GCP

To deploy on GCP, SKE needs a service account in your GCP project with the required IAM roles and APIs enabled.

1. Enable the Service Usage API

Before SKE can enable other APIs, the Service Usage API must already be active:

gcloud services enable serviceusage.googleapis.com --project=my-gcp-project

2. Create a service account

Create a dedicated service account for SKE:

gcloud iam service-accounts create ske-deployer \
  --display-name="SKE Deployer" \
  --project=my-gcp-project

3. Assign IAM roles

SKE requires predefined IAM roles grouped by feature. The core roles are always required; conditional roles are only needed if you use the corresponding feature.

Always required (11 roles)

ROLES=(
  roles/serviceusage.serviceUsageAdmin
  roles/iam.serviceAccountAdmin
  roles/resourcemanager.projectIamAdmin
  roles/datastore.owner
  roles/run.admin
  roles/artifactregistry.admin
  roles/secretmanager.admin
  roles/cloudtasks.admin
  roles/cloudscheduler.admin
  roles/logging.viewer
  roles/storage.objectAdmin
)

for role in "${ROLES[@]}"; do
  gcloud projects add-iam-policy-binding my-gcp-project \
    --member="serviceAccount:ske-deployer@my-gcp-project.iam.gserviceaccount.com" \
    --role="$role"
done

Conditional roles

Role	When needed
roles/compute.networkAdmin	Networking (VPC, subnets)
roles/cloudsql.admin	Databases (Cloud SQL)
roles/redis.admin	Caching (Memorystore)
roles/dns.admin	Custom domains (Cloud DNS)

# Add only the roles you need
gcloud projects add-iam-policy-binding my-gcp-project \
  --member="serviceAccount:ske-deployer@my-gcp-project.iam.gserviceaccount.com" \
  --role="roles/cloudsql.admin"

See the IAM Reference for details on what each role grants.

4. Create and download a key

gcloud iam service-accounts keys create ske-key.json \
  --iam-account=ske-deployer@my-gcp-project.iam.gserviceaccount.com

Keep this file secure. You’ll provide it when connecting the provider.

5. Connect the provider

ske provider:connect gcp \
  --project-id my-gcp-project \
  --credentials ./ske-key.json \
  --region us-central1

SKE validates the service account, enables required APIs, and checks permissions per feature group.

APIs enabled during bootstrap

When you connect a GCP provider, SKE automatically enables required APIs in your project:

Core APIs (always enabled)

API	Purpose
iam.googleapis.com	Service account management
run.googleapis.com	Cloud Run compute
artifactregistry.googleapis.com	Container image registry
firestore.googleapis.com	Deployment state storage
secretmanager.googleapis.com	Secret storage
cloudtasks.googleapis.com	Queue processing
cloudscheduler.googleapis.com	Scheduled tasks
logging.googleapis.com	Application logs
cloudresourcemanager.googleapis.com	Project metadata

Infrastructure APIs (enabled when needed)

API	Purpose
compute.googleapis.com	VPC networking
sqladmin.googleapis.com	Cloud SQL databases
redis.googleapis.com	Memorystore caches
dns.googleapis.com	Cloud DNS for custom domains
storage.googleapis.com	Asset storage

What gets provisioned

Resource	GCP Service	Notes
Compute	Cloud Run	Container-based services
Container registry	Artifact Registry	One repository per project
Queues	Cloud Tasks	One queue per configured queue
Scheduler	Cloud Scheduler	Jobs for Laravel scheduled tasks
Secrets	Secret Manager	Environment secrets
State	Firestore	Deployment state tracking
Logs	Cloud Logging	Structured application logs
Database	Cloud SQL	MySQL or PostgreSQL
Cache	Memorystore	Redis
Network	VPC	Subnets, firewall rules
Custom domains	Certificate Manager + Global HTTPS LB	SSL certificates and load balancing

Regions

SKE supports all GCP regions where Cloud Run is available. Each environment pins its own region.

Custom domains on GCP

Custom domains on GCP use a Global HTTPS Load Balancer with Certificate Manager for SSL. This requires the enable_lb flag on the network. See Domains for details.