# Google Cloud SDK (>= 450)
brew install --cask google-cloud-sdk
# Linux: https://cloud.google.com/sdk/docs/install

# Terraform (>= 1.5)
brew tap hashicorp/tap && brew install hashicorp/tap/terraform

# kubectl
brew install kubectl

# Helm (>= 3.12)
brew install helm

# Verify
gcloud version
terraform version
kubectl version --client
helm version

gcloud auth login
gcloud config set project <your-project-id>
gcloud auth application-default login

# Terraform enables these automatically — or enable manually:
gcloud services enable \
  container.googleapis.com \
  sqladmin.googleapis.com \
  redis.googleapis.com \
  storage.googleapis.com \
  iam.googleapis.com \
  servicenetworking.googleapis.com \
  cloudresourcemanager.googleapis.com \
  --project <your-project-id>

terraform/gcp/
├── Makefile                    ← All commands — start here (make help)
├── infra/
│   ├── main.tf                 ← Root config — enables APIs, wires all sub-modules
│   ├── variables.tf            ← All configurable inputs with defaults
│   ├── locals.tf               ← Naming convention: {prefix}-{env}-{resource}-{suffix}
│   ├── outputs.tf              ← Cluster, DB, Redis, Storage outputs
│   ├── modules/
│   │   ├── networking/         ← VPC, subnet, Cloud Router, Cloud NAT, private service connection
│   │   ├── k8s-cluster/        ← GKE Standard/Autopilot, node pool, Workload Identity
│   │   ├── postgres/           ← Cloud SQL PostgreSQL, HA, private IP, deletion protection
│   │   ├── redis/              ← Memorystore Redis, HA tier, private IP
│   │   ├── storage/            ← GCS bucket with TTL lifecycle rules (ttl_s/ ttl_l/)
│   │   ├── k8s-bootstrap/      ← Namespaces, K8s secrets, cert-manager, KEDA
│   │   ├── ingress/            ← Envoy Gateway (Gateway API), GatewayClass, HTTPRoute
│   │   ├── iam/                ← Workload Identity service accounts and IAM bindings
│   │   ├── dns/                ← Cloud DNS managed zone (optional)
│   │   └── secrets/            ← Secret Manager secrets (optional)
│   └── scripts/
│       ├── _common.sh          ← Shared helpers (tfvar parser, color output)
│       ├── preflight.sh        ← Pre-Terraform tooling / auth / API checks
│       ├── quickstart.sh       ← Interactive setup wizard — generates terraform.tfvars
│       ├── setup-env.sh        ← Exports TF_VAR_* secrets from Secret Manager (source it)
│       ├── status.sh           ← Deployment health check
│       ├── manage-secrets.sh   ← Secret Manager CRUD (list/get/set/validate/delete)
│       └── tf-run.sh           ← Terraform wrapper that auto-sources setup-env.sh
└── helm/
    ├── scripts/
    │   ├── deploy.sh               ← Helm deploy — values chain + Workload Identity annotation
    │   ├── get-kubeconfig.sh       ← gcloud get-credentials wrapper
    │   ├── init-values.sh          ← Generates values-overrides.yaml from Terraform outputs
    │   ├── preflight-check.sh      ← Pre-deploy validation (tools, cluster, helm repo)
    │   └── uninstall.sh            ← Helm uninstall + operator resource cleanup
    └── values/
        ├── values.yaml             ← GCP base Helm values (Gateway, GCS config) — tracked in git
        ├── values-overrides.yaml   ← Live file — gitignored, generated by init-values.sh
        └── examples/               ← Source templates — tracked in git, copied by init-values.sh

# Required
project_id            = "<your-gcp-project-id>"
environment           = "prod"
name_prefix           = "ls"
langsmith_license_key = "<your-license-key>"
langsmith_domain      = "langsmith.<your-domain>"

# Region / zone
region = "us-west2"
zone   = "us-west2-a"

# GKE
gke_use_autopilot   = false
gke_machine_type    = "e2-standard-4"
gke_min_nodes       = 2
gke_max_nodes       = 10
gke_release_channel = "REGULAR"

# Cloud SQL
postgres_source   = "external"
postgres_version  = "POSTGRES_15"
postgres_tier     = "db-custom-2-8192"
postgres_password = "<strong-password>"   # or: export TF_VAR_postgres_password=...

