feat(creative-studio): deployed Creative Studio to a dedicated project on GCP

[khangnguyen-ds-ti]

Summary

Deploys Creative Studio as an internal, trial environment in the iconic-ds-creative-studio-dev GCP project.

The deployment uses private-only Cloud SQL connectivity and includes the infrastructure, backend migration, and bootstrap changes needed to operate the application without a public database IP.

Motivation

Creative Studio is being trialled internally by Data Science and Tech users. The deployment needs to meet the organisation policy that prohibits public Cloud SQL addresses while still allowing the Cloud Run backend and database migrations to connect successfully.

The upstream bootstrap seeding flow depends on a Cloud Shell-hosted Cloud SQL Auth Proxy, which cannot reach a private-only database in the dedicated VPC. This deployment establishes a workable operational alternative through a VPC-attached Cloud Run Job.

Change

• Adds private Cloud SQL networking infrastructure:
  • Dedicated VPC and Private Services Access range.
  • Service Networking peering.
  • Serverless VPC Access connector for Cloud Run.
  • Cloud Run backend egress configured as PRIVATE_RANGES_ONLY.
• Configures Cloud SQL as private-IP only; public IPv4 remains disabled.
• Updates backend runtime database connectivity to use the Cloud SQL Python Connector with CLOUD_SQL_IP_TYPE=PRIVATE.
• Updates Alembic migrations to respect CLOUD_SQL_IP_TYPE=PRIVATE instead of requesting a public PRIMARY address.
• Deploys the backend and frontend successfully via Cloud Build.
• Seeds the initial database through a VPC-attached Cloud Run Job using the deployed backend image and runtime service account.
• Restricts Cloud Run backend invocation to the approved internal Google Groups:
  • tech.data.datascience@theiconic.com.au
  • tech.data@theiconic.com.au
  • Some other emails requested in the Slack thread #tech-data-creative

Deployment Details

Project: iconic-ds-creative-studio-dev
Region: us-central1
Frontend: https://iconic-ds-creative-studio-dev.web.app
Backend: https://cstudio-be-ipx55bsfzq-uc.a.run.app
Cloud SQL instance: creative-studio-db-be64ae2b

Relevant commits:

c03619c  feat(infra): add private Cloud SQL connectivity
09531ff  fix(bootstrap): update existing checkout branch
d125022  fix(infra): support service networking provider schema
168de49  fix(backend): use private SQL IP for migrations

Test Plan

• Terraform applied successfully, creating the private networking, Cloud SQL, VPC connector, and related infrastructure.
• Confirmed Cloud SQL is RUNNABLE with private IP 172.30.0.3 and public IPv4 disabled.
• Confirmed backend Cloud Build deployment completed successfully using the private-IP migration fix.
• Confirmed frontend Cloud Build deployment completed successfully.
• Ran database migrations against private Cloud SQL successfully.
• Ran initial seeding successfully through Cloud Run Job execution cstudio-seed-wwl5v.
• Confirmed the deployed frontend is reachable and the backend Cloud Run service is healthy.
• Confirmed backend invocation is granted only to the approved internal groups.

Follow-up Work

• Add the Cloud Run seeding Job to Terraform and update bootstrap to use it rather than the Cloud Shell proxy path.
• Update PRIVATE_SQL_DEPLOYMENT.md with the active Cloud Build connection name, gh-creative-studio-deploy-con-ti, and the Cloud Run Job seeding procedure.
• Validate trial-user access behaviour for people inside and outside the approved Invoker groups.
• Decide whether Identity Platform sign-in should be restricted to @theiconic.com.au.
• Define and execute a teardown plan when the trial period ends.
• Add a frontend trial warning banner instructing users not to enter, upload, or generate sensitive, confidential, or personal information.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.