The Anthos On-Prem API is a Google Cloud-hosted API that lets you manage the
lifecycle of your on-premises clusters using clients such as the
Google Cloud console and the Google Cloud CLI. When you create a user cluster using
one of these clients, the API stores metadata about your cluster's state in
the Google Cloud region that you specified when creating the cluster. This
metadata lets you manage the lifecycle of the cluster in the
console or gcloud CLI, including adding and removing
node pools. If you want to use these clients to view cluster details or manage
the lifecycle of clusters that were created using gkectl
, you must
enroll the clusters with the Anthos On-Prem API.
Requirements
- User clusters must be version 1.11 or higher.
- Admin clusters must be version 1.13 or higher.
If your organization has set up an allowlist that lets traffic from Google APIs and other addresses pass through your proxy server, add the following to the allowlist:
- gkeonprem.googleapis.com
- gkeonprem.mtls.googleapis.com
These are the service names for the Anthos On-Prem API.
If you aren't a project owner, minimally, you must be granted the Identity and Access Management role
roles/gkeonprem.admin
on the project. For details on the permissions included in this role, see GKE on-prem roles in the IAM documentation.
Enroll a cluster
To enroll clusters:
Run the following command to log in with your Google account:
gcloud auth login
Update the Google Cloud CLI alpha components:
gcloud components update
Enable the Anthos On-Prem API in your the fleet host project:
gcloud services enable \ --project FLEET_HOST_PROJECT_ID \ gkeonprem.googleapis.com
Replace
FLEET_HOST_PROJECT_ID
with the project ID of your fleet host project. This is the project ID that was configured in thegkeconnect
section of your admin cluster configuration file or user cluster configuration file.Enroll the cluster with the Anthos On-Prem API:
User cluster
gcloud alpha container vmware clusters enroll USER_CLUSTER_NAME \ --project=FLEET_HOST_PROJECT_ID \ --admin-cluster-membership=ADMIN_CLUSTER_MEMBERSHIP_NAME \ --location=LOCATION
Replace the following:
USER_CLUSTER_NAME
: The name of the user cluster that you want to enroll.FLEET_HOST_PROJECT_ID
The project ID of your fleet host project.ADMIN_CLUSTER_MEMBERSHIP_NAME
: The admin cluster that manages the user cluster. Specify either the name of the admin cluster or the fully-specified cluster name that uniquely identifies the cluster in Google Cloud. The admin cluster name is the last segment of the fully-specified cluster name:projects/FLEET_HOST_PROJECT_ID/locations/global/memberships/ADMIN_CLUSTER_NAME
LOCATION
: The Google Cloud region in which the Anthos On-Prem API runs. Specifyus-west1
or another supported region. The region can't be changed after the cluster is enrolled. In addition to setting the region where the Anthos On-Prem API runs, this is the region in which the following is stored:- The user cluster metadata that the Anthos On-Prem API needs to manage the cluster lifecycle
- The Cloud Logging and Cloud Monitoring data of system components
- The Admin Audit log created by Cloud Audit Logs
Admin cluster
gcloud alpha container vmware admin-clusters enroll ADMIN_CLUSTER_NAME \ --project=FLEET_HOST_PROJECT_ID \ --admin-cluster-membership=ADMIN_CLUSTER_MEMBERSHIP_NAME \ --location=LOCATION
Replace the following:
ADMIN_CLUSTER_NAME
: The name of the admin cluster that you want to enroll.FLEET_HOST_PROJECT_ID
The project ID of your fleet host project.ADMIN_CLUSTER_MEMBERSHIP_NAME
: Specify either the name of the admin cluster or the fully-specified cluster name that uniquely identifies the cluster in Google Cloud. The admin cluster name is the last segment of the fully-specified cluster name:projects/FLEET_HOST_PROJECT_ID/locations/global/memberships/ADMIN_CLUSTER_NAME
LOCATION
: TThe Google Cloud region in which the Anthos On-Prem API runs. Specifyus-west1
or another supported region. The region can't be changed after the cluster is enrolled. In addition to setting the region where the Anthos On-Prem API runs, this is the region in which the following is stored:- The user cluster metadata that the Anthos On-Prem API needs to manage the cluster lifecycle
- The Cloud Logging and Cloud Monitoring data of system components
- The Admin Audit log created by Cloud Audit Logs
After the cluster is enrolled, you can use the following commands to get information about your clusters:
User cluster
- To describe a user cluster:
gcloud alpha container vmware clusters describe USER_CLUSTER_NAME \ --project=FLEET_HOST_PROJECT_ID \ --location=LOCATION
- To list your user clusters:
gcloud alpha container vmware clusters list \ --project=FLEET_HOST_PROJECT_ID \ --location=LOCATION
Admin cluster
- To describe an admin cluster:
gcloud alpha container vmware admin-clusters describe ADMIN_CLUSTER_NAME \ --project=FLEET_HOST_PROJECT_ID \ --location=LOCATION
- To list your admin clusters:
gcloud alpha container vmware admin-clusters list \ --project=FLEET_HOST_PROJECT_ID \ --location=LOCATION
Connect to the cluster
After the cluster is enrolled with the Anthos On-Prem API, you need to choose and configure an authentication method so that you can manage the cluster from the Google Cloud console. The authentication method that you select also controls access to the cluster from the command line. For more information, see the following: