GCP Compute BYOC
The gcp-compute profile realizes one durable replica intent as one private Compute Engine VM. A
deterministic resource name lets reconciliation adopt the VM after an uncertain create response.
InferCrane does not store a service-account key, assign a public IP, or infer provider pricing.
The adapter is hermetically qualified. Real GCP GPU execution is deferred to consolidated
manual qualification and must not be described as production-qualified yet.
gcloud client. Authenticate with Application
Default Credentials using an identity allowed to create, describe, list, and delete only the
intended project resources. For Docker Compose, set GCLOUD_CONFIG_DIR to a read-only gcloud
configuration directory. Prefer workload identity when the control plane runs on GCP; do not put a
service-account key in a DeploymentSpec. Configure all fields together:
Validate identity, Compute API access, and the configured zone without creating capacity:
The attached service account reads the worker credential from Secret Manager at startup. Grant it
only secret-version access to that secret. The subnet must allow the control plane to reach the
runtime port over private addressing.
Deploy
The advanced provider.adapter field selects an exact infrastructure profile. It is optional while
only one default adapter exists for a cloud/runtime pair.
The operation remains durable if the terminal disconnects. Inventory and deletion are restricted to
resources labeled infercrane-managed=true; real cleanup must still be confirmed during manual
qualification.
The guarded real-provider harness is available when an isolated paid project is ready:
Other GCP profiles
gcp-mig, gcp-gke, and gcp-vertex have independent registered capability boundaries. They are
not aliases for Compute Engine and are not executable or locally qualified in this milestone until
their own lifecycle contracts pass. infercrane integrations --output json is authoritative.