┌──────────────────────────────────────────────────────────────────────────────┐
│ VERTRO PORTAL │
├──────────────────────────────────────────────────────────────────────────────┤
│ App Team submits a guided request │
│ │
│ • Application name • Application type / runtime │
│ • Environments • Predefined compute profile │
│ • Required Google Cloud services │
└─────────────────────────────────────┬────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ VERTRO ORCHESTRATOR │
├─────────────────────────────────────┤
│ • Validate the request │
│ • Apply approved defaults │
│ • Generate desired state │
│ • Create repositories and PRs │
└──────────────────┬──────────────────┘
│
▼
┌─────────────────────────────────────┐
│ GIT REVIEW AND APPROVAL │
├─────────────────────────────────────┤
│ Generated changes are reviewed and │
│ merged before execution begins │
└──────────────────┬──────────────────┘
│
▼
┌─────────────────────────────────────┐
│ SECURE EXECUTION LAYER │
├─────────────────────────────────────┤
│ GitHub Actions │
│ ↓ │
│ Private ARC runners on Platform GKE │
│ ↓ │
│ Workload Identity Federation │
└──────────────────┬──────────────────┘
│
┌────────────────────┴────────────────────┐
│ │
▼ ▼
PATH 1: GCP FOUNDATION PATH 2: APPLICATION ONBOARDING
┌───────────────────────────────────┐ ┌───────────────────────────────────┐
│ Terraform / Terragrunt provisions │ │ Repositories created from │
│ │ │ approved templates │
│ • GCP projects │ │ │
│ • Enabled APIs │ │ • Application repository │
│ • IAM and service accounts │ │ • Infrastructure/config repo │
│ • Cloud SQL instance │ │ • CI/CD workflows │
│ • Secret Manager │ │ • Helm chart and values │
│ • Cloud Storage │ │ • Argo CD Application config │
│ • Private connectivity │ └──────────────────┬────────────────┘
│ • Labels and ownership metadata │ │
└──────────────────┬────────────────┘ ▼
│ ┌───────────────────────────────────┐
│ │ Config Sync reconciles │
│ │ platform-owned GKE configuration │
│ │ │
│ │ • Namespace │
│ │ • Resource quotas and limits │
│ │ • Kubernetes service account │
│ │ • Network policies │
│ │ • Policies and guardrails │
│ └──────────────────┬────────────────┘
│ │
│ ▼
│ ┌───────────────────────────────────┐
│ │ CI/CD builds and validates │
│ │ │
│ │ • Build and test │
│ │ • Security checks │
│ │ • Container image │
│ │ • Artifact Registry │
│ └──────────────────┬────────────────┘
│ │
│ ▼
│ ┌───────────────────────────────────┐
│ │ Argo CD + Helm deploy │
│ │ the Application to GKE │
│ └──────────────────┬────────────────┘
│ │
└────────────────────┬──────────────────┘
│
▼
┌─────────────────────────────────────┐
│ RESULT │
├─────────────────────────────────────┤
│ Customer-owned cloud foundation, │
│ governed GKE configuration, CI/CD, │
│ identity and GitOps delivery path │
└─────────────────────────────────────┘Execution stays customer controlled. GitHub Actions runs approved workflows on private, ephemeral ARC runners in the Platform GKE cluster. Workload Identity Federation provides short-lived access to Google Cloud without stored service account keys.
Terraform / Terragrunt
Provision and manage Google Cloud infrastructure and environment-specific configuration.
Config Sync
Reconcile platform-owned Kubernetes configuration, namespaces, quotas, identity, policies, and guardrails.
Argo CD + Helm
Reconcile and deploy Application workloads through the governed GitOps delivery path.