> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP

> Hilt's single-tenant deployment architecture and provisioning on GCP.

Hilt runs as a single-tenant platform inside your own GCP project. A GKE cluster hosts ingest, enrichment, and the dashboard; collectors on your hosts stream telemetry into an in-cluster Kafka bus; ClickHouse Cloud (GCP) is the analytics database; Cloud SQL Postgres holds dashboard auth. Product images are pulled from Hilt's Artifact Registry. All customer telemetry stays in your project.

***

## Services

| Service | Role |
| :- | :- |
| GKE | Managed Kubernetes for ingest, enrichment, dashboard, and in-cluster Kafka |
| In-cluster Kafka (KRaft) | Event streaming between collectors and enrichment |
| ClickHouse Cloud (GCP) | Analytics database (private Service Connect later; public over Cloud NAT in v1) |
| Cloud SQL (PostgreSQL 15) | Dashboard auth database (private IP) |
| Cloud Storage | App configuration (auto-update toggle) and Terraform state |
| Artifact Registry | Workloads pull Hilt release images (`us-central1-docker.pkg.dev/hilt-release/hilt`) |
| Certificate Manager | TLS for GKE HTTPS Gateways (`{name}.hilt.ai`) |
| Cloud NAT | Outbound for image pulls and ClickHouse Cloud |

***

## Network topology

* You bring an existing VPC with at least two private subnets
* Collectors reach `{name}-ingest.hilt.ai` and `{name}-edr.hilt.ai` over HTTPS Gateways (GKE Gateway API)
* Dashboard is served at `https://{name}.hilt.ai`
* Workload Identity binds GKE service accounts to Google service accounts (no JSON keys)
* Outbound internet is Cloud NAT for GAR pulls and ClickHouse Cloud; no public node IPs

***

## Image delivery

Hilt publishes product images to Artifact Registry in project `hilt-release`:

```text theme={null}
us-central1-docker.pkg.dev/hilt-release/hilt/<service>:<tag>
```

Your project's GKE node service account (`hilt-gke-nodes@PROJECT`) and auto-update service account are granted `roles/artifactregistry.reader` when Hilt enrolls the project. Pods pull those images directly; a customer Artifact Registry mirror is optional.

The installer image the apply runs from is:

```text theme={null}
us-central1-docker.pkg.dev/hilt-release/hilt/hilt-deploy:main
```

***

## Provisioning

Hilt provisions the data plane with Terraform via `hilt-deploy` (`cloud: gcp`):

1. You provide a GCP project, VPC, two private subnets, and a ClickHouse Cloud GCP hostname
2. Hilt enrolls the project on dns-broker (`*.hilt.ai`) and grants GAR pull
3. `hilt-deploy apply` creates GKE, Cloud SQL, Kafka, Gateways, and workloads
4. After Certificate Manager is ACTIVE, HTTPS Gateways serve the dashboard and collectors
5. Collectors are deployed to your hosts using the [Linux](https://hilt.ai/docs/linux-collector/layout.md) and [macOS](https://hilt.ai/docs/macos-collector/layout.md) collector guides

First apply can keep HTTP load balancers only (`enable_https_frontends: false`) until certificates are issued; production stacks turn HTTPS on.

***

## v1 scope

Not in the GCP v1 path (same posture as the installer feature gates):

* TRACE ML classification (`enable_classification`)
* Managed Kafka (in-cluster KRaft is the default; OAUTHBEARER managed Kafka is follow-up)
* Prime-usage / fleet-digest / agent-download (AWS control-plane buckets)
* Client VPN (use IAP or `dashboard_ingress_cidr_blocks`)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.