GCP Environment Reference #

Every project ID, cluster name, context, hostname, and endpoint. Start here, then follow a task link.

Migration status (2026-08-11). Staging runs fully on GCP. Production runs on AWS ECS + Aurora. The production GCP stack is up and serves a view-only canary at app-gcp.funnelstory.ai; its Cloud SQL instance is still a demoted replica of Aurora. Every production GCP row below is real but not yet customer-facing.

Who can do what #

Access is tiered on purpose. Database credentials and secret payloads stay with Vivek and Preetam. Everyone else gets read-only.

The developer tier is these four roles. Ask in #back-end to be added:

roles/viewer                  # project-wide read
roles/gkehub.gatewayReader    # read-only kubectl through Connect Gateway
roles/gkehub.viewer           # list memberships, run get-credentials
roles/container.viewer        # in-cluster RBAC read

roles/viewer deliberately excludes secretmanager.versions.access, cloudsql.instances.login, container.secrets.*, container.pods.exec, and container.pods.portForward. That is what keeps secrets and the database out of reach while still allowing real debugging.

Developers also hold roles/aiplatform.user for Vertex AI, and roles/browser for org and folder traversal.

Granted on both projects as of 2026-08-11: Pulkit, Mamta, Nitin, Avadhut. Members are Terraform-owned in gcp/envs/<env>/terraform.tfvars under developer_members. Add someone by extending that list and applying, so the next plan keeps the binding instead of proposing to destroy it.

Two rules follow from this and are worth stating plainly:

• Logs → Grafana. Backend app logs live in the non-default backend-app-logs bucket, and reading a custom bucket view needs roles/logging.viewAccessor on top of roles/viewer. Grafana holds that grant through its own service account, so it needs no extra IAM for you.
• Deploys → an ops repo Helm PR. Nobody deploys from a laptop. Config and image changes go through k8s/deploy/<env>/values.yaml and the deploy workflow — see update env vars.

Projects and regions #

gcloud projects describe funnelstory-infra-staging --format='value(projectNumber)'

GKE #

The control plane has no public endpoint. All kubectl access goes through GKE Connect Gateway — see gcloud setup.

Cloud SQL (PostgreSQL 15) #

Endpoints are listed so you can read dashboards and Terraform. Connecting needs a database role, which is admin-only — see psql to Cloud SQL.

The production read replica is created at cutover. A DMS-managed destination cannot have replicas until it is promoted.

Private IPs can change. Re-check before you trust one:

gcloud sql instances describe funnelstory-staging \
  --project=funnelstory-infra-staging --format='value(ipAddresses[0].ipAddress)'

Network ranges #

Every range is private. You reach them over Cloudflare WARP.

VPC names are funnelstory-staging and funnelstory-production. The CIDRs avoid AWS production (172.30.0.0/16) and AWS staging (172.31.0.0/16), because an HA VPN joins them during the migration.

Monitoring links #

Both Grafana instances sit behind Cloudflare Access, which is the only gate — no GCP IAM needed. See Grafana (GCP) and PgHero.

Terraform #

See Terraform on GCP.

Other resources #

Container images live in the staging project for both environments:

us-west1-docker.pkg.dev/funnelstory-infra-staging/apps/{back-end,front-end,highcharts-export}

Production GKE pulls from the staging Artifact Registry. Zero-copy promotion means production runs the same bytes staging validated. The production node service account holds a repository-scoped reader grant.

Deploys #

All task guides #

Read-only, any developer:

• gcloud CLI setup — install, authenticate, switch contexts
• GKE diagnostics — find pods, read why one restarted
• Debug backend logs — kubectl logs, Cloud Logging, BigQuery
• Grafana (GCP) — dashboards and ad hoc SQL

Admin only:

• Terraform on GCP — plan and apply infrastructure
• psql to Cloud SQL — direct database access
• Update secrets — Secret Manager
• Update env vars — needs a merged PR, deploy is gated
• Backup and restore — clone and recover data
• Get pprof dumps — needs port-forward