Skip to main content

Deploy on GCP

The two deployment shapes on Google Cloud, a VM and GKE Autopilot, and where their Terraform, Helm and runbooks live.

On this page

TL;DR: Two shapes share one CI plane. A single VM and a GKE cluster. Each was proven once in a dummy project on the Vertex stub and torn down. Installs in Astound's own GCP organisation have not been applied.

Shape Stack Install
VM: compose with app, Postgres/pgvector, ClickHouse, Caddy deploy/gcp/terraform/stacks/vm, deploy/gcp/vm/ just gcp-install-vm; operate with just gcp-vm
GKE Autopilot + Cloud SQL + GCS + Helm deploy/gcp/terraform/stacks/gke, deploy/helm/systemprompt-astound/ just gcp-install-gke

just gcp-validate is the static check and makes no cloud calls. just gcp-prove-vm and just gcp-prove-gke apply, check and destroy.

Runbooks

  • docs/runbooks/client-org-reapply.md: standing it up in a new project.
  • docs/runbooks/gcp-iam-roles.md: operator roles.
  • docs/runbooks/gcp-proofs.md: the proofs.
  • docs/runbooks/ci-gcp.md: the Cloud Build CI plane.
  • docs/runbooks/image.md: the image contract. One image (about 271 MB, one binary) serves the gateway, api and worker roles; it carries no LibreOffice, because Drive converts Office formats and PDF in-process. The chart accepts an optional per-role image (gateway.image, api.image, worker.image, runner.image), which must be a digest reference when image.digest is set.
  • docs/runbooks/gke-runner.md: the runner pods. A workflow's agent steps run only on nodes with the runner role, from the runner image (the app image plus Node, git and Claude Code). just kind-prove-runner proves it on a local cluster with no cloud spend.

Not proven yet

A real Vertex call, a real pull request from an agent step (it needs a GitHub App and a git credential for the runner), the CI required-check proof (it needs the Cloud Build GitHub App), GKE hostname mode with a managed certificate, and the production install recipes.