AI SRE for GCP
Sherlocks AI on Google Cloud is an AI SRE that picks up your Cloud Monitoring alerts, reads the telemetry you already have, and returns a root cause with the evidence attached, in minutes rather than hours. Sixteen investigation agents run read-only inside your VPC, and your data never leaves your GCP project.
sre@prod-bastion ~ $ sherlocks investigate --source cloud-monitoringSOURCE SIGNAL CORRELATEDcloud-sql p99 100ms -> 1s N+1 after deploycloud-sql pool saturated query holding connsgke pod CrashLoopBack env var missingpubsub backlog growing subscriber OOM sre@prod-bastion ~ $ sherlocks explain trino-bigquery-jvm-config
Investigate incidents across your entire GCP stack
Modern GCP environments generate telemetry from everywhere. Cloud Monitoring metrics. Application logs in Cloud Logging. Kubernetes events on GKE. Cloud SQL query stats. Cloud Functions invocation traces. Pub/Sub subscription backlogs. When a real incident happens, the signal is almost always there. Finding it takes forty minutes of correlating dashboards, tabs, and Slack threads.
Sherlocks AI compresses that forty minutes into a few. Sixteen specialized investigation agents read your existing GCP telemetry, correlate signals across services and time, and return a root cause with the evidence attached. The Watson data agent runs inside your VPC with read-only access. Nothing gets modified, nothing gets executed, and no raw application data ever leaves your GCP project.
Supported GCP services
(07 Categories)Sherlocks AI integrates natively with the GCP services your production stack actually runs on.
Compute Engine instance metrics, resource utilization, and state changes.
Cloud SQL query performance, connection pools, replication lag, and slow query patterns across PostgreSQL and MySQL.
Cloud Functions and Cloud Run invocation metrics, error rates, cold start patterns, and function-level tracing.
Cloud Storage request metrics, error rates, latency, and access patterns.
Cloud Monitoring metrics and alerts, Cloud Logging log streams, and Cloud Trace spans across your entire GCP footprint.
GKE cluster health, pod status, deployment tracking, service dependencies, and resource metrics.
Pub/Sub subscription backlogs, message age, and DLQ stats.
How Sherlocks AI works on GCP
(04 Steps)- 1Step 1: Deploy Watson to your GKE cluster.
Install via Helm. Most teams finish setup in under thirty minutes. Watson runs as read-only pods inside your existing Kubernetes environment. No new infrastructure to provision.
- 2Step 2: Grant read-only IAM roles.
Create a service account with the project Viewer role and bind it to the Watson Kubernetes service account through Workload Identity. That gives Watson read access to Cloud Monitoring, Cloud SQL metadata, GKE state, and the other GCP APIs Sherlocks AI integrates with. Cannot modify infrastructure. Cannot execute commands. Cannot access secrets.
- 3Step 3: Connect your existing tools.
Slack for incident channels. Datadog, New Relic, or Prometheus if you use them. GitHub or GitLab for deployment correlation.
- 4Step 4: First investigation in Slack.
Tag Sherlocks AI in any incident channel or ask it directly. Most teams see their first AI-led investigation within an hour of finishing setup.
Deployment options for GCP
(02 Options)Two ways to run Sherlocks AI on GCP. Pick based on your security posture and compliance requirements.
SaaS
Fastest to startThe agents run in the Sherlocks AI cloud. Watson runs inside your VPC and is the only component that touches your systems.
On-premise
Strict residencyEverything runs inside your VPC, the model included. A deployment choice, not a reduced version of the product.
- Read-only. No write, delete or modify permission is requested anywhere.
- No business data. No table rows, message contents, customer PII or secrets.
- Encrypted. TLS 1.3 in transit, AES-256 at rest, keys separated per customer.
- SOC 2 Type 2. Report available on request.
Security and compliance
Enterprise GCP buyers care about specific things. Sherlocks AI answers each of them directly.
Watson cannot modify infrastructure, databases, or application state. Cannot execute commands or deploy changes. Cannot access secrets or credentials. Even if compromised, Watson cannot modify your systems or exfiltrate application data.
Sherlocks AI collects metadata and metrics. Database connection counts, query execution times, replication lag, error rates. Never table data, message contents, customer PII, API keys, or source code.
Sherlocks AI cloud environment is annually audited against the SOC 2 Type 2 framework.
TLS 1.3 in transit. AES-256 at rest. Separate encryption keys per customer with enforced rotation.
The On-premise option runs with no external dependencies. Compatible with regulated GCP deployments.
With the On-premise option, no telemetry data ever leaves your GCP project.
Telemetry metadata is retained for 90 days by default, configurable to match your policies.
