Bring Your Own Cloud on GCP

With Bring Your Own Cloud (BYOC) on Google Cloud Platform (GCP), all the components that interact with your private data are deployed on your own GCP infrastructure and managed by the Paradime Control Plane via the Paradime Operator. This page provides step-by-step instructions for deploying Paradime BYOC on GCP.

BYOC is available on the Enterprise plan. Contact the Paradime team at support@paradime.io for details.

Prerequisites

The bulk of the provisioning work is done remotely by Paradime automation. However, to get started, you’ll need:

Required information

GCP Project ID: A dedicated GCP project ID that will exclusively host Paradime-managed infrastructure. This should be a new, isolated project created specifically for Paradime BYOC.
GCP Region: The GCP region where the BYOC resources should be deployed.
Cloud DNS managed zone: A public Cloud DNS managed zone in the dedicated project for the DNS name your Paradime deployment will live under (for example paradime.example.com), with delegation set up from your parent domain. Paradime creates DNS records for the application endpoints in this zone and uses it for TLS certificate validation. Pass the managed zone name to your Paradime contact.

Required permissions

You need the following permissions in your GCP organization or folder to complete the setup:

Project Creator (roles/resourcemanager.projectCreator) to create a new dedicated project
Project IAM Admin (roles/resourcemanager.projectIamAdmin) to grant permissions in the project
Billing Account User (roles/billing.user) to link billing to the new project

If you don’t have these permissions, contact your GCP organization administrator.

Provisioning access

Step 1: Create a dedicated GCP project

We strongly recommend creating a dedicated GCP project that will exclusively host Paradime-managed infrastructure. This project isolation approach simplifies permission management and provides clear resource boundaries.

Navigate to the GCP Console
Click Create Project
Enter a project name (for example, “paradime-byoc”)
Note the Project ID (not the project name), you’ll need this for subsequent steps
Select your billing account
Click Create

Make sure billing is enabled for the project. You can verify this by navigating to Billing in the GCP Console and confirming the project is linked to an active billing account.

Step 2: Enable required APIs

Before granting permissions, enable the necessary GCP APIs in your dedicated project. This ensures that subsequent API calls will work correctly. Required APIs:

Compute Engine API (compute.googleapis.com) for VPC networks and compute resources
Kubernetes Engine API (container.googleapis.com) for GKE clusters
Cloud Storage API (storage.googleapis.com) for storage buckets used by Paradime services
IAM API (iam.googleapis.com) for service account management
Cloud Resource Manager API (cloudresourcemanager.googleapis.com) for project IAM operations
Service Networking API (servicenetworking.googleapis.com) for private service connectivity
Cloud SQL Admin API (sqladmin.googleapis.com) for the managed PostgreSQL instance
Memorystore for Redis API (redis.googleapis.com) for the managed Redis instance
Filestore API (file.googleapis.com) for the shared workspace file system
Cloud KMS API (cloudkms.googleapis.com) for encryption keys used by Paradime services
Cloud DNS API (dns.googleapis.com) for DNS records in your managed zone
Artifact Registry API (artifactregistry.googleapis.com) for the in-project container registry that Paradime images are copied into

You can enable these APIs through the API Library in the GCP Console, or use the gcloud command:

# Set your project ID
export PROJECT_ID="your-paradime-byoc-project-id"

# Enable all required APIs
gcloud services enable \
  compute.googleapis.com \
  container.googleapis.com \
  storage.googleapis.com \
  iam.googleapis.com \
  cloudresourcemanager.googleapis.com \
  servicenetworking.googleapis.com \
  sqladmin.googleapis.com \
  redis.googleapis.com \
  file.googleapis.com \
  cloudkms.googleapis.com \
  dns.googleapis.com \
  artifactregistry.googleapis.com \
  --project=$PROJECT_ID

Step 3: Grant IAM permissions

In order to manage resources in the dedicated GCP project, the Paradime service principal needs to be granted administrative permissions to a set of services.

Reach out to the Paradime team at support@paradime.io to get the Paradime installer service account principal used below.

Navigate to IAM & Admin > IAM in your dedicated project and add the following IAM binding for the Paradime service account: Principal: the Paradime installer service account shared by your Paradime contact Roles:

Compute Admin (roles/compute.admin) allows creation and management of VPC networks, subnets, routers, NAT gateways, firewall rules, IP addresses, and Private Service Connect endpoints
Kubernetes Engine Admin (roles/container.admin) allows creation and management of GKE clusters and node pools
Storage Admin (roles/storage.admin) allows creation and management of Cloud Storage buckets and their HMAC interoperability keys used by Paradime services
Cloud SQL Admin (roles/cloudsql.admin) allows creation and management of the managed PostgreSQL instance
Redis Admin (roles/redis.admin) allows creation and management of the Memorystore Redis instance
Filestore Editor (roles/file.editor) allows creation and management of the shared workspace file system
Cloud KMS Admin (roles/cloudkms.admin) allows creation and management of the key ring and keys used to encrypt Paradime secrets
DNS Administrator (roles/dns.admin) allows creation of DNS records for the application endpoints in your managed zone
Artifact Registry Administrator (roles/artifactregistry.admin) allows creation of the in-project container registry that Paradime images are copied into
Service Networking Admin (roles/servicenetworking.networksAdmin) allows creation of the private connection between your VPC and the managed database services
Service Account Admin (roles/iam.serviceAccountAdmin) allows creation and management of service accounts for cluster nodes and workload identity
Project IAM Admin (roles/resourcemanager.projectIamAdmin) allows granting IAM permissions to created resources (for example, bucket access for service accounts)

