Install and configure Premium

Premium adds services in your GCP project for pull-request previews, temporary human access, and observability. Installing those services and giving an application access to an extension are separate operations.

#Understand: three places with different responsibilities

Hosted login does not provide Google Cloud permissions. Installing customer services does not add methods to an application's SDK. A runtime gets extension operations only after you register the extension, declare its capability, and grant that runtime access.

These guides describe the current development version. Use the matching reviewed executable and service images from your authorized distribution or development build.

#Configure: install into a workspace environment

Prepare the project using Core deployment setup. You need an entitled Fluffy organization, a workspace environment with a GCP provider, and the permissions required by the selected products. Authenticate Google Cloud CLI and ADC as the same authorized human:

gcloud auth login
gcloud auth application-default login

Supply the stable installation passphrase through PULUMI_CONFIG_PASSPHRASE from your secret store. Preview additionally needs a delegated domain, repositories, and reviewer group. Resource Access needs an organization-backed project and separate requester/approver principals. Group integration needs your real Google Workspace customer ID.

#Obtain the companion and sign in

Use the executable supplied through your Premium distribution. In an authorized Fluffy development checkout, ./build-premium-local builds the companion; use --services when customer service images also changed. Follow the helper's printed executable and release-directory paths. These local build commands do not publish a release.

Put fluffy-chainsaw-premium on PATH. From the application's exact workspace root:

fluffy-chainsaw-premium login
fluffy-chainsaw-premium install

Login selects the Hosted organization. The guided installer selects the workspace environment, enabled products, groups, and product configuration. It derives project and region from the workspace provider. Review the generated configuration and infrastructure plan before applying it.

#Review the configuration files

Observability belongs beside each application's manifest in fluffy-chainsaw.observability.yaml. Remove conflicting configuration for disabled products: the loader rejects a preview/access/observability document whose capability is disabled.

Google Workspace integration can create a declared group when createIfMissing: true. It does not manage that group's human membership. For example, merge your real organization details and all referenced groups into the integration document:

apiVersion: fluffy-chainsaw.dev/integrations/v1
googleWorkspace:
  customerId: YOUR_GOOGLE_WORKSPACE_CUSTOMER_ID
  groups:
    - email: operators@your-company.com
    - email: reviewers@your-company.com
      createIfMissing: true

The placeholder customer ID must be replaced. The integration must include every referenced group, including operators, reviewers, access requesters, approvers, and emergency groups when configured. A group created by the installer still needs membership managed through your normal Google Workspace process.

#Register extension capabilities with an application

For an application that needs Premium SDK operations, register the reviewed executable:

fluffy-chainsaw extension install --application example-app --executable /path/to/fluffy-chainsaw-premium

Core copies and pins the executable identity in the application's .fluffy/extensions.lock.json. It is native code executed by Core; a YAML declaration alone cannot install it. After changing the executable, register the reviewed version again and regenerate affected outputs.

The observability guide shows both extensions.premium declarations and uses.extensions.premium grants for counters. Previews and human access do not require adding counter grants to an application.

#Check an existing installation or upgrade it

fluffy-chainsaw-premium install --check
fluffy-chainsaw-premium install --upgrade

For locally built service artifacts, pass the helper's directory with --release-directory. Inspect the plan against the intended installation before applying. install --check avoids infrastructure apply, but can save guided configuration or session bindings; it is not a completely write-free operation.

Open the reported customer Control Room URL. Verify the organization, installation, application bindings, and enabled product navigation. A successful login alone does not establish that all customer services are ready.

#Reference: installation fields and boundaries

The installation document uses apiVersion: fluffy-chainsaw.dev/installation/v1 and these fields:

At least one supported capability must be enabled. IDs use lowercase identities starting with a letter, followed by letters, digits, or hyphens, up to 63 characters. Project and region are resolved, not duplicated here. The current development build rejects managed-deployments installation even though its policy schema exists; use Core deployment for applications.

Integration googleWorkspace.customerId uses the real Google customer ID beginning with C. Group entries use email and optional createIfMissing. Optional slack.channel is the channel ID, not a display name; it requires the corresponding integration setup.

Fluffy owns the internal Pulumi stages. Do not run them manually to skip an installer check. Continue with private previews, human access, or observability.