Real GCP scenarios where Sherlocks AI helps
(05 Scenarios)A Cloud SQL query that ran in 100ms yesterday now takes 1 second. Sherlocks AI correlates the latency spike with the recent GKE deployment, identifies an N+1 query pattern introduced in a specific commit, and points to the exact code change. MTTR from hours to minutes.
Worked example: OOMKilled: Unbounded KYC Query (22M Rows)Some services deployed successfully, others failed silently. Sherlocks AI correlates CI/CD pipeline failures with missing services in GKE, identifies the failed build step, and links directly to the problematic commit.
Worked example: 503 Service OutageA pod restarts repeatedly. Sherlocks AI analyzes pod logs, identifies a missing environment variable introduced in the latest deployment, and provides the exact fix.
Worked example: CreateContainerConfigErrorDatabase connection pool saturated, queries timing out. Sherlocks AI detects the saturation, identifies a long-running query holding connections, and correlates with the recent code change that introduced it.
Worked example: DB Connection Pool ExhaustionSubscription backlog growing, message processing falling behind. Sherlocks AI identifies that a subscriber pod is crash-looping due to OOM, correlates with a recent traffic spike, and suggests scaling.
Worked example: Kafka Consumer LagIncidents on Kubernetes, worked end to end
(03 Published)Each of these is a real investigation with the evidence trail attached, including the hypotheses that were ruled out along the way.
Trino CrashLoopBackOff from a missing BigQuery connector JVM argument
Trino pods crash on startup (Exit Code 100) because the BigQuery connector requires --add-opens=java.base/java.nio=ALL-UNNAMED, which is missing from JVM config. Image Pull alert was a false positive.
Pod Evicted from Node Ephemeral Storage Exhaustion: root cause analysis
Pod evicted by kubelet after node ran out of ephemeral-storage (510 Mi available vs 2.14 GB threshold). DiskPressure taint blocked replacements; Karpenter provisioned new capacity. Missing ephemeral-storage requests allowed silent overcommit.
Prometheus PVC Disk Growth: TSDB blocks under a 65-day retention window
Prometheus PVC filled up due to TSDB block growth from increased metric cardinality under a 65-day retention window. Pod healthy: organic storage growth, not WAL bloat.
The full examples section has 20 investigations across AWS, Kubernetes, databases and Linux VMs. The Kubernetes RCA guides cover the failure classes behind them.
Frequently asked questions
(07 Questions)Does Sherlocks AI work with GKE?
Yes. Watson agent deploys via Helm directly into your GKE cluster. Sherlocks AI reads pod status, deployment events, service dependencies, and resource metrics across your GKE environment. GKE is one of the most common deployment targets for Sherlocks AI customers running on GCP.
How does the Watson agent authenticate to GCP?
Watson uses a dedicated GCP service account with the project Viewer role, bound to the Kubernetes service account through Workload Identity. No service account keys are stored in the cluster. Viewer is read-only across the project, so Watson can read Cloud Monitoring, Cloud SQL metadata, GKE state, and the other GCP APIs Sherlocks AI integrates with, and cannot change anything.
What IAM permissions does Sherlocks AI need?
The predefined Viewer role (roles/viewer) on a dedicated service account. That covers Cloud Monitoring metrics and Cloud Logging log streams, Cloud SQL metadata (INFORMATION_SCHEMA and metadata queries only, no application data), Cloud Functions invocation stats, Compute Engine metadata, Cloud Storage request metrics, GKE cluster status, and Pub/Sub subscription attributes. Sherlocks AI never requests write, modify, or execute permissions on any GCP service.
Can I deploy Sherlocks AI in regulated or air-gapped GCP environments?
Yes. The On-premise option supports regulated GCP environments. All Sherlocks AI components, the model included, run inside your GCP project with no external dependencies. Best suited for regulated industries requiring complete data isolation.
Is any data transmitted outside my GCP project?
Depends on the option. On-premise, nothing leaves your GCP project: agents, knowledge graph, model inference and Watson all run inside your network. SaaS, only encrypted metadata and metrics are transmitted to Sherlocks AI cloud, with PII redacted by Watson before it leaves, never raw application data.
Does Sherlocks AI integrate with Cloud Monitoring alerting policies?
Yes. Sherlocks AI reads Cloud Monitoring metrics, alerts, and alerting policies as part of its investigation. When a Cloud Monitoring alert fires and creates an incident channel in Slack, Sherlocks AI begins investigating automatically.
Can Sherlocks AI read from Cloud SQL without accessing application data?
Yes. Cloud SQL integration uses read-only access to INFORMATION_SCHEMA and metadata queries only. Sherlocks AI reads query performance stats, replication status, connection pool metrics, and slow query patterns. Never table contents, PII, or application records.
Get started with Sherlocks AI on GCP
Try Sherlocks AI free with 30 investigations per month, no credit card required. Most teams have Watson running on GKE in under thirty minutes.
The docs cover the Helm install and the IAM roles in full.