Excalidraw on GKE Autopilot

Excalidraw is an open-source (MIT) virtual whiteboard for sketching hand-drawn-style diagrams, wireframes, and quick collaborative drawings. The self-hosted distribution is a static single-page application served by nginx — there is no backend, database, or user accounts, and drawings are stored in the visitor's own browser. This module deploys that static frontend on GKE Autopilot on top of the App_GKE foundation, which provisions and manages the shared Google Cloud and Kubernetes infrastructure.

This guide focuses on the cloud services Excalidraw uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every GKE application — Workload Identity, ingress, autoscaling, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, and the deployment lifecycle — refer to the App_GKE foundation guide rather than repeating them here.

1. Overview

Excalidraw runs as a single stateless nginx web workload. Because the app has no backend, the deployment wires together only a minimal set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	GKE Autopilot	Static nginx pods on port 80, horizontally autoscaled; billed for requested CPU/memory
Container image	Artifact Registry	Thin custom build `FROM excalidraw/excalidraw`, mirrored into the project registry
Database	None	Excalidraw has no backend — no Cloud SQL instance is created
Object storage	None	No GCS bucket is provisioned; drawings live in the browser
Cache & queue	None	No Redis, no message queue
Secrets	None	No encryption keys, JWT secrets, or DB passwords — Secret Manager is unused
Ingress	Cloud Load Balancing	External LoadBalancer, optional custom domain + managed certificate

Sensible defaults worth knowing up front:

Fully stateless — no data is stored server-side. Drawings persist in each browser's local storage and are exported/imported as .excalidraw files. Pod rescheduling, redeploys, and scaling lose no server data because there is none.
Minimum 1 replica is maintained (GKE does not support scale-to-zero) to keep the whiteboard always reachable. The wrapper pins min_instance_count = 1.
Deployment workload, not StatefulSet. There is no per-pod persistent volume — every pod serves the same static bundle, so a plain Deployment is used and pods are fully interchangeable.
Fixed port 80. The nginx listener is baked into the image; container_port defaults to 80 and should not be changed.
No Cloud SQL, Secret Manager, Redis, NFS, or GCS. The corresponding foundation features are inert for this app — enabling them provisions unused infrastructure.
External LoadBalancer by default so the whiteboard is browser-reachable; a reserved static IP keeps the address stable across redeploys.
Vestigial homeserver_url / homeserver_name inputs. Carried over from the Element template and injected as HOMESERVER_URL / HOMESERVER_NAME; the Excalidraw static SPA ignores them. Leave them at their defaults.

2. Google Cloud Services & How to Explore Them

All commands assume you have run gcloud container clusters get-credentials <cluster> --region <region> --project <project> and that PROJECT, REGION, and NAMESPACE are set. The namespace and other identifiers are reported in the deployment Outputs.

A. GKE Autopilot — the Excalidraw workload

Excalidraw pods are scheduled on Autopilot, which bills for the CPU/memory the pods actually request. Horizontal Pod Autoscaling sizes the deployment between the minimum (1) and maximum replica counts. Because every pod is identical and stateless, scaling out is safe with no coordination.

Console: Kubernetes Engine → Workloads → select the Excalidraw workload for pods, revisions, and events. Kubernetes Engine → Services & Ingress shows the external IP.

CLI:

kubectl get pods,svc,hpa -n "$NAMESPACE"
kubectl logs -n "$NAMESPACE" deploy/<service-name> --tail=100      # nginx access/error logs
kubectl describe hpa -n "$NAMESPACE"                                # current vs target utilisation

See App_GKE for how Autopilot, scaling, and the workload type are managed.

B. Artifact Registry — the container image

The Excalidraw image is a thin custom build FROM excalidraw/excalidraw that Cloud Build produces and pushes into the project's Artifact Registry (enable_image_mirroring = true). App_GKE sets imagePullPolicy=Always for custom-built/mirrored images so a rebuilt tag is always re-pulled.

Console: Artifact Registry → Repositories.

CLI:

gcloud artifacts repositories list --project "$PROJECT" --location "$REGION"
gcloud artifacts docker images list <repo-path> --include-tags
gcloud builds list --project "$PROJECT" --region "$REGION" --limit 5
# Confirm the digest running in the cluster matches the freshly built image:
kubectl get pod -n "$NAMESPACE" -o jsonpath='{.items[0].status.containerStatuses[0].imageID}'

C. Database, Secret Manager, Cloud Storage, Redis — not used

Excalidraw provisions none of these. There is no Cloud SQL instance, no Secret Manager secret, no GCS bucket, and no Redis for this deployment. The following will return empty results for the app — that is expected:

gcloud sql instances list --project "$PROJECT" --filter="name~excalidraw"   # (none)
gcloud secrets list --project "$PROJECT" --filter="name~excalidraw"          # (none)
gcloud storage buckets list --project "$PROJECT" --filter="name~excalidraw"  # (none)

Multi-user real-time collaboration (a live shared canvas) requires a separate excalidraw-room WebSocket server, which this module does not deploy.

D. Networking & ingress

By default the workload is exposed through an external Cloud Load Balancing IP. A custom domain with a Google-managed certificate can be enabled, and a static IP can be reserved so the address survives redeploys. Cloud CDN is a good fit for the static assets.

Console: Network services → Load balancing; VPC network → IP addresses.

CLI:

kubectl get ingress,svc -n "$NAMESPACE"
gcloud compute addresses list --project "$PROJECT"

See App_GKE for custom domains, Cloud CDN, and static IP details.

E. Cloud Logging & Monitoring

Pod stdout/stderr (nginx logs) flow to Cloud Logging; GKE metrics flow to Cloud Monitoring. Optional uptime checks and alert policies are available; a public root-path uptime check is a natural health signal for the static frontend.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud logging read 'resource.type="k8s_container" AND resource.labels.namespace_name="'"$NAMESPACE"'"' \
  --project "$PROJECT" --limit 50

3. Excalidraw Application Behaviour

No first-deploy setup. There is no database, no init job, and no migrations. A pod is Ready as soon as nginx starts serving the static bundle — usually within a second or two.
No accounts, no login, no server persistence. The self-hosted frontend has no authentication and stores nothing server-side. Each user's drawings live in their own browser's local storage; use Export (.excalidraw, PNG, or SVG) to save or share work.
Pods are interchangeable. Every replica serves the identical static bundle, so requests need no session affinity and scaling out requires no coordination — unlike the stateful application modules.
Real-time collaboration is not included. The live "shareable link" collaboration feature depends on a separate excalidraw-room WebSocket service that this module does not deploy. Single-user editing works out of the box.
Health path. Startup and liveness probes target the root /, which nginx answers with 200 immediately. Verify from inside the cluster or via the LoadBalancer IP:
```
kubectl port-forward -n "$NAMESPACE" deploy/<service-name> 8080:80
curl -sI http://localhost:8080/ | head -1        # expect: HTTP/1.1 200 OK
```
Version upgrades are a rebuild + redeploy. Bumping application_version rebuilds the image from a new excalidraw/excalidraw tag and rolls out new pods; because there is no state, upgrades and rollbacks are trivial and non-destructive.
Vestigial env vars. HOMESERVER_URL / HOMESERVER_NAME are injected (Element carry-over) but ignored by the static SPA. Confirm/inspect env with:
```
kubectl exec -n "$NAMESPACE" deploy/<service-name> -- env | grep HOMESERVER
```

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for Excalidraw are listed; every other input is inherited from App_GKE with its standard behaviour and defaults.