Google Cloud Provider

# Application Default Credentials (recommended for local development)
gcloud auth application-default login

# Service Account key file
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"

# Workload Identity (when running in GKE)
# Credentials are automatically retrieved

# Sync from a specific project
ctrlc sync google-cloud gke --project my-project

# Continuous sync
ctrlc sync google-cloud gke --project my-project --interval 5m

identifier: projects/my-project/locations/us-central1/clusters/prod-cluster
name: prod-cluster
kind: GCP/GKE
metadata:
  project: my-project
  region: us-central1
  environment: production  # from GCP label
  team: platform           # from GCP label
config:
  endpoint: https://XXX.XXX.XXX.XXX
  version: "1.28.3-gke.1286000"

# Sync from a project
ctrlc sync google-cloud vms --project my-project

# Continuous sync
ctrlc sync google-cloud vms --project my-project --interval 5m

identifier: projects/my-project/zones/us-central1-a/instances/web-server-1
name: web-server-1
kind: GCP/VM
metadata:
  project: my-project
  zone: us-central1-a
  machine_type: e2-medium
  environment: production  # from GCP label
config:
  internal_ip: 10.128.0.2
  external_ip: 34.123.45.67

# Sync from a project
ctrlc sync google-cloud cloudsql --project my-project

# Continuous sync
ctrlc sync google-cloud cloudsql --project my-project --interval 10m

identifier: projects/my-project/instances/prod-db
name: prod-db
kind: GCP/CloudSQL
metadata:
  project: my-project
  region: us-central1
  database_version: POSTGRES_15
  tier: db-custom-4-16384
  environment: production  # from GCP label
config:
  connection_name: my-project:us-central1:prod-db
  ip_address: 10.0.0.5

# Sync from a project
ctrlc sync google-cloud cloudrun --project my-project

# Continuous sync
ctrlc sync google-cloud cloudrun --project my-project --interval 5m

identifier: projects/my-project/locations/us-central1/services/api-service
name: api-service
kind: GCP/CloudRun
metadata:
  project: my-project
  region: us-central1
  environment: production  # from GCP label
config:
  url: https://api-service-xxxxx-uc.a.run.app

apiVersion: run.googleapis.com/v1
kind: Job
metadata:
  name: ctrlplane-sync
spec:
  template:
    spec:
      containers:
        - image: ghcr.io/ctrlplanedev/cli:latest
          command:
            - ctrlc
            - sync
            - google-cloud
            - gke
            - --project
            - my-project
          env:
            - name: CTRLPLANE_API_KEY
              valueFrom:
                secretKeyRef:
                  name: ctrlplane-credentials
                  key: api-key
            - name: CTRLPLANE_WORKSPACE
              value: your-workspace-id

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ctrlplane-gcp-sync
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ctrlplane-gcp-sync
  template:
    metadata:
      labels:
        app: ctrlplane-gcp-sync
    spec:
      serviceAccountName: ctrlplane-sync
      containers:
        - name: sync
          image: ghcr.io/ctrlplanedev/cli:latest
          command:
            - ctrlc
            - sync
            - google-cloud
            - gke
            - --project
            - my-project
            - --interval
            - "5m"
          env:
            - name: CTRLPLANE_API_KEY
              valueFrom:
                secretKeyRef:
                  name: ctrlplane-credentials
                  key: api-key
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ctrlplane-sync
  annotations:
    iam.gke.io/gcp-service-account: ctrlplane-sync@my-project.iam.gserviceaccount.com

# Create service account
gcloud iam service-accounts create ctrlplane-sync

# Grant permissions
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ctrlplane-sync@my-project.iam.gserviceaccount.com" \
  --role="roles/container.viewer"

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ctrlplane-sync@my-project.iam.gserviceaccount.com" \
  --role="roles/compute.viewer"

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ctrlplane-sync@my-project.iam.gserviceaccount.com" \
  --role="roles/cloudsql.viewer"

# All production GKE clusters
type: Environment
name: Production GKE
resourceSelector: |
  resource.kind == "GCP/GKE" &&
  resource.metadata["environment"] == "production"

# US Central resources
type: Environment
name: US Central
resourceSelector: |
  resource.metadata["region"].startsWith("us-central")

# All Cloud Run services
type: Environment
name: Cloud Run Production
resourceSelector: |
  resource.kind == "GCP/CloudRun" &&
  resource.metadata["environment"] == "production"

gcloud compute instances add-labels web-server-1 \
  --labels=environment=production,team=platform,tier=critical

# Production project
ctrlc sync google-cloud gke --project prod-project --interval 5m &

# Staging project
ctrlc sync google-cloud gke --project staging-project --interval 5m &

# GKE clusters
ctrlc sync google-cloud gke --project my-project --interval 5m &

# Cloud SQL (less frequent)
ctrlc sync google-cloud cloudsql --project my-project --interval 15m &

# Cloud Run
ctrlc sync google-cloud cloudrun --project my-project --interval 5m &