GCP

​

Before you run Terraform

​

Projects and APIs

• A project for agent hosts. The host controller can create instances anywhere in the hosts’ project, and change or delete only its own. We recommend a project of its own for agent hosts: set it as the module’s host_project_id. Otherwise hosts run in the cluster’s project.
• APIs enabled in those projects: Compute Engine, IAM, IAM Service Account Credentials and Cloud Storage (compute.googleapis.com, iam.googleapis.com, iamcredentials.googleapis.com, storage.googleapis.com).

​

Cluster

• A VPC-native GKE cluster (Autopilot or Standard) with Workload Identity. Autopilot clusters always have it.
• Ingress: the chart serves Tembo through GKE’s Ingress with a Google-managed certificate (ingress.gke.enabled), so you don’t need a certificate in advance. GKE issues it once your hostname resolves to the Ingress.

​

VPC and subnetwork

• Cloud NAT and Private Google Access. Hosts have no external addresses. They need NAT for egress to your Tembo URL, Tembo’s API, LLM providers and code hosts such as GitHub, and Private Google Access for Cloud Storage and IAM.
• The cluster’s control plane reachable from it. Hosts read their configuration through the Kubernetes API, at the cluster’s private endpoint. If the cluster enforces master authorized networks on its private endpoint, add the subnetwork’s range to them. Hosts in a different region than the cluster need the control plane’s global access.
• Your own Postgres or Redis, if you use them instead of the chart’s, must accept connections from the subnetwork. Hosts reach the chart’s bundled Postgres and Redis through internal load balancers.

​

Organization policies

• compute.disableNestedVirtualization not enforced on the hosts’ project: hosts run agents in VMs.
• compute.requireShieldedVm not enforced: the agent host image boots with legacy BIOS.
• If you restrict compute.trustedImageProjects, allow Tembo’s image project, projects/tembo-prod.

​

Quotas

• N2 CPUs and local SSD in the hosts’ region. The defaults often cover a few hosts.
• Persistent Disk SSD in the hosts’ region: each host’s 100 GB boot disk counts toward it, as do GKE’s node disks. It’s 500 GB in new projects.
• CPUs (all regions), a project-wide limit that also counts the cluster’s nodes. It’s 32 in new projects, which isn’t enough for a single host.

​

Permissions to apply

​

Install the module

module "tembo" {
  source = "git::https://github.com/tembo/terraform-google-tembo-agent-host.git?ref=v0.1.0"

  project_id           = "<your-project>"
  cluster_name         = "<your-gke-cluster>"
  cluster_location     = "us-central1"
  kubernetes_namespace = "tembo"
  release_name         = "tembo"

  # A project of its own for agent hosts (recommended).
  # host_project_id = "<your-hosts-project>"

  host_subnetwork = "projects/<your-project>/regions/us-central1/subnetworks/<hosts>"

  # Your Tembo URL, so browsers can upload files.
  object_storage_cors_allowed_origins = ["https://tembo.example.com"]
}

output "helm_values" {
  value = module.tembo.helm_values
}

terraform init
terraform apply

• The host controller’s service account, bound to the chart’s service account with Workload Identity. It can change and delete only instances and disks named with your install’s prefix, launch them only into your subnetwork, and attach only the hosts’ service account.
• The agent hosts’ service account, with access to the install’s bucket.
• The firewall rule for the hosts’ manager.
• A GCS bucket for project images, session snapshots and file uploads, and the control plane’s service account to use it. To use a bucket you have, set object_storage_bucket_name.

​

Configure the chart with its outputs

terraform output -json helm_values > tembo-gcp.json

• The host controller, with its service account, the hosts’ project and your install’s instance name prefix.
• A host class named default, with your subnetwork, the hosts’ service account, n2-custom-32-65536 with four local SSDs, and Tembo’s stable agent host image.
• A pool named default, of one to three hosts.
• Object storage, with the bucket and the control plane’s service account.

​

Need Help?