Environment Reference #

Every project ID, cluster name, context, hostname, and endpoint.

Migration status (2026-08-11). Staging runs fully on GCP. Production runs on AWS ECS + Aurora. The production GCP stack is up and serves a view-only canary at app-gcp.funnelstory.ai; its Cloud SQL instance is still a demoted replica of Aurora. Every production GCP row below is real but not yet customer-facing.

Who can do what #

Access is tiered on purpose. Database credentials and secret payloads stay with the GCP admins. Everyone else gets read-only.

The developer tier is these four roles. Ask in #back-end to be added:

roles/viewer                  # project-wide read
roles/gkehub.gatewayReader    # read-only kubectl through Connect Gateway
roles/gkehub.viewer           # list memberships, run get-credentials
roles/container.viewer        # in-cluster RBAC read

roles/viewer deliberately excludes secretmanager.versions.access, cloudsql.instances.login, container.secrets.*, container.pods.exec, and container.pods.portForward. Secret values stay unreadable, and the database stays unusable without a role, while ordinary debugging still works.

Developers also hold roles/aiplatform.user for Vertex AI, and roles/browser for org and folder traversal.

Granted on both projects as of 2026-08-11: Pulkit, Mamta, Nitin, Avadhut. Members are Terraform-owned in gcp/envs/<env>/terraform.tfvars under developer_members. Add someone by extending that list and applying, so the next plan keeps the binding instead of proposing to destroy it.

Two rules follow from this and are worth stating plainly:

• Logs → Grafana. Backend app logs live in the non-default backend-app-logs bucket, and reading a custom bucket view needs roles/logging.viewAccessor on top of roles/viewer. Grafana holds that grant through its own service account, so it needs no extra IAM for you.
• Deploys → an ops repo Helm PR. Nobody deploys from a laptop. Config and image changes go through k8s/deploy/<env>/values.yaml and the deploy workflow — see update env vars.

Projects and regions #

gcloud projects describe funnelstory-infra-staging --format='value(projectNumber)'

GKE #

The control plane has no public endpoint. All kubectl access goes through GKE Connect Gateway — see gcloud setup.

Cloud SQL (PostgreSQL 15) #

Endpoints are listed so you can read dashboards and Terraform. Connecting needs a database role, which is admin-only — see psql to Cloud SQL.

The production read replica is created at cutover. A DMS-managed destination cannot have replicas until it is promoted.

Private IPs can change. Re-check before you trust one:

gcloud sql instances describe funnelstory-staging \
  --project=funnelstory-infra-staging --format='value(ipAddresses[0].ipAddress)'

Network ranges #

Every range is private. WARP routes all of them, so with WARP connected you can reach a Cloud SQL instance or a pod IP straight from your laptop. Network reach is not the access control — credentials and IAM are.

VPC names are funnelstory-staging and funnelstory-production. The CIDRs avoid AWS production (172.30.0.0/16) and AWS staging (172.31.0.0/16), because an HA VPN joins them during the migration.

Ten routes are published, five per environment. A route reaches your laptop once its CIDR is in the WARP split-tunnel include list, which lives on the account-wide device profile (Zero Trust → Settings → WARP Client → Device settings → Split Tunnels) rather than in Terraform. Check yours with warp-cli settings, and check the connection with warp-cli status. A missing entry is the usual cause of a hang on a private IP.

Monitoring links #

Both Grafana instances sit behind Cloudflare Access, which is the only gate — no GCP IAM needed. See Grafana and PgHero.

Terraform #

See Terraform.

Other resources #

Container images live in the staging project for both environments:

us-west1-docker.pkg.dev/funnelstory-infra-staging/apps/{back-end,front-end,highcharts-export}

Production GKE pulls from the staging Artifact Registry. Zero-copy promotion means production runs the same bytes staging validated. The production node service account holds a repository-scoped reader grant.

Deploys #

All task guides #

Read-only, any developer:

• gcloud CLI setup — install, authenticate, switch contexts
• GKE diagnostics — find pods, read why one restarted
• Debug backend logs — kubectl logs, Cloud Logging, BigQuery
• Grafana — dashboards and ad hoc SQL
• Get pprof dumps — pod IP over WARP, no extra IAM

Admin only:

• Terraform — plan and apply infrastructure
• psql to Cloud SQL — direct database access
• Update secrets — Secret Manager
• Update env vars — needs a merged PR, deploy is gated
• Backup and restore — clone and recover data