Tunnelling
Ensure your pub key is uploaded to GCP
gcloud compute os-login ssh-keys add --key-file=
In one window, create the tunnel
gcloud beta compute start-iap-tunnel
In another terminal;
ssh localhost -p 2222 -A -i
Direct over IAP tunnel
gcloud compute ssh