diagram.d2

gistfile1.txt

direction: right

styles: {
  cloud: { shape: cloud }
  ext: { shape: cylinder }
  svc: { shape: rounded }
  k8s: { shape: rectangle, stroke: "#4b5563" }
  note: { shape: note }
  repo: { shape: folder }
}

Bitbucket: {
  label: "Bitbucket\nRepository + Pipelines"
  style: ext
}

OIDC: {
  label: "OIDC Token\n(OpenID Connect)"
  style: note
}

GCP: {
  label: "Google Cloud Platform (PROJECT_ID)"
  style: cloud

  IAM: {
    label: "IAM\nService Account: ci-deployer@PROJECT_ID\nWorkload Identity Pool + Provider"
    style: svc
  }

  ArtifactRegistry: {
    label: "Artifact Registry\nREGION-docker.pkg.dev/PROJECT_ID/REPO"
    style: repo
  }

  Network: {
    label: "VPC (default or custom)"
    style: svc

    GKE: {
      label: "GKE Cluster: CLUSTER_NAME\nLocation: REGION/ZONE"
      style: k8s

      NS: {
        label: "Namespace: NAMESPACE"
        style: k8s

        Deploy: {
          label: "Deployment: example-web\nimage: REGION-docker.pkg.dev/PROJECT_ID/REPO/example-web:COMMIT_SHA\nreplicas: 2"
          style: k8s
        }

        Svc: {
          label: "Service (LoadBalancer/Ingress)\nport 80 → 8080"
          style: k8s
        }
      }
    }
  }

  CloudRun: {
    label: "Cloud Run Service: example-web\nRegion: REGION\nimage: ...:COMMIT_SHA\nPort: 8080"
    style: svc
  }

  Observability: {
    label: "Cloud Logging + Monitoring\n(Error Reporting, Traces)"
    style: note
  }

  Secrets: {
    label: "Secret Manager\nKMS (optional)"
    style: note
  }
}

Users: {
  label: "End Users\n(HTTPS)"
  style: ext
}

DNS: {
  label: "DNS / HTTPS LB\n(optional)"
  style: svc
}

/* Flows & relations */
Bitbucket -> OIDC: "Issue short-lived\nOIDC token"
OIDC -> GCP.IAM: "Trust (WIF)\nImpersonate SA"

Bitbucket -> GCP.ArtifactRegistry: "docker build & push\n(example-web:COMMIT_SHA)"
GCP.ArtifactRegistry -> GCP.CloudRun: "deploy\n(gcloud run deploy)"
GCP.ArtifactRegistry -> GCP.Network.GKE.NS.Deploy: "kubectl apply\nimage: COMMIT_SHA"

GCP.Network.GKE.NS.Deploy -> GCP.Network.GKE.NS.Svc: "exposed via\nSvc/Ingress"
GCP.CloudRun -> GCP.Observability: "logs/metrics"
GCP.Network.GKE.NS.Deploy -> GCP.Observability: "logs/metrics"

GCP.Secrets <- GCP.CloudRun: "access at runtime"
GCP.Secrets <- GCP.Network.GKE.NS.Deploy: "access at runtime"

Users -> DNS: "HTTPS"
DNS -> GCP.CloudRun: "Route /app"
DNS -> GCP.Network.GKE.NS.Svc: "Route /api"

note_bottom_left: {
  label: "Notes:\n• Replace PROJECT_ID, REGION, CLUSTER_NAME, REPO, NAMESPACE\n• Bitbucket Pipelines must enable OIDC and WIF on GCP\n• Artifact Registry stores images used by both Cloud Run and GKE\n• Add per-service IAM + RBAC for least privilege"
  style: note
}

/* Styling tweaks */
GCP.Network.GKE.NS.Deploy.style.fill: "#f3f4f6"
GCP.Network.GKE.NS.Svc.style.fill: "#eef2ff"
GCP.CloudRun.style.fill: "#ecfeff"
GCP.ArtifactRegistry.style.fill: "#fff7ed"
GCP.IAM.style.fill: "#fefce8"
DNS.style.fill: "#e0f2fe"