GCP-GKE deployment

Shared GCP resources

Google Cloud Platform offers a range of managed services that a Kubernetes-based deployment can draw on for container orchestration, database, and shared storage needs. The table below lists the specific GCP services against which HCL has validated AppScan 360°. These are provided as a reference to support your planning and are not a mandatory prescription — your organization's GCP administrators may select any equivalent service or alternative that aligns with your infrastructure standards, provided it satisfies the underlying functional requirement noted for each service.

If you select an alternative to a listed service, confirm with your GCP administrator that it meets the corresponding prerequisites described in Environment setup resources before proceeding with installation.

Network egress requirements

GKE nodes must have outbound HTTPS (443) connectivity to the HCL Harbor container registry, the AppScan 360° Helm chart repository, and the HCL license portal. Confirm which of the following applies to your environment before creating the cluster:

• Nodes with external IP addresses: Outbound internet access is available by default. This is not the recommended posture for production clusters.
• Private nodes (recommended): Provision Cloud NAT and Cloud Router on the VPC network and region used by the cluster. If your organization uses a Shared VPC, check with your network/host-project team first — a Cloud NAT gateway may already exist for the subnet, and creating a duplicate can cause routing conflicts.
• Restrictive egress / proxy-based networks: If a NAT gateway is not permitted by policy, configure an egress proxy or firewall allow list for the Harbor registry, chart repository, and license portal endpoints instead of relying on unrestricted outbound access.

Cluster setup