GCP - Hilt Documentation

Hilt runs as a single-tenant platform inside your own GCP project. A GKE cluster hosts ingest, enrichment, and the dashboard; collectors on your hosts stream telemetry into an in-cluster Kafka bus; ClickHouse Cloud (GCP) is the analytics database; Cloud SQL Postgres holds dashboard auth. Product images are pulled from Hilt’s Artifact Registry. All customer telemetry stays in your project.

Services

Service	Role
GKE	Managed Kubernetes for ingest, enrichment, dashboard, and in-cluster Kafka
In-cluster Kafka (KRaft)	Event streaming between collectors and enrichment
ClickHouse Cloud (GCP)	Analytics database (private Service Connect later; public over Cloud NAT in v1)
Cloud SQL (PostgreSQL 15)	Dashboard auth database (private IP)
Cloud Storage	App configuration (auto-update toggle) and Terraform state
Artifact Registry	Workloads pull Hilt release images (`us-central1-docker.pkg.dev/hilt-release/hilt`)
Certificate Manager	TLS for GKE HTTPS Gateways (`{name}.hilt.ai`)
Cloud NAT	Outbound for image pulls and ClickHouse Cloud

Network topology

You bring an existing VPC with at least two private subnets
Collectors reach {name}-ingest.hilt.ai and {name}-edr.hilt.ai over HTTPS Gateways (GKE Gateway API)
Dashboard is served at https://{name}.hilt.ai
Workload Identity binds GKE service accounts to Google service accounts (no JSON keys)
Outbound internet is Cloud NAT for GAR pulls and ClickHouse Cloud; no public node IPs

Image delivery

Hilt publishes product images to Artifact Registry in project hilt-release:

us-central1-docker.pkg.dev/hilt-release/hilt/<service>:<tag>

Your project’s GKE node service account (hilt-gke-nodes@PROJECT) and auto-update service account are granted roles/artifactregistry.reader when Hilt enrolls the project. Pods pull those images directly; a customer Artifact Registry mirror is optional. The installer image the apply runs from is:

us-central1-docker.pkg.dev/hilt-release/hilt/hilt-deploy:main

Provisioning

Hilt provisions the data plane with Terraform via hilt-deploy (cloud: gcp):

You provide a GCP project, VPC, two private subnets, and a ClickHouse Cloud GCP hostname
Hilt enrolls the project on dns-broker (*.hilt.ai) and grants GAR pull
hilt-deploy apply creates GKE, Cloud SQL, Kafka, Gateways, and workloads
After Certificate Manager is ACTIVE, HTTPS Gateways serve the dashboard and collectors
Collectors are deployed to your hosts using the Linux and macOS collector guides

First apply can keep HTTP load balancers only (enable_https_frontends: false) until certificates are issued; production stacks turn HTTPS on.

v1 scope

Not in the GCP v1 path (same posture as the installer feature gates):

TRACE ML classification (enable_classification)
Managed Kafka (in-cluster KRaft is the default; OAUTHBEARER managed Kafka is follow-up)
Prime-usage / fleet-digest / agent-download (AWS control-plane buckets)
Client VPN (use IAP or dashboard_ingress_cidr_blocks)