Complete deployment actions

A deployment can create infrastructure and still need an operator action before it is ready. Examples include authorizing a sign-in domain, updating DNS, or granting the deployer's missing database-administration permission.

#Understand: action required or provider still working

The CLI's Action required output identifies the exact project, domain, record, or permission. Use those values; a similar hostname or another active Google project is not interchangeable.

DNS needs a further distinction: incorrect records require your action; correct records with a certificate still being issued require provider reconciliation. Replacing correct records can prolong the problem.

#Configure: complete the reported action

After a change, rerun validation for the same target:

fluffy-chainsaw validate --application example-app --environment prod

Validation checks source correspondence, declared generated deployment output, and live readiness together. Follow the specific section below rather than changing unrelated settings.

#Generated deployment code

An application can keep the exact deployment project Fluffy consumes in an environment directory:

environments:
  prod:
    deployment: deployment/prod

Generate it explicitly:

fluffy-chainsaw generate --application example-app --environment prod

Review and commit the generated files. Validation fails if source or generator changes make them stale, or if generated files are added, removed, or edited by hand. Deployment checks and consumes that exact project; it does not silently rewrite it. Run deployment through Fluffy, not by invoking the generated Pulumi project yourself.

#Google login

For an application using Google sign-in, validation checks the enabled provider and authorized Firebase Hosting domains. These settings are operator-owned authentication configuration.

#Enable the Google provider

1. Open Firebase Console and select the project printed by Fluffy.
2. Open Authentication → Sign-in method.
3. Enable Google and save.

#Add authorized domains

1. In the same Firebase project, open Authentication → Settings → Authorized domains.
2. Add each domain reported by Fluffy, normally including the site's web.app hostname and configured custom hostname.
3. Save and validate again.

Use hostnames without a URL scheme or path. A successful browser login still needs backend verification and application authorization.

#Firebase Hosting site ID

Each Firebase Hosting entrypoint needs its environment-specific site ID. Merge into the existing entrypoint in fluffy-chainsaw.yaml:

webEntrypoints:
  web:
    siteIds:
      prod: your-unique-site-id

Replace the placeholder and use the entrypoint path printed by the CLI. Then deploy again. This excerpt does not replace the entrypoint's artifact or exposure configuration.

#Custom domains and DNS

Fluffy creates or observes the provider's custom-domain association. You apply the reported records at your DNS provider:

1. Select the zone containing the hostname.
2. Perform each requested ADD or REMOVE with the exact type, host, and value.
3. Allow public DNS to propagate, then validate again.

An amber ! means operator action is needed. A purple ○ means records are correct and the provider is reconciling the association or certificate. Preserve correct records while it is pending.

#Database administration permission

Managed Cloud SQL deployment runs a Fluffy-owned Cloud Run administration Job. The ADC principal performing deployment needs the reported permissions, including run.jobs.run.

Use your organization's IAM process to grant the exact missing authority to the correct caller, then validate again. Fluffy reports the project and permission; it does not grant its caller additional IAM authority. Giving the application runtime broad database access would not repair the deployer's missing permission.

#Reauthenticate Application Default Credentials

If the CLI reports expired or interaction-required ADC:

gcloud auth application-default login

Repeat the original command. Fluffy uses ADC for cloud APIs, Pulumi, and publication; changing only the active gcloud CLI account may not change ADC.

#Reference: what to check after an action

A later failure may be a different stage. Keep the diagnostic and target together when following Troubleshooting.