gcloud compute ssh: SSH Into a VM from CI
gcloud compute ssh connects to a VM over SSH, generating and propagating keys automatically.
Running a remote command on a VM from a pipeline is a one-liner with --command. IAP tunneling lets it work even when the instance has no public IP.
What it does
gcloud compute ssh resolves the instance, ensures an SSH key exists and is pushed to the project or instance metadata, then opens a session. With --command it runs a single command and exits with that command status.
Common usage
gcloud compute ssh runner-1 --zone=us-central1-a \
--command="sudo systemctl restart app"
# reach a VM with no external IP via IAP
gcloud compute ssh runner-1 --zone=us-central1-a \
--tunnel-through-iap --command="uptime"Flags
| Flag | What it does |
|---|---|
| --zone <zone> | Zone of the target instance |
| --command "<cmd>" | Run a single command and exit |
| --tunnel-through-iap | Connect via Identity-Aware Proxy (no public IP needed) |
| --ssh-key-file <file> | Use a specific SSH key |
| --strict-host-key-checking=no | Skip the host key prompt in automation |
In CI
Pass --tunnel-through-iap to reach private VMs without an external IP, and add --strict-host-key-checking=no so the first-connection host-key prompt does not block the job. The runner service account needs roles/iap.tunnelResourceAccessor for IAP.
Common errors in CI
"Permission denied (publickey)" means the key was not propagated yet; it can take a few seconds after first push, or OS Login is enabled and the account lacks roles/compute.osLogin. "ERROR: ... Could not fetch resource ... 4033: Not authorized" on IAP means the firewall does not allow the IAP range 35.235.240.0/20 or the account lacks the IAP tunnel role.