Supporto remoto di Anthos Cluster

Se hai un problema con i cluster registrati all'esterno di Google Cloud che non puoi risolvere autonomamente, potrebbe esserti chiesto di concedere all'assistenza Google Cloud l'accesso di sola lettura ai tuoi cluster per aiutarli a comprendere il problema e a classificarlo più rapidamente. Questa pagina mostra come condividere queste informazioni con l'assistenza Google Cloud.

In questo flusso di assistenza, per la tua richiesta di assistenza viene configurato un account di servizio Google Cloud dedicato e viene concesso l'accesso di sola lettura al cluster. Il team di assistenza potrà quindi eseguire comandi di sola lettura utilizzando questo account di servizio per elencare pod, pull dell'immagine container riuscito/non riuscito, ispezionare lo stato del nodo e così via per risolvere il problema. Il team di assistenza non può apportare modifiche al cluster.

Prima di iniziare

  • Assicurati di aver installato i seguenti strumenti a riga di comando:
    • Google Cloud CLI con una versione meno recente di 437.0.0 per abilitare l'accesso. Se devi installare Google Cloud CLI, consulta la guida all'installazione.
    • kubectl per eseguire comandi sui cluster Kubernetes. Se devi installare kubectl, consulta la guida all'installazione.
  • Assicurati di aver inizializzato gcloud CLI per utilizzarlo con il tuo progetto.
  • Assicurati che i cluster di cui hai bisogno per risolvere i problemi siano registrati nel parco risorse di progetti. Puoi verificare che un cluster sia registrato eseguendo gcloud container fleet memberships list (o glcoud container fleet memberships describe MEMBERSHIP_NAME, dove MEMBERSHIP_NAME è il nome univoco del cluster).
  • Assicurati di disporre dell'autorizzazione gkehub.rbacrolebindings.create nel progetto. Questa autorizzazione è inclusa nei ruoli gkehub.editor e gkehub.admin. È necessario per abilitare l'accesso per assistenza.
  • Assicurati di aver abilitato connectgateway.googleapis.com per il tuo progetto. Per farlo, se non sei un proprietario del progetto, devi disporre dell'autorizzazione serviceusage.services.enable.

Gestisci l'accesso per l'assistenza per il cluster

Per abilitare l'accesso per assistenza per il cluster, esegui un comando gcloud che promuove un set di criteri di controllo dell'accesso dell'accesso basato sui ruoli (RBAC) di sola lettura al cluster di destinazione. Il team di assistenza non sarà in grado di visualizzare i tuoi cluster finché non avrai eseguito correttamente questo comando. Per visualizzare i criteri RBAC applicati dal comando, consulta Esaminare in anticipo i criteri RBAC.

Per abilitare l'accesso per l'assistenza per il cluster, esegui questi comandi:

# enable Connect Gateway API
gcloud services enable connectgateway.googleapis.com --project=PROJECT_ID

# generate RBAC to enable access
gcloud beta container fleet memberships support-access enable MEMBERSHIP_NAME \
--project=PROJECT_ID

# verify the access is enabled
gcloud beta container fleet memberships support-access describe MEMBERSHIP_NAME \
--project=PROJECT_ID

Sostituisci quanto segue:

  • MEMBERSHIP_NAME: il nome utilizzato per rappresentare in modo univoco il cluster nel relativo parco risorse. Per informazioni su come controllare il nome dell'appartenenza del cluster, consulta Ottenere lo stato dell'abbonamento del parco risorse.
  • PROJECT_ID: l'ID progetto in cui è registrato il cluster.

