On Google Cloud (GKE)

Terraform for all of it is in verana-deploy-examples (Autopilot cluster, reserved address, ingress-nginx, cert-manager, Cloud DNS record); its README states whether it has been verified. The steps below are the CLI path to the same result.

Steps

1. Cluster. A GKE Autopilot cluster is the least work: gcloud container clusters create-auto agents --region europe-west1. Autopilot provides the standard-rwo storage class.
2. Ingress controller. Install ingress-nginx with a LoadBalancer Service; Google provisions an external load balancer with a static or ephemeral address. Reserve a static address if you want the DNS record to survive recreation.
3. DNS. In Cloud DNS, create an A record agent.example.com to that address.
4. cert-manager. Install cert-manager and a Let's Encrypt ClusterIssuer with the HTTP-01 solver on class nginx.
5. Storage class. storage.storageClassName: standard-rwo.
6. Continue with Deploy on Kubernetes with Helm.

Notes

• Secrets: Secret Manager plus External Secrets Operator, or a Secret created by Cloud Build.
• Autopilot bills per pod resources; the agent's requests are small.