> ## Documentation Index > Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt > Use this file to discover all available pages before exploring further. # Deploying Prisme.ai on GCP > GCP-specific managed services, persistent storage and ingress. The Helm install itself is documented under Installation. This page covers the GCP-specific bits. The actual Helm install — values, ingress, env vars — lives in [Install with Helm](/self-hosting/kubernetes/helm). *** ## Recommended managed services | Component | GCP service | Notes | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | Kubernetes | **GKE** (Standard or Autopilot) | 3–5 nodes, ≥ `e2-standard-4` (4 vCPU / 16 GB), regional cluster for HA. | | MongoDB | **MongoDB Atlas** (preferred) | Available on GCP via Atlas. See [MongoDB](/self-hosting/databases/mongodb). | | PostgreSQL (alternative) | **Cloud SQL for PostgreSQL**, regional HA. See [PostgreSQL](/self-hosting/databases/postgresql). | | | Elasticsearch | **Elastic Cloud on GCP**, or self-managed Elasticsearch on GKE via ECK. See [Elasticsearch](/self-hosting/databases/elasticsearch). | | | Redis | **Memorystore for Redis**. Standard Redis is enough — no modules required. See [Redis](/self-hosting/databases/redis). | | | Object storage | **Cloud Storage**. Two buckets are enough: `models` and `uploads` (the latter serves both public and private files, proxied by the api-gateway). Add a third public bucket fronted by **Cloud CDN** only if you want public assets served directly from a CDN. | | | File storage (PVC RWX) | **Filestore** with **regional redundancy**, via the Filestore CSI driver. | | | Ingress | **GKE Ingress** with **Google-managed certificates**, or NGINX. | | | TLS / Certificates | **Google-managed SSL certificates** (via Ingress or Certificate Manager). | | | Secrets | **Secret Manager** + Workload Identity, or External Secrets Operator. | | | Identity | **Workload Identity** for GCS, Secret Manager and Cloud SQL access. | | *** ## Persistent storage The shared RWX PVC (used by `prismeai-functions`) can be backed by either: * **Filestore with regional redundancy** — managed NFS, lowest latency for the functions sandbox. Survives a zonal outage. * **Cloud Storage FUSE** (via the [GCS FUSE CSI driver](https://cloud.google.com/kubernetes-engine/docs/concepts/cloud-storage-fuse-csi-driver)) — mounts a GCS bucket as a filesystem. Cheaper at large scale and inherently regional / multi-region, with higher latency than Filestore — fine for the function code volume, less ideal for hot temp files. Pick Filestore for hot workloads, GCS FUSE when storage cost dominates. *** ## Infrastructure as Code Use Terraform with the **Google provider** — Google's documentation is the canonical reference. Prisme.ai doesn't ship a dedicated GCP IaC bundle. *** ## DNS and TLS Create two records (Cloud DNS or your registrar): ``` api. -> GKE Ingress external IP / Cloud Load Balancer studio. -> same ``` For TLS, use **Google-managed certificates** declared on the Ingress resource. They auto-renew. *** ## Workload Identity For GCS, Secret Manager and Cloud SQL access without static credentials: 1. Enable Workload Identity on the GKE cluster. 2. Create a Kubernetes ServiceAccount per namespace (e.g. `prismeai-backends-sa`) and bind it to a Google ServiceAccount with the required IAM roles (`roles/storage.objectAdmin`, `roles/secretmanager.secretAccessor`, `roles/cloudsql.client`). 3. Set `serviceAccount.name: prismeai-backends-sa` on every backend service in your Helm values. GCS can also be accessed via **HMAC keys** for S3-compatible drivers — useful if you want to keep your config identical to an AWS deployment. *** ## Ingress annotations GKE exposes two distinct LB settings: * **`connectionDraining.drainingTimeoutSec`** (≈ 60 s, under the api-gateway server keep-alive of 70 s) — socket reuse between client requests. * **`timeoutSec`** (≈ 300 s) — kill an in-flight request after this much inactivity, so SSE / long LLM streams aren't dropped. The GKE HTTP(S) load balancer applies a **default `timeoutSec` of 30 s** on backends. SSE calls (e.g. `messages`) whose processing exceeds 30 s will be cut off before completion unless you raise this timeout via a `BackendConfig` attached to the `prismeai-console` and `prismeai-api-gateway` Services. Create the `BackendConfig` through the chart's `extraObjects` value: ```yaml theme={null} extraObjects: - apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: prismeai-backend-config spec: timeoutSec: 300 connectionDraining: drainingTimeoutSec: 60 ``` Then attach it to the relevant Services via the `cloud.google.com/backend-config` annotation — at minimum `prismeai-console` and `prismeai-api-gateway`, since these are the entry points exposed through the LB: ```yaml theme={null} prismeai-console: service: annotations: cloud.google.com/backend-config: '{"default": "prismeai-backend-config"}' prismeai-api-gateway: service: annotations: cloud.google.com/backend-config: '{"default": "prismeai-backend-config"}' ``` The full annotation reference lives in [Helm install — Ingress and load balancer](/self-hosting/kubernetes/helm#5-ingress-and-load-balancer). *** ## Next Steps Configure values and deploy core + apps namespaces. PostgreSQL or MongoDB, Redis, Elasticsearch or OpenSearch. Fresh-install walkthrough. Migrate an existing instance to v27.