> For the complete documentation index, see [llms.txt](https://docs.bluerock.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bluerock.io/deployment-guides/gcp-deployments/gcp-deployment-with-cli.md).

# GCP Deployment with CLI

This guide provides the necessary technical steps to install the Google Cloud CLI, configure your project environment, and deploy BlueRock-hardened instances on Google Cloud Platform (GCP).

### Prerequisites

* Google Cloud CLI tools (`gcloud`), for installation, refer to the official [Google Cloud CLI installation](https://docs.cloud.google.com/sdk/docs/install-sdk) guide.
* BlueRock images: BlueRock provides pre-packaged images for the BlueRock Ubuntu 2404 Linux Distribution; contact [BlueRock support](https://www.bluerock.io/contact) for the images. 

<table><thead><tr><th width="132.58984375">OS</th><th width="101.7109375">Kernel Version</th><th width="201.23828125">GCP Image Name</th><th>Description</th></tr></thead><tbody><tr><td>Ubuntu 24.04</td><td>6.12.89</td><td>bluerock-release-26-23-1-ubuntu2404-6-12-89-2703260707</td><td>Provides full policy configuration control. Allow switching policy action from observe to enforce mode.</td></tr></tbody></table>

### Procedure

To deploy the BlueRock-hardened instances on GCP with CLI following is the procedure:

1. [Instance Deployment](#instance-deployment)
2. [Create Storage Bucket](#create-a-storage-bucket)
3. [Instance Configuration](#bluerock-instance-configuration)
4. [Updating Configuration Source](#updating-configuration-source)
5. [OTEL Event Collection](#otel-event-collection)
6. [View Logs in GCP](#view-logs-in-gcp)

### Instance Deployment

Deploy the instance to provision the virtual hardware and Identity (Service Account) required for BlueRock. This command initializes a pre-configured environment with the security protocols needed to securely pull your configuration from GCP storage buckets.

```shell
gcloud compute instances create <instance-name> \
--zone us-central1-a \
--machine-type n1-standard-2 \
--image bluerock-release-26-08-0-ubuntu2404-6.12.89 \
--image-project <project-name> \
--boot-disk-size <insert-size-in-GB> \
--boot-disk-type <insert-disk-type> \
--tags <insert-tags>
```

<table data-header-hidden data-search="false"><thead><tr><th width="190.9296875"></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Parameter (Flag)</strong></td><td><strong>Description</strong></td><td><strong>Example Value</strong></td></tr><tr><td><code>--zone</code></td><td>Defines the specific physical data center location where the VM resides.</td><td><code>us-central1-a</code></td></tr><tr><td><code>--machine-type</code></td><td>Specifies the hardware configuration (CPU and RAM). </td><td><code>n1-standard-2</code></td></tr><tr><td><code>--image</code></td><td>The image name or OS template to install on the boot disk.</td><td><code>bluerock-release-26-08-0-ubuntu2404-6.12.89</code></td></tr><tr><td><code>--image-project</code></td><td>The Project ID where the specific image is stored (crucial for custom images in other projects).</td><td><code>project-1234</code></td></tr><tr><td><code>--scopes</code></td><td>Grants the VM permissions to interact with other GCP services (like Cloud Storage or Logging).</td><td><code>cloud-platform</code></td></tr><tr><td><code>--boot-disk-size</code></td><td>Sets the total storage capacity of the primary (OS) disk.</td><td><code>20GB</code></td></tr><tr><td><code>--boot-disk-type</code></td><td>Defines the performance tier of the disk (Standard, Balanced, or SSD).</td><td><code>pd-balanced</code></td></tr><tr><td><code>--tags</code></td><td>Metadata labels for the instance.</td><td><code>bluerock-instance</code></td></tr></tbody></table>

To validate the instance status:&#x20;

```sh
$ gcloud compute instances describe <instance-name> --zone=us-central1-a --format="value(status)"
```

To connect with the instance using **SSH:**

```shell
$ gcloud compute ssh <instance-name> --zone=<zone-id>
```

> **Note**:
>
> SSH may give some warnings and prompts to generate an SSH key for the first time. While generating SSH key leave the passphrase as empty by pressing Enter. It will automatically create the key and add the key permanently to the host.

### Create a Storage Bucket

Ensure to create a GCP Storage Bucket to save the Configuration files and Policy files as the BlueRock Instance picks these files from a separate bucket using `config.source` file that contains this Bucket's URL/URI.

To create a bucket run the following command:

{% code overflow="wrap" %}

```shell
$ gcloud storage buckets create gs://<your-bucket-name> --location=<insert-location>
```

{% endcode %}

Bucket URL example: `gs://bluerock-bucket/`&#x20;

Refer to the [About Cloud Storage buckets](https://docs.cloud.google.com/storage/docs/buckets) guide to learn more about storage buckets in GCP.

