=kz  # Kazakhstan region

## Authentication
## OAuth: https://oauth.yandex.ru/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb
yc config set token <oauth-token>
## Service account: yc config set service-account-key key.json

## Profile management
yc config profile list
yc config profile activate <name>
yc config profile create <name>
yc config list  # Show current config

## Common operations
yc compute instance list
yc compute instance get <id>
yc compute disk list
yc vpc network list
yc vpc security-group list

Region Endpoints

Command Structure

yc <service> <resource> <action> [flags]

Services: compute, vpc, iam, storage, managed-postgresql, managed-mysql, managed-mongodb, container-registry, certificate-manager, lockbox, dns, logging

Common flags:

• --profile <name> - Use specific profile
• --format yaml|json|table - Output format
• --async - Don't wait for completion
• --help - Command help

Core Operations

Compute (VMs)

## List/get VMs
yc compute instance list
yc compute instance get <id>
yc compute instance get --name <name>

## Create VM (Ubuntu 24.04)
yc compute instance create \
  --name my-vm \
  --zone kz1-a \
  --network-interface subnet-name=default-kz1-a,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2404-lts,size=20,type=network-ssd \
  --memory 4G \
  --cores 2 \
  --ssh-key ~/.ssh/id_ed25519.pub

## Control VM
yc compute instance start <id>
yc compute instance stop <id>
yc compute instance restart <id>
yc compute instance delete <id>

## Update resources (VM must be stopped)
yc compute instance update <id> --memory 8G --cores 4

Disks

yc compute disk list
yc compute disk create --name data --zone kz1-a --size 50 --type network-ssd
yc compute disk resize <id> --size 100  # No downtime

## Disk types: network-hdd, network-ssd, network-ssd-io-m3, network-ssd-nonreplicated

Networking (VPC)

## Networks
yc vpc network list
yc vpc network create --name my-network

## Subnets
yc vpc subnet list
yc vpc subnet create --name my-subnet --zone kz1-a --network-name my-network --range 10.1.0.0/24

## Security groups
yc vpc security-group list
yc vpc security-group get <id>
yc vpc security-group create \
  --name web-sg \
  --network-id <network-id> \
  --rule "direction=ingress,port=22,protocol=tcp,v4-cidrs=[0.0.0.0/0]" \
  --rule "direction=ingress,port=80,protocol=tcp,v4-cidrs=[0.0.0.0/0]" \
  --rule "direction=ingress,port=443,protocol=tcp,v4-cidrs=[0.0.0.0/0]" \
  --rule "direction=egress,protocol=any,v4-cidrs=[0.0.0.0/0]"

## Add rule to existing group
yc vpc security-group update-rules <id> \
  --add-rule "direction=ingress,port=3000,protocol=tcp,v4-cidrs=[0.0.0.0/0]"

Profile Configuration

## Create and configure profile
yc config profile create russia
yc config profile activate russia
yc config set endpoint api.cloud.yandex.net:443
yc config set token <oauth-token>

## Get OAuth token: https://oauth.yandex.ru/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb

## Set cloud and folder
yc resource-manager cloud list
yc config set cloud-id <id>
yc resource-manager folder list
yc config set folder-id <id>

## Run command with different profile (no switch)
yc compute instance list --profile turbocode-kz

Image Families

## Search images
yc compute image list --folder-id standard-images | grep ubuntu

SSH Access

## Default user is yc-user
ssh yc-user@<EXTERNAL_IP>
ssh -i ~/.ssh/id_ed25519 yc-user@<EXTERNAL_IP>

IAM & Service Accounts

## Create service account
yc iam service-account create --name my-robot

## Create API key
yc iam api-key create --service-account-name my-robot

## Create authorized key (for IAM tokens)
yc iam key create --service-account-name my-robot --output key.json

## Create static access key (for S3)
yc iam access-key create --service-account-name my-robot

## Assign role to folder
yc resource-manager folder add-access-binding <folder-id> \
  --role editor \
  --service-account-name my-robot

Object Storage (S3)

## Yandex CLI - Bucket operations
yc storage bucket list
yc storage bucket get <name> --full
yc storage bucket update <name> --public-read

## AWS CLI - Setup (use ru-central1 region)
aws configure
## Always add: --endpoint-url=https://storage.yandexcloud.net

## AWS CLI - Object operations
aws --endpoint-url=https://storage.yandexcloud.net \
  s3 cp file.txt s3://bucket-name/
aws --endpoint-url=https://storage.yandexcloud.net \
  s3 ls --recursive s3://bucket-name

Container Registry & Kubernetes

## Container Registry
yc container registry list
yc container registry create --name my-registry
yc container registry configure-docker  # Auth helper

## Push image
docker tag my-app cr.yandex/<registry-id>/my-app:latest
docker push cr.yandex/<registry-id>/my-app:latest

## Kubernetes Cluster
yc managed-kubernetes cluster list
yc managed-kubernetes cluster create \
  --name my-cluster \
  --network-name default \
  --zone kz1-a \
  --service-account-name k8s-cluster \
  --node-service-account-name k8s-nodes

## Node group
yc managed-kubernetes node-group create \
  --cluster-name my-cluster \
  --name worker-nodes \
  --fixed-size 3

Managed Databases

## PostgreSQL
yc managed-postgresql cluster list
yc managed-postgresql cluster create \
  --name pg-cluster \
  --environment production \
  --network-name default \
  --resource-preset s2.micro \
  --disk-size 10 \
  --disk-type network-ssd \
  --postgresql-version 15

## MySQL
yc managed-mysql cluster create --name mysql-cluster

## MongoDB
yc managed-mongodb cluster create --name mongo-cluster

## Backups
yc managed-postgresql backup list
yc managed-postgresql cluster restore --backup-id <id>

Snapshots

## Create snapshot from disk
yc compute snapshot create --name backup-$(date +%Y%m%d) --disk-id <disk-id>

## List snapshots
yc compute snapshot list

## Create VM from snapshot
yc compute instance create \
  --name restored-vm \
  --boot-disk snapshot-id=<snapshot-id>,size=50

Security Services

## Lockbox (Secrets)
yc lockbox secret create --name db-password --payload '[{"key":"password","text_value":"secret123"}]'
yc lockbox payload get --name db-password --key password

## Certificate Manager
yc certificate-manager certificate list
yc certificate-manager certificate request \
  --name my-cert \
  --domains example.com,www.example.com

DNS

## Create DNS zone
yc dns zone create --name my-zone --zone example.com. --public-visibility

## Add A record
yc dns zone add-records my-zone --record "@ 300 A 1.2.3.4"

## Add CNAME record
yc dns zone add-records my-zone --record "www 300 CNAME example.com."

Load Balancers

## Network Load Balancer (Layer 4)
yc load-balancer network-load-balancer create \
  --name my-nlb \
  --listener name=http,port=80,target-port=8080,external-ip-version=ipv4

## Application Load Balancer (Layer 7)
yc application-load-balancer load-balancer create \
  --name my-alb \
  --network-name default

Detailed References

• references/installation.md - Installation, setup, authentication (all OS)
• references/compute.md - VM operations, platforms, disk types
• references/vpc.md - Networking, security group rules
• references/profiles.md - Multi-region profile setup
• references/iam.md - Service accounts, keys, roles, CI/CD
• references/storage.md - Object Storage, S3 API, lifecycle
• references/containers.md - Container Registry, Kubernetes
• references/databases.md - PostgreSQL, MySQL, MongoDB, snapshots
• references/security.md - Lockbox secrets, Certificate Manager
• references/dns-lb.md - DNS zones, Load Balancers