Deploy Claude apps gateway on Google Cloud changedclaude-apps-gateway-on-gcp
Nearest release: v2.1.284, published 17 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 28 Sep 2026 00:07 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 23:37 UTC.
Upstream edited
Recorded here
Lines+18added
Lines−18removed
From line
140
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits6to this page, all time
The whole hunk
from line 140, old and new numbered
/
from line 140
140140
141141 Set `trusted_proxies` to match your front end. An external GKE Ingress of class `gce` isn't listed: it provisions a public forwarding-rule address, which the `/login` [private-network check](/docs/en/claude-apps-gateway#prerequisites) rejects.
142142
143 | Front end | `trusted_proxies` |
144 | -------------------------------------------------------- | --------------------------------------------------- |
145 | Cloud Run reached directly, no load balancer | `[169.254.0.0/16]` |
143 | Front end | `trusted_proxies` |
144 | - | - |
145 | Cloud Run reached directly, no load balancer | `[169.254.0.0/16]` |
146146 | Internal Application Load Balancer in front of Cloud Run | `169.254.0.0/16` plus your proxy-only subnet's CIDR |
147 | GKE internal Ingress, class `gce-internal` | Your proxy-only subnet's CIDR |
147 | GKE internal Ingress, class `gce-internal` | Your proxy-only subnet's CIDR |
148148
149149 The example below uses the internal-load-balancer-in-front-of-Cloud-Run values.
150150
from line 187
187187 <Step title="Store secrets in Secret Manager">
188188 Create four secrets and grant `roles/secretmanager.secretAccessor` to the `claude-gateway` service account:
189189
190 | Secret | Source |
191 | ---------------------------- | ----------------------------------------------- |
192 | `gateway-jwt-secret` | `openssl rand -base64 32` |
193 | `gateway-oidc-client-secret` | Google Cloud Console → OAuth client |
194 | `gateway-postgres-url` | `$GATEWAY_POSTGRES_URL` from the Cloud SQL step |
195 | `gateway-config` | the full `gateway.yaml` from the previous step |
190 | Secret | Source |
191 | - | - |
192 | `gateway-jwt-secret` | `openssl rand -base64 32` |
193 | `gateway-oidc-client-secret` | Google Cloud Console → OAuth client |
194 | `gateway-postgres-url` | `$GATEWAY_POSTGRES_URL` from the Cloud SQL step |
195 | `gateway-config` | the full `gateway.yaml` from the previous step |
196196
197197 How the secrets reach the container differs by track:
198198
from line 301
301301
302302For gateway boot and login errors, see the platform-agnostic [troubleshooting table](/docs/en/claude-apps-gateway-deploy#troubleshooting). The entries below are specific to Google Cloud.
303303
304| Symptom | Cause | Fix |
305| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
306| Cloud Run returns `403 Forbidden` before reaching the container | The invoker IAM check is still enabled | Deploy with `--no-invoker-iam-check`, or grant `allUsers` the `run.invoker` role with `--allow-unauthenticated` |
307| `--no-invoker-iam-check` rejected with `invoker_iam_disabled is not currently available` | Blocked by `constraints/run.managed.requireInvokerIam` | Use `--allow-unauthenticated`. If Domain Restricted Sharing via `constraints/iam.allowedPolicyMemberDomains` blocks that too, use the GKE track, which exposes the gateway at the network layer with no `allUsers` binding. |
308| `Container manifest type … must support amd64/linux` at deploy | Image was built on a non-amd64 host, or buildx emitted an OCI image index | Build with `--platform=linux/amd64 --provenance=false` |
309| Gateway boot exits with a Postgres connection-timeout error on Cloud Run | Service isn't attached to the VPC, or Cloud SQL has no private IP on that VPC | Deploy with `--network` and `--subnet` for Direct VPC egress, and create the Cloud SQL instance with `--no-assign-ip` and `--network` pointing at the same VPC |
310| Google Cloud's Agent Platform requests return `403 PERMISSION_DENIED` | Runtime isn't using the `claude-gateway` service account, or the model isn't enabled in Model Garden for the project | Set `--service-account` on Cloud Run or bind Workload Identity on GKE, and enable each Claude model in Model Garden for the target region |
311| Streaming responses cut off after a fixed duration | Front-end request timeout: the load balancer backend service behind GKE Ingress defaults to 30 seconds and Cloud Run to 300 seconds | Attach a BackendConfig with a raised `timeoutSec` on GKE, or deploy with `--timeout=3600` on Cloud Run |
304| Symptom | Cause | Fix |
305| - | - | - |
306| Cloud Run returns `403 Forbidden` before reaching the container | The invoker IAM check is still enabled | Deploy with `--no-invoker-iam-check`, or grant `allUsers` the `run.invoker` role with `--allow-unauthenticated` |
307| `--no-invoker-iam-check` rejected with `invoker_iam_disabled is not currently available` | Blocked by `constraints/run.managed.requireInvokerIam` | Use `--allow-unauthenticated`. If Domain Restricted Sharing via `constraints/iam.allowedPolicyMemberDomains` blocks that too, use the GKE track, which exposes the gateway at the network layer with no `allUsers` binding. |
308| `Container manifest type … must support amd64/linux` at deploy | Image was built on a non-amd64 host, or buildx emitted an OCI image index | Build with `--platform=linux/amd64 --provenance=false` |
309| Gateway boot exits with a Postgres connection-timeout error on Cloud Run | Service isn't attached to the VPC, or Cloud SQL has no private IP on that VPC | Deploy with `--network` and `--subnet` for Direct VPC egress, and create the Cloud SQL instance with `--no-assign-ip` and `--network` pointing at the same VPC |
310| Google Cloud's Agent Platform requests return `403 PERMISSION_DENIED` | Runtime isn't using the `claude-gateway` service account, or the model isn't enabled in Model Garden for the project | Set `--service-account` on Cloud Run or bind Workload Identity on GKE, and enable each Claude model in Model Garden for the target region |
311| Streaming responses cut off after a fixed duration | Front-end request timeout: the load balancer backend service behind GKE Ingress defaults to 30 seconds and Cloud Run to 300 seconds | Attach a BackendConfig with a raised `timeoutSec` on GKE, or deploy with `--timeout=3600` on Cloud Run |
312312
313313## Next steps
314314
No line in this hunk matches that.