THE FIELD GUIDE / OPERATIONS
Dedicated GCP integration node
Isolate cloud tooling and identity while retaining the target’s SSH trust and recovery semantics.
Give cloud integration a distinct runtime
The optional gcp-integration Docker node has its own identity, configuration, heartbeat and readiness checks and appears in deployment health. It supports complete, controller-only and remote-worker topologies, with explicit controller/worker connectivity to the supported service and tunnels.
Use a bounded authenticated interface
Scoped fixed operations cover GCP authentication checks, project/zone/instance lookup, connection verification and IAP transport workflows. Requests do not accept arbitrary cloud or shell commands from callers or AI. Per-target SSH keys, pinned fingerprints, deadlines and interrupted-operation recovery stay intact.
Provision cloud identity deliberately
Keep Google Cloud CLI dependencies and cloud credential/configuration state in the integration runtime. Use least-privilege IAM or federation, protected persistent state and explicit rotation/backup procedures. Authentication, permission, API and tunnel errors are actionable and redacted; credentials do not appear in browser diagnostics.
Migrate without losing connection coverage
Use the repository’s GCP installation/upgrade tooling and connectivity checks to move from the existing GCP-ready app/worker image arrangement. Match supported component versions and verify non-production instance access, controller/worker routing and target fingerprints before broadening use. The Google Cloud & IAP guide retains the current installer entry point.
Treat outages as incomplete work
Credential expiry, node restart, unavailable tunnels, permissions and network failure remain distinct states. Avoid duplicate target mutations when a request or tunnel is lost; inspect operation and recovery records before retry. Container startup alone is not evidence that cloud access and target operations are ready.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