No role allowing the creation of service account keys is required. Paradime authenticates workloads via GKE Workload Identity and uses Cloud Storage HMAC keys (covered by Storage Admin); no long-lived service account key files are created in your project.

You can grant these permissions through the Google Cloud Console UI or using the gcloud command-line tool:

# Set your project ID (replace with your actual project ID)
export PROJECT_ID="your-paradime-byoc-project-id"

# Set the Paradime installer service account (use the exact value shared by Paradime)
export PARADIME_SA="{PARADIME_INSTALLER_SERVICE_ACCOUNT}"

# Grant all required roles
for ROLE in \
  roles/compute.admin \
  roles/container.admin \
  roles/storage.admin \
  roles/cloudsql.admin \
  roles/redis.admin \
  roles/file.editor \
  roles/cloudkms.admin \
  roles/dns.admin \
  roles/artifactregistry.admin \
  roles/servicenetworking.networksAdmin \
  roles/iam.serviceAccountAdmin \
  roles/resourcemanager.projectIamAdmin
do
  gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$PARADIME_SA" \
    --role="$ROLE"
done

Step 4: Grant Service Account User permissions

Additionally, the Paradime service account needs permission to use the default Compute Engine service account for GKE node pools.

Make sure you have the PROJECT_ID and PARADIME_SA environment variables set from Step 3 before running these commands.

Run the following command to grant the necessary permissions:

# Get the project number
export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')

# Grant the Paradime service account permission to use the default compute service account
gcloud iam service-accounts add-iam-policy-binding \
  ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
  --member="serviceAccount:$PARADIME_SA" \
  --role="roles/iam.serviceAccountUser" \
  --project=$PROJECT_ID

This allows the Paradime service account to create GKE clusters that use the project’s default compute service account for worker nodes.

Step 5: Verify setup

Before notifying Paradime, verify that all permissions and APIs are correctly configured:

# Verify APIs are enabled
gcloud services list --enabled --project=$PROJECT_ID | grep -E '(compute|container|storage|iam|cloudresourcemanager|servicenetworking|sqladmin|redis|file|cloudkms|dns|artifactregistry)'

# Verify IAM bindings for the Paradime service account
gcloud projects get-iam-policy $PROJECT_ID \
  --flatten="bindings[].members" \
  --format="table(bindings.role)" \
  --filter="bindings.members:serviceAccount:$PARADIME_SA"

# Verify Service Account User permission
gcloud iam service-accounts get-iam-policy \
  ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
  --project=$PROJECT_ID

If all commands return the expected results, you’re ready to proceed with deployment.

Deployment

The actual deployment is done by Paradime automation. All that’s left to do is notify your Paradime contact at support@paradime.io that access has been granted, and pass along your GCP Project ID, Region, and Cloud DNS managed zone name. After deployment, Paradime manages the following resources in your dedicated project:

A VPC network with subnets, Cloud Router, and Cloud NAT for outbound connectivity
A GKE cluster with node pools for running Paradime applications
A Cloud SQL PostgreSQL instance, a Memorystore Redis instance, and a Filestore file system
Cloud Storage buckets and an Artifact Registry repository for Paradime data and images
Cloud KMS keys for encrypting Paradime secrets
DNS records for the application endpoints in your managed zone
Service accounts and IAM bindings for secure resource access
Firewall rules and network policies for security

Configuration

Environments

Environment Variables

Git Repositories

Users

Single Sign-On

Deployment

Bring Your Own Cloud on GCP

Prerequisites

Required information

Required permissions

Provisioning access

Step 1: Create a dedicated GCP project

Step 2: Enable required APIs

Step 3: Grant IAM permissions

Step 4: Grant Service Account User permissions

Step 5: Verify setup

Deployment

​Prerequisites

​Required information

​Required permissions

​Provisioning access

​Step 1: Create a dedicated GCP project

​Step 2: Enable required APIs

​Step 3: Grant IAM permissions

​Step 4: Grant Service Account User permissions

​Step 5: Verify setup

​Deployment

Prerequisites

Required information

Required permissions

Provisioning access

Step 1: Create a dedicated GCP project

Step 2: Enable required APIs

Step 3: Grant IAM permissions

Step 4: Grant Service Account User permissions

Step 5: Verify setup

Deployment