Dopo la chiusura della richiesta di assistenza, Google rimuove l'autorizzazione del team di assistenza ad accedere al cluster. Puoi anche eseguire questo comando per rimuovere manualmente l'autorizzazione di Google ad accedere al tuo cluster:

gcloud beta container fleet memberships support-access disable MEMBERSHIP_NAME \
--project=PROJECT_ID

Rivedi le norme RBAC in anticipo

Puoi anche generare i criteri RBAC proposti su un file da visualizzare in anteprima, personalizzare l'elenco di risorse nelle regole dei criteri e applicarli direttamente al cluster con i seguenti comandi:

# enable Connect Gateway API
gcloud services enable connectgateway.googleapis.com --project=PROJECT_ID

# display RBAC policies but don't apply them
gcloud beta container fleet memberships support-access get-yaml MEMBERSHIP_NAME \
--project=PROJECT_ID
--rbac-output-file=RBAC_OUTPUT_FILE

# directly apply the modified policies to the cluster
kubectl apply -f RBAC_OUTPUT_FILE

Criteri RBAC applicati dal comando

L'ID e il numero del progetto verranno visualizzati nell'output al posto di {PROJECT-NUMBER}.

Cluster Anthos su VMware

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      - apiGroups:
        - onprem.cluster.gke.io
        resources: [onpremadminclusters, onpremnodepools, onpremuserclusters, validations, onpremplatforms, onprembundles, clusterstates]
        verbs: [get, list, watch]
      - apiGroups:
        - vsphereproviderconfig.k8s.io
        resources: [vsphereclusterproviderconfigs, vspheremachineproviderconfigs]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster Anthos su Bare Metal

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      - apiGroups:
        - addon.baremetal.cluster.gke.io
        resources: [addonmanifests, addonoverrides, addons, addonsets, addonsettemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - baremetal.cluster.gke.io
        resources: [addonconfigurations, clustercidrconfigs, clustercredentials, clustermanifestdeployments, clusters, flatipmodes, healthchecks, inventorymachines, kubeletconfigs, machineclasses, machinecredentials, machines, nodepools, nodepoolclaims, nodeproblemdetectors, preflightchecks, secretforwarders]
        verbs: [get, list, watch]
      - apiGroups:
        - infrastructure.baremetal.cluster.gke.io
        resources:
        - baremetalclusters
        - baremetalmachines
        verbs: [get, list, watch]
      - apiGroups:
        - networking.baremetal.cluster.gke.io
        resources:
        - dpv2multinics
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster collegati ad Anthos

