Set up OpenTofu

Install the tooling, create the project, and clone the deployment repository. The infrastructure is described with OpenTofu, the open-source fork of Terraform.

Prerequisites

You need a Google Cloud project with billing enabled. Follow the official instructions to create one if you do not have one yet.

Install the gcloud CLI

Install it from the official instructions, then verify:

gcloud version

Install OpenTofu

Install it by following the official instructions, then verify:

tofu -version

The deployment was tested on OpenTofu v1.9.1 and later.

Configure Application Default Credentials

OpenTofu authenticates to Google Cloud with your local credentials:

gcloud auth application-default login

This writes ~/.config/gcloud/application_default_credentials.json.

Permissions

roles/owner covers everything and is the simplest choice. roles/editor on its own is not enough. It cannot set IAM policies, so the deployment fails partway through.

Otherwise grant roles/editor plus:

Role	Unlocks
roles/resourcemanager.projectIamAdmin	Project roles for the operator service account
roles/cloudkms.admin	IAM policy on the KMS key
roles/iam.workloadIdentityPoolAdmin	The attestation pool and provider
roles/secretmanager.admin	Creating the secrets and setting IAM on each one. roles/secretmanager.secretAccessor alone is not enough
roles/servicenetworking.networksAdmin	Private service access for Cloud SQL

Check what your account currently holds:

gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:$(gcloud config get-value account)" \
  --format="value(bindings.role)"

Clone the repository

git clone https://github.com/silence-laboratories/duo-on-gcc.git
cd duo-on-gcc

Every command in this tutorial runs from the repository root.

deploy/gcp/tf holds three modules, applied in this order:

Module	Creates
bootstrap-secret-guardian	KMS key ring and key, and the attestation pool
bootstrap-backend	VPC, firewall rules, service accounts, storage bucket, Cloud SQL
backend	The Confidential Space VMs and the policy admin dashboard

The two bootstrap modules change rarely. backend is the one you re-apply while iterating.

Each bootstrap module creates its Secret Manager secrets empty. Scripts in deploy/gcp/scripts fill them in afterwards, and create the database roles, so that no secret value is ever written to OpenTofu state. The steps therefore alternate: apply a module, run its scripts, then apply the next. Each page below says which scripts to run and what they need installed.