> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring Your Own Cloud on GCP

> Project setup, permissions, and provisioning flow for deploying Paradime BYOC inside a dedicated GCP project.

With Bring Your Own Cloud (BYOC) on Google Cloud Platform (GCP), all the components that interact with your private data are deployed on your own GCP infrastructure and managed by the Paradime Control Plane via the Paradime Operator. This page provides step-by-step instructions for deploying Paradime BYOC on GCP.

<Note>
  BYOC is available on the [Enterprise plan](https://www.paradime.io/pricing). Contact the Paradime team at [support@paradime.io](mailto:support@paradime.io) for details.
</Note>

## Prerequisites

The bulk of the provisioning work is done remotely by Paradime automation. However, to get started, you'll need:

### Required information

* **GCP Project ID:** A dedicated GCP project ID that will exclusively host Paradime-managed infrastructure. This should be a new, isolated project created specifically for Paradime BYOC.
* **GCP Region:** The [GCP region](https://cloud.google.com/compute/docs/regions-zones) where the BYOC resources should be deployed.
* **Cloud DNS managed zone:** A public [Cloud DNS managed zone](https://cloud.google.com/dns/docs/zones) in the dedicated project for the DNS name your Paradime deployment will live under (for example `paradime.example.com`), with delegation set up from your parent domain. Paradime creates DNS records for the application endpoints in this zone and uses it for TLS certificate validation. Pass the **managed zone name** to your Paradime contact.

### Required permissions

You need the following permissions in your GCP organization or folder to complete the setup:

* **Project Creator** (`roles/resourcemanager.projectCreator`) to create a new dedicated project
* **Project IAM Admin** (`roles/resourcemanager.projectIamAdmin`) to grant permissions in the project
* **Billing Account User** (`roles/billing.user`) to link billing to the new project

If you don't have these permissions, contact your GCP organization administrator.

## Provisioning access

### Step 1: Create a dedicated GCP project

We strongly recommend creating a dedicated GCP project that will exclusively host Paradime-managed infrastructure. This project isolation approach simplifies permission management and provides clear resource boundaries.

1. Navigate to the [GCP Console](https://console.cloud.google.com/)
2. Click **Create Project**
3. Enter a project name (for example, "paradime-byoc")
4. Note the **Project ID** (not the project name), you'll need this for subsequent steps
5. Select your billing account
6. Click **Create**

<Info>
  Make sure billing is enabled for the project. You can verify this by navigating to **Billing** in the GCP Console and confirming the project is linked to an active billing account.
</Info>

### Step 2: Enable required APIs

Before granting permissions, enable the necessary GCP APIs in your dedicated project. This ensures that subsequent API calls will work correctly.

**Required APIs:**

* **Compute Engine API** (`compute.googleapis.com`) for VPC networks and compute resources
* **Kubernetes Engine API** (`container.googleapis.com`) for GKE clusters
* **Cloud Storage API** (`storage.googleapis.com`) for storage buckets used by Paradime services
* **IAM API** (`iam.googleapis.com`) for service account management
* **Cloud Resource Manager API** (`cloudresourcemanager.googleapis.com`) for project IAM operations
* **Service Networking API** (`servicenetworking.googleapis.com`) for private service connectivity
* **Cloud SQL Admin API** (`sqladmin.googleapis.com`) for the managed PostgreSQL instance
* **Memorystore for Redis API** (`redis.googleapis.com`) for the managed Redis instance
* **Filestore API** (`file.googleapis.com`) for the shared workspace file system
* **Cloud KMS API** (`cloudkms.googleapis.com`) for encryption keys used by Paradime services
* **Cloud DNS API** (`dns.googleapis.com`) for DNS records in your managed zone
* **Artifact Registry API** (`artifactregistry.googleapis.com`) for the in-project container registry that Paradime images are copied into

You can enable these APIs through the [API Library](https://console.cloud.google.com/apis/library) in the GCP Console, or use the `gcloud` command:

```bash theme={"system"}
# Set your project ID
export PROJECT_ID="your-paradime-byoc-project-id"

# Enable all required APIs
gcloud services enable \
  compute.googleapis.com \
  container.googleapis.com \
  storage.googleapis.com \
  iam.googleapis.com \
  cloudresourcemanager.googleapis.com \
  servicenetworking.googleapis.com \
  sqladmin.googleapis.com \
  redis.googleapis.com \
  file.googleapis.com \
  cloudkms.googleapis.com \
  dns.googleapis.com \
  artifactregistry.googleapis.com \
  --project=$PROJECT_ID
```

### Step 3: Grant IAM permissions

In order to manage resources in the dedicated GCP project, the Paradime service principal needs to be granted administrative permissions to a set of services.