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Cluster GKE

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - ""
        resourceNames:
        - service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com
        resources:
        - users
        verbs:
        - impersonate
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-imp-actuation-gke-fleet-support-access
      subjects:
      - kind: ServiceAccount
        name: connect-agent-sa
        namespace: gke-connect
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      rules:
      - apiGroups:
        - acme.cert-manager.io
        resources: [challenges, orders]
        verbs: [get, list, watch]
      - apiGroups:
        - addons.gke.io
        resources:[metricsserver, monitoring, stackdrivers]
        verbs: [get, list, watch]
      - apiGroups:
        - admissionregistration.k8s.io
        resources: [mutatingwebhookconfigurations, validatingwebhookconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - anthos.gke.io
        resources: [entitlements, healthcheckjobs, healthchecks]
        verbs: [get, list, watch]
      - apiGroups:
        - apiextensions.k8s.io
        resources: [customresourcedefinitions]
        verbs: [get, list, watch]
      - apiGroups:
        - apiregistration.k8s.io
        resources: [apiservices]
        verbs: [get, list, watch]
      - apiGroups:
        - apiserver.k8s.io
        resources: [flowschemas, prioritylevelconfigurations]
        verbs: [get, list, watch]
      - apiGroups:
        - apps
        resources: [controllerrevisions, daemonsets, deployments, replicasets, statefulset]
        verbs: [get, list, watch]
      - apiGroups:
        - apps.k8s.io
        resources: [applications]
        verbs: [get, list, watch]
      - apiGroups:
        - authentication.gke.io
        resources: [clientconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - batch
        resources: [cronjobs, jobs]
        verbs: [get, list, watch]
      - apiGroups:
        - bootstrap.cluster.x-k8s.io
        resources: [kubeadmconfigs, kubeadmconfigtemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - bundle.gke.io
        resources: [bundlebuilders, bundles, clusterbundles, componentbuilders, componentlists, components, componentsets, gkeonprembundles, packagedeploymentclasses, packagedeployments, patchtemplatebuilders, patchtemplates, requirements]
        verbs: [get, list, watch]
      - apiGroups:
        - bundleext.gke.io
        resources: [nodeconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - certificates.k8s.io
        resources: [certificatesigningrequests]
        verbs: [get, list, watch]
      - apiGroups:
        - cert-manager.io
        resources: [certificaterequests, certificates, clusterissuers, issuers]
        verbs: [get, list, watch]
      - apiGroups:
        - cilium.io
        resources: [ciliumnodes, ciliumendpoints, ciliumidentities, ciliumegressnatpolicies, ciliumexternalworkloads]
        verbs: [get, list, watch]
      - apiGroups:
        - configmanagement.gke.io
        resources: [configmanagements]
        verbs: [get, list, watch]
      - apiGroups:
        - config.gatekeeper.sh
        resources: [configs]
        verbs: [get, list, watch]
      - apiGroups:
        - coordination.k8s.io
        resources: [leases]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - cluster.x-k8s.io
        resources: [clusters, controlplanes, machineclasses, machinedeployments, machinehealthchecks, machines, machinesets]
        verbs: [get, list, watch]
      - apiGroups:
        - clusterctl.cluster.x-k8s.io
        resources: [metadata, providers]
        verbs: [get, list, watch]
      - apiGroups:
        - crd.projectcalico.org
        resources: [bgpconfigurations, bgppeers, blockaffinities, clusterinformations, felixconfigurations, globalnetworkpolicies, globalnetworksets, hostendpoints, ipamblocks, ipamconfigs, ipamhandles, ippools, networkpolicies, networksets, vpntunnels]
        verbs: [get, list, watch]
      - apiGroups:
        - discovery.k8s.io
        resources: [endpointslices]
        verbs: [get, list, watch]
      - apiGroups:
        - expansion.gatekeeper.sh
        resources: [expansiontemplate]
        verbs: [get, list, watch]
      - apiGroups:
        - extensions.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - gateway.networking.k8s.io
        resources: [gatewayclasses, gateways, grpcroutes, httproutes, referencegrants, tcproutes, tlsroutes, udproutes]
        verbs: [get, list, watch]
      - apiGroups:
        - hub.gke.io
        resources: [memberships]
        verbs: [get, list, watch]
      - apiGroups:
        - install.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - k8s.cni.cncf.io
        resources: [network-attachment-definitions]
        verbs: [get, list, watch]
      - apiGroups:
        - mutations.gatekeeper.sh
        resources: [assign, assignimage, assignmetadata, modifyset, mutatorpodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - networking.k8s.io
        resources: [ingressclasses, ingresses, multiclusterconnectivityconfigs, networkgatewaygroups, networkgatewaynodes, networkinterfaces, networkloggings, networks, trafficsteerings]
        verbs: [get, list, watch]
      - apiGroups:
        - node.k8s.io
        resources: [runtimeclasses]
        verbs: [get, list, watch]
      - apiGroups:
        - policy
        resources: [poddisruptionbudgets, podsecuritypolicies]
        verbs: [get, list, watch]
      - apiGroups:
        - rbac.authorization.k8s.io
        resources: [clusterroles, clusterrolebindings, roles, rolebindings]
        verbs: [get, list, watch]
      - apiGroups:
        - security.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - storage.k8s.io
        resources: [csidrivers, csinodes, csistoragecapacities, storageclasses, volumeattachments]
        verbs: [get, list, watch]
      - apiGroups:
        - sriovnetwork.k8s.cni.cncf.io
        resources: [sriovnetworknodepolicies, sriovnetworknodestates, sriovoperatorconfigs]
        verbs: [get, list, watch]
      - apiGroups:
        - status.gatekeeper.sh
        resources: [constraintpodstatuses, constrainttemplatepodstatuses, expansiontemplatepodstatuses]
        verbs: [get, list, watch]
      - apiGroups:
        - telemetry.istio.io
        resources: [*]
        verbs: [get, list, watch]
      - apiGroups:
        - templates.gatekeeper.sh
        resources: [constrainttemplates]
        verbs: [get, list, watch]
      - apiGroups:
        - vm.cluster.gke.io
        resources: [gpuallocation, guestenvironmentdata, virtualmachineaccessrequest, virtualmachinedisk, virtualmachinepasswordresetrequest, virtualmachinetype, vmhighavailabilitypolicy, vmruntimes]
        verbs: [get, list, watch]
      - apiGroups:
        - '*'
        resources: [componentstatuses, configmaps, endpoints, events, horizontalpodautoscalers, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, pods/log, podtemplates, replicationcontrollers, resourcequotas, serviceaccounts, services]
        verbs: [get, list, watch]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        creationTimestamp: null
        name: fleet-rrb-actuation-gke-fleet-support-access
      roleRef:
        apiGroup: ""
        kind: ClusterRole
        name: fleet-rrb-actuation-gke-fleet-support-access
      subjects:
      - kind: User
        name: service-{PROJECT-NUMBER}@gcp-sa-anthossupport.iam.gserviceaccount.com

