MastertheMesh
sovereignty · GKE · istio ambient · agentgateway · kagent · vault · kyverno
Architecture Part 3 · Google Cloud

Secure Sovereign AI on GKE, Part 3: The Same Architecture on Google Cloud

TO
Tom O'Rourke
EMEA Field CTO · Solo.io

This is the Part 1 architecture, the same open-weight European model and the same zero-trust controls around it, moved from AWS to Google Cloud. The interesting part is how little of the diagram changes: the security lives in the mesh, the gateway and the admission layer, so moving cloud swaps the substrate underneath and leaves the model intact. The region stays in the UK, europe-west2 is London.

This is the third part of the lab. Part 1 builds and explains the architecture on AWS, and Part 2 attacks it with real exploits. This page is the shorter companion: the same diagram with the Google Cloud substrate in place, and the service-by-service mapping. It does not re-explain the layers, Part 1 already does that.

Istio ambient + Vault CA agentgateway, one TLS door kagent + gVisor substrate PSA + Kyverno GKE · europe-west2 (London)

The diagram below is the Part 1 topology with every AWS service swapped for its Google Cloud equivalent. The workloads in the cluster are identical; only the managed substrate underneath is Google's. The full mapping is in the table further down. Click any component to see the Google Cloud service in place, and what, if anything, changes.

The same topology, on Google Cloud

Same cluster profile as Part 1: one region in the UK (europe-west2), a private GKE cluster, the ambient mesh and the one gateway in front of the model, on Google Cloud's managed services instead of AWS's. Click any component, and its Google Cloud detail appears in the panel beside it (on a phone it opens as a card).

the Google Cloud architecture (Part 1 runs the live AWS build) dashed = best practice, not deployed ▸ Click any component to see the Google Cloud service in place of the AWS one.

Google Cloud · europe-west2 (London)
VPC 10.42.0.0/16 · private subnets
Edge & network (hardened)
GKE · uk-sovereign-ai
Workloads (ambient mesh)
Node pools (COS · Shielded Nodes · WI metadata)
Platform operations · not deployed in this lab
Google Cloud managed

AWS to Google Cloud, service by service

Everything above the managed substrate is unchanged. What changes is the cloud underneath the cluster, and it maps almost one for one:

LayerAWS (Part 1)Google Cloud (this page)
KubernetesEKS 1.34GKE, private cluster
Edge load balancerNLB, L4 TLS passthroughExternal passthrough Network Load Balancer
EgressNAT gatewayCloud NAT
Network firewallSecurity groupsVPC firewall rules
DNS allowlistRoute 53 DNS FirewallCloud DNS response policy
Key managementKMSCloud KMS, Cloud EKM for external keys
Secrets at restetcd envelope encryption, KMSGKE application-layer secrets encryption, Cloud KMS
Object storageS3Cloud Storage
Workload identityIAM roles for service accounts (IRSA)Workload Identity Federation for GKE
Node hardeningAmazon Linux 2023, IMDSv2 hop-limit 1Container-Optimized OS, Shielded Nodes, Workload Identity metadata
GPU nodeg7e, RTX PRO 6000 96 GBa2-ultragpu-1g, A100 80 GB
Regioneu-west-2 (London)europe-west2 (London)
BackupVelero to S3Velero to Cloud Storage, or Backup for GKE
Threat detectionGuardDutySecurity Command Center
Managed database, KeycloakRDS Multi-AZCloud SQL, regional HA
WAFAWS WAF, or the gateway WAFCloud Armor, or the gateway WAF
Private API accessVPC endpoints, PrivateLinkPrivate Google Access, Private Service Connect

Why it ports this cleanly

The security in Part 1 is not made of AWS services. Identity is SPIFFE from a Vault CA the mesh runs; the one door is agentgateway; admission is Kyverno and Pod Security Admission; isolation is gVisor; provenance is cosign. Every one of those is a Kubernetes workload that neither knows nor cares which cloud it sits on. The cloud's own services are used only for the primitives underneath, the keys, the storage, the node image and the load balancer, and each of those has a direct Google Cloud equivalent. So the move is a substrate swap, not a redesign, and the claims hold the same way: data residency by keeping storage and inference in europe-west2, key custody by unsealing Vault from Cloud KMS, traffic control by the same default-deny network and the same one gateway.

The rest is Part 1

This page is deliberately short. The why of each layer, how a request reaches the model, the identity and policy planes, the full sovereignty argument and operational readiness are all in Part 1, and none of it changes with the cloud. Read them there. This page only shows the same diagram with the Google Cloud substrate in place of AWS.