# Google Cloud Platform on Northflank Connect your Google Cloud Platform account to manage clusters, access registries, or use other [integration features](use-other-cloud-providers-with-northflank). To add your GCP account, open Cloud → Provider links. If you already have provider links, select Create provider link. Otherwise, select Add provider link beside your provider. > [!note] > > [Click here](https://app.northflank.com/s/account/cloud/integrations/new/gcp) to create a new GCP integration. Use a [cross-project service account](#add-your-account-with-a-cross-project-service-account) when it supports your selected features. You can also connect with a [service account key](#add-your-account-with-a-service-key). After connecting the account, continue to [registry setup](https://northflank.com/docs/v1/application/run/save-registry-credentials#cloud-provider-registries) or [cluster creation](#create-a-cluster). ## Select or create your GCP project You can use Northflank with an existing Google Cloud Platform project, or create a new one. ### New GCP project setup 1. Open your [GCP console](https://console.cloud.google.com/) and create a new project, or select an existing one. 2. Ensure [billing is enabled](https://cloud.google.com/billing/docs/how-to/modify-project) 3. Enable the [Kubernetes Engine API](https://console.cloud.google.com/marketplace/product/google/container.googleapis.com) and [Cloud Resource Manager API](https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com) ## Required permissions Select the integration features you need before assigning Google Cloud roles. Northflank shows the required roles and permissions for that selection. For Docker Registries, grant Artifact Registry Reader (`roles/artifactregistry.reader`). For Docker Registry Push, also grant Artifact Registry Writer (`roles/artifactregistry.writer`). See Google's [Artifact Registry access guidance](https://cloud.google.com/artifact-registry/docs/access-control) for role details. For BYOC cluster deployment, grant Service Account User (`roles/iam.serviceAccountUser`) and Kubernetes Engine Admin (`roles/container.admin`), or roles with equivalent permissions. Additional features, such as a custom VPC, require the permissions shown in Northflank. Registry-only integrations do not need these Kubernetes roles. The list below covers the base cluster permissions. Use the current list in Northflank for your selected features. Required GCP permissions - `iam.serviceAccounts.actAs` - `iam.serviceAccounts.get` - `container.clusterRoleBindings.create` - `container.clusterRoleBindings.delete` - `container.clusterRoleBindings.get` - `container.clusterRoleBindings.list` - `container.clusterRoleBindings.update` - `container.clusterRoles.bind` - `container.clusterRoles.create` - `container.clusterRoles.escalate` - `container.clusterRoles.get` - `container.clusterRoles.list` - `container.clusterRoles.update` - `container.clusters.create` - `container.clusters.delete` - `container.clusters.get` - `container.clusters.getCredentials` - `container.clusters.list` - `container.clusters.update` - `container.configMaps.create` - `container.configMaps.get` - `container.configMaps.list` - `container.configMaps.update` - `container.customResourceDefinitions.create` - `container.customResourceDefinitions.get` - `container.customResourceDefinitions.update` - `container.daemonSets.create` - `container.daemonSets.delete` - `container.daemonSets.get` - `container.daemonSets.list` - `container.daemonSets.update` - `container.deployments.create` - `container.deployments.get` - `container.deployments.list` - `container.deployments.update` - `container.horizontalPodAutoscalers.create` - `container.horizontalPodAutoscalers.list` - `container.horizontalPodAutoscalers.update` - `container.mutatingWebhookConfigurations.create` - `container.mutatingWebhookConfigurations.list` - `container.mutatingWebhookConfigurations.update` - `container.namespaces.create` - `container.namespaces.get` - `container.namespaces.update` - `container.networkPolicies.create` - `container.networkPolicies.get` - `container.networkPolicies.update` - `container.nodes.list` - `container.operations.list` - `container.persistentVolumeClaims.list` - `container.podDisruptionBudgets.create` - `container.podDisruptionBudgets.list` - `container.podDisruptionBudgets.update` - `container.pods.list` - `container.pods.proxy` - `container.podSecurityPolicies.create` - `container.podSecurityPolicies.get` - `container.podSecurityPolicies.update` - `container.replicaSets.list` - `container.resourceQuotas.create` - `container.resourceQuotas.get` - `container.resourceQuotas.update` - `container.roleBindings.create` - `container.roleBindings.get` - `container.roleBindings.list` - `container