docs: google cloud enrollment guides - agent blockers - #69628
docs: google cloud enrollment guides - agent blockers#69628mmcallister wants to merge 3 commits into
Conversation
mmcallister
added
documentation
no-changelog
GitHub Actions
Inactive
|
Amplify deployment status
Preview links for changed docs pages
|
GitHub Actions
Inactive
GitHub Actions
Inactive
mmcallister
changed the title
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ceb67f2be
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ```code | ||
| $ gcloud sql instances patch <Var name="instance-name" /> \ | ||
| --database-flags=cloudsql_iam_authentication=on |
There was a problem hiding this comment.
When the Cloud SQL instance already has database flags configured, this invocation replaces the entire flag set with only cloudsql_iam_authentication, potentially resetting security or operational settings and restarting a production instance. Google’s Cloud SQL documentation warns that --database-flags overwrites previously set flags, so instruct readers to retrieve and include every existing flag in this command.
AGENTS.md reference: docs/AGENTS.md:L92-L96
Useful? React with 👍 / 👎.
| When running on a GCE instance, attach the `teleport-db-service` service account directly to the instance instead of using service account keys. This avoids managing key files: | ||
|
|
||
| ```code | ||
| $ gcloud compute instances set-service-account <Var name="gce-instance-name" /> \ |
There was a problem hiding this comment.
On the existing, running GCE host described by the prerequisites, Compute Engine rejects this command because changing a VM's service account or access scopes requires the VM to be stopped. Google's service-account change procedure explicitly requires stopping the VM first; add the corresponding stop and restart commands so this required credential step can complete.
AGENTS.md reference: docs/AGENTS.md:L92-L96
Useful? React with 👍 / 👎.
|
|
||
| ```code | ||
| $ gcloud sql instances patch <Var name="instance-name" /> \ | ||
| --database-flags=cloudsql.iam_authentication=on |
There was a problem hiding this comment.
For a Cloud SQL instance with any existing database flags, this command replaces the complete flag set with only cloudsql.iam_authentication, potentially clearing production security or tuning settings and forcing a restart. Google’s Cloud SQL documentation warns that --database-flags overwrites previously set flags, so the guide must tell readers to retrieve and include all current flags.
AGENTS.md reference: docs/AGENTS.md:L92-L96
Useful? React with 👍 / 👎.
| account directly to the instance instead of using service account keys: | ||
|
|
||
| ```code | ||
| $ gcloud compute instances set-service-account <Var name="gce-instance-name" /> \ |
There was a problem hiding this comment.
When readers run this on the existing GCE Database Service host, the VM is normally running and Compute Engine rejects the service-account change. Google's documented procedure requires stopping the VM before changing its service account or scopes, so include stop and restart commands around this invocation.
AGENTS.md reference: docs/AGENTS.md:L92-L96
Useful? React with 👍 / 👎.
| When running on a GCE instance, we recommend attaching the `teleport-db-service` service account directly to the instance. This avoids creating and managing service account keys: | ||
|
|
||
| ```code | ||
| $ gcloud compute instances set-service-account <Var name="gce-instance-name" /> \ |
There was a problem hiding this comment.
On the running GCE host this section targets, set-service-account is rejected because Compute Engine requires the VM to be stopped before its service account or access scopes can be changed. Follow Google's service-account change procedure by adding stop and restart commands; otherwise readers cannot complete the recommended credential setup.
AGENTS.md reference: docs/AGENTS.md:L92-L96
Useful? React with 👍 / 👎.
1 participant
Summary
Fixes for guide-following medium and high-level blockers surfaced by Beams agent testing of GCP-related documentation. Changes add CLI alternatives for GUI-only steps, missing critical steps,
<Checkpoint>verification blocks, and "Run on:" markers for multi-machine orchestration that tripped up autonomous runs.Changes
google-cloud.mdx: Added bold "Run on:" markers distinguishing workstation vs.
Application Service host commands, gcloud compute ssh connection instructions, token
transfer methods between machines, and decision guidance for choosing between
authentication approaches.
gke-discovery.mdx: Added Workload Identity as a non-destructive alternative to VM
stop/restart for credential attachment, a batch script for applying RBAC across all
discovered clusters, discovery commands for placeholder values, and blocks
after credential attachment and discovery verification.
gcp-discovery.mdx: Added batch guest-attribute enablement commands (project-wide and
per-instance), replaced empty placeholder arrays with realistic example values,
documented the host key bootstrap flow with multiple methods (batch/startup script/SSH),
and added blocks after instance preparation.
gcp-tags.mdx: Added the critical missing Step 2/3 for attaching the service account to
the VM (gcloud compute instances set-service-account) with both CLI and Console tabs, a
verifying attachment, and a troubleshooting section for when labels don't
appear.
alloydb.mdx: Added discovery tips for the 4-component URI format (project, region,
cluster, instance), blocks after impersonation setup and IAM user creation,
and the .iam suffix naming convention note.
mysql-cloudsql.mdx: Added blocks with
gcloud equivalents after each GUI-only include (service account creation, role
assignment, IAM auth enablement, database user creation), and wrapped the inline "Create
a database user" section in Tabs with a CLI option.
postgres-cloudsql.mdx: Added gcloud CLI alternatives for service account creation, role
assignment, IAM auth enablement, and database user creation alongside the existing
Console instructions, a after impersonation setup and service join, the
.iam suffix naming convention note for PostgreSQL IAM users, and the recommended
attached-service-account credential method.
spanner.mdx: Added discovery tips for Spanner instance ID and project ID, a
after service account creation, and a recommendation for Workload Identity Federation
over service account keys in the credentials step.