> For the complete documentation index, see [llms.txt](https://docs.envector.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.envector.io/1.4.x/get-started/installation/gcp-marketplace.md). # Google Cloud Marketplace ### Overview This guide explains how to deploy **enVector on Google Kubernetes Engine (GKE)** from the Google Cloud Marketplace listing. The Marketplace flow installs all enVector microservices into your cluster from the Google Cloud Console with a default configuration suitable for evaluation. * Listing: [enVector on Google Cloud Marketplace](https://console.cloud.google.com/marketplace/product/heaan-public/envector-sm) ### Why deploy via Marketplace * **Consolidated billing** — usage is billed through your existing Google Cloud account; no separate invoice or license-token to manage. * **Embedded dependencies for evaluation** — PostgreSQL and MinIO are bundled by default, so a single Subscribe → Deploy click brings up a working stack. * **Fewer moving pieces** — no separate Docker registry credentials or image-pull Secrets to manage. ### Prerequisites * A Google Cloud project with billing enabled. * The deploying principal needs the following IAM roles on the target project: * `roles/container.admin` * `roles/iam.serviceAccountUser` * `roles/serviceusage.serviceUsageAdmin` * `gcloud` and `kubectl` available locally, or use **Cloud Shell** from the Google Cloud Console. {% hint style="info" %} **Organization policy — allow service-account key creation** enVector's Marketplace usage billing relies on a *reporting* service account whose key Google creates in your project at deploy time. If your organization enforces the `iam.disableServiceAccountKeyCreation` organization policy, the **Deploy** step fails because that key cannot be created. Have your **Organization Policy Administrator** add a **project-scoped exception** on the deploy project — not an organization-wide change: 1. In the Console resource selector, select the **deploy project**. 2. **IAM & Admin → Organization Policies**. 3. Filter for `iam.disableServiceAccountKeyCreation`. 4. Open it → **Manage policy** → **Override parent's policy** → set enforcement to **Off** → **Save**. The deploying developer does not need organization-admin rights; only this one-time, project-scoped exception is required, and organization-wide enforcement stays intact. {% endhint %} ### Step 1 — Subscribe to the listing 1. Open the [Marketplace listing](https://console.cloud.google.com/marketplace/product/heaan-public/envector-sm). 2. Click **Purchase**. 3. Confirm the selected plan and **Select your billing account**. 4. Review and accept the **Google Cloud Marketplace Terms of Service** and **Standard EULA**. 5. Click **Subscribe** to complete the subscription. After the subscription completes, you return to the listing with **Configure** enabled. ### Step 2 — Configure the deployment Click **Configure** on the listing to open the deployer form. * **Cluster** — we recommend selecting an **existing GKE cluster** in your project, or **pre-creating a dedicated cluster** (see below), rather than the inline **Create a new cluster** option. Pre-creating lets you control machine type, region, and node count. For evaluation, a **single `e2-standard-8` node** (8 vCPU / 32 GiB) runs the full stack at low cost. * **Namespace** — `default` works fine; pick a dedicated namespace for logical isolation from other workloads. * **App instance name** — used as a prefix for every Kubernetes object the chart creates (default `envector-sm-1`). Pick something short; renaming later requires a redeploy. * **Embedded services** — PostgreSQL and MinIO are provisioned automatically; no database / storage fields to fill in. {% hint style="info" %} **Pre-create an evaluation cluster (recommended)** Create a single-node cluster before configuring the deployment, then select it in the **Cluster** field above: ```bash gcloud container clusters create envector-eval \ --project \ --zone \ --num-nodes 1 \ --machine-type e2-standard-8 ``` A zonal cluster with one `e2-standard-8` node (8 vCPU / 32 GiB) is the lowest-cost shape that runs the full evaluation stack. Use a multi-node cluster sized to your workload for production. {% endhint %} {% hint style="warning" %} **About the "Service Account" field** The deployer's **Service Account** field offers only **Create a new service account** — choose it. This is the in-cluster **Kubernetes service account** enVector's pods run as (namespace-scoped RBAC). It is **not** the billing *reporting* service account — that one Google provisions automatically and is not shown here — and it creates no GCP service-account key. {% endhint %} ### Step 3 — Deploy Review the remaining default values and click **Deploy**. The Console switches to the **Kubernetes Engine** UI and shows deployment progress. ### Step 4 — Verify the deployment From either a local