path: root/docs/automation/terraform/terraformGoogle.md

---
lastproofread: '2026-03-23'
---

(terraformgoogle)=

# Deploy VyOS on Google Cloud with Terraform and Ansible

Using Terraform, you can quickly deploy VyOS-based infrastructure on
Google Cloud Platform (GCP) and remove the
infrastructure when it's no longer needed.
Additionally, you can use Ansible for provisioning.

On this page you'll learn how to:

- Create the necessary files for Terraform and Ansible.
- Use Terraform to create a single instance on GCP and use Ansible for
  provisioning.

## Prepare to deploy VyOS with Terraform on GCP

To create a single instance and install your configuration using
Terraform, Ansible, and GCP, follow these steps:

### GCP

1. Create an account with GCP and a new project.

```{image} /_static/images/project.webp
:align: center
:alt: Network Topology Diagram
:width: 50%
```

2. Create a service account and download your key (a JSON file).

```{image} /_static/images/service.webp
:align: center
:alt: Network Topology Diagram
:width: 50%
```

```{image} /_static/images/key.webp
:align: center
:alt: Network Topology Diagram
:width: 50%
```

The .JSON file downloads automatically after you create it and looks
like the following:

```{image} /_static/images/json.webp
:align: center
:alt: Network Topology Diagram
:width: 50%
```

### Terraform

1. Create an UNIX or Windows instance.

2. Download and install
   [Terraform](https://developer.hashicorp.com/terraform/install).

3. Create the folder. For example, `/root/google`.

```none
mkdir /root/google
```

4. Copy all files into your Terraform project `/root/google`
   (`vyos.tf`, `var.tf`, `terraform.tfvars`, `mykey.json`).
   For more details,
   see [Structure of files Terraform for Google Cloud](#structure-of-files-in-terraform-for-google-cloud)

<!-- -->

5. Run the following commands:

```none
cd /<your folder> 
terraform init
```

### Ansible

1. Create an UNIX instance either locally or in the cloud.

2. Download and install Ansible

3. Create the folder for example /root/google/

4. Copy all files into your Ansible project `/root/google/`
   (`ansible.cfg`, `instance.yml`, `mykey.json`, and `all`). For more
   details, see [Structure of files in Ansible for Google Cloud](#structure-of-files-in-ansible-for-google-cloud)

You obtain `mykey.json` when you create a service account in GCP
and download the key (a JSON file).

### Deploy with Terraform

Run the following commands on your Terraform instance:

```none
cd /<your folder>
terraform plan  
terraform apply  
yes
```

