This page shows how to use separate Google Cloud projects for different aspects of GKE on-prem.
A cluster configuration file has several fields where you can specify a Google Cloud project ID:
...
usercluster:
usagemetering:
bigqueryprojectid: ""
...
gkeconnect:
projectid: ""
...
stackdriver:
projectid: ""
...
cloudauditlogging:
projectid: ""
The idea is that you can have one project for connecting to GKE on-prem, another project for logging and monitoring, and so on.
You do not have to use separate project IDs. For example, you could use the same project for both connecting and logging. If you like, you can use the same project for everything.
Usage metering project
If you enable GKE usage metering for a user cluster, GKE on-prem stores usage data in a BigQuery dataset that is associated with a Google Cloud project of your choice.
In your GKE on-prem configuration file, set
usercluster.usagemetering.bigqueryprojectid to the ID of the
Google Cloud project where you want to store usage data.
Enabling APIs in your usage metering project
To enable the required APIs in your usage metering project:
Linux and macOS
gcloud services enable --project [PROJECT_ID] \
bigquery.googleapis.com \
serviceusage.googleapis.com \
iam.googleapis.com \
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your usage metering project.
Windows
gcloud services enable --project [PROJECT_ID] ^
bigquery.googleapis.com ^
serviceusage.googleapis.com ^
iam.googleapis.com ^
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your usage metering project.
Granting roles to service accounts on your usage metering project
Your usage metering service account must be granted certain roles on your usage metering project.
For details see usage metering service account.
Connect project
When you create a user cluster, GKE on-prem uses Connect to register the cluster with a Google Cloud project of your choice. After your cluster is registered, you can view and manage your cluster in this project in the Google Cloud console.
Connect uses a Deployment called the Connect Agent to establish a connection between your GKE on-prem cluster and your Google Cloud project.
In the GKE on-prem configuration file, set gkeconnect.projectid to
the ID of the Google Cloud project where you want to view and manage your
cluster.
Enabling APIs in your connect project
To enable the required APIs in your connect project:
Linux and macOS
gcloud services enable --project [PROJECT_ID] \
cloudresourcemanager.googleapis.com \
container.googleapis.com \
gkeconnect.googleapis.com \
gkehub.googleapis.com \
serviceusage.googleapis.com \
iam.googleapis.com \
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your connect project.
Windows
gcloud services enable --project [PROJECT_ID] ^
cloudresourcemanager.googleapis.com ^
container.googleapis.com ^
gkeconnect.googleapis.com ^
gkehub.googleapis.com ^
serviceusage.googleapis.com ^
iam.googleapis.com ^
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your connect project.
Granting roles to service accounts on your connect project
Your connect-register service account and your connect-agent service account must be granted certain roles on your connect project.
For details see Connect-register service account and Connect-agent service account.
Logging-monitoring project
In a user cluster, logging and metrics agents collect data and make it available to Cloud Logging and Cloud Monitoring. To view logs and metrics from your cluster, you must specify an associated Google Cloud project.
In your user cluster configuration file, set stackdriver.projectID to
the ID of the Google Cloud project that you want to associate with logging
and monitoring. This is the project where you will view the cluster's logs and
metrics.
Enabling APIs in your logging-monitoring project
To enable the required APIs in your logging-monitoring project:
Linux and macOS
gcloud services enable --project [PROJECT_ID] \
stackdriver.googleapis.com \
monitoring.googleapis.com \
logging.googleapis.com \
serviceusage.googleapis.com \
iam.googleapis.com \
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your logging-monitoring project.
Windows
gcloud services enable --project [PROJECT_ID] ^
stackdriver.googleapis.com ^
monitoring.googleapis.com ^
logging.googleapis.com ^
serviceusage.googleapis.com ^
iam.googleapis.com ^
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your logging-monitoring project.
Granting roles to service accounts on your logging-monitoring project
Your logging-monitoring service account must be granted certain roles on your logging-monitoring project.
For details, see Logging-monitoring service account.
Audit logging project
If you enable Cloud Audit Logs for GKE on-prem, the audit log entries from your cluster's Kubernetes API server are sent to Google Cloud. You can view the audit log entries in a Google Cloud project of your choice.
In the GKE on-prem configuration file, set
cloudauditlogging.projectid to the ID of the Google Cloud project where you
want to view audit logs.
Enabling APIs in your audit logging project
To enable the required APIs in your audit logging project:
Linux and macOS
gcloud services enable --project [PROJECT_ID] \
anthosgke.googleapis.com \
serviceusage.googleapis.com \
iam.googleapis.com \
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your audit logging project.
Windows
gcloud services enable --project [PROJECT_ID] ^
anthosgke.googleapis.com ^
serviceusage.googleapis.com ^
iam.googleapis.com ^
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of your audit logging project.
Granting roles to service accounts on your audit logging project
Your audit logging service account must be granted certain roles on your audit logging project.
For details, see Audit logging service account.
Parent project of your component access service account
To install GKE on-prem, you must have:
Created a Google Cloud project.
In your Google Cloud project, you created a service account that GKE on-prem can use to download components from Container Registry. This service account is called your component access service account.
Enabled the GKE Enterprise API. Enabling this API might incur charges. See the Pricing guide for more details.
The Google Cloud project where you created your compoonent access service account is called the parent of your component access service account. This project can be the same as one of the projects that you specify in your GKE on-prem configuration file, or it can be different from all of the projects that you specify in your configuration file.
To enable the required APIs for the parent project of your component access service account:
Linux and macOS
gcloud services enable --project [PROJECT_ID] \
serviceusage.googleapis.com \
iam.googleapis.com \
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of the parent project of your component access service account.
Windows
gcloud services enable --project [PROJECT_ID] ^
serviceusage.googleapis.com ^
iam.googleapis.com ^
cloudresourcemanager.googleapis.com
where [PROJECT_ID] is the ID of the parent project of your component access service account.
What's next
Learn about service accounts and keys for GKE on-prem.