Connect Crossplane to Google GCP to create and manage cloud resources from Kubernetes with the GCP Official Provider.
This guide walks you through the steps required to get started with the GCP Official Provider. This includes installing Upbound Universal Crossplane, configuring the provider to authenticate to GCP and creating a Managed Resource in GCP directly from your Kubernetes cluster.
curl -sL "https://cli.upbound.io"| sh
sudo mv up /usr/local/bin/
Install Upbound Universal Crossplane
Upbound Universal Crossplane (UXP) consists of upstream Crossplane and Upbound-specific enhancements and patches. It’s open source and maintained by Upbound.
Install UXP with the Up command-line up uxp install command.
kubectl get pods -n upbound-system
NAME READY STATUS RESTARTS AGE
crossplane-7fdfbd897c-pmrml 1/1 Running 0 68m
crossplane-rbac-manager-7d6867bc4d-v7wpb 1/1 Running 0 68m
For more details about UXP pods, read the UXP section.
Installing UXP and Crossplane creates new Kubernetes API end-points. Take a look at the new API end-points with kubectl api-resources | grep crossplane. In a later step you use the Provider
resource install the Official Provider.
The provider requires credentials to create and manage GCP resources. Providers use a Kubernetes Secret to connect the credentials to the provider.
First generate a Kubernetes Secret from a Google Cloud service account JSON file and then configure the Provider to use it.
Generate a GCP service account JSON file
For basic user authentication, use a Google Cloud service account JSON file.
The GCP documentation provides information on how to generate a service account JSON file.
Save this JSON file as gcp-credentials.json
The Configuration section of the Provider documentation describes other authentication methods.
Create a Kubernetes secret with the GCP credentials
A Kubernetes generic secret has a name and contents. Use kubectl create secret
to generate the secret object named gcp-secret
in the upbound-system
namespace. Use the --from-file=
argument to set the value to the contents of the gcp-credentials.json
file.
This attaches the GCP credentials, saved as a Kubernetes secret, as a secretRef
.
The spec.credentials.secretRef.name
value is the name of the Kubernetes secret containing the GCP credentials in the spec.credentials.secretRef.namespace
.
Create a managed resource
A managed resource is anything Crossplane creates and manages outside of the Kubernetes cluster. This creates a GCP storage bucket with Crossplane. The storage bucket is a managed resource.
This will generate a random name for the storage bucket starting with upbound-bucket
Notice the apiVersion
and kind
are from the Provider's CRDs.
The metadata.name
value is the name of the created GCP storage bucket. This example uses the generated name upbound-bucket-<hash> in the $bucket
variable.
kubectl describe bucket
Name: upbound-bucket-b7cf6b590
Namespace:
Labels: <none>
Annotations: crossplane.io/external-name: upbound-bucket-b7cf6b590
API Version: storage.gcp.upbound.io/v1beta1
Kind: Bucket
# Output trimmed for brevitySpec:
Deletion Policy: Delete
For Provider:
Location: US
Storage Class: MULTI_REGIONAL
Provider Config Ref:
Name: default
Status:
At Provider:
Conditions:
Last Transition Time: 2022-10-13T02:39:18Z
Message: observe failed: cannot run refresh: refresh failed: Error when reading or editing Storage Bucket "upbound-bucket-b7cf6b590": Get "https://storage.googleapis.com/storage/v1/b/upbound-bucket-b7cf6b590?alt=json&prettyPrint=false": private key should be a PEM or plain PKCS1 or PKCS8; parse error: x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format):
Reason: ReconcileError
Status: False
Type: Synced
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning CannotObserveExternalResource 1s (x4 over 7s) managed/storage.gcp.upbound.io/v1beta1, kind=bucket cannot run refresh: refresh failed: Error when reading or editing Storage Bucket "upbound-bucket-b7cf6b590": Get "https://storage.googleapis.com/storage/v1/b/upbound-bucket-b7cf6b590?alt=json&prettyPrint=false": private key should be a PEM or plain PKCS1 or PKCS8; parse error: x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format):
The error message in the Events log indicates the problem. private key should be a PEM or plain PKCS1 or PKCS8; parse error: x509: failed to parse private key
.
This indicates the GCP authorization JSON file
To fix the problem:
Update your GCP credentials in the gcp-credentials.json file.