## Create a GCP instance and check its configuration

```none
# terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_compute_firewall.tcp_22[0] will be created
  + resource "google_compute_firewall" "tcp_22" {
      + creation_timestamp = (known after apply)
      + destination_ranges = (known after apply)
      + direction          = (known after apply)
      + enable_logging     = (known after apply)
      + id                 = (known after apply)
      + name               = "vyos-tcp-22"
      + network            = "default"
      + priority           = 1000
      + project            = "vyosproject"
      + self_link          = (known after apply)
      + source_ranges      = [
          + "0.0.0.0/0",
        ]
      + target_tags        = [
          + "vyos-deployment",
        ]

      + allow {
          + ports    = [
              + "22",
            ]
          + protocol = "tcp"
        }
    }

  # google_compute_firewall.udp_500_4500[0] will be created
  + resource "google_compute_firewall" "udp_500_4500" {
      + creation_timestamp = (known after apply)
      + destination_ranges = (known after apply)
      + direction          = (known after apply)
      + enable_logging     = (known after apply)
      + id                 = (known after apply)
     + name               = "vyos-udp-500-4500"
      + network            = "default"
      + priority           = 1000
      + project            = "vyosproject"
      + self_link          = (known after apply)
      + source_ranges      = [
         + "0.0.0.0/0",
        ]
      + target_tags        = [
          + "vyos-deployment",
        ]

      + allow {
          + ports    = [
              + "500",
              + "4500",
            ]
          + protocol = "udp"
        }
    }

  # google_compute_instance.default will be created
  + resource "google_compute_instance" "default" {
      + can_ip_forward       = true
      + cpu_platform         = (known after apply)
      + current_status       = (known after apply)
      + deletion_protection  = false
      + effective_labels     = (known after apply)
      + guest_accelerator    = (known after apply)
      + id                   = (known after apply)
      + instance_id          = (known after apply)
      + label_fingerprint    = (known after apply)
      + machine_type         = "n2-highcpu-4"
      + metadata             = {
          + "enable-oslogin"     = "FALSE"
          + "serial-port-enable" = "TRUE"
          + "user-data"          = ""
        }
      + metadata_fingerprint = (known after apply)
      + min_cpu_platform     = (known after apply)
      + name                 = "vyos"
      + project              = "vyosproject"
      + self_link            = (known after apply)
      + tags_fingerprint     = (known after apply)
      + terraform_labels     = (known after apply)
      + zone                 = "us-west1-a"

      + boot_disk {
          + auto_delete                = true
          + device_name                = (known after apply)
          + disk_encryption_key_sha256 = (known after apply)
          + kms_key_self_link          = (known after apply)
          + mode                       = "READ_WRITE"
          + source                     = (known after apply)

          + initialize_params {
              + image                  = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039"
              + labels                 = (known after apply)
              + provisioned_iops       = (known after apply)
              + provisioned_throughput = (known after apply)
              + size                   = (known after apply)
              + type                   = (known after apply)
            }
        }

      + network_interface {
          + internal_ipv6_prefix_length = (known after apply)
          + ipv6_access_type            = (known after apply)
          + ipv6_address                = (known after apply)
          + name                        = (known after apply)
          + network                     = "default"
          + network_ip                  = (known after apply)
          + nic_type                    = "GVNIC"
          + stack_type                  = (known after apply)
          + subnetwork                  = "default"
          + subnetwork_project          = (known after apply)

          + access_config {
              + nat_ip       = (known after apply)
              + network_tier = (known after apply)
            }
        }
    }

  # local_file.ip will be created
  + resource "local_file" "ip" {
      + content              = (known after apply)
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "ip.txt"
      + id                   = (known after apply)
    }

  # null_resource.SSHconnection1 will be created
  + resource "null_resource" "SSHconnection1" {
      + id = (known after apply)
    }

  # null_resource.SSHconnection2 will be created
  + resource "null_resource" "SSHconnection2" {
      + id = (known after apply)
    }

Plan: 6 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + public_ip_address = (known after apply)
╷
│ Warning: Quoted references are deprecated
│
│   on vyos.tf line 126, in resource "null_resource" "SSHconnection1":
│  126:   depends_on = ["google_compute_instance.default"]
│
│ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a
│ future version of Terraform. Remove the quotes surrounding this reference to silence this warning.
│
│ (and one more similar warning elsewhere)
╵

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

google_compute_firewall.udp_500_4500[0]: Creating...
google_compute_firewall.tcp_22[0]: Creating...
google_compute_instance.default: Creating...
google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed]
google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed]
google_compute_instance.default: Still creating... [10s elapsed]
google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-tcp-22]
google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-udp-500-4500]
google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/zones/us-west1-a/instances/vyos]
null_resource.SSHconnection1: Creating...
null_resource.SSHconnection2: Creating...
null_resource.SSHconnection1: Provisioning with 'file'...
null_resource.SSHconnection2: Provisioning with 'remote-exec'...
null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH...
null_resource.SSHconnection2 (remote-exec):   Host: 10.***.***.104
null_resource.SSHconnection2 (remote-exec):   User: root
null_resource.SSHconnection2 (remote-exec):   Password: true
null_resource.SSHconnection2 (remote-exec):   Private key: false
null_resource.SSHconnection2 (remote-exec):   Certificate: false
null_resource.SSHconnection2 (remote-exec):   SSH Agent: false
null_resource.SSHconnection2 (remote-exec):   Checking Host Key: false
null_resource.SSHconnection2 (remote-exec):   Target Platform: unix
local_file.ip: Creating...
local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca]
null_resource.SSHconnection2 (remote-exec): Connected!
null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161]

null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************

null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] **************
null_resource.SSHconnection2: Still creating... [10s elapsed]
null_resource.SSHconnection2: Still creating... [20s elapsed]
null_resource.SSHconnection2: Still creating... [30s elapsed]
null_resource.SSHconnection2: Still creating... [40s elapsed]
null_resource.SSHconnection2: Still creating... [50s elapsed]
null_resource.SSHconnection2: Still creating... [1m0s elapsed]
null_resource.SSHconnection2: Still creating... [1m10s elapsed]
null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158]

null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] *********************
null_resource.SSHconnection2: Still creating... [1m20s elapsed]
null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158]

null_resource.SSHconnection2 (remote-exec): PLAY RECAP *********************************************************************
null_resource.SSHconnection2 (remote-exec): 104.***.***.158            : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742]

Apply complete! Resources: 6 added, 0 changed, 0 destroyed.

Outputs:

public_ip_address = "104.***.***.158"
```

