Sample mattersEvery client, case, and document on this deployment is invented for demonstration. This is purposefully a demo environment.

Network and storage buckets

With the APIs on, the CLI provisions the data plane and runtime identity:

  • A custom-mode VPC with one explicitly named regional subnet and private Google access. The deployment's GKE cluster is pinned to both names.
  • Five private Cloud Storage buckets, all uniform bucket-level access: -assets (marketing objects served through the same-origin /assets/* application route), -documents (client documents), -exports (Parquet/Iceberg archives), -logs (the Nearline log-sink destination), and -applications (each Project's published client-portal bundle, streamed same-origin through /app/projects/{code}/portal). A deployment may also name separate archive and telemetry buckets for long-term snapshots and telemetry landing data.
  • A deployment-specific Google service account with the Secret Manager accessor role, object access on only that deployment's five core buckets and any named archive/telemetry lanes, Workload Identity bindings for the namespace's navigator-web and workflows-service Kubernetes service accounts, and permission to sign its own GCS URLs.
  • A separate Workspace Drive service account with no runtime GCP roles. An operator creates one JSON key, records it in that deployment's secrets.enc.yaml, and grants its OAuth client domain-wide delegation in the selected Workspace.