Deploy on Google Cloud (Cloud Run)

To deploy SUPERWISE® Sentinel on Google Cloud, run the Sentinel gateway container on Cloud Run with --min-instances=1 and --no-cpu-throttling, its three identity values in Secret Manager, and its public URL registered as SENTINEL_EXTERNAL_HOST. Cloud Run supplies the HTTPS endpoint and certificate, so no load balancer is required; the two flags compensate for its per-request CPU model.

Before you start

• Complete Before you deploy: create the Sentinel, and have SENTINEL_ID, SW_CLIENT_ID, and SW_CLIENT_SECRET in your shell.
• The gcloud CLI, signed in, with deploy access to the project.
• The commands below also use TEAM (a name for this gateway's resources), PROJECT_ID, and REGION.

1. Store the identity values

SA="sentinel-gw-${TEAM}@${PROJECT_ID}.iam.gserviceaccount.com"
gcloud iam service-accounts create "sentinel-gw-${TEAM}"

# Per gateway: one secret per team
gcloud secrets create "SENTINEL_ID_${TEAM}" --replication-policy=automatic
printf '%s' "$SENTINEL_ID" | gcloud secrets versions add "SENTINEL_ID_${TEAM}" --data-file=-
gcloud secrets add-iam-policy-binding "SENTINEL_ID_${TEAM}" \
  --member="serviceAccount:${SA}" --role="roles/secretmanager.secretAccessor"

# Per organization: create once, then grant this gateway read access
for n in SW_CLIENT_ID SW_CLIENT_SECRET; do
  gcloud secrets describe "$n" >/dev/null 2>&1 || {
    gcloud secrets create "$n" --replication-policy=automatic
    printf '%s' "${!n}" | gcloud secrets versions add "$n" --data-file=-; }
  gcloud secrets add-iam-policy-binding "$n" \
    --member="serviceAccount:${SA}" --role="roles/secretmanager.secretAccessor"
done

2. Deploy, then register the URL

gcloud run deploy "sentinel-gateway-${TEAM}" \
  --image="us-central1-docker.pkg.dev/admina33d6818/sentinel-public/sentinel:latest" \
  --region="$REGION" --port=8000 --timeout=3600 \
  --min-instances=1 --no-cpu-throttling \
  --service-account="$SA" --allow-unauthenticated \
  --update-secrets="SENTINEL_ID=SENTINEL_ID_${TEAM}:latest,SW_CLIENT_ID=SW_CLIENT_ID:latest,SW_CLIENT_SECRET=SW_CLIENT_SECRET:latest"

GATEWAY_URL=$(gcloud run services describe "sentinel-gateway-${TEAM}" \
  --region="$REGION" --format="value(status.url)")

gcloud run services update "sentinel-gateway-${TEAM}" --region="$REGION" \
  --update-env-vars="SENTINEL_EXTERNAL_HOST=${GATEWAY_URL}"

--timeout=3600 keeps Cloud Run from cutting long streaming responses short. See Raise the request timeout.

3. Verify the gateway

The Sentinel turns Active in the SUPERWISE app within about a minute. First check that the container is serving. /healthz answers 200 OK:

curl -i "$GATEWAY_URL"/healthz

HTTP/1.1 200 OK
...
{"status":"ok"}

/healthz shows only that the gateway is up. Then confirm a guardrail fires with POST /test, as described in Verify the gateway.

Restrict access later

To restrict an already-deployed service, drop the allUsers binding and grant roles/run.invoker to specific identities. gcloud run services update has no --allow-unauthenticated flag, so use add-iam-policy-binding.

Update or remove it

To run a newer image, deploy the service again with the same gcloud run deploy command. To remove the gateway, delete the service. The Sentinel's configuration stays in the SUPERWISE app.

gcloud run services delete "sentinel-gateway-${TEAM}" --region="$REGION"

Common errors

The Sentinel drops to Pending within 10 minutes

The service is on Cloud Run's defaults, which allocate CPU only during a request and stop the heartbeat between calls. Deploy with --min-instances=1 and --no-cpu-throttling. See step 2.

Long responses are cut short

The request timeout is below the length of the response. Deploy with --timeout=3600. See step 2.

gcloud run services update rejects --allow-unauthenticated

That command has no such flag. Change access with gcloud run services add-iam-policy-binding. See Restrict access later.

Get Sentinel: Create a free SUPERWISE account.

See also

• Deploy a gateway: every way to deploy, and what a team gateway needs on any platform.
• Deploy on AWS (ECS Express Mode) and Deploy on Azure (Container Apps).
• Deploy with Helm on Kubernetes: GKE and any other cluster.
• Gateway reference: environment variables, routes, and states.