GCP Infrastructure manager terraform for elastic-agent #3776

amirbenun · 2025-12-18T16:27:16Z

Summary of your changes

Replaces deprecated GCP Deployment Manager with modern Infrastructure Manager (Terraform) for deploying Elastic Agent CSPM integration. Provides identical resources with improved tooling and user experience.

New Directory: deploy/infrastructure-manager/gcp-elastic-agent/ Files Added:

main.tf - Main infrastructure configuration (compute instance, network, service account, IAM bindings)
variables.tf - Input variable definitions
outputs.tf - Deployment outputs
service_account.tf - Standalone service account deployment for agentless mode
terraform.tfvars.example - Example configuration for main deployment
service_account.tfvars.example - Example configuration for SA-only deployment
README.md - Comprehensive deployment guide

Resources Created

Identical to Deployment Manager implementation:
Compute instance (Ubuntu, n2-standard-4, 32GB disk) with Elastic Agent pre-installed
Service account with roles/cloudasset.viewer and roles/browser
VPC network with auto-created subnets
IAM bindings (project or organization scope)
Optional SSH firewall rule

Compatibility

The new deployment script infrastructure-manager/deploy.sh is compatible with kibana deployment command of the form:

gcloud config set project elastic-security-test && \
FLEET_URL=https://a6f784d2fb4d48bea7724fbe41ef17d3.fleet.us-central1.gcp.qa.elastic.cloud:443 \
ENROLLMENT_TOKEN=<REDUCTED> \
STACK_VERSION=9.2.3 \
./deploy.sh

Related Issues

Resolves: Replace GCP deployment-manager scripts with infrastructure-manager #3132

mergify · 2025-12-18T16:27:57Z

This pull request does not have a backport label. Could you fix it @amirbenun? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

amirbenun · 2025-12-23T17:01:21Z

A common failure is when the artifacts server is not configured well, I tested this use case to create a good user experience and surface the error to the GCP cloudshell and console:

olegsu · 2026-01-05T21:12:02Z

deploy/infrastructure-manager/gcp-elastic-agent/README.md

+
+#### Option 2: GCP Console
+
+1. Go to [Infrastructure Manager Console](https://console.cloud.google.com/infrastructure-manager/deployments/create)


Suggested change

1. Go to [Infrastructure Manager Console](https://console.cloud.google.com/infrastructure-manager/deployments/create)

1. Go to [Infrastructure Manager Console](https://console.cloud.google.com/infra-manager/deployments/create)

olegsu · 2026-01-05T21:17:50Z

deploy/infrastructure-manager/gcp-elastic-agent/README.md

+3. Add input variables (see table below)
+4. Click **Create**
+
+### Input Variables


Infrastructure manager requires the values to be in JSON format. Can you clarify in the example how to pass it?

That's a strange behavior on their UI but string values should be wrapped with ""

olegsu · 2026-01-05T21:21:29Z

deploy/infrastructure-manager/gcp-elastic-agent/README.md

+
+#### Option 1: Cloud Shell (Recommended)
+
+[![Open in Cloud Shell](https://gstatic.com/cloudssh/images/open-btn.svg)](https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https://github.com/elastic/cloudbeat.git&cloudshell_git_branch=main&cloudshell_workspace=deploy/infrastructure-manager/gcp-elastic-agent&show=terminal&ephemeral=true)


This URL leads to 404 (after I change the branch and the repo owner), any idea why?
(the url in [elastic/integrations](https://github.com/elastic/integrations/blob/main/packages/cloud_security_posture/manifest.yml#L172C22-L172C235 is a bit different)

Can you try setting my branch and my repo instead?
https://github.com/amirbenun/cloudbeat.git
infra-manager-agent

This link works for me
https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https://github.com/amirbenun/cloudbeat.git&cloudshell_git_branch=infra-manager-agent&cloudshell_workspace=deploy/infrastructure-manager/gcp-elastic-agent&show=terminal&ephemeral=true

