GCP

Early access. To deploy on GCP, SKE needs a service account in your GCP project with the required IAM roles and APIs enabled.

1. Enable the Service Usage API

Before SKE can enable other APIs, the Service Usage API must already be active:

gcloud services enable serviceusage.googleapis.com --project=my-gcp-project

2. Create a service account

Create a dedicated service account for SKE:

gcloud iam service-accounts create ske-deployer \
  --display-name="SKE Deployer" \
  --project=my-gcp-project

3. Assign IAM roles

SKE requires predefined IAM roles grouped by feature. The core roles are always required; conditional roles are only needed if you use the corresponding feature.

Always required (12 roles)

ROLES=(
  roles/serviceusage.serviceUsageAdmin
  roles/iam.serviceAccountAdmin
  roles/iam.serviceAccountUser
  roles/resourcemanager.projectIamAdmin
  roles/datastore.owner
  roles/run.admin
  roles/artifactregistry.admin
  roles/secretmanager.admin
  roles/cloudtasks.admin
  roles/cloudscheduler.admin
  roles/logging.viewer
  roles/storage.objectAdmin
)

for role in "${ROLES[@]}"; do
  gcloud projects add-iam-policy-binding my-gcp-project \
    --member="serviceAccount:[email protected]" \
    --role="$role"
done

Conditional roles

Role	When needed
roles/compute.networkAdmin	Networking (VPC, subnets)
roles/cloudsql.admin	Databases (Cloud SQL)
roles/redis.admin	Caching (Memorystore)
roles/dns.admin	Listed with the infrastructure roles; custom domains don’t use Cloud DNS
roles/firebase.admin	Static hosting setup; includes firebase.projects.update to add Firebase
roles/firebasehosting.admin	Static hosting sites, deployments and custom domains
roles/storage.admin	Static hosting’s private upload staging buckets; Object Admin alone cannot create buckets

# Add only the roles you need
gcloud projects add-iam-policy-binding my-gcp-project \
  --member="serviceAccount:[email protected]" \
  --role="roles/cloudsql.admin"

See the IAM Reference for details on what each role grants.

4. Create and download a key

gcloud iam service-accounts keys create ske-key.json \
  --iam-account=ske-deployer@my-gcp-project.iam.gserviceaccount.com

Keep this file secure. You’ll provide it when connecting the provider.

5. Connect the provider

In the dashboard, go to Connections, Cloud providers, select Connect provider and pick Google Cloud Platform. Drop ske-key.json into the wizard, which reads the project and service account from it, pick a default region, then select Validate connection.

SKE checks the key and which of the APIs below are enabled in the project. A critical API that is off stops the connection; an optional one that is off is only a warning. Connecting doesn’t check the roles or enable anything. Give the connection a name and select Save connection.

6. Enable Firebase Hosting for static sites (early access)

Firebase Hosting is optional. Cloud Run applications can use the connection without enabling it. Each static environment gets one SKE-owned Hosting site and a default https://<site-id>.web.app address with HTTPS. Static hosting requires no network or load balancer. Deleting an environment removes its SKE-owned site, versions, staging files and domain attachments, while preserving unrelated Firebase resources and project-level Firebase enablement.

For an organization with the static-sites feature enabled:

1. Grant the three static-hosting roles above to the connected service account. Keep the core Service Usage Admin (roles/serviceusage.serviceUsageAdmin), Cloud Datastore Owner (roles/datastore.owner) and Secret Manager Admin (roles/secretmanager.admin) roles.
2. On the GCP connection card, read the Firebase notice and select I understand Firebase enablement is permanent, then Enable Firebase Hosting. This requires provider management permission (provider:manage). Adding Firebase to the project is permanent: deleting a SKE connection or environment cannot undo it.
3. Wait until the card shows Ready for static sites. SKE checks the feature permissions before provisioning, enables the feature APIs listed below, reuses an existing Firebase project or adds Firebase, and checks the default Firestore database. You can leave the page while setup runs.
4. Create an environment for a static-site project using this ready connection. Use the same local or CI ske deploy workflow as on AWS; the CLI runs the build command and uploads its output, with no Docker build.

