Network and storage buckets
With the APIs on, the CLI provisions the data plane and runtime identity:
- A custom-mode VPC with one explicitly named regional subnet and private Google access. The deployment's GKE cluster is pinned to both names.
- Six private Cloud Storage buckets, all uniform bucket-level access:
-assets(marketing objects served through the same-origin/assets/*application route),-documents(client documents),-exports(Parquet/Iceberg archives),-logs(the Nearline log-sink destination),-postgres-backups(the PostgreSQL WAL archive and base backups, expired at 30 days), and-applications(still provisioned; the retired Portal's bundles are no longer read or written). A deployment may also name separate archive and telemetry buckets for long-term snapshots and telemetry landing data. - A deployment-specific Google service account with the Secret Manager accessor role, object access on only that
deployment's core buckets other than PostgreSQL backups and any named archive/telemetry lanes, Workload Identity
bindings for the namespace's
navigator-webandworkflows-serviceKubernetes service accounts, and permission to sign its own GCS URLs. - A separate Workspace Drive service account with no runtime GCP roles. An operator creates one JSON key, records it
in that deployment's
secrets.enc.yaml, and grants its OAuth client domain-wide delegation in the selected Workspace.