### BlueRock Instance Configuration

BlueRock instances have a configuration file `bluerockd.toml` to define telemetry and policy settings that resides at `/etc/bluerock/`.&#x20;

{% code title="bluerockd.toml" overflow="wrap" lineNumbers="true" %}

```toml
[runtime]
metrics_timer = 1800
state_dir = "/var/lib/bluerockd/"

[policy]
public_key = "gs://<bucket-name>/<key>.pem"
poll_period = 300

[policy.source]
location   = "gs://<bucket-name>/"
policy     = "<policy>.json"
policy_sig = "<policy>.json.sig"

[policy.source.transport]
auth_method = "default"
region      = "us-central1"

[policy.engine]
augment_events  = true

[otlp]
file = "/var/log/bluerockd/otel-events.log"

[otlp.http]
url = "http://<internal_ip>:4318/"
```

{% endcode %}

<table data-header-hidden data-search="false"><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Parameter</strong></td><td><strong>Type</strong></td><td><strong>Description</strong></td></tr><tr><td><code>metrics_timer</code></td><td>Integer</td><td>How often (in seconds) the agent pushes its performance metrics (e.g., <code>1800</code> = 30 minutes).</td></tr><tr><td><code>state_dir</code></td><td>Path / String</td><td>The local directory path where the agent (<code>bluerockd</code>) stores its internal state data.</td></tr><tr><td><code>policy.public_key</code></td><td>GCS Path</td><td>The Cloud Storage bucket location of the public key used to validate the policy signature file (<code>.pem</code> format).</td></tr><tr><td><code>policy.poll_period</code></td><td>Integer</td><td>How often (in seconds) the agent checks the source location for a new policy version (e.g., <code>300</code> = 5 minutes).</td></tr><tr><td><code>policy.source.location</code></td><td>GCS Path</td><td>The base Google Cloud Storage bucket path where the policy-related files are hosted.</td></tr><tr><td><code>policy.source.policy</code></td><td>File Name</td><td>The specific JSON file name containing the agent's configuration rules.</td></tr><tr><td><code>policy.source.policy_sig</code></td><td>File Name</td><td>The digital signature file used to verify that the core policy JSON file hasn't been tampered with.</td></tr><tr><td><code>policy.source.transport.auth_method</code></td><td>String</td><td>The authentication strategy used to access files. Setting it to <code>default</code> utilizes the VM's attached Application Default Credentials (ADC).</td></tr><tr><td><code>policy.source.transport.region</code></td><td>String</td><td>The Google Cloud Platform (GCP) region where the storage resources are located (e.g., <code>us-central1</code>).</td></tr><tr><td><code>policy.engine.augment_events</code></td><td>Boolean</td><td>Determines whether the policy engine should enrich or add additional metadata/context to the captured events (<code>true</code> or <code>false</code>).</td></tr><tr><td><code>otlp.file</code></td><td>Path / String</td><td>The local file path where OpenTelemetry log events are written.</td></tr><tr><td><code>otlp.http.url</code></td><td>URL</td><td>The local or internal HTTP endpoint (usually an OTLP/HTTP receiver or collector) where telemetry data is forwarded.</td></tr></tbody></table>

After editing the `bluerockd.toml`  restart the `bluerockd.service` .

```shellscript
$ sudo systemctl restart bluerockd.service
```

### OTEL Event Collection

1. Locate the OTEL config file:

   ```shellscript
   $ cd /opt/bluerock/otel

   $ ls

   otel-config.yaml
   ```
2. Edit the `otel-config.yaml` file based on the requirements.
3. Enable the otel service

   ```shellscript
   $ sudo systemctl enable otelcol.service
   ```
4. Start the otel service

   ```shellscript
   $ sudo systemctl start otelcol.service
   ```
5. Check the status of the otel service

   ```shell
   $ sudo systemctl status otelcol.service --no-pager -l
   ● otelcol.service - OpenTelemetry Collector (Bluerock)
        Loaded: loaded (/etc/systemd/system/otelcol.service; enabled; preset: enabled)
        Active: active (running) since Fri 2026-07-03 03:15:22 UTC; 7h ago
          Docs: https://opentelemetry.io/docs/collector/
      Main PID: 3227 (aws-otel-collec)
         Tasks: 9 (limit: 18800)
        Memory: 19.9M (peak: 21.7M)
           CPU: 19.917s
        CGroup: /system.slice/otelcol.service
                └─3227 /opt/gcp/gcp-otel-collector/bin/aws-otel-collector --config=/opt/bluerock/otel/otel-config.yaml
   Jul 03 03:15:22 ip-172-31-29-175 run-otelcol.sh[3227]: 2026-07-03T03:15:22.324Z        debug        builders/builders.go:24        Stable component.        {"resource": {"service.instance.id": "27df2ba6-b766-4dc7-9b5b-c80a5956c45c", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "otlp", "otelcol.component.kind": "receiver", "otelcol.signal": "logs"}
   Jul 03 03:15:22 ip-172-31-29-175 run-otelcol.sh[3227]: 2026-07-03T03:15:22.324Z        debug        Logger core does not support injecting component attributes        {"resource": {"service.instance.id": "27df2ba6-b766-4dc7-9b5b-c80a5956c45c", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "otlp", "otelcol.component.kind": "receiver", "otelcol.signal": "logs"}
   ```

### View Logs in GCP

To view logs in GCP:

1. Log in to your GCP account in a browser, navigate to **Compute Engine** > **VM Instances**.
2. Select the required instance.
3. Select **Logging**.<br>

   <figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2FMpsSqONwRrAWz3H0CrvK%2FLogs-Explorer-GCP.png?alt=media&amp;token=07de3952-1841-40c1-9532-a5557c3b6adc" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bluerock.io/deployment-guides/gcp-deployments/gcp-deployment-with-cli.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.