terminal with `gcloud` + `kubectl`, or **Cloud Shell** (click the `>_` icon in the Google Cloud Console), connect to the cluster and inspect the workloads: ```bash gcloud container clusters get-credentials \ --region --project kubectl get pods -n ``` You should see the enVector pods (`endpoint`, `backend`, `orchestrator`, `compute`, `shaper`, and the embedded `pg` / `minio` pods) reach `Running`. ### Exposing the endpoint {% hint style="warning" %} **TLS / Auth disclaimer** The Marketplace deployment ships the `endpoint` Service as `ClusterIP`, so it is **not externally reachable** out of the box. The steps below switch it to `LoadBalancer` for evaluation, which exposes the service to any caller that can reach the external IP + port. For anything beyond evaluation, terminate TLS and add an authentication layer in front of the endpoint (e.g., IAP, API Gateway, Cloud Armor). enVector query and result payloads are transmitted as homomorphic encryption ciphertext, so wire-level plaintext exposure does not occur. This disclaimer is about **blocking unauthenticated callers**, which is the operator's responsibility. TLS and authentication will be integrated into the Marketplace deployment in an upcoming release. {% endhint %} Use the same `kubectl` context you set up in **Step 4 — Verify the deployment**. #### 1. Locate the endpoint Service In the Kubernetes Engine UI, navigate to **Networking → Gateways, Services & Ingress → Services** and filter by `endpoint`. Note the Service name, for example `envector-sm-1-envector-chart-endpoint`. #### 2. Patch the endpoint Service to LoadBalancer ```bash kubectl patch svc -n \ -p '{"spec":{"type":"LoadBalancer"}}' ``` Example: ```bash kubectl patch svc envector-sm-1-envector-chart-endpoint -n default \ -p '{"spec":{"type":"LoadBalancer"}}' ``` #### 3. Get the external address ```bash kubectl get svc -n ``` Wait until `EXTERNAL-IP` is no longer ``. Example output: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE envector-sm-1-envector-chart-endpoint LoadBalancer 10.0.0.1 34.44.55.66 50050:32040/TCP,8080:32438/TCP 61m ``` The gRPC endpoint is `:50050`. The HTTP health/admin port is `:8080`. ### Connect with the SDK Validate the deployment end to end with the [Quick Start](https://docs.envector.io/get-started/quick-start) notebook — the quickest way is to run it in [Google Colab](https://colab.research.google.com/drive/1PnqGi4jQ3WSHhwD27LhXM56w1oYIPbv9?usp=sharing), no local setup required. The notebooks also live in the [`envector-deployment`](https://github.com/CryptoLabInc/envector-deployment) repository. First install the SDK (in Colab, prefix with `!`): ```bash pip install pyenvector ``` Then initialize the connection, setting `address` to the external IP and gRPC port from the previous step: ```python import pyenvector as ev ev.init_connect(address="34.44.55.66:50050", access_token=None, secure=False) ``` The evaluation endpoint is plaintext (no TLS), so `secure=False`. With `access_token=None` the SDK already defaults to an insecure channel; passing it explicitly keeps the example unambiguous. {% hint style="info" %} The validation notebooks read the endpoint from an `ENVECTOR_ADDRESS` environment variable and pass it to `init_connect(address=...)`. Set it before running the notebook cells: ```python import os os.environ["ENVECTOR_ADDRESS"] = "34.44.55.66:50050" # your EXTERNAL-IP:50050 ``` `ENVECTOR_ADDRESS` is a notebook convention, not an SDK setting — the SDK always takes the endpoint through the `address` argument. The first `init_connect` can take **\~3 minutes** while the encryption context is initialized. {% endhint %} See [Connecting to the Service](/1.4.x/sdk-user-guide/initialize/connecting-to-the-service.md) for the full SDK reference (including `access_token` usage when the endpoint is fronted by auth). ### Uninstall Delete the application: ```bash kubectl delete application -n envector-sm-1 ``` The Application controller cascades the deletion through the Helm release — pods, Services, RBAC, and PVCs are removed. To stop further billing, also cancel the subscription itself: **Marketplace → Your Products & Services → enVector → Cancel subscription**. ### Notes & tips * **Region** — pick the GKE region closest to where your client workloads will run; high-QPS use cases are sensitive to RTT. * **Support** — open a ticket via [docs.envector.io/support](https://docs.envector.io/support) or email . ### Next steps * SDK reference: [💻 Client SDK](/1.4.x/get-started/installation/client-sdk.md) * Add TLS via Ingress + cert-manager: see the **TLS/HTTPS (Ingress)** section in [⛵ Helm Chart](/1.4.x/get-started/installation/helm-chart.md). The Ingress / cert-manager steps apply to the Marketplace install as well. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.envector.io/1.4.x/get-started/installation/gcp-marketplace.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.