GCP BYOC

Provision the customer-owned GCP foundation

The OpenTofu root at product/enterprise/terraform/gcp-byoc provisions:

• custom VPC and private regional GKE;
• control and tainted gVisor worker pools;
• Workload Identity and least-privilege runtime identity;
• regional Cloud SQL PostgreSQL with PITR and customer KMS;
• authenticated/encrypted Memorystore;
• versioned, retained, KMS-encrypted GCS;
• private Artifact Registry and KMS-encrypted Secret Manager placeholders.

tofu init -backend=false
tofu fmt -check -recursive
tofu validate
tofu plan -out=veridical.tfplan

The stack never accepts model keys, passwords, OAuth secrets, license contents, or database URLs as Terraform variables. Populate secret versions through the customer’s approved workflow after apply, then sync the existing Kubernetes Secret consumed by Helm.

Repository validation does not authorize or perform tofu apply. Review the saved plan, quota, billing account, private endpoint access, and recovery design before a protected operator applies it.