> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-workload-identity-keyless/single-google-cloud-project.md). # Single Google Cloud Project ## About connecting a single Google Cloud project You can connect a single Google Cloud project to OX using Workload Identity Federation. OX uses a read-only service account to access resources in the project without creating or maintaining a long-lived service account key. First, configure the required resources in Google Cloud. Then, use the generated values to complete the connection in OX. ## Prerequisites Make sure that you have: * The Google Cloud CLI (`gcloud`) installed and configured, or access to Cloud Shell. * Permissions to create a service account and grant the required roles in the project. * Access to the GCP connector in OX. > Run each command on a single line. Line continuations pasted into Cloud Shell split at the backslash. > Run each command on a single line. Line continuations pasted into Cloud Shell split at the backslash. ## Step 1: Configure Google Cloud To configure a single Google Cloud project for OX: 1. Sign in to Google Cloud and list the available Google Cloud projects. ```bash gcloud auth login # skip in Cloud Shell gcloud projects list --format="table(projectId,name)" ``` 2. Set the variables for the project and Workload Identity configuration. ```bash PROJECT= gcloud config set project "$PROJECT" PROJECT_NUMBER=$(gcloud projects describe "$PROJECT" --format="value(projectNumber)") POOL_ID=ox-pool PROVIDER_ID=ox-oidc ``` 3. Enable the required Google Cloud APIs. `gcloud services enable` accepts up to 20 APIs per call, so the list runs in two batches. ```bash gcloud services enable iam.googleapis.com iamcredentials.googleapis.com cloudresourcemanager.googleapis.com cloudasset.googleapis.com compute.googleapis.com container.googleapis.com containerregistry.googleapis.com artifactregistry.googleapis.com storage.googleapis.com aiplatform.googleapis.com appengine.googleapis.com bigquery.googleapis.com cloudfunctions.googleapis.com cloudkms.googleapis.com dataproc.googleapis.com datastore.googleapis.com discoveryengine.googleapis.com dns.googleapis.com gcloud services enable firebase.googleapis.com firebasedatabase.googleapis.com firebaserules.googleapis.com firestore.googleapis.com healthcare.googleapis.com logging.googleapis.com monitoring.googleapis.com pubsub.googleapis.com redis.googleapis.com run.googleapis.com secretmanager.googleapis.com spanner.googleapis.com sqladmin.googleapis.com ``` 4. Create the read-only service account and set `SA` to its email. OX assumes this identity to read your project. No key is created for it. To reuse an existing service account, set `SA` to its email. ```bash gcloud iam service-accounts create ox-readonly --display-name="OX read-only" # skip when reusing SA=ox-readonly@$PROJECT.iam.gserviceaccount.com ``` 5. Grant the read-only roles to the service account. See \[Roles granted to OX] for what each covers. ```bash ROLES="roles/viewer roles/iam.securityReviewer roles/storage.objectViewer roles/accessapproval.viewer roles/accesscontextmanager.policyReader roles/discoveryengine.viewer roles/firebaserules.viewer roles/firebase.viewer roles/healthcare.datasetViewer" for R in $ROLES; do gcloud projects add-iam-policy-binding "$PROJECT" --member="serviceAccount:$SA" --role="$R"; done ``` 6. In OX, open **Connectors > GCP > Workload Identity (Keyless)** and copy the **Issuer URI**. 7. Return to your Google Cloud shell and set `ISSUER_URI` to the Issuer URI that you copied from OX. ```bash ISSUER_URI= ``` 8. Create the Workload Identity Pool. ```bash gcloud iam workload-identity-pools create "$POOL_ID" --location=global --display-name="OX" ``` 9. Create the Workload Identity provider. ```bash gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" --location=global --workload-identity-pool="$POOL_ID" --issuer-uri="$ISSUER_URI" --attribute-mapping="google.subject=assertion.sub" ``` 10. Allow identities that authenticated through the pool to obtain credentials for the service account. This grant is what lets the token OX presents become the identity of the service account. ```bash gcloud iam service-accounts add-iam-policy-binding "$SA" --role=roles/iam.workloadIdentityUser --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/*" ``` 11. Add the output values to the connector's page. ```bash echo "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID" echo "$SA" ``` ## Step 2: Complete the connection in OX To complete the connection in OX: 1. In OX, go to **Connectors > GCP**.
2. Select **Workload Identity (Keyless)**. 3. Enter the connection details: | Field | Description | | ------------------------------------------ | ------------------------------------------------------------------------------------------------ | | Workload Identity Pool Provider (audience) | Enter the Workload Identity Pool Provider value generated during the Google Cloud configuration. | | Service account to impersonate | Enter the service account email generated during the Google Cloud configuration. | | Connection Name | Enter a name that identifies the connection in OX. | 4. Select **Verify Connectivity**. 5. After OX verifies the connection, select **Connect**. ## Step 3: Connect GKE You can connect GKE clusters in the connected Google Cloud project to OX. GKE uses the credentials configured for the GCP connector. OX reads each GKE cluster through its Kubernetes API from the following IP addresses: * `108.128.213.11` * `34.247.61.212` If the cluster restricts control-plane access using a private endpoint or authorized networks, add both OX IP addresses to the allowlist. **To connect GKE clusters:** 1. Add `108.128.213.11` to the allowlist if access to the cluster control plane is restricted. 2. Add `34.247.61.212` to the allowlist if access to the cluster control plane is restricted. 3. In OX, go to **Connectors > GKE**.
4. Select **Connect**. 5. Select the clusters that you want to connect. 6. Save the connection. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-workload-identity-keyless/single-google-cloud-project.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.