All instances have metadata enable-oslogin=FALSE and project-wide SSH keys are blocked; no instance or project SSH keys exist. Firewall allows SSH from any IP. How can you SSH into an instance now?

The correct answer is to open Cloud Shell and run gcloud compute ssh to connect to the instance. Even with enable-oslogin=FALSE and no existing SSH keys, gcloud compute ssh can automatically generate an ephemeral SSH key pair, push the public key to the instance's metadata, and use the private key to establish a connection. This is a convenient and secure method for initial access. Setting enable-oslogin=TRUE would enable OS Login, but that's a different authentication method and doesn't directly solve the immediate SSH access problem without further configuration. Generating a new SSH key pair and adding it to the instance or project metadata would work, but gcloud compute ssh automates this process, making it the most straightforward solution in this scenario.