Skip to main content
Set up and manage your Google Cloud infrastructure using Ryvn’s provisioning tools.

​
Prerequisites

Before you begin, make sure you have:

​
Configure your environment

  1. Go to the Environments tab in the Ryvn Dashboard
  2. Click Create Environment in the top-right corner
  3. Give your environment a name (e.g. production)
  4. Select a release channel (e.g. production)
    Release channels link services to environments. When you push code changes, services publish releases to release channels. Environments subscribed to those channels automatically deploy new releases.
  5. Click Create Environment

​
Provisioning steps

  1. From your environment in the Ryvn Dashboard, click View Environment
  2. Click Self Setup
  3. Click Start Provisioning
  4. Select Google Cloud as your cloud provider
  5. Fill out the form with your Google Cloud credentials
  6. Click Continue
  7. Click Create Permissions
  8. Follow the Google Cloud-specific instructions shown in the dashboard
  9. Return to Ryvn and wait for provisioning to complete
The provisioning process is automated and typically takes 15-20 minutes. Ryvn will set up all necessary Google Cloud resources including networking, security, and compute infrastructure.

​
Grant Ryvn access to your project

Ryvn provisions through a service account in your project, ryvn-provisioner, that it can only impersonate: no key is created. The account holds the Ryvn Provisioner custom role, which lists exactly the permissions provisioning needs, plus Kubernetes Engine Admin for installing the Ryvn agent. It does not hold Owner. See the full GCP permission reference for the required grants and what each permission group covers. The dashboard shows a setup script for your project. It comes from the Ryvn API, so the role definition and the identity you trust are always current for the Ryvn instance you use:
  • On Ryvn’s hosted control plane, the script creates a Workload Identity Federation pool that trusts Ryvn’s AWS control-plane role, and ends by printing the credential configuration JSON to paste into Ryvn.
  • On a dedicated Ryvn control plane running in Google Cloud, the script grants Ryvn’s own service account roles/iam.serviceAccountTokenCreator on ryvn-provisioner. Nothing needs to be pasted back.
Re-run the script whenever Ryvn releases new provisioning capabilities; it updates the custom role in place. Whoever runs the script needs Service Usage Admin, Service Account Admin, Role Administrator and Project IAM Admin on the project, plus Workload Identity Pool Admin when a pool is created.

​
What gets created

Ryvn provisions a production-ready GKE cluster in your Google Cloud account, complete with secure networking and IAM configuration. This includes a VPC with private subnets, load balancers for service exposure, and all necessary firewall rules and service accounts.