Google Cloud Platform Deployment

GCP Deployment Options

Deploy to Cloud Run

1. Push Image to Artifact Registry

# Configure Docker to use Artifact Registry
gcloud auth configure-docker us-central1-docker.pkg.dev

# Create repository
gcloud artifacts repositories create openclaw   --repository-format=docker   --location=us-central1

# Tag and push
docker tag openclaw:latest   us-central1-docker.pkg.dev/my-project/openclaw/openclaw:latest
docker push us-central1-docker.pkg.dev/my-project/openclaw/openclaw:latest

2. Store Secrets in Secret Manager

# Create secret
echo -n "sk-your-openai-key" |   gcloud secrets create openai-api-key --data-file=-

# Grant Cloud Run service account access
gcloud secrets add-iam-policy-binding openai-api-key   --member="serviceAccount:openclaw-sa@my-project.iam.gserviceaccount.com"   --role="roles/secretmanager.secretAccessor"

3. Deploy the Cloud Run Service

gcloud run deploy openclaw   --image=us-central1-docker.pkg.dev/my-project/openclaw/openclaw:latest   --region=us-central1   --allow-unauthenticated   --min-instances=0   --max-instances=10   --cpu=1   --memory=512Mi   --port=8080   --set-env-vars="OPENCLAW_ENV=production"   --set-secrets="OPENAI_API_KEY=openai-api-key:latest"   --service-account="openclaw-sa@my-project.iam.gserviceaccount.com"

Cloud Run YAML (Infrastructure as Code)

# service.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: openclaw
  annotations:
    run.googleapis.com/ingress: all
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "0"
        autoscaling.knative.dev/maxScale: "10"
        run.googleapis.com/cpu-throttling: "false"  # Always allocate CPU
    spec:
      containerConcurrency: 10
      containers:
        - image: us-central1-docker.pkg.dev/my-project/openclaw/openclaw:latest
          resources:
            limits:
              cpu: "1"
              memory: 512Mi
          env:
            - name: OPENCLAW_ENV
              value: production
            - name: REDIS_URL
              value: redis://10.100.0.3:6379  # Memorystore internal IP
          volumeMounts:
            - name: secrets
              mountPath: /secrets
      volumes:
        - name: secrets
          secret:
            secretName: openai-api-key

gcloud run services replace service.yaml --region=us-central1

GCP-Native Service Integrations

Connecting to Private Resources

Cloud Run is serverless and can't access your VPC directly by default. Use the Serverless VPC Access Connector to reach Memorystore (Redis), Cloud SQL, or private APIs:

# Create VPC connector
gcloud compute networks vpc-access connectors create openclaw-connector   --region=us-central1   --subnet=default

# Deploy Cloud Run with VPC connector
gcloud run deploy openclaw   --vpc-connector=openclaw-connector   --vpc-egress=private-ranges-only   [... other flags ...]

Cloud Run Deployment

Cloud Run is the recommended service for most OpenClaw deployments on GCP. It provides serverless container execution with automatic scaling to zero, pay-per-request pricing, and no infrastructure management. Deploy your OpenClaw agent container to Cloud Run with a minimum instance count of 0 for cost efficiency or 1 for low-latency response to the first request. Use Cloud Run Jobs (not Cloud Run services) for batch processing workloads — Jobs are designed for tasks that run to completion rather than long-lived services that handle requests.

Configure Cloud Run with appropriate CPU and memory limits. A typical Claude API-based OpenClaw agent needs 1 vCPU and 512MB-1GB RAM — the actual compute is light because the heavy processing happens at the LLM provider. If you're running a local LLM on GCP (with GPU-enabled Compute Engine instances), the resource requirements are dramatically higher and Cloud Run is not the right service — use GKE with GPU node pools instead.

Secret Manager Integration

Use Google Cloud Secret Manager to store all credentials. Reference secrets in your Cloud Run service configuration using Secret Manager volume mounts or environment variable references. The Cloud Run service account needs the roles/secretmanager.secretAccessor role on the specific secret resources — not the entire project. Use IAM conditions to restrict access to specific secret versions if you need fine-grained control over which service can access which version during key rotation. Enable Secret Manager audit logging to track every secret access event for compliance and incident investigation.

Observability on GCP

Cloud Run automatically sends stdout/stderr logs to Cloud Logging. Use structured JSON logging from your OpenClaw deployment to enable log-based metrics in Cloud Monitoring. Create alert policies based on log-based metrics: alert when error rate exceeds 1% of requests, alert when a specific error code appears more than 10 times per minute. Use Cloud Trace for distributed tracing — if your OpenClaw agent calls downstream GCP services, traces connect end-to-end across all services, enabling root cause diagnosis of latency issues that span service boundaries. GCP's tight integration between Cloud Run, Cloud Logging, and Cloud Monitoring makes basic observability setup much faster than assembling equivalent capabilities from individual open-source tools.

Multi-Region Deployment

For global deployments with low-latency requirements, deploy Cloud Run services in multiple regions and use a Global HTTP(S) Load Balancer to route each user's request to the nearest deployed region. Cloud Run's per-region deployment model makes this straightforward — deploy the same container image to us-central1, europe-west1, and asia-east1, then configure the load balancer with a backend service pointing to all three. The load balancer handles health-based routing automatically — if one region's services become unhealthy, traffic fails over to healthy regions without manual intervention.

Quick Start with Cloud Run

Deploy a containerized OpenClaw agent to Cloud Run in one command: gcloud run deploy openclaw-agent --image gcr.io/myproject/openclaw:latest --region us-central1 --no-allow-unauthenticated --set-secrets OPENCLAW_LLM_API_KEY=llm-api-key:latest. The --no-allow-unauthenticated flag requires IAM authentication for all requests — only services and identities you explicitly grant roles/run.invoker can invoke the service. The --set-secrets flag injects the secret from Secret Manager as a runtime environment variable without storing it in the service configuration.