LangFlow on GKE Autopilot

LangFlow is an open-source, low-code visual builder for AI agents and workflows, built on LangChain — you assemble language-model chains, RAG pipelines, and agents by dragging and wiring components on a canvas, then expose them as APIs. This module deploys LangFlow on GKE Autopilot on top of the App_GKE foundation, which provisions and manages the shared Google Cloud and Kubernetes infrastructure.

This guide focuses on the cloud services LangFlow uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics that are common to every GKE application — Workload Identity, ingress, autoscaling, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_GKE foundation guide rather than repeating them here.

1. Overview

LangFlow runs as a single Python (FastAPI + React) web workload. The deployment wires together a focused set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	GKE Autopilot	Python pods on port 7860, 1 vCPU / 1 GiB by default, horizontally autoscaled
Database	Cloud SQL for PostgreSQL 15	Required — LangFlow persists all flows, components, and credentials in Postgres
Object storage	Cloud Storage	A dedicated `data` bucket is provisioned by default; LangFlow's application state itself lives in PostgreSQL
Cache & queue	Redis (optional)	Not required by LangFlow; wired for forward compatibility only
Secrets	Secret Manager	Auto-generated `LANGFLOW_SECRET_KEY` and `LANGFLOW_SUPERUSER_PASSWORD`; database password
Ingress	Cloud Load Balancing	External LoadBalancer, optional custom domain + managed certificate

Sensible defaults worth knowing up front:

PostgreSQL 15 is mandatory. The database engine is fixed by the shared application layer (database_type = "POSTGRES_15"); selecting any other engine breaks startup.
LANGFLOW_SECRET_KEY is generated automatically and stored in Secret Manager. It encrypts every stored credential embedded in a flow. It must never be rotated after first boot — rotating it permanently breaks all stored credentials, which then have to be re-entered in each flow.
The admin account is provisioned from a generated password. LANGFLOW_AUTO_LOGIN = "false" turns on authentication; LangFlow creates the initial admin (admin by default) using the LANGFLOW_SUPERUSER_PASSWORD secret. Retrieve it from Secret Manager to log in.
The database connects via the Cloud SQL Auth Proxy sidecar on 127.0.0.1; the entrypoint composes LANGFLOW_DATABASE_URL over TCP with sslmode=disable (the proxy terminates TLS).
Session affinity is ClientIP by default. LangFlow holds in-process session and flow-editor state; sticky routing keeps a client on the same pod.
A single pod by default (min_instance_count = 1, max_instance_count = 1). GKE does not scale to zero; LangFlow's in-process state means a single replica is the safe default.
Application state lives in PostgreSQL; NFS is off by default. A data Cloud Storage bucket is provisioned by default (storage_buckets), but LangFlow itself keeps flows, components, and credentials in the database.

2. Google Cloud Services & How to Explore Them

All commands assume you have run gcloud container clusters get-credentials <cluster> --region <region> --project <project> and that PROJECT, REGION, and NAMESPACE are set. The namespace and other identifiers are reported in the deployment Outputs.

A. GKE Autopilot — the LangFlow workload

LangFlow pods are scheduled on Autopilot, which bills for the CPU/memory the pods actually request. Horizontal Pod Autoscaling sizes the deployment between the minimum and maximum replica counts.

Console: Kubernetes Engine → Workloads → select the LangFlow workload to see pods, revisions, and events. Kubernetes Engine → Services & Ingress shows the external IP.

CLI:

kubectl get pods,svc,hpa -n "$NAMESPACE"
kubectl logs -n "$NAMESPACE" deploy/<service-name> --tail=100
kubectl describe hpa -n "$NAMESPACE"          # current vs target utilisation

See App_GKE for how Autopilot, scaling, and the workload type (Deployment vs StatefulSet) are managed.

B. Cloud SQL for PostgreSQL 15

LangFlow stores all application data (flows, components, credentials, run history, users) in a managed Cloud SQL for PostgreSQL 15 instance. Pods reach it privately through the Cloud SQL Auth Proxy sidecar on 127.0.0.1; no public IP is exposed. On first deploy an initialization Job creates the application database, role, and grants.

Console: SQL → select the instance for connections, backups, flags, and metrics.