### Summary of your changes Replaces deprecated GCP Deployment Manager with modern Infrastructure Manager (Terraform) for deploying Elastic Agent CSPM integration. Provides identical resources with improved tooling and user experience. #### New Directory: deploy/infrastructure-manager/gcp-elastic-agent/ Files Added: main.tf - Main infrastructure configuration (compute instance, network, service account, IAM bindings) variables.tf - Input variable definitions outputs.tf - Deployment outputs service_account.tf - Standalone service account deployment for agentless mode terraform.tfvars.example - Example configuration for main deployment service_account.tfvars.example - Example configuration for SA-only deployment README.md - Comprehensive deployment guide #### Resources Created Identical to Deployment Manager implementation: Compute instance (Ubuntu, n2-standard-4, 32GB disk) with Elastic Agent pre-installed Service account with roles/cloudasset.viewer and roles/browser VPC network with auto-created subnets IAM bindings (project or organization scope) Optional SSH firewall rule #### Compatibility The new deployment script `infrastructure-manager/deploy.sh` is compatible with kibana deployment command of the form: ```bash gcloud config set project elastic-security-test && \ FLEET_URL=https://a6f784d2fb4d48bea7724fbe41ef17d3.fleet.us-central1.gcp.qa.elastic.cloud:443 \ ENROLLMENT_TOKEN=<REDUCTED> \ STACK_VERSION=9.2.3 \ ./deploy.sh ``` ### Related Issues - Resolves: elastic#3132 (cherry picked from commit fdf76cc)

init

47cf40d

amirbenun requested a review from a team as a code owner December 18, 2025 16:27

Copilot AI review requested due to automatic review settings December 18, 2025 16:27

Copilot started reviewing on behalf of amirbenun December 18, 2025 16:27 View session

mergify bot assigned amirbenun Dec 18, 2025

improve exmpale

11ab07e

Copilot AI reviewed Dec 18, 2025

View reviewed changes

amirbenun added 22 commits December 18, 2025 19:53

seup

a2179fe

gem

7db0820

gem2

4915931

deploysh

16aa11f

bc

4557a0f

rename

cd4af80

chmod

a77e7d7

STACK_VERSION

66e3b4f

test git

5b16816

amirbenun

1fb41f4

remove ssh

4837aea

suffix

82569f7

enhance

7513705

vars

07eb90c

no test

fab8da3

elastic-agent-gcp

32ae443

server

4aa2e57

guest atr

246e20f

ns

b48d1ee

validation

83d12b0

rm

100a557

report_failure

89371c6

amirbenun added 9 commits December 23, 2025 11:28

validate curl

039bdab

google_client_config

b438e77

gcloud examples

41d980b

space

6741f9f

script.sh

a6bee5a

envar

526a049

debug instructions

9af94a2

permissions:

7dba993

"

787ad6e

amirbenun added 6 commits December 24, 2025 00:04

shellcheck

e962d00

shfmt

3c7563f

setup

e1ba7e6

enhance

89bef81

review

9f41dfe

always create sa

28f8eaa

olegsu reviewed Jan 5, 2026

View reviewed changes

amirbenun added 5 commits January 8, 2026 10:09

links

fc6b840

remove key

10aaf6f

vars

27cd509

naming

d815693

naming

9ef21a4

amirbenun mentioned this pull request Jan 8, 2026

Replace GCP deployment-manager scripts with infrastructure-manager #3132

Open

2 tasks

olegsu approved these changes Jan 8, 2026

View reviewed changes

amirbenun merged commit fdf76cc into elastic:main Jan 8, 2026
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GCP Infrastructure manager terraform for elastic-agent #3776

GCP Infrastructure manager terraform for elastic-agent #3776

Uh oh!

amirbenun commented Dec 18, 2025 •

edited

Loading

Uh oh!

mergify bot commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

amirbenun commented Dec 23, 2025

Uh oh!

olegsu Jan 5, 2026

Uh oh!

olegsu Jan 5, 2026

Uh oh!

amirbenun Jan 8, 2026

Uh oh!

olegsu Jan 5, 2026

Uh oh!

amirbenun Jan 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		#### Option 2: GCP Console

		1. Go to [Infrastructure Manager Console](https://console.cloud.google.com/infrastructure-manager/deployments/create)


		#### Option 1: Cloud Shell (Recommended)

		[![Open in Cloud Shell](https://gstatic.com/cloudssh/images/open-btn.svg)](https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https://github.com/elastic/cloudbeat.git&cloudshell_git_branch=main&cloudshell_workspace=deploy/infrastructure-manager/gcp-elastic-agent&show=terminal&ephemeral=true)

GCP Infrastructure manager terraform for elastic-agent #3776

GCP Infrastructure manager terraform for elastic-agent #3776

Uh oh!

Conversation

amirbenun commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of your changes

New Directory: deploy/infrastructure-manager/gcp-elastic-agent/ Files Added:

Resources Created

Compatibility

Related Issues

Uh oh!

mergify bot commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

amirbenun commented Dec 23, 2025

Uh oh!

olegsu Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

olegsu Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

amirbenun Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

olegsu Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

amirbenun Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

amirbenun commented Dec 18, 2025 •

edited

Loading