GCP Deployment with CLI

This guide provides the necessary technical steps to install the Google Cloud CLI, configure your project environment, and deploy BlueRock-hardened instances on Google Cloud Platform (GCP).

Prerequisites

• Google Cloud CLI tools (gcloud), for installation, refer to the official Google Cloud CLI installation guide.

• BlueRock images: BlueRock provides pre-packaged images for the BlueRock Ubuntu 2404 Linux Distribution; contact BlueRock support for the images.

OS	Kernel Version	GCP Image Name	Description
Ubuntu 24.04	6.12.89	bluerock-release-26-23-1-ubuntu2404-6-12-89-2703260707	Provides full policy configuration control. Allow switching policy action from observe to enforce mode.

Procedure

To deploy the BlueRock-hardened instances on GCP with CLI following is the procedure:

1. Instance Deployment

2. Create Storage Bucket

3. Instance Configuration

4. Updating Configuration Source

5. OTEL Event Collection

6. View Logs in GCP

Instance Deployment

Deploy the instance to provision the virtual hardware and Identity (Service Account) required for BlueRock. This command initializes a pre-configured environment with the security protocols needed to securely pull your configuration from GCP storage buckets.

gcloud compute instances create <instance-name> \
--zone us-central1-a \
--machine-type n1-standard-2 \
--image bluerock-release-26-08-0-ubuntu2404-6.12.89 \
--image-project <project-name> \
--boot-disk-size <insert-size-in-GB> \
--boot-disk-type <insert-disk-type> \
--tags <insert-tags>

Parameter (Flag)	Description	Example Value
--zone	Defines the specific physical data center location where the VM resides.	us-central1-a
--machine-type	Specifies the hardware configuration (CPU and RAM).	n1-standard-2
--image	The image name or OS template to install on the boot disk.	bluerock-release-26-08-0-ubuntu2404-6.12.89
--image-project	The Project ID where the specific image is stored (crucial for custom images in other projects).	project-1234
--scopes	Grants the VM permissions to interact with other GCP services (like Cloud Storage or Logging).	cloud-platform
--boot-disk-size	Sets the total storage capacity of the primary (OS) disk.	20GB
--boot-disk-type	Defines the performance tier of the disk (Standard, Balanced, or SSD).	pd-balanced
--tags	Metadata labels for the instance.	bluerock-instance

To validate the instance status:

$ gcloud compute instances describe <instance-name> --zone=us-central1-a --format="value(status)"

To connect with the instance using SSH:

$ gcloud compute ssh <instance-name> --zone=<zone-id>

Note:

SSH may give some warnings and prompts to generate an SSH key for the first time. While generating SSH key leave the passphrase as empty by pressing Enter. It will automatically create the key and add the key permanently to the host.

Create a Storage Bucket

Ensure to create a GCP Storage Bucket to save the Configuration files and Policy files as the BlueRock Instance picks these files from a separate bucket using config.source file that contains this Bucket's URL/URI.

To create a bucket run the following command:

$ gcloud storage buckets create gs://<your-bucket-name> --location=<insert-location>

Bucket URL example: gs://bluerock-bucket/

Refer to the About Cloud Storage buckets guide to learn more about storage buckets in GCP.

BlueRock Instance Configuration

BlueRock instances have a configuration file bluerockd.toml to define telemetry and policy settings that resides at /etc/bluerock/.

bluerockd.toml

[runtime]
metrics_timer = 1800
state_dir = "/var/lib/bluerockd/"

[policy]
public_key = "gs://<bucket-name>/<key>.pem"
poll_period = 300

[policy.source]
location   = "gs://<bucket-name>/"
policy     = "<policy>.json"
policy_sig = "<policy>.json.sig"

[policy.source.transport]
auth_method = "default"
region      = "us-central1"

[policy.engine]
augment_events  = true

[otlp]
file = "/var/log/bluerockd/otel-events.log"

[otlp.http]
url = "http://<internal_ip>:4318/"

Parameter	Type	Description
metrics_timer	Integer	How often (in seconds) the agent pushes its performance metrics (e.g., 1800 = 30 minutes).
state_dir	Path / String	The local directory path where the agent (bluerockd) stores its internal state data.
policy.public_key	GCS Path	The Cloud Storage bucket location of the public key used to validate the policy signature file (.pem format).
policy.poll_period	Integer	How often (in seconds) the agent checks the source location for a new policy version (e.g., 300 = 5 minutes).
policy.source.location	GCS Path	The base Google Cloud Storage bucket path where the policy-related files are hosted.
policy.source.policy	File Name	The specific JSON file name containing the agent's configuration rules.
policy.source.policy_sig	File Name	The digital signature file used to verify that the core policy JSON file hasn't been tampered with.
policy.source.transport.auth_method	String	The authentication strategy used to access files. Setting it to default utilizes the VM's attached Application Default Credentials (ADC).
policy.source.transport.region	String	The Google Cloud Platform (GCP) region where the storage resources are located (e.g., us-central1).
policy.engine.augment_events	Boolean	Determines whether the policy engine should enrich or add additional metadata/context to the captured events (true or false).
otlp.file	Path / String	The local file path where OpenTelemetry log events are written.
otlp.http.url	URL	The local or internal HTTP endpoint (usually an OTLP/HTTP receiver or collector) where telemetry data is forwarded.

After editing the bluerockd.toml restart the bluerockd.service .

$ sudo systemctl restart bluerockd.service

OTEL Event Collection

1. Locate the OTEL config file:

   $ cd /opt/bluerock/otel
   
   $ ls
   
   otel-config.yaml

2. Edit the otel-config.yaml file based on the requirements.

3. Enable the otel service

   $ sudo systemctl enable otelcol.service

4. Start the otel service

   $ sudo systemctl start otelcol.service

5. Check the status of the otel service

   $ sudo systemctl status otelcol.service --no-pager -l
   ● otelcol.service - OpenTelemetry Collector (Bluerock)
        Loaded: loaded (/etc/systemd/system/otelcol.service; enabled; preset: enabled)
        Active: active (running) since Fri 2026-07-03 03:15:22 UTC; 7h ago
          Docs: https://opentelemetry.io/docs/collector/
      Main PID: 3227 (aws-otel-collec)
         Tasks: 9 (limit: 18800)
        Memory: 19.9M (peak: 21.7M)
           CPU: 19.917s
        CGroup: /system.slice/otelcol.service
                └─3227 /opt/gcp/gcp-otel-collector/bin/aws-otel-collector --config=/opt/bluerock/otel/otel-config.yaml
   Jul 03 03:15:22 ip-172-31-29-175 run-otelcol.sh[3227]: 2026-07-03T03:15:22.324Z        debug        builders/builders.go:24        Stable component.        {"resource": {"service.instance.id": "27df2ba6-b766-4dc7-9b5b-c80a5956c45c", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "otlp", "otelcol.component.kind": "receiver", "otelcol.signal": "logs"}
   Jul 03 03:15:22 ip-172-31-29-175 run-otelcol.sh[3227]: 2026-07-03T03:15:22.324Z        debug        Logger core does not support injecting component attributes        {"resource": {"service.instance.id": "27df2ba6-b766-4dc7-9b5b-c80a5956c45c", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "otlp", "otelcol.component.kind": "receiver", "otelcol.signal": "logs"}

View Logs in GCP

To view logs in GCP:

1. Log in to your GCP account in a browser, navigate to Compute Engine > VM Instances.

2. Select the required instance.

3. Select Logging.