Google Cloud Platform on Northflank

You can use Northflank with an existing Google Cloud Platform project, or create a new one.

New GCP project setup

1. Open your GCP console and create a new project, or select an existing one.
2. Ensure billing is enabled
3. Enable the Kubernetes Engine API and Cloud Resource Manager API

Select the integration features you need before assigning Google Cloud roles. Northflank shows the required roles and permissions for that selection.

For Docker Registries, grant Artifact Registry Reader (roles/artifactregistry.reader). For Docker Registry Push, also grant Artifact Registry Writer (roles/artifactregistry.writer). See Google's Artifact Registry access guidance for role details.

For BYOC cluster deployment, grant Service Account User (roles/iam.serviceAccountUser) and Kubernetes Engine Admin (roles/container.admin), or roles with equivalent permissions. Additional features, such as a custom VPC, require the permissions shown in Northflank. Registry-only integrations do not need these Kubernetes roles.

The list below covers the base cluster permissions. Use the current list in Northflank for your selected features.

A cross-project service account lets Northflank access your Google Cloud project without a service account key that you manage. Northflank creates a service account, and you grant that account access to your project.

For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters.

1. Open Cloud → Provider links in Northflank.
2. Open the GCP provider link form .
3. Under Basic information, enter a Name. Select the features you need under Desired features.
4. In Credentials, select Cross-project service account.
5. Enter your Google project ID.
6. Select Create provider link.
7. On the new provider link's Edit tab, copy the Service account email from Credentials.
8. Open the IAM page in your Google Cloud project.
9. Select Grant access. Enter the copied email as the principal.
10. Assign the roles shown for your selected features in Northflank.
11. Save the assignment in Google Cloud.
12. In Northflank, select Verify all permissions under Credentials.

Wait for the updated permissions before you retry an operation.

After access is available, use the integration for your registry or create a cluster.

You can integrate Google Cloud with a service account key. Use a cross-project service account when it supports your selected features to avoid managing a long-lived key.

For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters.

1. Open Cloud → Provider links in Northflank.
2. Open the GCP provider link form .
3. Under Basic information, enter a Name. Select the features you need under Desired features.
4. In Credentials, select Service account key. Review the required roles.
5. Open IAM & Admin → Service Accounts in your Google Cloud project.
6. Create a service account with a name and description.
7. Assign the roles required for your selected features.
8. Open the service account's Keys tab. Create a JSON key.
9. Copy the downloaded JSON into Service account key (keyfile.json) in Northflank.
10. Make sure that Google project ID matches your project.
11. Select Create provider link.

Wait for the updated permissions before you retry an operation.

You can update the key and Google project ID in the integration.

To successfully deploy a cluster on GCP using Northflank you must have the required resources available to your account for your desired region.

Check the node types you wish to deploy and ensure your account has sufficient quotas for your required node type, vCPU, and disk type for your desired regions.

You can manage your Google quota settings from your quotas page on the IAM and admin page of your Google Cloud project. You can filter the list by resource and region.

For example, to increase the number of node pools you can deploy on Google Cloud using the n2-standard-4 node type in the region europe-west2, filter the quota list with region:europe-west2 and n2_cpus, select the quota from the list, and click edit quotas.

To add a new cluster, navigate to the clusters page in your account settings and click create cluster.

Enter a name for the cluster and select GCP as the cloud provider. Choose your integration credentials and select the region to deploy in.

The Google project ID field will be automatically filled based on the provided credentials.

Configure node pools

You can now configure the node pools for your cluster. Node pools can also be added, deleted, and updated after creating your cluster. Click add node pool to add another pool.

Each node can schedule up to 256 pods (minus system pods). The actual number of pods per node will usually be limited by resource requests and request modifiers for smaller nodes.

Cluster networking limits

The number of workloads that can be deployed to a GCP cluster is limited by the available number of pod and service IP addresses, allocated by CIDR block.

Northflank configures GCP clusters with a CIDR block of /14 for pods and a CIDR block of /20 for services, which means you will be able to deploy up to 4000 services, jobs, and addons to your cluster before facing networking constraints.

See deploy and scale node pools for more information on configuring nodes and node pools.

Configure advanced options

After adding your initial node pools you can configure advanced options for the cluster, such as build infrastructure and resource request modifiers.

When you create the cluster Northflank will begin installing system components in node pools according to their capacity. This may take up to 20 minutes.

Private GCP nodes have no public IP addresses, which prevents direct connections from the internet to the nodes.

To use private GCP nodes, select Enable private node IPs in the node-pool form. The corresponding API field is gcp.enablePrivateNodes. Private nodes require Cloud NAT on the subnet for internet egress.

Node privacy and workload ingress are separate choices. Workloads on private nodes can still receive traffic through a public ingress load balancer.

Eligible GCP clusters also support private ingress. See Public and VPC ingress for availability, configuration, and client connectivity requirements.