GCP on Allen Ziegenfushttps://allenz.net/tags/gcp/Recent content in GCP on Allen ZiegenfusHugoen-usSat, 16 May 2026 00:00:00 +0000Environment-stable table ownership: surviving cross-environment restore with IAM database authhttps://allenz.net/writing/environment-stable-table-ownership-surviving-cross-environment-restore-with-iam-database-auth/Sat, 16 May 2026 00:00:00 +0000https://allenz.net/writing/environment-stable-table-ownership-surviving-cross-environment-restore-with-iam-database-auth/Cloud SQL IAM database auth breaks cross-environment restores because table ownership encodes a per-environment service account. Make ownership environment-independent by owning every table as cloudsqlsuperuser.When Terraform owns a shared resource as if it were dedicatedhttps://allenz.net/writing/when-terraform-owns-a-shared-resource-as-if-it-were-dedicated/Mon, 04 May 2026 00:00:00 +0000https://allenz.net/writing/when-terraform-owns-a-shared-resource-as-if-it-were-dedicated/When a per-cluster Terraform module owns a project-global, shared resource, tearing down one cluster quietly breaks the others. Why resources with different lifecycles can’t share state — and the bootstrap-module fix.Tearing down a managed-Kubernetes deployment without leaving a tailhttps://allenz.net/writing/tearing-down-a-managed-kubernetes-deployment-without-leaving-a-tail/Tue, 28 Apr 2026 00:00:00 +0000https://allenz.net/writing/tearing-down-a-managed-kubernetes-deployment-without-leaving-a-tail/A field guide to deleting a GKE or EKS deployment cleanly when the cluster, the in-cluster GitOps/Crossplane layer, and Terraform all disagree about who owns cleanup — orphans, deletion order, and the stuck cases.Use GKE Connect Gateway to protect your private control planehttps://allenz.net/writing/use-gke-connect-gateway-to-protect-your-private-control-plane/Tue, 21 Apr 2026 00:00:00 +0000https://allenz.net/writing/use-gke-connect-gateway-to-protect-your-private-control-plane/Reach a private GKE cluster’s API server without a bastion or authorized-networks — using the GKE-native Connect Gateway, with GCP IAM outside the gateway and Kubernetes RBAC inside.A clone-and-go installer: GCP Cloud Shell tutorials + Infrastructure Managerhttps://allenz.net/writing/a-clone-and-go-installer-gcp-cloud-shell-tutorials--infrastructure-manager/Thu, 19 Mar 2026 00:00:00 +0000https://allenz.net/writing/a-clone-and-go-installer-gcp-cloud-shell-tutorials--infrastructure-manager/Turning a many-step platform install — APIs, IAM, Terraform, state, secrets — into a browser-only, guided, clone-and-go onboarding with GCP Cloud Shell tutorials and Infrastructure Manager.