Deploying to GKE

llms.txt lists every page for an agent

Optional: hand this page to your coding agentThe steps work by hand too.

Read https://intentius.io/chant/lexicons/gcp/gke-kubernetes/.
Set up the cross-lexicon project the page describes: the gcp lexicon for the Config Connector resources, the k8s lexicon for the workloads, with the service account emails flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built manifests.
List the deploy steps (`npm run bootstrap`, `npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/lexicons/gcp/gke-kubernetes/.
Set up the cross-lexicon project the page describes: the gcp lexicon for the Config Connector resources, the k8s lexicon for the workloads, with the service account emails flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built manifests.
List the deploy steps (`npm run bootstrap`, `npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Optional: hand this page to your coding agent

Read https://intentius.io/chant/lexicons/gcp/gke-kubernetes/.
Set up the cross-lexicon project the page describes: the gcp lexicon for the Config Connector resources, the k8s lexicon for the workloads, with the service account emails flowing through `.env` into `config.ts`.
Run `npm run build` and `npx chant lint src`, and open a pull request with the source and the built manifests.
List the deploy steps (`npm run bootstrap`, `npm run deploy-infra`, `npm run load-outputs`, `npm run apply`) for me to run in order, and do not run them or kubectl against any cluster yourself.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

One chant project can hold GCP infrastructure and Kubernetes workloads in the same src/ directory. The GCP lexicon produces Config Connector YAML; the K8s lexicon produces kubectl-ready YAML.

Architecture

┌─────────────────────────────────────────────────────────┐
│  GCP Lexicon (Config Connector)                         │
│  ├── VPC + Subnets + Cloud NAT                          │
│  ├── GKE Cluster + Node Pool (Workload Identity)        │
│  ├── 4× GCP Service Accounts                           │
│  ├── IAM Policy Members (WI bindings + role grants)     │
│  └── Cloud DNS Managed Zone                             │
└────────────────────┬────────────────────────────────────┘
                     │ SA emails via .env → config.ts
┌────────────────────▼────────────────────────────────────┐
│  K8s Lexicon                                            │
│  ├── Namespace (quotas, limits, network policy)         │
│  ├── AutoscaledService (Deployment + HPA + PDB)         │
│  ├── WorkloadIdentityServiceAccount (GKE)               │
│  ├── GceIngress + GkeExternalDnsAgent                   │
│  ├── GcePdStorageClass                                  │
│  ├── GkeFluentBitAgent (Cloud Logging)                  │
│  └── GkeOtelCollector (Cloud Trace + Monitoring)        │
└─────────────────────────────────────────────────────────┘

Cross-lexicon value flow

Config Connector resource outputs map to K8s composite props via .env:

CC Output	K8s Composite Prop
`APP_GSA_EMAIL`	`WorkloadIdentityServiceAccount({ gcpServiceAccountEmail })`
`EXTERNAL_DNS_GSA_EMAIL`	`GkeExternalDnsAgent({ gcpServiceAccountEmail })`
`FLUENT_BIT_GSA_EMAIL`	`GkeFluentBitAgent({ gcpServiceAccountEmail })`
`OTEL_GSA_EMAIL`	`GkeOtelCollector({ gcpServiceAccountEmail })`
`GCP_PROJECT_ID`	`gcpProjectId` / `projectId` props
`GKE_CLUSTER_NAME`	`clusterName` props

Values go from .env to config.ts to the K8s source files. npm run load-outputs refreshes .env after any infra deploy.

K8s composites used

The K8s lexicon has GKE composites for the workloads:

WorkloadIdentityServiceAccount — ServiceAccount with GCP SA email annotation
GceIngress — Ingress with GCE annotations, static IP, managed certificates
GkeGateway — Gateway API with GKE gateway classes (alternative to GceIngress)
GcePdStorageClass — GCE Persistent Disk CSI StorageClass
FilestoreStorageClass — ReadWriteMany StorageClass via Filestore
GkeExternalDnsAgent — Cloud DNS record management
GkeFluentBitAgent — Cloud Logging via DaemonSet
GkeOtelCollector — Cloud Trace + Cloud Monitoring
ConfigConnectorContext — Config Connector namespace bootstrap

See the GKE Composites reference for full API details.

Deploy workflow

npm run bootstrap      # One-time: create GKE cluster with Config Connector
npm run build          # Build CC YAML + K8s manifests
npm run deploy-infra   # Apply Config Connector resources
npm run configure-kubectl  # Set up kubeconfig
npm run load-outputs   # Write SA emails to .env
npm run build:k8s      # Rebuild K8s with real values
npm run apply          # kubectl apply