Using multiple Google Cloud projects

This page shows how to use separate Google Cloud projects for different aspects of GKE on-prem.

The GKE on-prem configuration file has several fields where you can specify a Google Cloud project ID:

...
usercluster:
  usagemetering:
    bigqueryprojectid: ""
...
gkeconnect:
  projectid: ""
...
stackdriver:
  projectid: ""
...
cloudauditlogging:
  projectid: ""

The idea is that you can have one project for connecting to GKE on-prem, another project for logging and monitoring, and so on.

You do not have to use separate project IDs. For example, you could use the same project for both connecting and logging. If you like, you can use the same project for everything.

Usage metering project

If you enable GKE usage metering for a user cluster, GKE on-prem stores usage data in a BigQuery dataset that is associated with a Cloud project of your choice.

In your GKE on-prem configuration file, set usercluster.usagemetering.bigqueryprojectid to the ID of the Cloud project where you want to store usage data.

Enabling APIs in your usage metering project

To enable the required APIs in your usage metering project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    bigquery.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your usage metering project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    bigquery.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your usage metering project.

Granting roles to service accounts on your usage metering project

Your usage metering service account must be granted certain roles on your usage metering project.

For details see usage metering service account.

Connect project

When you create a user cluster, GKE on-prem uses Connect to register the cluster with a Cloud project of your choice. After the cluster is registered, you can use Google Cloud Console to manage the cluster.

Connect uses a Deployment called the Connect Agent to establish a connection between your GKE on-prem cluster and your Cloud project.

In the GKE on-prem configuration file, set gkeconnect.projectid to the ID of the Cloud project where you want your cluster to be registered.

Enabling APIs in your connect project

To enable the required APIs in your connect project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    cloudresourcemanager.googleapis.com \
    container.googleapis.com \
    gkeconnect.googleapis.com \
    gkehub.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    cloudresourcemanager.googleapis.com ^
    container.googleapis.com ^
    gkeconnect.googleapis.com ^
    gkehub.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Granting roles to service accounts on your connect project

Your connect-register service account and your connect-agent service account must be granted certain roles on your connect project.

For details see Connect-register service account and Connect-agent service account.

Logging-monitoring project

Cloud Logging and Cloud Monitoring collect data from your GKE on-prem cluster and make it available to Google Cloud. To view logs and metrics from your cluster, you must specify an associated Cloud project.

In the GKE on-prem configuration file, set stackdriver.projectid to the ID of the Cloud project that you want to associate with logging and monitoring.

Enabling APIs in your logging-monitoring project

To enable the required APIs in your logging-monitoring project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    stackdriver.googleapis.com \
    monitoring.googleapis.com \
    logging.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    stackdriver.googleapis.com ^
    monitoring.googleapis.com ^
    logging.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your connect project.

Granting roles to service accounts on your logging-monitoring project

Your logging-monitoring service account must be granted certain roles on your logging-monitoring project.

For details, see Logging-monitoring service account.

Audit logging project

If you enable Cloud Audit Logs for GKE on-prem, the audit log entries from your cluster's Kubernetes API server are sent to Google Cloud. You can view the audit log entries in a Cloud project of your choice.

In the GKE on-prem configuration file, set cloudauditlogging.projectid to the ID of the Cloud project where you want to view audit logs.

Enabling APIs in your audit logging project

To enable the required APIs in your audit logging project:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    anthosgke.googleapis.com \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your audit logging project.

Windows

gcloud services enable --project [PROJECT_ID] ^
    anthosgke.googleapis.com ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of your audit logging project.

Granting roles to service accounts on your audit logging project

Your audit logging service account must be granted certain roles on your audit logging project.

For details, see Audit logging service account.

Parent project of your component access service account

To install GKE on-prem, you must have:

  • Created a Cloud project.

  • In your Cloud project, created a service account that GKE on-prem can use do download components from Container Registry. This service account is called your component access service account.

  • Enabled the Anthos API. Enabling this API might incur charges. See the Pricing guide for more details.

The Cloud project where you created your coompoonent access service account is called the parent of your component access service account. This project can be the same as one of the projects that you specify in your GKE on-prem configuration file, or it can be different from all of the projects that you specify in your configuration file.

To enable the required APIs for the parent project of your component access service account:

Linux and macOS

gcloud services enable --project [PROJECT_ID] \
    serviceusage.googleapis.com \
    iam.googleapis.com \
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of the parent project of your component access service account.

Windows

gcloud services enable --project [PROJECT_ID] ^
    serviceusage.googleapis.com ^
    iam.googleapis.com ^
    cloudresourcemanager.googleapis.com

where [PROJECT_ID] is the ID of the parent project of your component access service account.

What's next

Learn about service accounts and keys for GKE on-prem.