Dukungan Cluster Anthos Jarak Jauh

Jika mengalami masalah dengan cluster terdaftar di luar Google Cloud yang tidak dapat diselesaikan sendiri, Anda mungkin diminta untuk memberi Dukungan Google Cloud akses hanya baca ke cluster Anda untuk membantu mereka memahami masalah dan melakukan triase dengan lebih cepat. Halaman ini menjelaskan cara membagikan informasi ini kepada Dukungan Google Cloud.

Dalam alur dukungan ini, akun layanan Google Cloud khusus disiapkan untuk kasus dukungan Anda dan diberi akses hanya baca ke cluster Anda. Tim dukungan kemudian dapat menjalankan perintah hanya baca menggunakan akun layanan ini untuk mencantumkan pod, keberhasilan/kegagalan pull image container, memeriksa status node, dan sebagainya untuk membantu menyelesaikan masalah Anda. Tim dukungan tidak dapat membuat perubahan apa pun pada cluster Anda.

Sebelum memulai

  • Pastikan Anda telah menginstal alat command line berikut:
    • Google Cloud CLI dengan 437.0.0 versi paling awal untuk mengaktifkan akses. Jika Anda perlu menginstal Google Cloud CLI, lihat panduan penginstalan.
    • kubectl untuk menjalankan perintah pada cluster Kubernetes. Jika Anda perlu menginstal kubectl, lihat panduan penginstalan.
  • Pastikan Anda telah melakukan inisialisasi gcloud CLI untuk digunakan dengan project.
  • Pastikan cluster yang perlu memecahkan masalah terdaftar ke fleet project Anda. Anda dapat memverifikasi bahwa cluster didaftarkan dengan menjalankan gcloud container fleet memberships list (atau glcoud container fleet memberships describe MEMBERSHIP_NAME, dengan MEMBERSHIP_NAME sebagai nama unik cluster).
  • Pastikan Anda memiliki izin gkehub.rbacrolebindings.create di project Anda. Izin ini disertakan dalam peran gkehub.editor dan gkehub.admin. Anda memerlukan ini untuk mengaktifkan akses Dukungan.
  • Pastikan Anda telah mengaktifkan connectgateway.googleapis.com untuk project Anda. Untuk melakukannya, jika bukan pemilik project, Anda harus diberi izin serviceusage.services.enable.

Mengelola akses Dukungan untuk cluster

Untuk mengaktifkan akses Dukungan untuk cluster, jalankan perintah gcloud yang menyebarkan serangkaian kebijakan role-based access control (RBAC) Kubernetes hanya-baca ke cluster target. Tim dukungan tidak akan dapat melihat cluster Anda hingga Anda berhasil menjalankan perintah ini. Untuk melihat kebijakan RBAC yang diterapkan perintah tersebut, lihat Meninjau kebijakan RBAC terlebih dahulu.

Untuk mengaktifkan akses dukungan bagi cluster, jalankan perintah berikut:

# enable Connect Gateway API
gcloud services enable connectgateway.googleapis.com --project=PROJECT_ID

# generate RBAC to enable access
gcloud beta container fleet memberships support-access enable MEMBERSHIP_NAME \
--project=PROJECT_ID

# verify the access is enabled
gcloud beta container fleet memberships support-access describe MEMBERSHIP_NAME \
--project=PROJECT_ID

Ganti kode berikut:

  • MEMBERSHIP_NAME: nama yang digunakan untuk merepresentasikan cluster secara unik dalam fleet-nya. Anda dapat mengetahui cara memeriksa nama keanggotaan cluster di bagian Mendapatkan status keanggotaan fleet.
  • PROJECT_ID: ID project tempat cluster terdaftar.

Setelah kasus dukungan ditutup, Google akan menghapus izin tim dukungan untuk mengakses cluster Anda. Anda juga dapat menjalankan perintah berikut untuk menghapus izin Google secara manual guna mengakses cluster Anda:

gcloud beta container fleet memberships support-access disable MEMBERSHIP_NAME \
--project=PROJECT_ID

Tinjau kebijakan RBAC terlebih dahulu

Anda juga dapat menghasilkan kebijakan RBAC yang diusulkan ke file yang akan dipratinjau, menyesuaikan daftar resource dalam aturan kebijakan, dan menerapkannya langsung ke cluster dengan perintah berikut:

# enable Connect Gateway API
gcloud services enable connectgateway.googleapis.com --project=PROJECT_ID

# display RBAC policies but don't apply them
gcloud beta container fleet memberships support-access get-yaml MEMBERSHIP_NAME \
--project=PROJECT_ID
--rbac-output-file=RBAC_OUTPUT_FILE

# directly apply the modified policies to the cluster
kubectl apply -f RBAC_OUTPUT_FILE

Kebijakan RBAC yang diterapkan perintah

Project ID dan nomor project Anda akan muncul dalam output, bukan {PROJECT-NUMBER}.