CLI:

gcloud sql instances list --project "$PROJECT" --filter="name~langflow"
gcloud sql instances describe <instance-name> --project "$PROJECT"
# Open an interactive shell to inspect schema/data:
gcloud sql connect <instance-name> --user=<db-user> --database=<db-name> --project "$PROJECT"

The instance name, database name, user, and the Secret Manager secret holding the password are all surfaced in the Outputs. For the connection model, automated backups, and password rotation, see App_GKE.

C. Redis (optional — not used by LangFlow)

Redis is disabled by default and LangFlow does not require it; the enable_redis inputs are wired for forward compatibility only. Leave enable_redis = false unless a future feature needs it.

CLI (only if enabled):

kubectl exec -n "$NAMESPACE" deploy/<service-name> -- env | grep -i redis

D. Secret Manager

Two secrets are generated automatically and stored in Secret Manager: LANGFLOW_SECRET_KEY (encrypts all stored credentials) and LANGFLOW_SUPERUSER_PASSWORD (the initial admin login password). They are delivered to pods through the Secret Store CSI integration. The database password is managed separately by the foundation.

Console: Security → Secret Manager.

CLI:

gcloud secrets list --project "$PROJECT" --filter="name~langflow"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"

The database password secret name is in the Outputs. See App_GKE for the Secret Store CSI integration and rotation.

E. Networking & ingress

By default the workload is exposed through an external Cloud Load Balancing IP (service_type = LoadBalancer). A custom domain with a Google-managed certificate can be enabled, and a static IP can be reserved so the address survives redeploys.

Console: Network services → Load balancing; VPC network → IP addresses.

CLI:

kubectl get ingress,svc -n "$NAMESPACE"
gcloud compute addresses list --project "$PROJECT"

See App_GKE for custom domains, Cloud CDN, and static IP details.

F. Cloud Logging & Monitoring

Pod stdout/stderr flow to Cloud Logging; GKE and Cloud SQL metrics flow to Cloud Monitoring. Optional uptime checks and alert policies are available.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud logging read 'resource.type="k8s_container" AND resource.labels.namespace_name="'"$NAMESPACE"'"' \
  --project "$PROJECT" --limit 50

3. LangFlow Application Behaviour

First-deploy database setup. An initialization Job runs create-db-and-user.sh using postgres:15-alpine. It waits for PostgreSQL, then idempotently creates the application role and database, sets ownership, and grants privileges on the database and public schema, then signals the Cloud SQL Auth Proxy sidecar to shut down (POST /quitquitquit) so the Job pod exits cleanly. It is safe to re-run.
Schema migrations on start. LangFlow runs its Alembic migrations on every container start, so the tables are created and upgraded by the application itself — the db-init job only handles role/database/grants. Allow extra time on first boot.
LANGFLOW_SECRET_KEY is immutable after first boot. It is generated once and written to Secret Manager. Changing it permanently breaks every stored credential embedded in a flow; they can no longer be decrypted. Only rotate during a planned maintenance window with a plan to re-enter credentials.
Initial admin account. With LANGFLOW_AUTO_LOGIN = "false", LangFlow creates the superuser (admin by default, set via langflow_username) using the LANGFLOW_SUPERUSER_PASSWORD secret. Retrieve the password and log in:
```
gcloud secrets versions access latest \
  --secret=<langflow-password-secret> --project "$PROJECT"
```
Database URL is composed at runtime. The entrypoint builds LANGFLOW_DATABASE_URL from the injected DB_* vars over TCP. On GKE DB_HOST = 127.0.0.1 (the Auth Proxy sidecar) so sslmode=disable is used — do not set the DSN manually.
Health path. Startup and liveness probes target /health, LangFlow's public liveness endpoint that returns 200 once the server is up. Allow time on first boot for the Alembic migrations before the pod becomes Ready.
Session affinity. session_affinity = ClientIP keeps each client on the same pod — important because LangFlow keeps flow-editor state in-process.

Inspect job execution:

kubectl get jobs -n "$NAMESPACE"
kubectl logs -n "$NAMESPACE" job/<job-name>

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for LangFlow are listed; every other input is inherited from App_GKE with its standard behaviour and defaults.