.roleBindings.update` - `container.roles.bind` - `container.roles.create` - `container.roles.escalate` - `container.roles.get` - `container.roles.list` - `container.roles.update` - `container.runtimeClasses.list` - `container.secrets.create` - `container.secrets.get` - `container.secrets.list` - `container.secrets.update` - `container.serviceAccounts.create` - `container.serviceAccounts.delete` - `container.serviceAccounts.get` - `container.serviceAccounts.list` - `container.serviceAccounts.update` - `container.services.create` - `container.services.get` - `container.services.list` - `container.services.update` - `container.statefulSets.create` - `container.statefulSets.get` - `container.storageClasses.create` - `container.storageClasses.get` - `container.storageClasses.update` - `container.thirdPartyObjects.create` - `container.thirdPartyObjects.get` - `container.thirdPartyObjects.list` - `container.thirdPartyObjects.update` - `container.validatingWebhookConfigurations.create` - `container.validatingWebhookConfigurations.get` - `container.validatingWebhookConfigurations.list` - `container.validatingWebhookConfigurations.update` - `container.volumeSnapshotClasses.create` - `container.volumeSnapshotClasses.get` - `container.volumeSnapshotClasses.update` ## Add your account with a cross-project service account A cross-project service account lets Northflank access your Google Cloud project without a service account key that you manage. Northflank creates a service account, and you grant that account access to your project. > [!note] Requirements > > You will need the following to get started: > > - A [Google Cloud project](#select-or-create-your-gcp-project) > - Permission to grant the [required roles](#required-permissions) in that project > - For cluster deployment: sufficient [quotas](#check-your-quotas) to deploy your cluster For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters. 1. Open Cloud → Provider links in Northflank. 2. Open the [GCP provider link form](https://app.northflank.com/s/account/cloud/integrations/new/gcp). 3. Under Basic information, enter a Name. Select the features you need under Desired features. 4. In Credentials, select Cross-project service account. 5. Enter your Google project ID. 6. Select Create provider link. 7. On the new provider link's Edit tab, copy the Service account email from Credentials. 8. Open the [IAM page](https://console.cloud.google.com/iam-admin/iam) in your Google Cloud project. 9. Select Grant access. Enter the copied email as the principal. 10. Assign the roles shown for your selected features in Northflank. 11. Save the assignment in Google Cloud. 12. In Northflank, select Verify all permissions under Credentials. > [!note] After changing permissions > > Google Cloud can take time to apply new permissions. An operation can fail before those changes apply. Wait for the updated permissions before you retry an operation. After access is available, use the integration for your registry or [create a cluster](#create-a-cluster). ## Add your account with a service key You can integrate Google Cloud with a service account key. Use a [cross-project service account](#add-your-account-with-a-cross-project-service-account) when it supports your selected features to avoid managing a long-lived key. > [!note] Requirements > > You will need the following to get started: > > - A [Google Cloud project](#select-or-create-your-gcp-project) > - Permission to create service accounts and service account keys > - Permission to grant the [required roles](#required-permissions) in that project > - For cluster deployment: sufficient [quotas](#check-your-quotas) to deploy your cluster For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters. 1. Open Cloud → Provider links in Northflank. 2. Open the [GCP provider link form](https://app.northflank.com/s/account/cloud/integrations/new/gcp). 3. Under Basic information, enter a Name. Select the features you need under Desired features. 4. In Credentials, select Service account key. Review the required roles. 5. Open IAM & Admin → Service Accounts in your Google Cloud project. 6. Create a service account with a name and description. 7. Assign the roles required for your selected features. 8. Open the service account's Keys tab. Create a JSON key. 9. Copy the downloaded JSON into Service account key (keyfile.json) in Northflank. 10. Make sure that Google project ID matches your project. 