Cluster Anthos di VMware

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      - apiGroups:
        - onprem.cluster.gke.io
        resources: [onpremadminclusters, onpremnodepools, onpremuserclusters, validations, onpremplatforms, onprembundles, clusterstates]
        verbs: [get, list, watch]
      - apiGroups:
        - vsphereproviderconfig.k8s.io
        resources: [vsphereclusterproviderconfigs, vspheremachineproviderconfigs]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster Anthos di Bare Metal

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      - apiGroups:
        - addon.baremetal.cluster.gke.io
        resources: [addonmanifests, addonoverrides, addons, addonsets, addonsettemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - baremetal.cluster.gke.io
        resources: [addonconfigurations, clustercidrconfigs, clustercredentials, clustermanifestdeployments, clusters, flatipmodes, healthchecks, inventorymachines, kubeletconfigs, machineclasses, machinecredentials, machines, nodepools, nodepoolclaims, nodeproblemdetectors, preflightchecks, secretforwarders]
        verbs: [get, list, watch]
      - apiGroups:
        - infrastructure.baremetal.cluster.gke.io
        resources:
        - baremetalclusters
        - baremetalmachines
        verbs: [get, list, watch]
      - apiGroups:
        - networking.baremetal.cluster.gke.io
        resources:
        - dpv2multinics
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster Terlampir Anthos

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster GKE

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Mengaudit penggunaan Dukungan Google Cloud

Tim dukungan mengakses cluster Anda menggunakan akun Layanan Google Cloud khusus per project melalui connect gateway API. Anda dapat mengaudit semua aktivitas dukungan menggunakan Cloud Audit Logs.

Untuk meninjau penggunaan, enable log audit Akses Data dan cari log audit dengan identitas pemanggil yang ditetapkan ke service-PROJECT_NUMBER@gcp-sa-anthossupport.iam.gserviceaccount.com. Anda akan dapat melihat resource yang diakses di kolom labels.k8s-request-path log audit.

Untuk informasi selengkapnya tentang cara melihat data log audit ini, baca artikel Melihat Cloud Audit Logs.

Guna melihat operasi log audit yang tersedia untuk gateway terhubung, lihat Operasi yang Diaudit.

FAQ

Apa yang dapat diakses oleh Google?

Alur ini memungkinkan Dukungan Google Cloud memiliki akses hanya baca ke resource non-PII. Artinya, Google tidak akan memiliki akses ke data sensitif, misalnya secret, token, dll. Selain itu, Dukungan Google Cloud tidak akan dapat menjalankan perintah seperti kubectl exec untuk melakukan shell ke pod/node agar dapat berinteraksi dengan VM/mesin yang mendasarinya secara langsung. Daftar resource yang dapat diakses didokumentasikan di sini.

Perubahan apa yang dapat dilakukan Google pada cluster saya?

Tindakan ini akan memberi Google akses hanya baca, dan Dukungan Google Cloud tidak akan dapat melakukan modifikasi apa pun pada cluster. Jika Dukungan Google Cloud memiliki saran tindakan untuk menyelesaikan masalah, pelanggan akan diminta untuk menjalankan perintah mutasi.

Berapa lama Google akan memiliki akses ini?

Setelah kasus dukungan ditutup, Google akan menghapus izin tim dukungan untuk mengakses cluster Anda. Anda juga dapat menghapus izin ini secara manual menggunakan perintah di sini.

Bagaimana cluster diakses?

Dukungan Google Cloud akan menggunakan layanan Connect Gateway yang telah diaktifkan untuk mengakses cluster. Tidak ada software baru yang akan diinstal di cluster. Lihat Menghubungkan Fitur Keamanan untuk mengetahui detailnya.

Mengapa Google memerlukan akses ini?

Akses ini memungkinkan Dukungan Google Cloud untuk memahami masalah dengan lebih mudah dengan memiliki akses hanya baca real-time ke resource cluster. Selain itu, hal ini mengurangi komunikasi dua arah sehingga Dukungan Google Cloud dapat melakukan triase dan menyelesaikan masalah lebih cepat.

Di mana saya dapat melihat resource apa saja yang diakses di cluster saya?

Anda dapat mengaudit semua aktivitas Dukungan Google Cloud di cluster melalui Cloud Audit Logs. Lihat di sini untuk mengetahui petunjuknya.