Skip to content

GCP Infrastructure Technical Guide

Overview

WorkWingman Cloud Edition operates on Google Cloud Platform (GCP). It hosts the public Multi-Page Application (MPA) built with .NET and htmx/Razor.

Compute

  • Service: Cloud Run serving the public MPA site.
  • Traffic Routing: Uses Cloud Run revisions and traffic-splitting models.
  • Revision State: Serving revision and latest-ready revision are distinct states; new revisions do not receive live traffic until traffic allocation is explicitly modified.

Container Registry & Image Strategy

  • Registry: Artifact Registry.
  • Tagging Policy: MUTABLE TAGS BANNED.
  • Immutable Artifacts: Container images are tagged exclusively with sha-<commit> and deployed by image digest.
  • Incident History: A deployment utilizing a mutable v2 tag previously caused stale application bytes to re-fire in production.

Build Pipeline

  • Automation: Cloud Build manages build execution.
  • Source Integrity: Triggered from a pinned clean worktree.
  • Substitutions: Uses _TAG parameter substitution during build steps.

Secret Management

  • Service: GCP Secret Manager stores credentials and sensitive runtime parameters.
  • Version Gotcha: Disabling a secret version does NOT cause :latest to fall back to an older enabled version. Operations must publish a new version before disabling the outdated version.

Storage

  • Service: Google Cloud Storage (GCS).
  • CMS Source of Truth: CMS content bucket serves as the canonical content store.
  • Data Guard: Enforces content integrity using SHA-256 ETag guards.

Environment & Configuration Management

  • Configuration Engine: env-ladder declares service environment variables.
  • Drift Hazard: Undeclared runtime settings create an armed drift hazard (e.g., RT-3 incident context where 7 live reader settings were undeclared and vulnerable to being stripped on ladder deploy).

IAM & Service Accounts

  • Identity & Access: TODO(verify) exact service accounts, IAM roles, and binding assignments.

Audit & Observability

  • Logging: GCP Cloud Logging (gcloud logging).
  • Attribution: Tracks principals and command executions to provide revision attribution for incident analysis.