Answers: <p>As per the <a href="https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#instance-only" rel="nofollow noreferrer">link</a>, You can add keys via metadata. You can try the following. </p>
  
  <pre><code>   metadata:
       ssh-keys: "[USERNAME]:ssh-rsa [NEW_KEY_VALUE] [USERNAME]"
  </code></pre>
  
  <p>Replace [USERNAME] &amp; [NEW_KEY_VALUE] with actual key value. </p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-21T08:38:41.790Z
Answers: I will try this today
Answers: Danylo Mysko
Answers: CC BY-SA 4.0
Answers: 2019-11-20T21:28:37.870Z
Answers: 2019-11-20T21:28:37.870Z
Answers: Vigneshwar
Answers: <p>use <code>ssh-keys</code> in metadata, e.g.:</p>
  <pre class="lang-yaml prettyprint-override"><code>    - name: Ensure instances
        google.cloud.gcp_compute_instance:
          name: &quot;{{ item.name }}&quot;
          machine_type: &quot;{{ item.machine_type }}&quot;
          disks:
            - auto_delete: true
              boot: true
              source: &quot;{{ disk }}&quot;
          network_interfaces:
            - network: &quot;{{ network }}&quot;
              subnetwork: &quot;{{ subnet }}&quot;
              access_configs:
              - name: External NAT
                nat_ip: &quot;{{ address }}&quot;
                type: ONE_TO_ONE_NAT
          zone: &quot;{{ item.zone }}&quot;
          metadata:
            ssh-keys: &quot;root:{{ lookup('file',  'you_id_rsa.pub') }}&quot;
          tags:
            items:
              - &quot;{{ gcp.project }}&quot;
          project: &quot;{{ gcp.project }}&quot;
          auth_kind: serviceaccount
          service_account_file: &quot;{{ gcp.service_account_file }}&quot;
          state: present
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-09T05:27:31.317Z
Answers: 2021-12-09T05:27:31.317Z
Answers: dylanninin
Body: <p>I create VM instance using ansible module <code>gcp_compute_instance</code>
  My code:</p>
  
  <pre><code>---
  - name: Create jenkins node-1
    hosts: localhost
    connection: local
    gather_facts: no
    vars:
      address: &lt;my ip&gt;
      project_id: geocitizen-app
      machine_type: f1-micro
      machine_name: jenkins-node-1
      image: https://www.googleapis.com/compute/v1/projects/centos-cloud/global/images/centos-7-v20191014
      zone: europe-north1-a
      service_email: log@project-app.iam.gserviceaccount.com
      startup_script_url: gs://project/startup.sh
      service_account_scope: https://www.googleapis.com/auth/devstorage.read_only
    tasks:
     - name: Launch instances
       gcp_compute_instance:
         auth_kind: serviceaccount
         name: "{{ machine_name }}"
         machine_type: "{{ machine_type }}"
         project: "{{ project_id }}"
         zone: "{{ zone }}"
         network_interfaces:
         - network:
           access_configs:
           - name: External NAT
             nat_ip: 
               address: "{{ node_1_ip }}"
             type: ONE_TO_ONE_NAT
         disks:
         - auto_delete: 'true'
           boot: 'true'
           initialize_params:
             source_image: "{{ image }}"
         tags:
           items:
           - jenkins-server
           - http-server
         service_accounts:
         - email: "{{ service_email }}"
           scopes: 
           - "{{ service_account_scope }}"
         metadata:
           startup-script-url: "{{ startup_script_url }}"
  </code></pre>
  
  <p>At this point I have startup-script. This script deploy my public key to newly created VM instance:</p>
  
  <pre><code>#! /bin/sh
  iniFile=/var/opt/inited.ini
  if test -f "$iniFile"; then
      exit 0
  else
      useradd ssh
      runuser -l ssh -c "mkdir -p ~/.ssh"
      runuser -l ssh -c "echo 'ssh-rsa &lt;my public key&gt;' &gt;&gt; ~/.ssh/authorized_keys"
      runuser -l ssh -c "chmod -R go= ~/.ssh"
      touch /var/opt/inited.ini
  fi
  </code></pre>
  
  <p>Can I add public key when I create VM without using startup script? I read
  <a href="https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys" rel="nofollow noreferrer">https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys</a> But i don't understand how I can use it in my playbook.</p>
  
Tags: <ansible><gcp><centos>
Title: How deploy public key to newly created VM on GCP?
UserDisplayName: Danylo Mysko
ThreadText: # How deploy public key to newly created VM on GCP?
  
