GCP Deployment with CLI
This guide provides the necessary technical steps to install the Google Cloud CLI, configure your project environment, and deploy BlueRock-hardened instances on Google Cloud Platform (GCP).
Prerequisites
Google Cloud CLI tools (
gcloud), for installation, refer to the official Google Cloud CLI installation guide.BlueRock images: BlueRock provides pre-packaged images for the BlueRock Ubuntu 2404 Linux Distribution; contact BlueRock support for the images.
Ubuntu 24.04
6.12.89
bluerock-release-26-23-1-ubuntu2404-6-12-89-2703260707
Provides full policy configuration control. Allow switching policy action from observe to enforce mode.
Procedure
To deploy the BlueRock-hardened instances on GCP with CLI following is the procedure:
Instance Deployment
Deploy the instance to provision the virtual hardware and Identity (Service Account) required for BlueRock. This command initializes a pre-configured environment with the security protocols needed to securely pull your configuration from GCP storage buckets.
Parameter (Flag)
Description
Example Value
--zone
Defines the specific physical data center location where the VM resides.
us-central1-a
--machine-type
Specifies the hardware configuration (CPU and RAM).
n1-standard-2
--image
The image name or OS template to install on the boot disk.
bluerock-release-26-08-0-ubuntu2404-6.12.89
--image-project
The Project ID where the specific image is stored (crucial for custom images in other projects).
project-1234
--scopes
Grants the VM permissions to interact with other GCP services (like Cloud Storage or Logging).
cloud-platform
--boot-disk-size
Sets the total storage capacity of the primary (OS) disk.
20GB
--boot-disk-type
Defines the performance tier of the disk (Standard, Balanced, or SSD).
pd-balanced
--tags
Metadata labels for the instance.
bluerock-instance
To validate the instance status:
To connect with the instance using SSH:
Note:
SSH may give some warnings and prompts to generate an SSH key for the first time. While generating SSH key leave the passphrase as empty by pressing Enter. It will automatically create the key and add the key permanently to the host.
Create a Storage Bucket
Ensure to create a GCP Storage Bucket to save the Configuration files and Policy files as the BlueRock Instance picks these files from a separate bucket using config.source file that contains this Bucket's URL/URI.
To create a bucket run the following command:
Bucket URL example: gs://bluerock-bucket/
Refer to the About Cloud Storage buckets guide to learn more about storage buckets in GCP.
BlueRock Instance Configuration
BlueRock instances have a configuration file bluerockd.toml to define telemetry and policy settings that resides at /etc/bluerock/.
Parameter
Type
Description
metrics_timer
Integer
How often (in seconds) the agent pushes its performance metrics (e.g., 1800 = 30 minutes).
state_dir
Path / String
The local directory path where the agent (bluerockd) stores its internal state data.
policy.public_key
GCS Path
The Cloud Storage bucket location of the public key used to validate the policy signature file (.pem format).
policy.poll_period
Integer
How often (in seconds) the agent checks the source location for a new policy version (e.g., 300 = 5 minutes).
policy.source.location
GCS Path
The base Google Cloud Storage bucket path where the policy-related files are hosted.
policy.source.policy
File Name
The specific JSON file name containing the agent's configuration rules.
policy.source.policy_sig
File Name
The digital signature file used to verify that the core policy JSON file hasn't been tampered with.
policy.source.transport.auth_method
String
The authentication strategy used to access files. Setting it to default utilizes the VM's attached Application Default Credentials (ADC).
policy.source.transport.region
String
The Google Cloud Platform (GCP) region where the storage resources are located (e.g., us-central1).
policy.engine.augment_events
Boolean
Determines whether the policy engine should enrich or add additional metadata/context to the captured events (true or false).
otlp.file
Path / String
The local file path where OpenTelemetry log events are written.
otlp.http.url
URL
The local or internal HTTP endpoint (usually an OTLP/HTTP receiver or collector) where telemetry data is forwarded.
After editing the bluerockd.toml restart the bluerockd.service .
OTEL Event Collection
Locate the OTEL config file:
Edit the
otel-config.yamlfile based on the requirements.Enable the otel service
Start the otel service
Check the status of the otel service
View Logs in GCP
To view logs in GCP:
Log in to your GCP account in a browser, navigate to Compute Engine > VM Instances.
Select the required instance.
Select Logging.

Last updated