Google Cloud

Ensure all of the following are configured before linking your GCP account in Onehouse.

GCP Project

Create a dedicated GCP project for Onehouse managed resources. Onehouse will provision the GKE cluster, service accounts, and supporting infrastructure within this project.

Networking

VPC

You need a VPC in your GCP project with:

• A /16 CIDR block (e.g. 10.0.0.0/16)
• A private /20 subnet for GKE nodes (4,096 IPs) — GKE nodes and their alias pod IPs are allocated from this subnet
• NAT Gateway for outbound internet access
• Two secondary IP ranges reserved in the subnet for GKE alias IPs:
  • /20 for pods (4,096 pod IPs)
  • /24 for services (256 service IPs)

GKE uses Alias IPs, where pods get IPs from secondary ranges rather than directly from the node subnet. Even so, size the node subnet at /20 to leave room for node scaling and future growth — consistent with AWS private subnets.

Private Google Access

Enable Private Google Access on your subnet so that GKE nodes can reach GCS without routing through NAT. See GCP docs.

VPC Peering

If your data sources (Kafka clusters, databases) live in a separate GCP project or VPC, configure VPC peering between that VPC and your Onehouse VPC so the GKE cluster can reach them. See GCP docs.

Domain Allowlist

Required only if your environment has an egress firewall. The Required set below is shared across all clouds (image registries, tooling, control plane) — all Google Cloud services (GKE, GCS, Artifact Registry) are reached via .googleapis.com, which is already included. The Conditional set is only needed when the corresponding feature or connector is enabled.

Required — allowlist for every Google Cloud deployment

Shared across all clouds (image registries, tooling, control plane) — all Google Cloud services (GKE, GCS, Artifact Registry) are reached via .googleapis.com:

• .onehouse.ai — control plane APIs, gateway, telemetry, image distribution
• .docker.io — Docker Hub registry
• production.cloudflare.docker.com — Docker Hub blob CDN (Cloudflare)
• production.cloudfront.docker.com — Docker Hub blob CDN (AWS CloudFront)
• docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com
• docker-registry-production.d24a988e385e0074d717b6bdaea58f0d.r2.cloudflarestorage.com
• auth.docker.io.cdn.cloudflare.net
• .cloudfront.net — registry / image blob delivery
• .gcr.io — Google Container Registry image pulls
• .pkg.dev — Google Artifact Registry image pulls
• .googleapis.com — Google Cloud services (GKE, GCS) + gcr.io / pkg.dev blob storage
• .k8s.io — Kubernetes registry (registry.k8s.io)
• ghcr.io — spark-operator and flink-operator images
• .quay.io — Strimzi, Prometheus, and Calico images
• registry.terraform.io — Terraform provider/module registry
• releases.hashicorp.com — Terraform binaries
• get.helm.sh — Helm binary downloads
• github.com — Terraform providers and modules
• .github.com
• .githubusercontent.com
• .github.io
• .strimzi.io — Strimzi Kafka operator
• .pagerduty.com — Onehouse operational alerting

Conditional — only if the corresponding feature or connector is enabled

• .confluent.cloud — Confluent / Kafka sources
• .jupyter.org — notebooks
• .debezium.io — Debezium CDC connectors
• .amazonaws.com — Debezium CDC image (Onehouse ECR) and S3 artifacts
• public.ecr.aws — Datadog agent images
• datadoghq.com — Datadog telemetry (site-specific, e.g. us5.datadoghq.com)
• docker.elastic.co — Elasticsearch images
• docker-auth.elastic.co
• .snowflakecomputing.com — Snowflake source/sink
• .databricks.com — Databricks source/sink
• .splunkcloud.com — Splunk log sink
• .slack.com — Slack notifications
• api.honeycomb.io — Honeycomb telemetry
• .openai.com — AI features
• apachesuperset.docker.scarf.sh — Superset dashboards image

Private Service Connect (optional)

For environments requiring no public internet traversal, Onehouse supports routing all control plane traffic over Private Service Connect. To enable this, set privateServiceConnect.enabled = true in the customer stack and provide a vpcName and subnetCidr. Onehouse will create a forwarding rule and private DNS zone (onehouse.ai) in your project.

Service Account

Create a Terraform executor service account with Owner or Editor permissions:

terraform@${GCP_PROJECT_ID}.iam.gserviceaccount.com

Generate and download a JSON key file for this service account — it is required to run the Terraform stack.

Storage

Terraform State Bucket

Create a GCS bucket named onehouse-customer-bucket-<RequestIdPrefix> in the same region as your deployment. This stores Terraform state and configuration.

Lakehouse Bucket

Create a GCS bucket for your data lakehouse in the same region as your deployment.

GKE Cluster Endpoint Access

The GKE cluster API endpoint is private. The Onehouse control plane connects to it from its NAT IP — you must ensure this is not blocked by your VPC firewall rules:

• 54.153.81.1/32

If your firewall blocks inbound access to the cluster endpoint from this IP, Onehouse will not be able to reach the cluster after it is created.

APIs

Enable the following GCP APIs in your project before running Terraform:

• Cloud Resource Manager API — required for Terraform to manage project resources
• Kubernetes Engine API — required for Onehouse to provision and manage the GKE cluster

Tooling

Ensure the following are installed in the environment where you will run the Terraform stack:

Tool	Purpose
Terraform 1.11.0	Infrastructure deployment
gcloud CLI	GCP authentication and project management
yq	YAML processing for config.yaml
jq	JSON processing
curl	Checksum verification during install