  (Asked by: username_0 on 2019-11-20)
  
  I create VM instance using ansible module `gcp_compute_instance`
  My code:
  
  ```
  ---
  - name: Create jenkins node-1
    hosts: localhost
    connection: local
    gather_facts: no
    vars:
      address: <my ip>
      project_id: geocitizen-app
      machine_type: f1-micro
      machine_name: jenkins-node-1
      image: https://www.googleapis.com/compute/v1/projects/centos-cloud/global/images/centos-7-v20191014
      zone: europe-north1-a
      service_email: log@project-app.iam.gserviceaccount.com
      startup_script_url: gs://project/startup.sh
      service_account_scope: https://www.googleapis.com/auth/devstorage.read_only
    tasks:
     - name: Launch instances
       gcp_compute_instance:
         auth_kind: serviceaccount
         name: "{{ machine_name }}"
         machine_type: "{{ machine_type }}"
         project: "{{ project_id }}"
         zone: "{{ zone }}"
         network_interfaces:
         - network:
           access_configs:
           - name: External NAT
             nat_ip: 
               address: "{{ node_1_ip }}"
             type: ONE_TO_ONE_NAT
         disks:
         - auto_delete: 'true'
           boot: 'true'
           initialize_params:
             source_image: "{{ image }}"
         tags:
           items:
           - jenkins-server
           - http-server
         service_accounts:
         - email: "{{ service_email }}"
           scopes: 
           - "{{ service_account_scope }}"
         metadata:
           startup-script-url: "{{ startup_script_url }}"
  
  ```
  
  At this point I have startup-script. This script deploy my public key to newly created VM instance:
  
  ```
  #! /bin/sh
  iniFile=/var/opt/inited.ini
  if test -f "$iniFile"; then
      exit 0
  else
      useradd ssh
      runuser -l ssh -c "mkdir -p ~/.ssh"
      runuser -l ssh -c "echo 'ssh-rsa <my public key>' >> ~/.ssh/authorized_keys"
      runuser -l ssh -c "chmod -R go= ~/.ssh"
      touch /var/opt/inited.ini
  fi
  
  ```
  
  Can I add public key when I create VM without using startup script? I read
  <https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys> But i don't understand how I can use it in my playbook.
  
  **Tags:** ansible, gcp, centos
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-11-20. Score: 1 | Accepted answer
  
  As per the [link](https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#instance-only), You can add keys via metadata. You can try the following.
  
  ```
     metadata:
       ssh-keys: "[USERNAME]:ssh-rsa [NEW_KEY_VALUE] [USERNAME]"
  
  ```
  
  Replace [USERNAME] & [NEW\_KEY\_VALUE] with actual key value.
  
  > **Comments:**
  > **username_0**: I will try this today  
  
  ---
  
  ### Answer by username_2 on 2021-12-09. Score: 0
  
  use `ssh-keys` in metadata, e.g.:
  
  ```yaml
      - name: Ensure instances
        google.cloud.gcp_compute_instance:
          name: "{{ item.name }}"
          machine_type: "{{ item.machine_type }}"
          disks:
            - auto_delete: true
              boot: true
              source: "{{ disk }}"
          network_interfaces:
            - network: "{{ network }}"
              subnetwork: "{{ subnet }}"
              access_configs:
              - name: External NAT
                nat_ip: "{{ address }}"
                type: ONE_TO_ONE_NAT
          zone: "{{ item.zone }}"
          metadata:
            ssh-keys: "root:{{ lookup('file',  'you_id_rsa.pub') }}"
          tags:
            items:
              - "{{ gcp.project }}"
          project: "{{ gcp.project }}"
          auth_kind: serviceaccount
          service_account_file: "{{ gcp.service_account_file }}"
          state: present
  
  ```
  
  
  ---
  
  