After running all the commands, your VyOS instance is deployed on
GCP with your specified configuration.
To delete the instance, type the following command:

```none
terraform destroy
```

## Troubleshooting

- Increase the timeout value in `instance.yml` from 300 seconds to
  500 seconds or more (depends on your location). Ensure that the
  security group allows access to the instance.
- If Terraform doesn't connect via SSH to your Ansible instance:
  Check the correct login and password in the `VyOS.tf` file.

```none
connection {
 type     = "ssh"
 user     = "root"              # open root access using login and password on your Ansible
 password = var.password        # check password in the file terraform.tfvars isn't empty
     host = var.host            # check the correct IP address of your Ansible host
}
```

Verify that Ansible can ping from Terraform.

## Structure of files in Terraform for Google Cloud

```none
.
├── vyos.tf                            # The main script
├── ***.JSON               # The credential file from GCP
├── var.tf                                     # The file of all variables in "vyos.tf"
└── terraform.tfvars           # The value of all variables (passwords, login, IP addresses and so on)
```

## File contents of Terraform for Google Cloud

`vyos.tf`

```none
##############################################################################
# Build a VyOS VM from the Marketplace
#
# After deploying the GCP instance and getting an IP address, the IP address is copied into the file
#"ip.txt" and copied to the Ansible node for provisioning.
##############################################################################

terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
    }
  }
}

provider "google" {
  project         = var.project_id
  request_timeout = "60s"
  credentials = file(var.gcp_auth_file)
}

locals {
  network_interfaces = [for i, n in var.networks : {
    network     = n,
    subnetwork  = length(var.sub_networks) > i ? element(var.sub_networks, i) : null
    external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE"
    }
  ]
}

resource "google_compute_instance" "default" {
  name         = var.goog_cm_deployment_name
  machine_type = var.machine_type
  zone         = var.zone

  metadata = {
    enable-oslogin     = "FALSE"
    serial-port-enable = "TRUE"
    user-data          = var.vyos_user_data
  }
  boot_disk {
    initialize_params {
      image = var.image
    }
  }

  can_ip_forward = true

  dynamic "network_interface" {
    for_each = local.network_interfaces
    content {
      network    = network_interface.value.network
      subnetwork = network_interface.value.subnetwork
      nic_type   = "GVNIC"
      dynamic "access_config" {
        for_each = network_interface.value.external_ip == "NONE" ? [] : [1]
        content {
          nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_interface.value.external_ip
        }
      }
    }
  }
}

resource "google_compute_firewall" "tcp_22" {
  count = var.enable_tcp_22 ? 1 : 0

  name    = "${var.goog_cm_deployment_name}-tcp-22"
  network = element(var.networks, 0)

  allow {
    ports    = ["22"]
    protocol = "tcp"
  }

  source_ranges = ["0.0.0.0/0"]

  target_tags = ["${var.goog_cm_deployment_name}-deployment"]
}

resource "google_compute_firewall" "udp_500_4500" {
  count = var.enable_udp_500_4500 ? 1 : 0

  name    = "${var.goog_cm_deployment_name}-udp-500-4500"
  network = element(var.networks, 0)

  allow {
    ports    = ["500", "4500"]
    protocol = "udp"
  }

  source_ranges = ["0.0.0.0/0"]

  target_tags = ["${var.goog_cm_deployment_name}-deployment"]
}

output "public_ip_address" {
  value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip
}

##############################################################################
#
# IP of google instance copied to a file ip.txt in local system Terraform
# ip.txt looks like:
# cat ./ip.txt
# ххх.ххх.ххх.ххх
##############################################################################

resource "local_file" "ip" {
    content  = google_compute_instance.default.network_interface[0].access_config[0].nat_ip
    filename = "ip.txt"
}

#connecting to the Ansible control node using SSH connection

##############################################################################
# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible.
##############################################################################

resource "null_resource" "SSHconnection1" {
depends_on = ["google_compute_instance.default"]
connection {
   type     = "ssh"
   user     = "root"
   password = var.password
   host     = var.host
}

#copying the ip.txt file to the Ansible control node from local system

 provisioner "file" {
    source      = "ip.txt"
    destination = "/root/google/ip.txt"                             # The folder of your Ansible project
       }
}

resource "null_resource" "SSHconnection2" {
depends_on = ["google_compute_instance.default"]
connection {
    type     = "ssh"
    user     = "root"
        password = var.password
    host     = var.host
}

#command to run Ansible playbook on remote Linux OS

provisioner "remote-exec" {
    inline = [
    "cd /root/google/",
    "ansible-playbook instance.yml"                               # more detailed in "File contents of Ansible for Google Cloud"
]
}
}
```

