Skip to content

docs: google cloud installation guides - agent blockers #69634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mmcallister wants to merge 3 commits into
base: master
Choose a base branch
from
+582 −32
Draft

docs: google cloud installation guides - agent blockers #69634

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02d8e67
docs: google cloud installation guides: agent blockers
mmcallister Aug 13, 2026
50c821a
corrects small region typos, hostname lookup replaced with the standa…
mmcallister Aug 14, 2026
920f30c
fix invalid GCP LB config and KMS doc inconsistencies
mmcallister Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/cspell.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -959,6 +959,7 @@
"rootfully",
"rootlessly",
"rpou",
"rrdatas",
"rtrzn",
"runbook",
"runbooks",
Expand Down
43 changes: 43 additions & 0 deletions docs/pages/installation/agents/gcp.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,13 @@ will run:

(!docs/pages/includes/provision-token/gcp-spec.mdx!)

<Admonition type="warning" title="Security best practices for allow rules">
Define allow rules as narrowly as possible. Avoid using wildcards for
`project_ids`, `service_accounts`, or `locations` in production. Each allow rule
should target a specific project, service account, and region combination to
minimize the blast radius if a VM is compromised.
</Admonition>

Run the following command to create the token:

```code
Expand All @@ -74,12 +81,34 @@ Add the following Kubernetes resource manifest, replacing values as indicated:
</TabItem>
</Tabs>

<Checkpoint>
Verify the token was created:

```code
$ tctl tokens ls --format=text
```

You should see your `gcp-token` listed with join method `gcp`.
</Checkpoint>

## Step 2/3. Install Teleport

Install Teleport on your GCP Linux VM.

(!docs/pages/includes/install-linux.mdx!)

To discover the service account attached to your GCP VM (useful for verifying
your token's allow rules), run the following on your workstation, replacing
`INSTANCE_NAME` and `ZONE` with your VM's instance name and zone (both are
visible in the GCP Console, or you can list them with `gcloud compute
instances list`):

```code
$ gcloud compute instances describe INSTANCE_NAME \
--zone=ZONE \
--format="value(serviceAccounts.email)"
```

## Step 3/3. Configure your services

The GCP join method can be used for Teleport processes running the SSH (`Node`), Proxy,
Expand Down Expand Up @@ -112,3 +141,17 @@ process should be run directly on a GCP VM.

1. Once you have started Teleport, confirm that your service is able to connect
to and join your cluster.

<Checkpoint>
Verify the node has joined the cluster by running this on a machine with `tsh` access:

```code
$ tsh ls
```

You should see your GCP VM listed as a node. If the node does not appear, check the Teleport logs on the VM:

```code
$ sudo journalctl -u teleport --no-pager -n 50 | grep -i "join\|error\|token"
```
</Checkpoint>
Loading
Loading