# Memorystore Redis
redis_source      = "external"
redis_memory_size = 5
redis_version     = "REDIS_7_0"

# ClickHouse
clickhouse_source = "in-cluster"

# Ingress + TLS
install_ingress        = true
ingress_type           = "envoy"
tls_certificate_source = "letsencrypt"
letsencrypt_email      = "<ops@your-domain>"

# Sizing + addon flags
sizing_profile = "production"
# enable_deployments   = true
# enable_agent_builder = true
# enable_insights      = true
# enable_polly         = true

backend "gcs" {
  bucket = "<your-terraform-state-bucket>"
  prefix = "langsmith/state"
}

cd terraform/gcp

# First time? Run the interactive setup wizard:
make quickstart   # generates terraform.tfvars from guided prompts

# Set up secrets in Secret Manager (auto-generates passwords + Fernet keys)
# Must be sourced — not executed — to export TF_VAR_* into your shell
source infra/scripts/setup-env.sh

make preflight    # checks gcloud auth, required APIs, and IAM roles
make init
make plan
make apply

make kubeconfig

kubectl get nodes
kubectl get ns

kubectl get pods -n cert-manager
kubectl get pods -n keda
kubectl get secrets -n langsmith

cd terraform/gcp

make init-values   # reads Terraform outputs → writes values-overrides.yaml
make deploy        # helm upgrade --install with the full values chain

kubectl get pods -n langsmith

# Get Gateway external IP — create an A record pointing your domain here
EXTERNAL_IP=$(kubectl get svc -n envoy-gateway-system \
  -l gateway.envoyproxy.io/owning-gateway-name=langsmith-gateway \
  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')
echo "A record: $EXTERNAL_IP → <your-langsmith-domain>"

# Verify TLS certificate
kubectl get certificate -n langsmith

# infra/terraform.tfvars
enable_deployments = true

cd terraform/gcp

make apply          # pushes enable_deployments flag (KEDA managed by Terraform)
make init-values    # picks up enable_deployments = true
make deploy         # rolls out host-backend + listener + operator

kubectl get pods -n langsmith | grep -E "host-backend|listener|operator"
# Expected: all Running

kubectl get lgp -n langsmith      # list LangSmith Deployments
kubectl get crd | grep langchain  # operator CRDs registered
kubectl get pods -n keda          # KEDA running

# infra/terraform.tfvars
enable_agent_builder = true

cd terraform/gcp

make init-values    # picks up enable_agent_builder = true
make deploy

kubectl get pods -n langsmith | grep -E "tool-server|trigger-server|bootstrap"
# Expected: tool-server Running, trigger-server Running, agentBootstrap Completed

kubectl rollout restart deployment langsmith-frontend -n langsmith

# infra/terraform.tfvars
enable_insights = true
enable_polly    = true   # requires Polly license entitlement

cd terraform/gcp

make init-values    # picks up both flags
make deploy

kubectl get pods -n langsmith | grep -E "clio|polly"
# Expected: clio Running, smith-polly Running (operator-spawned)

kubectl get pods -n langsmith -w   # watch until all new pods stabilize

cd terraform/gcp

make quickstart              # generates terraform.tfvars interactively
source infra/scripts/setup-env.sh   # exports TF_VAR_* into shell (must be sourced)
make secrets                 # verify secrets stored correctly in Secret Manager
make init && make plan && make apply   # ~25–35 min
make kubeconfig
make init-values
make deploy

make status            # full deployment health check
make status-quick      # skip Secret Manager + K8s queries
make deploy            # re-deploy after changing Helm values or upgrading chart
make init-values       # re-generate values after Terraform changes
make kubeconfig        # refresh cluster credentials
make secrets           # manage Secret Manager secrets interactively (list/get/set/validate)

# infra/terraform.tfvars — set flags, then: make init-values && make deploy
enable_deployments   = true   # required for Agent Builder and Polly
enable_agent_builder = true   # requires enable_deployments = true
enable_insights      = true
enable_polly         = true   # requires enable_deployments = true + Polly entitlement
enable_usage_telemetry = true # optional extended telemetry

# infra/terraform.tfvars — then: make init-values && make deploy
sizing_profile = "production"