`var.tf`

```none
variable "image" {
  type    = string
  default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039"
}

variable "project_id" {
  type = string
}

variable "zone" {
  type = string
}

##############################################################################
# You can choose a lower cost machine type than n2-highcpu-4
##############################################################################

variable "machine_type" {
  type    = string
  default = "n2-highcpu-4"
}

variable "networks" {
  description = "The network name to attach the VM instance."
  type        = list(string)
  default     = ["default"]
}

variable "sub_networks" {
  description = "The sub network name to attach the VM instance."
  type        = list(string)
  default     = ["default"]
}

variable "external_ips" {
  description = "The external IPs assigned to the VM for public access."
  type        = list(string)
  default     = ["EPHEMERAL"]
}

variable "enable_tcp_22" {
  description = "Allow SSH traffic from the Internet"
  type        = bool
  default     = true
}

variable "enable_udp_500_4500" {
  description = "Allow IKE/IPSec traffic from the Internet"
  type        = bool
  default     = true
}

variable "vyos_user_data" {
  type    = string
  default = ""
}

// Marketplace requires this variable name to be declared
variable "goog_cm_deployment_name" {
  description = "VyOS Universal Router Deployment"
  type        = string
  default     = "vyos"
}

# GCP authentication file
variable "gcp_auth_file" {
  type        = string
  description = "GCP authentication file"
}

variable "password" {
   description = "pass for Ansible"
   type = string
   sensitive = true
}
variable "host"{
  description = "The IP of my Ansible"
  type = string
}
```

`terraform.tfvars`

```none
##############################################################################
# Must be filled in
##############################################################################

zone = "us-west1-a"
gcp_auth_file = "/root/***/***.json"   # path of your .json file
project_id    = ""                     # the google project
password      = ""                     # password for Ansible SSH
host          = ""                     # IP of my Ansible
```

## Structure of files in Ansible for Google Cloud

```none
.
├── group_vars
    └── all
├── ansible.cfg
└── instance.yml
```

## File contents of Ansible for Google Cloud

`ansible.cfg`

```none
[defaults]
inventory = /root/google/ip.txt
host_key_checking= False
remote_user=vyos
```

`instance.yml`

```none
##############################################################################
# About tasks:
# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds
# "Configure general settings for the VyOS hosts group" - make provisioning into Google Cloud VyOS node
# Add all necessary VyOS commands under the "lines:" block
##############################################################################


- name: integration of terraform and ansible
  hosts: all
  gather_facts: 'no'

  tasks:

    - name: "Wait 300 seconds, but only start checking after 60 seconds"
      wait_for_connection:
        delay: 60
        timeout: 300

    - name: "Configure general settings for the VyOS hosts group"
      vyos_config:
        lines:
          - set system name-server xxx.xxx.xxx.xxx
        save:
          true
```

`group_vars/all`

```none
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: vyos.vyos.vyos
ansible_user: vyos
ansible_ssh_pass: vyos
```


## Source files on GitHub

All files related to deploying VyOS on Google Cloud Platform with
Terraform and Ansible can be found in the [vyos-automation] repository.

[vyos-automation]: <https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Google_terraform_ansible_single_vyos_instance-main>