Skip to main content

Google GKE Cluster Access for Cloudaware

Configure Google Kubernetes Engine (GKE) cluster access so Cloudaware can discover Kubernetes objects in your GCP projects.

Prerequisites​

  • Access to a Cloudaware account.
  • A user with access to the Admin Console for managing integrations (Cloudaware Administrator).
  • You have Service Account Admin/Project IAM Admin permissions in Google Cloud.
  • You have Cluster Viewer permissions to view or access the cluster.
  • A service account is configured and keys are created for Cloudaware as described in Google Cloud Setup Guide.
  • One or more GKE clusters in projects where the Cloudaware service account has access. The GKE cluster(s) must be able to download the container image.

Access Model Overview​

GKE access for Cloudaware typically involves:

  • IAM — the Cloudaware service account must be allowed to obtain Kubernetes credentials for the cluster (for example, via roles/container.admin or a more restrictive custom role).
  • Kubernetes RBAC — the Kubernetes identity used by Cloudaware should have a read‑only ClusterRole (namespaces, nodes, pods, services, RBAC, etc.).

Configuration​

Configure the GKE Cluster​

The cluster needs credentials or identity-based access to pull the app image from your container registry. Use one of the following options:

  • Workload Identity - A Google Cloud-native way to let workloads authenticate without storing long-lived secrets in Kubernetes.
  • Image pull secrets - A Kubernetes secret containing registry credentials, used when pulling private images.

Assign GKE IAM Roles to Cloudaware​

Grant Cloudaware one of the following IAM roles:

  1. Kubernetes Engine Viewer. Assign the Cloudaware service account a predefined IAM role that provides read-only access to resources within Google Kubernetes Engine (GKE).
  2. Custom role. Create a custom IAM role with the container.clusters.get permission and assign it to the Cloudaware service account.

To assign the role in the Google Cloud console:

  1. Sign in to the Google Cloud console.
  2. Select the project, folder, or organization that contains the GKE clusters Cloudaware should discover.
  3. Go to IAM & Admin → IAM.
  4. Click Grant Access.
  5. In New principals, enter the Cloudaware service account email address.
  6. In Select a role, choose Kubernetes Engine Viewer or the custom role created for Cloudaware.
  7. Click Save.
  8. Repeat these steps for each project, folder, or organization scope that contains GKE clusters to discover.

For more information about Kubernetes Engine roles and permissions, use the Google Cloud documentation.

note

If the GKE cluster is not reachable from Cloudaware due to private networking, install the Breeze agent and use TunHub for a secure connection.

Verification in Cloudaware​

After the Google Cloud permissions for GKE are in place:

  • Allow time for the next discovery cycle (up to 24 hours in some environments).
  • In Cloudaware CMDB Navigator, check the GOOGLE CLOUD PLATFORM → COMPUTE → GKE.
  • Confirm that GKE cluster resources (namespaces, nodes, pods, services, role bindings, etc.) are populated.

Troubleshooting​

If GKE resources do not appear:

  • Confirm that:
    • The Cloudaware service account has the required GKE IAM permissions, such as container.clusters.get or an equivalent read-only role.
    • The GKE cluster endpoint is reachable from Cloudaware, or the Breeze agent and TunHub are configured for private clusters.
    • The GCP integration service account key in Cloudaware is current and matches an active Google Cloud service account.
  • Review Google Cloud audit logs and Kubernetes audit logs for denied requests from the Cloudaware service account or mapped Kubernetes identity.

Supported GKE Objects​

Google GKE ObjectCMDB Object API Name
Google GKE ClusterCA10G1__CaGoogleGkeCluster__c
Google GKE Cluster Config MapCA10G1__CaGoogleGkeClusterConfigMap__c
Google GKE Cluster Daemon SetCA10G1__CaGoogleGkeClusterDaemonSet__c
Google GKE Cluster DeploymentCA10G1__CaGoogleGkeClusterDeployment__c
Google GKE Cluster EndpointCA10G1__CaGoogleGkeClusterEndpoint__c
Google GKE Cluster HPACA10G1__CaGoogleGkeClusterHpa__c
Google GKE Cluster IngressCA10G1__CaGoogleGkeClusterIngress__c
Google GKE Cluster Limit RangeCA10G1__CaGoogleGkeClusterLimitRange__c
Google GKE Cluster NamespaceCA10G1__CaGoogleGkeClusterNamespace__c
Google GKE Cluster Network PolicyCA10G1__CaGoogleGkeClusterNetworkPolicy__c
Google GKE Cluster Network Policy RuleCA10G1__CaGoogleGkeClusterNetworkPolicyRule__c
Google GKE Cluster NodeCA10G1__CaGoogleGkeClusterNode__c
Google GKE Cluster Node AddressCA10G1__CaGoogleGkeClusterNodeAddress__c
Google GKE Cluster Node ConditionCA10G1__CaGoogleGkeClusterNodeCondition__c
Google GKE Cluster Node PoolCA10G1__CaGoogleGkeClusterNodePool__c
Google GKE Cluster PodCA10G1__CaGoogleGkeClusterPod__c
Google GKE Cluster Pod ContainerCA10G1__CaGoogleGkeClusterPodContainer__c
Google GKE Cluster Pod Disruption BudgetCA10G1__CaGoogleGkeClusterPodDisruptionBudget__c
Google GKE Cluster Replica SetCA10G1__CaGoogleGkeClusterReplicaSet__c
Google GKE Cluster Resource QuotaCA10G1__CaGoogleGkeClusterResourceQuota__c
Google GKE Cluster RoleCA10G1__CaGoogleGkeClusterRole__c
Google GKE Cluster Role BindingCA10G1__CaGoogleGkeClusterRoleBinding__c
Google GKE Cluster SecretCA10G1__CaGoogleGkeClusterSecret__c
Google GKE Cluster ServiceCA10G1__CaGoogleGkeClusterService__c
Google GKE Cluster Service Account SecretCA10G1__CaGoogleGkeClusterServiceAccSecret__c
Google GKE Cluster Service AccountCA10G1__CaGoogleGkeClusterServiceAccount__c
Google GKE Cluster Stateful SetCA10G1__CaGoogleGkeClusterStatefulSet__c
Google GKE Cluster Storage ClassCA10G1__CaGoogleGkeClusterStorageClass__c