Skip to main content

GCP Deployment Checklist

Pre-deployment​

Infrastructure​

  • GKE cluster running with Workload Identity
  • Cloud SQL reachable on private IP from cluster
  • Databases bighammer_db_<env> and keycloak_db_<env> provisioned
  • Platform GSM prerequisite secrets provisioned — Secret Manager Secrets · Infrastructure
  • Dual-role values: POSTGRES_USER: bh_dev_user, BH_APP_USER: bh_app_user, postgres.password → bh-dev-user-password — Secret Manager Secrets
  • Application schemas applied (bighammer_db_setup.sql) — Scripts Reference
  • One-time GSM secrets — Scripts Reference
  • Cloud DNS zone and A records (or plan to add after LB IP known)
  • Shared VPC firewall: TCP 10256, 80, 443 to node SA

Chart / values​

  • values-<env>.yaml — project ID, image repo, hostnames
  • global.remoteSecrets aligned with GSM secret names
  • Chart and images mirrored to your GAR — Release Manifest & Distribution
  • Chart version in values-<env>.yaml matches mirrored release manifest

Cluster add-ons​

  • External Secrets Operator healthy
  • Edge: ingress-nginx or (gateway-crds + Envoy controller + bh-gateway in envoy-gateway-system)
  • RabbitMQ broker deployed and reachable
  • TLS: cert-manager path or private cert in GSM + K8s secret
  • Reloader (optional, matches chart annotation)

Identity / IAM​

  • external-secrets-operator WI binding applied
  • App Workload Identity GSAs bound (<your-app-gsa> or per-service SAs)
  • GKE node SA has artifactregistry.reader (if using GAR)

Deployment​

  • kubectl create namespace bh-control-plane (if needed)
  • helm upgrade --install bighammer ...
  • ExternalSecrets status SecretSynced
  • All pods Running (allow time for image pull)

Post-deployment​

Release upgrade​

  • New release manifest received from BigHammer
  • Mirror job completed for new chart version and image tags
  • Release notes reviewed — Helm Chart Release Notes

See Release Manifest & Distribution.