Skip to main content
This page covers the GCP-specific bits. The actual Helm install — values, ingress, env vars — lives in Install with Helm.
ComponentGCP serviceNotes
KubernetesGKE (Standard or Autopilot)3–5 nodes, ≥ e2-standard-4 (4 vCPU / 16 GB), regional cluster for HA.
MongoDBMongoDB Atlas (preferred)Available on GCP via Atlas. See MongoDB.
PostgreSQL (alternative)Cloud SQL for PostgreSQL, regional HA. See PostgreSQL.
ElasticsearchElastic Cloud on GCP, or self-managed Elasticsearch on GKE via ECK. See Elasticsearch.
RedisMemorystore for Redis. Standard Redis is enough — no modules required. See Redis.
Object storageCloud Storage. Two buckets are enough: models and uploads (the latter serves both public and private files, proxied by the api-gateway). Add a third public bucket fronted by Cloud CDN only if you want public assets served directly from a CDN.
File storage (PVC RWX)Filestore with regional redundancy, via the Filestore CSI driver.
IngressGKE Ingress with Google-managed certificates, or NGINX.
TLS / CertificatesGoogle-managed SSL certificates (via Ingress or Certificate Manager).
SecretsSecret Manager + Workload Identity, or External Secrets Operator.
IdentityWorkload Identity for GCS, Secret Manager and Cloud SQL access.

​
Persistent storage

The shared RWX PVC (used by prismeai-functions) can be backed by either:
  • Filestore with regional redundancy — managed NFS, lowest latency for the functions sandbox. Survives a zonal outage.
  • Cloud Storage FUSE (via the GCS FUSE CSI driver) — mounts a GCS bucket as a filesystem. Cheaper at large scale and inherently regional / multi-region, with higher latency than Filestore — fine for the function code volume, less ideal for hot temp files.
Pick Filestore for hot workloads, GCS FUSE when storage cost dominates.

​
Infrastructure as Code

Use Terraform with the Google provider — Google’s documentation is the canonical reference. Prisme.ai doesn’t ship a dedicated GCP IaC bundle.

​
DNS and TLS

Create two records (Cloud DNS or your registrar): 
api.<your-domain>     -> GKE Ingress external IP / Cloud Load Balancer
studio.<your-domain>  -> same
For TLS, use Google-managed certificates declared on the Ingress resource. They auto-renew.

​
Workload Identity

For GCS, Secret Manager and Cloud SQL access without static credentials:
  1. Enable Workload Identity on the GKE cluster.
  2. Create a Kubernetes ServiceAccount per namespace (e.g. prismeai-backends-sa) and bind it to a Google ServiceAccount with the required IAM roles (roles/storage.objectAdmin, roles/secretmanager.secretAccessor, roles/cloudsql.client).
  3. Set serviceAccount.name: prismeai-backends-sa on every backend service in your Helm values.
GCS can also be accessed via HMAC keys for S3-compatible drivers — useful if you want to keep your config identical to an AWS deployment.

​
Ingress annotations

GKE exposes two distinct LB settings:
  • connectionDraining.drainingTimeoutSec (≈ 60 s, under the api-gateway server keep-alive of 70 s) — socket reuse between client requests.
  • timeoutSec (≈ 300 s) — kill an in-flight request after this much inactivity, so SSE / long LLM streams aren’t dropped.
The GKE HTTP(S) load balancer applies a default timeoutSec of 30 s on backends. SSE calls (e.g. messages) whose processing exceeds 30 s will be cut off before completion unless you raise this timeout via a BackendConfig attached to the prismeai-console and prismeai-api-gateway Services.
Create the BackendConfig through the chart’s extraObjects value: 
extraObjects:
  - apiVersion: cloud.google.com/v1
    kind: BackendConfig
    metadata:
      name: prismeai-backend-config
    spec:
      timeoutSec: 300
      connectionDraining:
        drainingTimeoutSec: 60
Then attach it to the relevant Services via the cloud.google.com/backend-config annotation — at minimum prismeai-console and prismeai-api-gateway, since these are the entry points exposed through the LB: 
prismeai-console:
  service:
    annotations:
      cloud.google.com/backend-config: '{"default": "prismeai-backend-config"}'

prismeai-api-gateway:
  service:
    annotations:
      cloud.google.com/backend-config: '{"default": "prismeai-backend-config"}'
The full annotation reference lives in Helm install — Ingress and load balancer.

​
Next Steps

Install with Helm

Configure values and deploy core + apps namespaces.

Databases

PostgreSQL or MongoDB, Redis, Elasticsearch or OpenSearch.

Install products

Fresh-install walkthrough.

Migration v27

Migrate an existing instance to v27.