Skip to content

Deploy to GKE

Status: Current | Last reviewed: 2026-05-28

Deploys to Google Kubernetes Engine. Sentinel uses this path; customer GCP environments use the same chart with a different values file.

Cluster

Aspect Value
Cluster name (Sentinel) sentinel-dev
Namespace trueserve
Helm release trueserve
Values file values-cloud-gcp.yaml

One-time setup

  1. Create the cluster with at least two node pools:
  2. default for application services.
  3. media with nodeSelector node-pool: media, taint media=true:NoSchedule, large MTU. See media-pool-tuning.md.
  4. Reserve a regional static IP for the ingress (kubectl apply -f ingress.yaml referencing the IP name).
  5. Reserve a second static IP for SIP/media if not using a regional LB.
  6. Create the trueserve-master-key secret with MASTER_ENCRYPTION_KEY.
  7. Configure the DNS zone *.<your-domain> to point at the ingress IP.
  8. Install cert-manager with a Let's Encrypt or ACM Private CA issuer.

Deploy

helm upgrade --install trueserve charts/trueserve-stack \
  -f charts/trueserve-stack/values-cloud-gcp.yaml \
  --namespace trueserve --create-namespace

For Sentinel specifically, use the GitHub Actions workflow sentinel-deploy-gke.yml rather than running Helm directly. The workflow lints, renders, and applies; gives you a deploy log; and stamps the deployment in the audit trail.

Sentinel promotion

Use the /promote-to-sentinel <service> skill to promote a per-service image. It opens a PR updating values-cloud-gcp.yaml.<service>.image.tag and dispatches the deploy workflow. See promote-to-sentinel.md.

Cloud-managed services in GCP

In-cluster Managed equivalent
Postgres Cloud SQL for PostgreSQL
Redis Memorystore
MinIO GCS (note: conversation-api needs S3-SDK rewrite; see swap doc)
RabbitMQ self-managed in cluster
Neo4j Neo4j Aura

Toggle via <service>.enabled: false plus the appropriate connection-string env vars. See cloud-managed-swap.md.

Observability

Wire otel-collector to Cloud Operations or a third-party APM. The chart ships with a Cloud Operations exporter ready to enable.

Verifying

  1. kubectl get pods -n trueserve — every pod ready.
  2. kubectl get ingress -n trueserve — your hosts are bound.
  3. Hit https://status.<your-domain> — status page reports green.
  4. From the ai-manager UI, run a test call. Watch ai-orchestrator logs.

See also