Anthropic Deploy Integration
Overview
Deploy Claude API integrations with proper secret management, health checks, and rollback procedures across Docker, GCP Cloud Run, and Kubernetes.
Docker Deployment
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY src/ ./src/
ENV ANTHROPIC_API_KEY=""
EXPOSE 8000
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]
# src/main.py
from fastapi import FastAPI, HTTPException
import anthropic
app = FastAPI()
client = anthropic.Anthropic()
@app.get("/health")
async def health():
try:
count = client.messages.count_tokens(
model="claude-haiku-4-20250514",
messages=[{"role": "user", "content": "ping"}]
)
return {"status": "healthy", "api": "connected"}
except Exception as e:
raise HTTPException(503, detail=str(e))
GCP Cloud Run
echo -n "sk-ant-api03-..." | gcloud secrets create anthropic-key --data-file=-
gcloud run deploy claude-service \
--image gcr.io/my-project/claude-service \
--set-secrets ANTHROPIC_API_KEY=anthropic-key:latest \
--min-instances 1 --max-instances 10 \
--memory 512Mi --timeout 120s
Kubernetes
apiVersion: apps/v1
kind: Deployment
metadata: { name: claude-service }
spec:
replicas: 3
strategy: { type: RollingUpdate, rollingUpdate: { maxUnavailable: 1 } }
template:
spec:
containers:
- name: app
env:
- name: ANTHROPIC_API_KEY
valueFrom:
secretKeyRef: { name: anthropic-secrets, key: api-key }
livenessProbe:
httpGet: { path: /health, port: 8000 }
periodSeconds: 30
Rollback
# Cloud Run
gcloud run services update-traffic claude-service --to-revisions=PREVIOUS=100
# Kubernetes
kubectl rollout undo deployment/claude-service
Error Handling
| Issue | Cause | Fix |
|---|---|---|
| Container crash on start | Missing API key env var | Verify secret binding |
| Health check fails | Key invalid in prod | Test key with curl |
| 429 after scaling up | More replicas = more RPM | Shared rate limiter (Redis) |
Prerequisites
- Have an approved artifact digest, environment/workspace mapping, secret-manager reference, health probe, deployment owner, canary plan, and tested rollback command.
- Use a least-privileged runtime identity and synthetic fixtures in staging; never embed API keys in images, manifests, command history, or deployment output.
- Define deployment SLOs for health, errors, latency, rate limits, cost, and data-policy checks, with explicit halt thresholds.
Instructions
- Build and scan the pinned artifact, bind the environment-specific secret at runtime, and verify that logs and probes cannot expose prompts, responses, or credentials.
- Deploy to staging and run the token-count/health probe plus synthetic Messages API, error, timeout, rate-limit, and redaction tests. Confirm the workspace and model are approved.
- Release to one sandbox or internal canary, monitor aggregate SLOs and
sensitive_content_logged=0, and require owner approval before wider traffic. - Promote in bounded stages while preserving the prior revision and idempotent deployment record. Do not bypass failed health, authorization, or data-policy gates.
- On failure, stop traffic, roll back to the prior revision, revoke temporary access, clean up staged artifacts under the retention policy, and issue a redacted deployment receipt.
Output
Produce a deployment receipt containing artifact digest, environment/workspace class, model policy, probe/test results, canary scope, SLO outcomes, approval, rollout state, retention cleanup, and rollback reference. Exclude API keys, prompts, responses, customer identifiers, and raw stack traces.
Examples
Deploy artifact=sha256:fixture to a staging workspace, run synthetic fixture-request-001, assert workspace=staging; sensitive_content_logged=0, then release a 1% internal canary. If the 5xx or latency gate fails, record promotion=halted; rollback=previous-revision and send no production traffic.
Resources
Next Steps
For event-driven patterns, see anth-webhooks-events.