Using multiple Google Cloud projects

This page shows how to use separate Google Cloud projects for different aspects of GKE on-prem.

The GKE on-prem configuration file has several fields where you can specify a Google Cloud project ID:

...
usercluster:
  usagemetering:
    bigqueryprojectid: ""
...
gkeconnect:
  projectid: ""
...
stackdriver:
  projectid: ""
...
cloudauditlogging:
  projectid: ""

The idea is that you can have one project for connecting to GKE on-prem, another project for logging and monitoring, and so on.

You do not have to use separate project IDs. For example, you could use the same project for both connecting and logging. If you like, you can use the same project for everything.

Usage metering project

If you enable GKE usage metering for a user cluster, GKE on-prem stores usage data in a BigQuery dataset that is associated with a Google Cloud project of your choice.

In your GKE on-prem configuration file, set usercluster.usagemetering.bigqueryprojectid to the ID of the Google Cloud project where you want to store usage data.

Enabling APIs in your usage metering project

To enable the required APIs in your usage metering project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    bigquery.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your usage metering project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    bigquery.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your usage metering project.

Granting roles to service accounts on your usage metering project

Your usage metering service account must be granted certain roles on your usage metering project.

For details see usage metering service account.

Connect project

When you create a user cluster, GKE on-prem uses Connect to register the cluster with a Google Cloud project of your choice. After your cluster is registered, you can view and manage your cluster in this project in the Google Cloud console.

Connect uses a Deployment called the Connect Agent to establish a connection between your GKE on-prem cluster and your Google Cloud project.

In the GKE on-prem configuration file, set gkeconnect.projectid to the ID of the Google Cloud project where you want to view and manage your cluster.

Note: The Google Cloud project where you view and manage your cluster might be different from the Google Cloud project where you view your cluster's logs and metrics. The project where you view logs and metrics is called the logging-monitoring project.

Enabling APIs in your connect project

To enable the required APIs in your connect project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    cloudresourcemanager.googleapis.com \
    container.googleapis.com \
    gkeconnect.googleapis.com \
    gkehub.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    cloudresourcemanager.googleapis.com ^
    container.googleapis.com ^
    gkeconnect.googleapis.com ^
    gkehub.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Granting roles to service accounts on your connect project

Your connect-register service account and your connect-agent service account must be granted certain roles on your connect project.

For details see Connect-register service account and Connect-agent service account.

Logging-monitoring project

In a user cluster, logging and metrics agents collect data and make it available to Cloud Logging and Cloud Monitoring. To view logs and metrics from your cluster, you must specify an associated Google Cloud project.

In your user cluster configuration file, set stackdriver.projectID to the ID of the Google Cloud project that you want to associate with logging and monitoring. This is the project where you will view the cluster's logs and metrics.

Note: The Google Cloud project where you view your cluster's logs and metrics might be different from the Google Cloud project where you view and manage your cluster. The project where you view and manage your cluster is called the connect project.

Enabling APIs in your logging-monitoring project

To enable the required APIs in your logging-monitoring project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    stackdriver.googleapis.com \
    monitoring.googleapis.com \
    logging.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your logging-monitoring project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    stackdriver.googleapis.com ^
    monitoring.googleapis.com ^
    logging.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your logging-monitoring project.

Granting roles to service accounts on your logging-monitoring project

Your logging-monitoring service account must be granted certain roles on your logging-monitoring project.

For details, see Logging-monitoring service account.

Audit logging project

If you enable Cloud Audit Logs for GKE on-prem, the audit log entries from your cluster's Kubernetes API server are sent to Google Cloud. You can view the audit log entries in a Google Cloud project of your choice.

In the GKE on-prem configuration file, set cloudauditlogging.projectid to the ID of the Google Cloud project where you want to view audit logs.

Enabling APIs in your audit logging project

To enable the required APIs in your audit logging project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    anthosgke.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your audit logging project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    anthosgke.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your audit logging project.

Granting roles to service accounts on your audit logging project

Your audit logging service account must be granted certain roles on your audit logging project.

For details, see Audit logging service account.

Parent project of your component access service account

To install GKE on-prem, you must have:

• Created a Google Cloud project.

• In your Google Cloud project, you created a service account that GKE on-prem can use to download components from Container Registry. This service account is called your component access service account.

• Enabled the GKE Enterprise API. Enabling this API might incur charges. See the Pricing guide for more details.

The Google Cloud project where you created your compoonent access service account is called the parent of your component access service account. This project can be the same as one of the projects that you specify in your GKE on-prem configuration file, or it can be different from all of the projects that you specify in your configuration file.

To enable the required APIs for the parent project of your component access service account:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of the parent project of your component access service account.

Windows

gcloud services enable --project [PROJECT_ID] ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of the parent project of your component access service account.

What's next

Learn about service accounts and keys for GKE on-prem.