Connect to GKE

GKE cluster authentication requires more than just a kubeconfig, it also needs a service account configured.

See the GKE example for a full working example bundle.

1. Generate a kubeconfig.

2. Create a service account.

3. Define credentials in porter.yaml for the kubeconfig and service account:

   credentials:
       - name: kubeconfig
         path: /root/.kube/config
       - name: google-service-account
         path: /root/google-service-account.json
   

4. Define an environment variable, GOOGLE_APPLICATION_CREDENTIALS that contains the path to the service account file, /root/google-service-account.json.

   This can be accomplished via one of the methods below. The first method is recommended over using a parameter. Using parameters to define environment variables is a hack provided only for the purpose of this example.

   • Add the following line to your Custom Dockerfile:

     ENV GOOGLE_APPLICATION_CREDENTIALS=/root/google-service-account.json
     

   • Add a parameter to porter.yaml:

     parameters:
         - name: google-app-creds
           env: GOOGLE_APPLICATION_CREDENTIALS
           default: /root/google-service-account.json
     

---

Generate a kubeconfig

1. You must have gcloud installed locally, and be authenticated.

2. Define the following environment variables:

   CLUSTER="REPLACE_WITH_YOUR_CLUSTER_NAME"
   ZONE="REPLACE_WITH_YOUR_CLUSTER_ZONE"
   PROJECT="REPLACE_WITH_YOUR_GOOGLE_PROJECT"
   GET_CMD="gcloud container clusters describe $CLUSTER --zone=$ZONE --project=$PROJECT"
   

3. Run the following command to create a kubeconfig for your GKE cluster:

    cat > kubeconfig.yaml <<EOF
    apiVersion: v1
    kind: Config
    current-context: my-cluster
    contexts: [{name: my-cluster, context: {cluster: cluster-1, user: user-1}}]
    users: [{name: user-1, user: {auth-provider: {name: gcp}}}]
    clusters:
    - name: cluster-1
    cluster:
        server: "https://$(eval "$GET_CMD --format='value(endpoint)'")"
        certificate-authority-data: "$(eval "$GET_CMD --format='value(masterAuth.clusterCaCertificate)'")"
    EOF
   

4. Move the kubeconfig.yaml to a location where you would like to keep it, for example $HOME/.kube/my-gke-cluster.yaml.

This file contains your master’s IP address and the cluster’s CA certificate but does not contain enough information to authenticate to the cluster.

---

Create a service account

1. Create a service account.
2. Assign the account access to GKE, such as Kubernetes Engine Developer.
3. Create a service account key file, e.g. service-account.json, and save the file locally.

This is a sensitive file that contains enough information to perform actions against your Google account. Keep it safe. 🔐

A big thanks to https://ahmet.im/blog/authenticating-to-gke-without-gcloud/ for helping us figure out how to authenticate to GKE properly! 🙇‍♀️