Controlla l'utilizzo dell'assistenza Google Cloud

Il team di assistenza accede al tuo cluster utilizzando un account di servizio Google Cloud dedicato a livello di progetto tramite l'API Connect Gateway. Puoi controllare tutte le attività di assistenza utilizzando Cloud Audit Logs.

Per esaminare l'utilizzo, enable i log di controllo di Accesso ai dati e cerca i log con l'identità chiamante impostata su service-PROJECT_NUMBER@gcp-sa-anthossupport.iam.gserviceaccount.com. Potrai visualizzare la risorsa a cui è stato eseguito l'accesso nel campo labels.k8s-request-path dell'audit log.

Per ulteriori informazioni su come visualizzare i dati di questi audit log, consulta Visualizzazione di Cloud Audit Logs.

Per visualizzare le operazioni degli audit log disponibili per il gateway di connessione, vedi Operazioni controllate.

Domande frequenti

A quali dati potrà accedere Google?

Questo flusso consente all'assistenza Google Cloud di avere accesso di sola lettura alle risorse non PII. Ciò significa che Google non avrà accesso a dati sensibili come secret, token e così via. Inoltre, l'assistenza Google Cloud non sarà in grado di eseguire comandi come kubectl exec per eseguire lo shell nei pod/nodi per interagire direttamente con le VM o le macchine sottostanti. L'elenco delle risorse a cui è possibile accedere è documentato qui.

Quali modifiche potrà apportare Google al mio cluster?

Ciò fornisce a Google l'accesso di sola lettura e l'assistenza Google Cloud non potrà apportare alcuna modifica al cluster. Se l'assistenza Google Cloud ha suggerimenti per risolvere il problema, al cliente verrà chiesto di eseguire comandi di mutazione.

Per quanto tempo Google avrà questo accesso?

Dopo la chiusura della richiesta di assistenza, Google rimuove l'autorizzazione del team di assistenza ad accedere al cluster. Puoi anche rimuovere manualmente queste autorizzazioni utilizzando i comandi qui.

Come si accede al cluster?

L'assistenza Google Cloud utilizzerà il servizio Connect Gateway già abilitato per accedere al cluster. Nessun nuovo software verrà installato sul cluster. Per maggiori dettagli, consulta Collegare le funzionalità di sicurezza.

Perché Google ha bisogno di questo accesso?

Questo accesso consente all'assistenza Google Cloud di comprendere più facilmente il problema grazie all'accesso di sola lettura in tempo reale alle risorse del cluster. Inoltre, in questo modo si riducono gli scambi di comunicazioni, in modo che l'Assistenza Google Cloud possa individuare e risolvere i problemi molto più rapidamente.

Dove posso vedere a quali risorse è stato eseguito l'accesso nel mio cluster?

Puoi controllare tutte le attività dell'assistenza Google Cloud sul cluster tramite Cloud Audit Logs. Leggi qui per le istruzioni.