Administrator password
Google Cloud Platform
Compute Engine instances and images in
Deploy Compute Engine VM
Image
Full self-link, projects/PROJECT/global/images/IMAGE, or projects/PROJECT/global/images/family/FAMILY.
SSH Key (from Secret Manager) — bound to this workstream
No SSH key configured.
Add a Secret Manager secret name in the wizard →Lowercase letters, numbers, and hyphens only. More than one deploys copies of the same image, numbered automatically, behind a shared Gateway.
External IP
Attach an ephemeral public IP address.
Asset group, Gateway and credential — the configured defaults unless changed
BeyondTrust PRA options — optional; fall back to the configured defaults.
No PRA Asset Groups/Gateways returned — the shell jump falls back to the configured defaults.
Overrides bt_client_secret for this deploy's shell jump.
Runs after deploy:
Advanced options — SSH key override, integrations, Windows identity
Bound to this workstream: — used when this is left at the default.
Any Secret Manager secret. Must be JSON with a public_key — validated on launch.
Requires Entitle registration enabled; private instances also need a provisioned Entitle agent.
Requires Password Safe registration enabled. Linux: onboards the image's adminuser account, SSH-key managed. Windows: the administrator is onboarded password-managed and rotated straight away.
After the deploy, a follow-up job onboards the server to Azure Arc over OpenSSH and installs AADLoginForWindows, so Entra users with Virtual Machine Administrator/User Login can RDP in. Needs Windows Server 2025 or later with Desktop Experience and outbound 443 to Azure. A server joins Entra ID or an AD domain, not both. Hybrid join: the server joins the on-prem domain picked above, into its synced OU, and Entra Connect brings it into Entra ID; a follow-up check watches for it.
Windows servers get a PRA Shell Jump over OpenSSH (port 22, PowerShell), switched on at first boot. Tick this for a Remote RDP jump as well. If OpenSSH does not come up, the server gets an RDP jump anyway and the job says why.
Overrides the configured GCE Gateway deploy key. Supplying one gives this VM its own paired Gateway instead of the shared host (BeyondTrust only).
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
Capture Custom Image
Creates a custom image from the boot disk of . The instance stays running.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
Bulk Deploy GCE Instances
images selected — one VM per image. To deploy several copies of a single image, use the Count field on the normal deploy form.
Lowercase letters, numbers and hyphens (RFC1035).
After the deploy, a follow-up job onboards the server to Azure Arc over OpenSSH and installs AADLoginForWindows, so Entra users with Virtual Machine Administrator/User Login can RDP in. Needs Windows Server 2025 or later with Desktop Experience and outbound 443 to Azure. A server joins Entra ID or an AD domain, not both. Hybrid join: the server joins the on-prem domain picked above, into its synced OU, and Entra Connect brings it into Entra ID; a follow-up check watches for it.
Windows servers get a PRA Shell Jump over OpenSSH (port 22, PowerShell), switched on at first boot. Tick this for a Remote RDP jump as well. If OpenSSH does not come up, the server gets an RDP jump anyway and the job says why.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
Build GCE Image with Packer
Provision a public GCE image with a shell script and register the result as a new custom image in your project. Runs as a tracked background job (typically 5–15 min).
Lowercase letters, digits, and hyphens only. A timestamp is appended automatically.
GCP image family (e.g. debian-12, rocky-linux-9, ubuntu-2204-lts-amd64) — resolves to the family's latest image across the standard public projects.
The exact name of an image in this project. Use this for an image you imported yourself — an imported image carries no family, so the family field can never name it.
Only when the image lives in a separate shared image project. Left blank, the build project is searched first, then the public image projects.
This provisioner bakes a VyOS network cell and refuses any other image. Pick Custom image and name your imported VyOS image — a public family builds Debian, and the script aborts on the missing /opt/vyatta tooling a minute in.
Shared-core types (e2-micro/small) are omitted — they throttle to a fraction of a vCPU and make image builds crawl.
SSD-backed disks make package installs much faster on the throwaway build VM.
Leave blank to use the source image's default size. Cannot be smaller than the image.
Shell script run on the build instance. Leave empty to build a base image with no provisioning.
Loaded from .
BeyondTrust provisioner options — used by the bt-ready scripts; ignored by other provisioners.
Storage pins the version you synced and doesn't need BeyondTrust reachable from the build — sync it first on the Storage page. Not available on local-filesystem storage.
