google cloud platform

Real GCP infrastructure, provisioned by an agent with Terraform.

Production cloud experience on Oracle Cloud (OCI) maps directly onto GCP — the primitives are the same under different names. To prove the ramp rather than assert it, I stood up a full GCP stack with infrastructure-as-code in a few hours. It is live right now.

● terraform apply — 5 resources, real GCP, one command

01 · what is running now

Declared in Terraform and applied by an agent. Least-privilege IAM, scale-to-zero compute, keyless workload identity ready.

Cloud Run

A live, public serverless service that scales to zero when idle.

Cloud Storage

An object bucket with uniform bucket-level access.

Artifact Registry

A Docker registry for container images.

Service account + IAM

An identity scoped to object access on that bucket — nothing broader.

▸ open the live Cloud Run service

terraform apply · real GCP

$ terraform apply -auto-approve
google_storage_bucket.docs: Creating...
google_service_account.app: Creating...
google_artifact_registry_repository.images: Creating...
google_storage_bucket.docs: Creation complete after 2s
google_service_account.app: Creation complete after 13s
google_artifact_registry_repository.images: Creation complete after 21s
google_cloud_run_v2_service.api: Creating...
google_cloud_run_v2_service.api: Creation complete after 12s

Apply complete! Resources: 5 added, 0 changed, 0 destroyed.

Outputs:
bucket_url        = "gs://****-forge-docs"
artifact_registry = "europe-west1-docker.pkg.dev/****/forge-images"
cloud_run_uri     = "https://forge-api-jz5cvs6w4a-ew.a.run.app"
service_account   = "forge-app@****.iam.gserviceaccount.com"

Project identifiers masked (****). The Cloud Run URL above is the intentional public demo — click it.

02 · OCI → GCP, primitive by primitive

Why the ramp is days, not months: the fundamentals transfer. Different console, same building blocks — understand what sits underneath and the mapping is mechanical.

Capability	Oracle Cloud (OCI)	Google Cloud (GCP)
Identity & access	IAM, dynamic groups, instance principals	IAM, service accounts, Workload Identity
Networking	VCN, subnets, security lists / NSGs	VPC, subnets, firewall rules
Managed Kubernetes	OKE	GKE (Standard / Autopilot)
Object storage	Object Storage	Cloud Storage (GCS)
Container registry	OCIR	Artifact Registry
Serverless containers	Container Instances / Functions	Cloud Run / Cloud Functions
Compute	Compute	Compute Engine
Secrets	Vault	Secret Manager
Observability	Logging & Monitoring	Cloud Logging / Monitoring, Managed Prometheus
Infrastructure-as-code	Terraform · oci provider	Terraform · google provider

03 · the Terraform

One config, provider-agnostic patterns. GKE Autopilot sits behind a toggle; Workload Identity is wired so pods authenticate with no static keys.

main.tf · google provider (excerpt)

resource "google_storage_bucket" "docs" {
  name                        = "${var.project_id}-forge-docs"
  location                    = var.region
  uniform_bucket_level_access = true
}

resource "google_artifact_registry_repository" "images" {
  location      = var.region
  repository_id = "forge-images"
  format        = "DOCKER"
}

resource "google_service_account" "app" {
  account_id = "forge-app"
}

# least privilege: object access to the one bucket, nothing broader
resource "google_storage_bucket_iam_member" "app_objects" {
  bucket = google_storage_bucket.docs.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.app.email}"
}

resource "google_cloud_run_v2_service" "api" {
  name     = "forge-api"
  location = var.region
  template {
    service_account = google_service_account.app.email
    scaling { min_instance_count = 0 }   # scale to zero
  }
}

# keyless pod auth — Workload Identity (enabled with GKE)
resource "google_service_account_iam_member" "workload_identity" {
  count  = var.enable_gke ? 1 : 0
  role   = "roles/iam.workloadIdentityUser"
  member = "serviceAccount:${var.project_id}.svc.id.goog[forge/forge-app]"
}

04 · local-equivalent proof (zero cost)

The same GCP shapes, emulated locally in Docker — so development and CI never touch billing, and the code path is identical to the real API.

Cloud Storage emulator

fake-gcs-server — buckets & objects created against the real GCS JSON API.

Pub/Sub emulator

The messaging pattern — topics & subscriptions, seeded and running.

local GCS emulator · same API surface

$ curl -X POST "localhost:4443/storage/v1/b?project=demo" -d '{"name":"forge-docs"}'
→ HTTP 200   bucket created
$ curl "localhost:4443/storage/v1/b?project=demo"
→ buckets: ["forge-docs"]