11. Select Create provider link. > [!note] After changing permissions > > Google Cloud can take time to apply new permissions. An operation can fail before those changes apply. Wait for the updated permissions before you retry an operation. You can update the key and Google project ID in the integration. > [!warning] Keep access to existing resources > > Keep access to existing resources when you change these values. If you change the project while it still contains Northflank clusters, Northflank cannot manage those clusters. Deleting clusters directly in Google Cloud can leave unused resources. ## Check your quotas To successfully deploy a cluster on GCP using Northflank you must have the required resources available to your account for your desired region. [Check the node types](deploy-and-scale-node-pools#select-node-type) you wish to deploy and ensure your account has sufficient quotas for your required node type, vCPU, and disk type for your desired regions. You can manage your [Google quota settings](https://cloud.google.com/docs/quota_detail/view_manage) from your [quotas page](https://console.cloud.google.com/iam-admin/quotas) on the IAM and admin page of your Google Cloud project. You can filter the list by resource and region. For example, to increase the number of node pools you can deploy on Google Cloud using the `n2-standard-4` node type in the region `europe-west2`, filter the quota list with `region:europe-west2` and `n2_cpus`, select the quota from the list, and click edit quotas. ## Create a cluster To add a new cluster, navigate to the clusters page in your account settings and click create cluster. > [!note] > > [Click here](https://app.northflank.com/s/account/cloud/clusters/new/gcp) to create a new GCP cluster. ![Create a new cluster in the Northflank application](https://assets.northflank.com/documentation/v1/application/bring-your-own-cloud/create-a-kubernetes-cluster-with-Northflank/create-cluster.png) Enter a name for the cluster and select GCP as the cloud provider. Choose your integration credentials and select the region to deploy in. The Google project ID field will be automatically filled based on the provided credentials. ### Configure node pools You can now configure the node pools for your cluster. Node pools can also be added, deleted, and updated after creating your cluster. Click add node pool to add another pool. > [!note] Minimum cluster requirements > > Each cluster requires at least one node pool, and a combined minimum of 8 vCPU and 16GB memory across all node pools. Each node can schedule up to 256 pods (minus system pods). The actual number of pods per node will usually be limited by resource requests and [request modifiers](configure-your-cluster#configure-resources) for smaller nodes. #### Cluster networking limits The number of workloads that can be deployed to a GCP cluster is limited by the available number of pod and service IP addresses, allocated by CIDR block. Northflank configures GCP clusters with a CIDR block of `/14` for pods and a CIDR block of `/20` for services, which means you will be able to deploy up to 4000 services, jobs, and addons to your cluster before facing networking constraints. See [deploy and scale node pools](deploy-and-scale-node-pools) for more information on configuring nodes and node pools. ### Configure advanced options After adding your initial node pools you can configure advanced options for the cluster, such as build infrastructure and resource request modifiers. When you create the cluster Northflank will begin installing system components in node pools according to their capacity. This may take up to 20 minutes. ## Deploy to private nodes Private GCP nodes have no public IP addresses, which prevents direct connections from the internet to the nodes. To use private GCP nodes, select Enable private node IPs in the node-pool form. The corresponding API field is `gcp.enablePrivateNodes`. Private nodes require Cloud NAT on the subnet for internet egress. Node privacy and workload ingress are separate choices. Workloads on private nodes can still receive traffic through a public ingress load balancer. Eligible GCP clusters also support private ingress. See [Public and VPC ingress](./configure-your-cluster#public-and-vpc-ingress) for availability, configuration, and client connectivity requirements. ## Next steps - [Configure your Kubernetes cluster: Manage your clusters on other cloud providers using Northflank.](/v1/application/bring-your-own-cloud/configure-your-cluster) - [Deploy node pools: Configure and deploy node pools on a Kubernetes cluster with Northflank.](/v1/application/bring-your-own-cloud/deploy-and-scale-node-pools) - [Deploy workloads to your cluster: Deploy services, jobs, and addons to your own cluster, and configure workloads to schedule on specific node pools.](/v1/application/bring-your-own-cloud/deploy-workloads-to-your-cluster) - [Run GPU workloads: Deploy GPU workloads on Northflank for AI, machine learning, HPC workloads, and other tasks.](/v1/application/gpu-workloads/gpus-on-northflank)