EPM-L is installed at build; activation runs post-deploy via the EPM-L integration.
Environment variables — passed to the provisioner script.
Secret refs are resolved at build start and passed via Packer sensitive variables — never written to the generated or archived template.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
OT Demo Cell
Deploy a simulated plant cell — a Modbus PLC simulator (:502) + FUXA web HMI (:1881) from the Packer-baked ot-sim image — into the egress-less private subnet, with BeyondTrust access auto-wired: Web Jump → HMI, protocol tunnel → PLC port, plus the Shell Jump and optional Password Safe onboarding every GCE deploy gets. Bake the image first on the Build Image tab with provisioners/ot/ot-sim-debian.sh.
Deploy a cell
No ot-sim image yet — build one on the Build Image tab, or tick "show all".
The cell gets no external IP — access is PRA-brokered only, which is the point.
What the image you picked was baked with. The dashboard cannot read this off an image — both runtimes produce an ot-sim image — so it is your assertion, and it decides whether the cell's own platform endpoints can be brokered at all.
The cell itself
The cell simulates every PLC protocol at once — each gets its own PRA protocol tunnel, so access can be granted per vendor. It also runs those simulators on k3s, so the cell's own Kubernetes API can be brokered the same way: a recorded kubectl into the plant cluster, with no other route in. Protocols the image does not simulate (e.g. DNP3) stay available on the standalone tunnel card below.
BeyondTrust PRA placement — where the cell's jump items land; defaults are the configured gcp_bt_jump_group_name / gcp_jumpoint_name.
Pick the pair matching the cell's region. With a Gateway override the deploy skips the shared-gateway size check — the host behind that Gateway needs ≥2 GB RAM for the Web Jump.
The agent that brokers this access runs in the plant, on its own industrial-DMZ host deployed beside the cell — not in a cluster somewhere else. That host is the only machine here with a way out, and it gets two ports to one destination. Needs the Purdue zoning on (ot_purdue_firewall_enabled); the deploy refuses with the remedy if anything it depends on is missing.
No image with broker in its name yet — bake one with OT_ROLE=broker and name it e.g. ot-broker (see provisioners/ot/README.md), or tick "show all".
8 GB or more: the agent requests 1Gi on its own.
The gateway backing the Web Jump needs ≥2 GB RAM (gcp_jumpoint_machine_type e2-small minimum, e2-medium preferred — Settings → Integrations → Privileged Remote Access) — the deploy checks and refuses early with the remedy otherwise.
Cells
No OT cells yet.
Standalone OT Protocol Tunnel
A generic-TCP PRA protocol tunnel to any host the gateway can reach — for demoing against your own lab gear without deploying a cell.
Network Cell
Preview. The bake has not been run against a live VyOS image — that a Packer shell provisioner configures one at all, and that the baked account is reachable as deployed, are both unobserved. Read provisioners/net/README.md before you demo it.
Deploy a VyOS router/firewall from the Packer-baked vyos-cell image, with no external IP and no inbound rule — reached only through a Shell Jump on the Gateway. A firewall needs SSH and nothing else, so unlike the OT cell this provisions no Web Jump and no protocol tunnel. Bake the image first on the Build Image tab with provisioners/net/vyos-cell.sh.
Deploy a cell
No vyos image yet — import one into this project, then bake it on the Build Image tab with source Custom image (an imported image has no family, so the family field cannot name it), or tick "show all".
Your assertion about the image, not something the dashboard can read off it. The firewall tree moved in 1.4, so the commands you are about to type differ by train.
Where the demo's DROP rule lands. Must match the bake's VYOS_RULESET.
Cells
No network cells yet.
A cell is an ordinary GCE deploy row, so Destroy and the auto-delete timer on the Instances tab reap the whole thing — VM, Shell Jump and Password Safe registration.
Edit labels
Nothing removable — the labels on this selection are the dashboard's own.
Updated .
Queued for agent — this connection is reached through one, so the change lands when the job runs.
— view job
could not be updated:
—
already had it.
PRA access —
Creates a BeyondTrust PRA Shell Jump to this VM, so you reach it over SSH through the representative console. Blank fields use the configured defaults. Destroying the VM removes the jump.
This VM has Shell Jump . Re-apply replaces it with one built from the options below.
PRA is not configured (bt_api_host / bt_client_id / bt_client_secret). Set it on Settings — the dropdowns stay empty and the job will fail until then.
Resolved to a bt_client_secret override for this jump's provisioning.