Deploy Claude apps gateway on Google Cloud

A worked example of running Claude apps gateway on Google Cloud: Cloud Run or GKE, Cloud SQL for PostgreSQL, Secret Manager, and service-account auth to Google Cloud's Agent Platform.

This page walks through one way to run Claude apps gateway on Google Cloud. The configuration is a working example for customer-managed infrastructure rather than a supported production deployment; use it to see how the pieces fit together before adapting it to your own environment. For the platform-agnostic requirements, see the deployment guide.

This example provisions Claude apps gateway on Google Cloud with Google Cloud's Agent Platform as the model upstream, using either Cloud Run or GKE for compute. Google Workspace is the example identity provider (IdP), but any OpenID Connect (OIDC) compliant IdP works; only the oidc block changes. See Identity provider setup for per-IdP details.

What you'll build

The deployment consists of:

• Cloud Run service or GKE Deployment running the gateway container
• Artifact Registry repository for the gateway image
• Cloud SQL for PostgreSQL instance, private IP only, for the gateway's store
• Secret Manager secrets for gateway.yaml, the JWT signing key, the OIDC client secret, and the Postgres URL
• Service account with roles/aiplatform.user, attached directly on Cloud Run or bound via Workload Identity on GKE
• HTTPS front end that you provide: an internal Application Load Balancer in front of Cloud Run, which this walkthrough configures the gateway for but doesn't create, or an internal GKE Ingress of class gce-internal on GKE

Prerequisites

• A GCP project with billing enabled, and permission to create the resources above
• The gcloud CLI, authenticated with gcloud auth login, and Docker installed locally
• For the GKE track: kubectl, and a GKE cluster on the VPC created in the walkthrough below
• Access to the Claude models you need in Model Garden, in a region that publishes them