---
title: "GCP Infrastructure Diagrams"
slug: gcp-infrastructure-diagrams
section: Platform
status: stable
description: "Live-sourced architecture diagrams for GCP project skilled-script-469819-f2 — the Alliance Abroad development platform."
last-updated: 2026-07-07
---

# GCP Infrastructure Diagrams

# GCP Infrastructure Diagrams

Live-sourced architecture diagrams for GCP project skilled-script-469819-f2 — the Alliance Abroad development platform. Covers GKE workloads, Cloud Run services, data layer, CI/CD pipeline, and all external integrations.

## Overview

> **Source of truth**
>
> These diagrams were generated from a live inspection of the GCP project via the Alliance MCP Gateway on 2026-07-08. They reflect the actual running state of the infrastructure at that point in time, including replica counts, ingress URLs, secret sync status, Cloud SQL tiers, Pub/Sub topics, Cloud Build triggers, and all registered service accounts.

| Diagram | Scope |
| --- | --- |
| 1 — High-Level Overview | One-page summary: actors, DNS ingress, GKE, Cloud Run, data layer, and all external integrations |
| 2 — GKE Cluster Deep Dive | All 6 namespaces with replica counts, ingress URLs, ExternalSecret sync status, ESO ClusterSecretStores, and the OCR → Document AI private path |
| 3 — Cloud Run Services | All 29 services: 12 MCP servers, 11 autonomous agents, and 3 infrastructure services with descriptions |
| 4 — Data Layer | All 8 Cloud SQL instances (tier, IP, region), Secret Manager categories, Pub/Sub topics, and the full ESO secret distribution flow |
| 5 — CI/CD & Deployment | GitHub repos, Cloud Build trigger, GitHub Actions services, GKE vs Cloud Run deployment targets, and all 5 deployment service accounts |
| 6 — External Integrations | All 12 third-party services with caller, transport, purpose, and auth details |

## 1 — High-Level Overview

## 2 — GKE Cluster Deep Dive

> **Active issue: host-portal-qa**
>
> The host-portal-qa pod is currently in CreateContainerConfigError with a corresponding SecretSyncedError on its ExternalSecret. The QA ClusterSecretStore was created only 12 days ago and may have a missing or misconfigured secret reference. Investigate the host-portal-qa-secrets ExternalSecret in the host-portal-qa namespace.

## 3 — Cloud Run Services

## 4 — Data Layer

## 5 — CI/CD & Deployment

## 6 — External Integrations

## Known Issues at Time of Capture

| Component | Issue | Severity |
| --- | --- | --- |
| host-portal-qa (GKE) | CreateContainerConfigError + SecretSyncedError — pod cannot start due to missing/misconfigured secret reference in the QA ClusterSecretStore | High |
| Portal 3 MCP Registry (PPPToo) | Stale endpoint description: POST /api/extract-passport-data was listed as 'OpenAI GPT-4o' — corrected to GCP Document AI via Private Service Connect | Medium |
| Cloud Build triggers | Only 1 active trigger (globus-mcp-development). All other services rely on GitHub Actions. No trigger exists for the applicant portal or host portal GKE deployments. | Info |