You use a Harness Google Cloud Platform Cloud Provider to connect your Harness account to the Google Cloud Platform account where you will deploy your services.
You add Cloud Providers to your Harness Account and then reference them when defining deployment resources and environments.
Before setting up a Google Cloud Platform Cloud Provider, you must have a Harness Delegate installed on a host where it can connect to your Google Cloud Platform account.
Harness includes a platform-agnostic Kubernetes Cluster Cloud Provider for connections to a Kubernetes cluster. This is the preferred method for connecting Harness to a target Kubernetes cluster.
If you use the Google Cloud Platform Cloud Provider for Harness Kubernetes deployments, the GKE version in the target cluster must be less than GKE 1.19.
Basic authentication is deprecated and has been removed in GKE 1.19 and later. Harness uses Basic authentication during deployments to Kubernetes that use a Google Cloud Platform Cloud Provider.
Step 1: Add the Cloud Provider
To add a cloud provider to your Harness account, do the following:
Click Setup, and then click Cloud Providers.
Click Add Cloud Provider and select Google Cloud Platform.
The Add Google Cloud Platform Cloud Provider panel appears.
Option 1: Inherit from Delegate
If your GCP Cloud Provider uses the Inherit from Delegate option, it cannot be used with an Infrastructure Definition, such as a Kubernetes cluster Infrastructure Definition. It is not supported at this time.
Select this option to have the Cloud Provider inherit the default credentials used by the Harness Delegate running in GCP.
For example, if you installed the Harness Kubernetes Delegate in a Kubernetes cluster (GKE) that has GCP Workload Identity enabled, the Cloud Provider provider will inherit these credentials if it uses that Delegate.
To use Inherit from Delegate, do the following:
Ensure a Harness Delegate is installed in your GCP project.
Ensure the Harness Delegate host has the required credentials. See the different permissions required below.
In your Google Cloud Platform Cloud Provider, select Inherit from Delegate.
In Delegate Selectors, select the Selector(s) attached to the Delegate(s) running in your GCP account.
Click Test. You will see Test was successful unless there is a connectivity error, or the Delegate is disconnected. If it is disconnected, simply restart it.
If you want to set up certain credentials on the Delegate using Harness, you can run the commands in a Delegate Profile and attach that profile to the Delegate. See Run Scripts on Delegates using Profiles.
You can even add a Selector to the Profile, and then use that Selector in the Google Cloud Platform Cloud Provider. This ensure that any Google Cloud Platform Cloud Provider using that Selector is also using a Delegate with that Profile.
Option 2: Select Encrypted Key
In Select Encrypted Key, select or create a new Harness Encrypted Text secret that contains the Google Cloud's Account Service Key File.
Once you have the key file from Google, open it, copy it, and paste it into the Harness Encrypted Text secret.
Next, use that Harness Encrypted Text secret in Select Encrypted Key.
Click Submit. The GCP cloud provider is added.
Review: GCP Permissions Required for Kubernetes
The GCP service account used for any credentials requires Kubernetes Engine Admin (GKE Admin) role to get the Kubernetes master username and password. Harness also requires Storage Object Viewer permissions.
Basic authentication required: When you attempt to connect to the Kubernetes cluster via GCP, the Kubernetes cluster must have Basic authentication enabled or the connection will fail. For more information, see Control plane security from GCP. From GCP:
You can handle cluster authentication in Google Kubernetes Engine by using Cloud IAM as the identity provider. However, legacy username-and-password-based authentication is enabled by default in Google Kubernetes Engine. For enhanced authentication security, you should ensure that you have disabled Basic Authentication by setting an empty username and password for the MasterAuth configuration. In the same configuration, you can also disable the client certificate which ensures that you have one less key to think about when locking down access to your cluster.
If Basic authentication is inadequate for your security requirements, use the Kubernetes Cluster Cloud Provider.
While Harness recommends that you use the Kubernetes Cluster Cloud Provider for Kubernetes cluster deployments, to use a Kubernetes cluster on Google GKE, Harness requires a combination of Basic Authentication and/or Client Certificate to be enabled on the cluster:This is required because some API classes, such as the MasterAuth class, require HTTP basic authentication or client certificates.
Another option is to use a service account that has only the Storage Object Viewer permission needed to query GCR, and then use either an in-cluster Kubernetes Delegate or a direct Kubernetes Cluster Cloud Provider with the Kubernetes service account token for performing deployment.
Review: Google GCS and GCR Requirements
For Google Cloud Storage (GCS) and Google Container Registry (GCR), the following roles are required:
Ensure the Harness Delegate you have installed can reach to the GCR registry host name you are using in Registry Host Name (for example, gcr.io) and storage.cloud.google.com.
Review: Google Cloud Operations Suite (Stackdriver) Requirements
Most APM and logging tools are added to Harness as Verification Providers. For Google Cloud's operations suite (formerly Stackdriver), you use the Google Cloud Platform Cloud Provider.
Roles and Permissions
Stackdriver Logs - The minimum role requirement is logging.viewer
Stackdriver Metrics - The minimum role requirements are compute.networkViewer and monitoring.viewer.
