> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP BYOC

> Provision the customer-owned GCP foundation

The OpenTofu root at `product/enterprise/terraform/gcp-byoc` provisions:

* custom VPC and private regional GKE;
* control and tainted gVisor worker pools;
* Workload Identity and least-privilege runtime identity;
* regional Cloud SQL PostgreSQL with PITR and customer KMS;
* authenticated/encrypted Memorystore;
* versioned, retained, KMS-encrypted GCS;
* private Artifact Registry and KMS-encrypted Secret Manager placeholders.

```bash theme={null}
tofu init -backend=false
tofu fmt -check -recursive
tofu validate
tofu plan -out=veridical.tfplan
```

The stack never accepts model keys, passwords, OAuth secrets, license contents,
or database URLs as Terraform variables. Populate secret versions through the
customer's approved workflow after apply, then sync the existing Kubernetes
Secret consumed by Helm.

<Warning>
  Repository validation does not authorize or perform `tofu apply`. Review the
  saved plan, quota, billing account, private endpoint access, and recovery design
  before a protected operator applies it.
</Warning>