<Info>
  Reach out to the Paradime team at [support@paradime.io](mailto:support@paradime.io) to get the **Paradime installer service account** principal used below.
</Info>

Navigate to **IAM & Admin > IAM** in your dedicated project and add the following IAM binding for the Paradime service account:

**Principal:** the Paradime installer service account shared by your Paradime contact

**Roles:**

* **Compute Admin** (`roles/compute.admin`) allows creation and management of VPC networks, subnets, routers, NAT gateways, firewall rules, IP addresses, and Private Service Connect endpoints
* **Kubernetes Engine Admin** (`roles/container.admin`) allows creation and management of GKE clusters and node pools
* **Storage Admin** (`roles/storage.admin`) allows creation and management of Cloud Storage buckets and their HMAC interoperability keys used by Paradime services
* **Cloud SQL Admin** (`roles/cloudsql.admin`) allows creation and management of the managed PostgreSQL instance
* **Redis Admin** (`roles/redis.admin`) allows creation and management of the Memorystore Redis instance
* **Filestore Editor** (`roles/file.editor`) allows creation and management of the shared workspace file system
* **Cloud KMS Admin** (`roles/cloudkms.admin`) allows creation and management of the key ring and keys used to encrypt Paradime secrets
* **DNS Administrator** (`roles/dns.admin`) allows creation of DNS records for the application endpoints in your managed zone
* **Artifact Registry Administrator** (`roles/artifactregistry.admin`) allows creation of the in-project container registry that Paradime images are copied into
* **Service Networking Admin** (`roles/servicenetworking.networksAdmin`) allows creation of the private connection between your VPC and the managed database services
* **Service Account Admin** (`roles/iam.serviceAccountAdmin`) allows creation and management of service accounts for cluster nodes and workload identity
* **Project IAM Admin** (`roles/resourcemanager.projectIamAdmin`) allows granting IAM permissions to created resources (for example, bucket access for service accounts)

<Info>
  No role allowing the creation of service account keys is required. Paradime authenticates workloads via GKE Workload Identity and uses Cloud Storage HMAC keys (covered by Storage Admin); no long-lived service account key files are created in your project.
</Info>

You can grant these permissions through the Google Cloud Console UI or using the `gcloud` command-line tool:

```bash theme={"system"}
# Set your project ID (replace with your actual project ID)
export PROJECT_ID="your-paradime-byoc-project-id"

# Set the Paradime installer service account (use the exact value shared by Paradime)
export PARADIME_SA="{PARADIME_INSTALLER_SERVICE_ACCOUNT}"

# Grant all required roles
for ROLE in \
  roles/compute.admin \
  roles/container.admin \
  roles/storage.admin \
  roles/cloudsql.admin \
  roles/redis.admin \
  roles/file.editor \
  roles/cloudkms.admin \
  roles/dns.admin \
  roles/artifactregistry.admin \
  roles/servicenetworking.networksAdmin \
  roles/iam.serviceAccountAdmin \
  roles/resourcemanager.projectIamAdmin
do
  gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$PARADIME_SA" \
    --role="$ROLE"
done
```

### Step 4: Grant Service Account User permissions

Additionally, the Paradime service account needs permission to use the default Compute Engine service account for GKE node pools.

<Info>
  Make sure you have the `PROJECT_ID` and `PARADIME_SA` environment variables set from Step 3 before running these commands.
</Info>

Run the following command to grant the necessary permissions:

```bash theme={"system"}
# Get the project number
export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')

# Grant the Paradime service account permission to use the default compute service account
gcloud iam service-accounts add-iam-policy-binding \
  ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
  --member="serviceAccount:$PARADIME_SA" \
  --role="roles/iam.serviceAccountUser" \
  --project=$PROJECT_ID
```

This allows the Paradime service account to create GKE clusters that use the project's default compute service account for worker nodes.

### Step 5: Verify setup

Before notifying Paradime, verify that all permissions and APIs are correctly configured:

```bash theme={"system"}
# Verify APIs are enabled
gcloud services list --enabled --project=$PROJECT_ID | grep -E '(compute|container|storage|iam|cloudresourcemanager|servicenetworking|sqladmin|redis|file|cloudkms|dns|artifactregistry)'

# Verify IAM bindings for the Paradime service account
gcloud projects get-iam-policy $PROJECT_ID \
  --flatten="bindings[].members" \
  --format="table(bindings.role)" \
  --filter="bindings.members:serviceAccount:$PARADIME_SA"

# Verify Service Account User permission
gcloud iam service-accounts get-iam-policy \
  ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
  --project=$PROJECT_ID
```

If all commands return the expected results, you're ready to proceed with deployment.

## Deployment

The actual deployment is done by Paradime automation. All that's left to do is notify your Paradime contact at [support@paradime.io](mailto:support@paradime.io) that access has been granted, and pass along your GCP Project ID, Region, and Cloud DNS managed zone name.

After deployment, Paradime manages the following resources in your dedicated project:

* A VPC network with subnets, Cloud Router, and Cloud NAT for outbound connectivity
* A GKE cluster with node pools for running Paradime applications
* A Cloud SQL PostgreSQL instance, a Memorystore Redis instance, and a Filestore file system
* Cloud Storage buckets and an Artifact Registry repository for Paradime data and images
* Cloud KMS keys for encrypting Paradime secrets
* DNS records for the application endpoints in your managed zone
* Service accounts and IAM bindings for secure resource access
* Firewall rules and network policies for security


## Related topics

- [Bring Your Own Cloud on AWS](/products/settings/deployment/byoc/aws.md)
- [Bring Your Own Cloud on Azure](/products/settings/deployment/byoc/azure.md)
- [Deployment options](/products/settings/deployment/index.md)
- [Administration](/products/settings/index.md)
- [GCP Cloud Functions](/integrations/gcp-cloud-function.md)