Setup requires a Firestore Native default database for deployment state. SKE creates one in the connection’s default region if it is absent, or reuses an existing Native database. A project whose default database uses Datastore mode cannot complete setup; connect a project with Firestore Native instead.

If setup fails, the card shows the reason and offers retry. Fix missing roles or disabled APIs first. If Google requires Firebase terms acceptance, open the project in the Firebase console, accept the terms, then retry Enable Firebase Hosting. SKE keeps static sites on Firebase Hosting; it does not fall back to Cloud Run.

Static-hosting APIs

The Service Usage API must already be enabled, as in step 1. The explicit Firebase setup action enables:

API	Purpose
firebase.googleapis.com	Firebase project enablement and metadata
firebasehosting.googleapis.com	Hosting sites, versions, releases and custom domains
firestore.googleapis.com	Deployment state in Firestore Native
storage.googleapis.com	Private upload staging
secretmanager.googleapis.com	Environment variables and secrets

The CLI uploads to private GCS staging using signed URLs. SKE transfers the files into an immutable Firebase version and cleans up staging after the version is finalized. Rollback uses retained Firebase versions, rather than keeping the raw staging uploads. See Rollbacks.

APIs

Checked when you connect

Kind	APIs
Critical (connecting stops without them)	iam, run, artifactregistry, firestore, secretmanager, cloudresourcemanager
Optional (a warning; features may be limited)	cloudtasks, cloudscheduler, logging, storage, compute, sqladmin, redis, dns

Each is <name>.googleapis.com.

Enabled on compute deploy

The first Cloud Run deploy enables every API SKE needs in the project, these 16, and creates the Firestore database:

API	Purpose
iam.googleapis.com	Service account management
run.googleapis.com	Cloud Run compute
artifactregistry.googleapis.com	Container image registry
firestore.googleapis.com	Deployment state storage
secretmanager.googleapis.com	Secret storage
cloudtasks.googleapis.com	Queue processing
cloudscheduler.googleapis.com	Scheduled tasks
logging.googleapis.com	Application logs
monitoring.googleapis.com	Request metrics
cloudresourcemanager.googleapis.com	Project metadata
storage.googleapis.com	Asset storage
compute.googleapis.com	VPC networking and the load balancer
sqladmin.googleapis.com	Cloud SQL databases
redis.googleapis.com	Memorystore caches
dns.googleapis.com	Cloud DNS
servicenetworking.googleapis.com	Private connections to Cloud SQL and Memorystore

What gets provisioned

Resource	GCP Service	Notes
Compute	Cloud Run	Container-based services
Static hosting	Firebase Hosting	One site per static environment, with a default HTTPS web.app URL
Container registry	Artifact Registry	One repository per project
Queues	Cloud Tasks	One queue per configured queue
Scheduler	Cloud Scheduler	Jobs for Laravel scheduled tasks
Secrets	Secret Manager	Environment secrets
State	Firestore	Deployment state tracking
Logs	Cloud Logging	Structured application logs
Database	Cloud SQL	MySQL or PostgreSQL
Cache	Memorystore	Redis
Network	VPC	Subnets, firewall rules
Compute custom domains	Certificate Manager + Global HTTPS LB	SSL certificates and load balancing
Static custom domains	Firebase Hosting	Managed HTTPS and Firebase-supplied DNS records

Regions

SKE offers these GCP regions: us-central1 (Iowa), us-east1 (South Carolina), us-east4 (Northern Virginia), us-west1 (Oregon), europe-west1 (Belgium), europe-west2 (London), europe-west4 (Netherlands), asia-east1 (Taiwan), asia-northeast1 (Tokyo), asia-southeast1 (Singapore), australia-southeast1 (Sydney) and southamerica-east1 (São Paulo). Each environment pins its own region.

Custom domains on GCP

Cloud Run custom domains use a Global HTTPS Load Balancer with Certificate Manager for SSL. This requires the enable_lb flag on the network.

Static-site domains use Firebase Hosting’s managed HTTPS without a network. Add exact names such as example.com and www.example.com; Firebase static hosting does not support wildcard domains. Apply the DNS records and Add or Remove actions shown on the Domains tab, including TXT ownership records and A or AAAA records when Firebase supplies them. The default web.app URL stays the primary dashboard and deployment link. See Domains for details.