> ## Documentation Index
> Fetch the complete documentation index at: https://infercrane.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Compute BYOC

> Configure the private, identity-based GCP Compute provider adapter.

# GCP Compute BYOC

The `gcp-compute` profile realizes one durable replica intent as one private Compute Engine VM. A
deterministic resource name lets reconciliation adopt the VM after an uncertain create response.
InferCrane does not store a service-account key, assign a public IP, or infer provider pricing.

<Warning>
  The adapter is hermetically qualified. Real GCP GPU execution is deferred to consolidated
  manual qualification and must not be described as production-qualified yet.
</Warning>

## Configure

The production image contains a checksum-pinned `gcloud` client. Authenticate with Application
Default Credentials using an identity allowed to create, describe, list, and delete only the
intended project resources. For Docker Compose, set `GCLOUD_CONFIG_DIR` to a read-only gcloud
configuration directory. Prefer workload identity when the control plane runs on GCP; do not put a
service-account key in a DeploymentSpec. Configure all fields together:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
export INFERCRANE_GCP_PROJECT='acme-production'
export INFERCRANE_GCP_ZONE='europe-west4-a'
export INFERCRANE_GCP_SUBNET='private-inference'
export INFERCRANE_GCP_MACHINE_TYPE='g2-standard-4'
export INFERCRANE_GCP_GPU='nvidia-l4'
export INFERCRANE_GCP_SERVICE_ACCOUNT='runtime@acme-production.iam.gserviceaccount.com'
export INFERCRANE_GCP_VM_IMAGE='projects/cos-cloud/global/images/cos-stable-QUALIFIED_VERSION'
export INFERCRANE_GCP_WORKER_SECRET='infercrane-worker-key'
export INFERCRANE_GCP_CONTAINER_IMAGE='REGISTRY/IMAGE@sha256:QUALIFIED_DIGEST'
export GCLOUD_CONFIG_DIR="$HOME/.config/gcloud"
```

Validate identity, Compute API access, and the configured zone without creating capacity:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
infercrane doctor --gcp
```

The attached service account reads the worker credential from Secret Manager at startup. Grant it
only secret-version access to that secret. The subnet must allow the control plane to reach the
runtime port over private addressing.

## Deploy

The advanced `provider.adapter` field selects an exact infrastructure profile. It is optional while
only one default adapter exists for a cloud/runtime pair.

```yaml theme={"theme":{"light":"github-light-default","dark":"vesper"}}
apiVersion: infercrane.dev/v1
kind: Deployment
name: qwen-gcp
model:
  id: Qwen/Qwen3-8B
runtime:
  engine: vllm
compute:
  mode: elastic
resources:
  gpu: nvidia-l4
provider:
  cloud: gcp
  adapter: gcp-compute
  region: europe-west4
scaling:
  min_replicas: 1
  max_replicas: 1
```

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
infercrane deploy deployment.yaml --idempotency-key qwen-gcp-initial
```

The operation remains durable if the terminal disconnects. Inventory and deletion are restricted to
resources labeled `infercrane-managed=true`; real cleanup must still be confirmed during manual
qualification.

The guarded real-provider harness is available when an isolated paid project is ready:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
./scripts/portable-provider-acceptance.sh gcp --approve-paid-resources
```

## Other GCP profiles

`gcp-mig`, `gcp-gke`, and `gcp-vertex` have independent registered capability boundaries. They are
not aliases for Compute Engine and are not executable or locally qualified in this milestone until
their own lifecycle contracts pass. `infercrane integrations --output json` is authoritative.