<p>As per the <a href="https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#instance-only" rel="nofollow noreferrer">link</a>, You can add keys via metadata. You can try the following. </p>

<pre><code>   metadata:
     ssh-keys: "[USERNAME]:ssh-rsa [NEW_KEY_VALUE] [USERNAME]"
</code></pre>

<p>Replace [USERNAME] &amp; [NEW_KEY_VALUE] with actual key value. </p>

CC BY-SA 4.0
2019-11-21T08:38:41.790Z
I will try this today
Danylo Mysko
CC BY-SA 4.0
2019-11-20T21:28:37.870Z
2019-11-20T21:28:37.870Z
Vigneshwar
<p>use <code>ssh-keys</code> in metadata, e.g.:</p>
<pre class="lang-yaml prettyprint-override"><code>    - name: Ensure instances
      google.cloud.gcp_compute_instance:
        name: &quot;{{ item.name }}&quot;
        machine_type: &quot;{{ item.machine_type }}&quot;
        disks:
          - auto_delete: true
            boot: true
            source: &quot;{{ disk }}&quot;
        network_interfaces:
          - network: &quot;{{ network }}&quot;
            subnetwork: &quot;{{ subnet }}&quot;
            access_configs:
            - name: External NAT
              nat_ip: &quot;{{ address }}&quot;
              type: ONE_TO_ONE_NAT
        zone: &quot;{{ item.zone }}&quot;
        metadata:
          ssh-keys: &quot;root:{{ lookup('file',  'you_id_rsa.pub') }}&quot;
        tags:
          items:
            - &quot;{{ gcp.project }}&quot;
        project: &quot;{{ gcp.project }}&quot;
        auth_kind: serviceaccount
        service_account_file: &quot;{{ gcp.service_account_file }}&quot;
        state: present
</code></pre>

CC BY-SA 4.0
2021-12-09T05:27:31.317Z
2021-12-09T05:27:31.317Z
dylanninin
<p>I create VM instance using ansible module <code>gcp_compute_instance</code>
My code:</p>

<pre><code>---
- name: Create jenkins node-1
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    address: &lt;my ip&gt;
    project_id: geocitizen-app
    machine_type: f1-micro
    machine_name: jenkins-node-1
    image: https://www.googleapis.com/compute/v1/projects/centos-cloud/global/images/centos-7-v20191014
    zone: europe-north1-a
    service_email: log@project-app.iam.gserviceaccount.com
    startup_script_url: gs://project/startup.sh
    service_account_scope: https://www.googleapis.com/auth/devstorage.read_only
  tasks:
   - name: Launch instances
     gcp_compute_instance:
       auth_kind: serviceaccount
       name: "{{ machine_name }}"
       machine_type: "{{ machine_type }}"
       project: "{{ project_id }}"
       zone: "{{ zone }}"
       network_interfaces:
       - network:
         access_configs:
         - name: External NAT
           nat_ip: 
             address: "{{ node_1_ip }}"
           type: ONE_TO_ONE_NAT
       disks:
       - auto_delete: 'true'
         boot: 'true'
         initialize_params:
           source_image: "{{ image }}"
       tags:
         items:
         - jenkins-server
         - http-server
       service_accounts:
       - email: "{{ service_email }}"
         scopes: 
         - "{{ service_account_scope }}"
       metadata:
         startup-script-url: "{{ startup_script_url }}"
</code></pre>

<p>At this point I have startup-script. This script deploy my public key to newly created VM instance:</p>

<pre><code>#! /bin/sh
iniFile=/var/opt/inited.ini
if test -f "$iniFile"; then
    exit 0
else
    useradd ssh
    runuser -l ssh -c "mkdir -p ~/.ssh"
    runuser -l ssh -c "echo 'ssh-rsa &lt;my public key&gt;' &gt;&gt; ~/.ssh/authorized_keys"
    runuser -l ssh -c "chmod -R go= ~/.ssh"
    touch /var/opt/inited.ini
fi
</code></pre>

<p>Can I add public key when I create VM without using startup script? I read
<a href="https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys" rel="nofollow noreferrer">https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys</a> But i don't understand how I can use it in my playbook.</p>

<ansible><gcp><centos>
How deploy public key to newly created VM on GCP?
Danylo Mysko
# How deploy public key to newly created VM on GCP?

(Asked by: username_0 on 2019-11-20)

I create VM instance using ansible module gcp_compute_instance
My code:
---
- name: Create jenkins node-1
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    address: 
    project_id: geocitizen-app
    machine_type: f1-micro
    machine_name: jenkins-node-1
    image: https://www.googleapis.com/compute/v1/projects/centos-cloud/global/images/centos-7-v20191014
    zone: europe-north1-a
    service_email: log@project-app.iam.gserviceaccount.com
    startup_script_url: gs://project/startup.sh
    service_account_scope: https://www.googleapis.com/auth/devstorage.read_only
  tasks:
   - name: Launch instances
     gcp_compute_instance:
       auth_kind: serviceaccount
       name: "{{ machine_name }}"
       machine_type: "{{ machine_type }}"
       project: "{{ project_id }}"
       zone: "{{ zone }}"
       network_interfaces:
       - network:
         access_configs:
         - name: External NAT
           nat_ip: 
             address: "{{ node_1_ip }}"
           type: ONE_TO_ONE_NAT
       disks:
       - auto_delete: 'true'
         boot: 'true'
         initialize_params:
           source_image: "{{ image }}"
       tags:
         items:
         - jenkins-server
         - http-server
       service_accounts:
       - email: "{{ service_email }}"
         scopes: 
         - "{{ service_account_scope }}"
       metadata:
         startup-script-url: "{{ startup_script_url }}"

At this point I have startup-script. This script deploy my public key to newly created VM instance:
#! /bin/sh
iniFile=/var/opt/inited.ini
if test -f "$iniFile"; then
    exit 0
else
    useradd ssh
    runuser -l ssh -c "mkdir -p ~/.ssh"
    runuser -l ssh -c "echo 'ssh-rsa ' >> ~/.ssh/authorized_keys"
    runuser -l ssh -c "chmod -R go= ~/.ssh"
    touch /var/opt/inited.ini
fi

Can I add public key when I create VM without using startup script? I read
https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys But i don't understand how I can use it in my playbook.

**Tags:** ansible, gcp, centos


---

## 2 answers

### Answer by username_1 on 2019-11-20. Score: 1 | Accepted answer

As per the link, You can add keys via metadata. You can try the following. 
   metadata:
     ssh-keys: "[USERNAME]:ssh-rsa [NEW_KEY_VALUE] [USERNAME]"

Replace [USERNAME] & [NEW_KEY_VALUE] with actual key value.

> **Comments:**
> **username_0**: I will try this today  

---

### Answer by username_2 on 2021-12-09. Score: 0

use ssh-keys in metadata, e.g.:
    - name: Ensure instances
      google.cloud.gcp_compute_instance:
        name: "{{ item.name }}"
        machine_type: "{{ item.machine_type }}"
        disks:
          - auto_delete: true
            boot: true
            source: "{{ disk }}"
        network_interfaces:
          - network: "{{ network }}"
            subnetwork: "{{ subnet }}"
            access_configs:
            - name: External NAT
              nat_ip: "{{ address }}"
              type: ONE_TO_ONE_NAT
        zone: "{{ item.zone }}"
        metadata:
          ssh-keys: "root:{{ lookup('file',  'you_id_rsa.pub') }}"
        tags:
          items:
            - "{{ gcp.project }}"
        project: "{{ gcp.project }}"
        auth_kind: serviceaccount
        service_account_file: "{{ gcp.service_account_file }}"
        state: present


---

