Configure a cluster to be managed by the GKE On-Prem API

The GKE On-Prem API is a Google Cloud-hosted API that lets you manage the lifecycle of your on-premises clusters by using standard tools: the Google Cloud console, the Google Cloud CLI, or Terraform. When you create a cluster using one of these tools, the API stores metadata about your cluster's state in the Google Cloud region that you specified when creating the cluster. This metadata lets you manage the lifecycle of the cluster using the standard tools. If you want to use these tools to view cluster details or manage the lifecycle of clusters that were created using bmctl, you must enroll the clusters in the GKE On-Prem API.

Terminology

Enrolling a cluster lets you manage the cluster lifecycle by using the console, the gcloud CLI, or Terraform.

Enrolling a cluster is a separate process to registering a cluster to a fleet. A fleet is a a logical grouping of Kubernetes clusters that you can manage together. All Google Distributed Cloud clusters are registered to a fleet at cluster creation time. When you create a cluster using bmctl, the cluster is registered to the Google Cloud project that you specify in the gkeConnect.projectID field in the cluster configuration file. This project is referred to as the fleet host project. To learn more about fleets, including uses cases, best practices, and examples, see the Fleet management documentation.

View registered clusters

All your fleet clusters are displayed on the GKE Clusters pages in the console. This both gives you an overview of your entire fleet and, for Google Distributed Cloud, lets you see which clusters are managed by the GKE On-Prem API.

To view your fleet clusters:

1. In the console, go to the GKE clusters page.
   Go to GKE clusters
2. Select the Google Cloud project.
   • If Bare metal is displayed in the Type column, the cluster is managed by the GKE On-Prem API.
   • If External is displayed in the Type column, the cluster isn't managed by the GKE On-Prem API.

Requirements

• Only user and admin clusters can be enrolled with the GKE On-Prem API. Enrolling hybrid and standalone clusters isn't supported.

• Version 1.13 or higher.

• If you aren't a project owner, minimally, you must be granted the Identity and Access Management role roles/gkeonprem.admin on the project. For details on the permissions included in this role, see GKE on-prem roles in the IAM documentation.

Before you begin

1. Set up the gcloud CLI, if needed.

   1. If you need to install the gcloud CLI, see the gcloud CLI documentation. Update the gcloud CLI components, if needed:

      gcloud components update
      

2. Make sure that the GKE On-Prem API is enabled in the project. To enable the API, run the following command:

   gcloud services enable \
       --project PROJECT_ID \
       gkeonprem.googleapis.com
   

   Replace PROJECT_ID with the project ID of your fleet host project. This is the project ID that was configured in the gkeconnect section of your cluster configuration file.

   If you get a PERMISSION_DENIED error, double check the project ID that you entered. If the project ID is correct, run gcloud auth login to sign in to the Google Cloud CLI with the account that has access to the project.

3. If this is the first time that you have enabled the GKE On-Prem API in your project, you might need to initialize the API. You can do this by calling a gcloud CLI command that displays available versions that you can use to create a cluster:

   gcloud container bare-metal clusters query-version-config \
       --project=PROJECT_ID \
       --location=REGION
   

   Replace REGION with us-west1 or another supported region.

4. If your organization has set up an allowlist that lets traffic from Google APIs and other addresses pass through your proxy server, add the following to the allowlist:

   • gkeonprem.googleapis.com
   • gkeonprem.mtls.googleapis.com

   These are the service names for the GKE On-Prem API.

Enroll a cluster

If your cluster is at 1.15.3 or higher, you can use the bmctl command-line tool to enroll the cluster.

Enroll a user cluster

gcloud container bare-metal clusters enroll USER_CLUSTER_NAME  \
    --project=PROJECT_ID \
    --admin-cluster-membership=projects/PROJECT_ID/locations/global/memberships/ADMIN_CLUSTER_NAME \
    --location=REGION

Enroll an admin cluster

gcloud container bare-metal admin-clusters enroll ADMIN_CLUSTER_NAME \
    --project=PROJECT_ID \
    --admin-cluster-membership=projects/PROJECT_ID/locations/global/memberships/ADMIN_CLUSTER_NAME \
    --location=REGION

Get information about your cluster

After the cluster is enrolled, you can use the following commands to get information about your clusters:

gcloud container bare-metal clusters describe USER_CLUSTER_NAME \
    --project=PROJECT_ID \
    --location=REGION

gcloud container bare-metal clusters list \
    --project=PROJECT_ID \
    --location=-

gcloud container bare-metal admin-clusters describe ADMIN_CLUSTER_NAME \
    --project=PROJECT_ID \
    --location=REGION

gcloud container bare-metal admin-clusters list \
    --project=PROJECT_ID \
    --location=-

Connect to the cluster

After the cluster is enrolled with the GKE On-Prem API, you need to choose and configure an authentication method so that you can manage the cluster from the Google Cloud console. The authentication method that you select also controls access to the cluster from the command line. For more information, see the following:

• Manage the cluster from the Google Cloud console
• GKE Identity Service