services-gcp-deploy

Services_GCP Deployment

Purpose

Deploy the Services_GCP platform module from the partner-modules repository. This module provisions the shared infrastructure layer (VPC, Cloud SQL, GKE, Artifact Registry, NFS, service accounts) that application modules depend on.

Prerequisites

• GCloud isolated auth set up for the target project (see gcloud-isolated-auth skill)
• partner-modules repository checked out at the same workspace root as rad-modules
• tofu (OpenTofu) available on PATH

Procedure

Step 1: Handle stale state

The Services_GCP module directory accumulates state from prior projects. Before deploying to a new project, check:

cd partner-modules/modules/Services_GCP
ls -la terraform.tfstate*

If the current terraform.tfstate is for a different project, park it:

mv terraform.tfstate "terraform.tfstate.parked-<old-project>-$(date +%Y%m%d)"
mv terraform.tfstate.backup "terraform.tfstate.backup.parked-<old-project>-$(date +%Y%m%d)"

Then clear any stale lock and plans:

rm -f .terraform.tfstate.lock.info plan.tfplan plan-output.tfplan

Step 2: Write a minimal config/deploy.tfvars

resource_creator_identity = ""
project_id                = "<target-project-id>"
tenant_id                 = "demo"

module_dependency = []   # platform is root of stack

# Databases
create_postgres = true
create_mysql    = true

# GKE
create_google_kubernetes_engine = true

Key points:

• resource_creator_identity = "" — use caller identity (no SA impersonation). Only set it to an SA email when deploying via the RAD platform Cloud Build, which needs to impersonate.
• tenant_id (named tenant_deployment_id before 2026-08-04) — short prefix applied to all resource names. Defaults to demo; a validation block enforces ^[a-z0-9]+$ (no hyphens, underscores or uppercase). Every app module deployed on top must use the same tenant ID.
• module_dependency = [] — Services_GCP is the root module; it has no upstream.