Single Google Cloud Project

About connecting a single Google Cloud project

You can connect a single Google Cloud project to OX using Workload Identity Federation. OX uses a read-only service account to access resources in the project without creating or maintaining a long-lived service account key.

First, configure the required resources in Google Cloud. Then, use the generated values to complete the connection in OX.

Prerequisites

Make sure that you have:

The Google Cloud CLI (gcloud) installed and configured, or access to Cloud Shell.
Permissions to create a service account and grant the required roles in the project.
Access to the GCP connector in OX.

Run each command on a single line. Line continuations pasted into Cloud Shell split at the backslash.

Step 1: Configure Google Cloud

To configure a single Google Cloud project for OX:

gcloud auth login    # skip in Cloud Shell
gcloud projects list --format="table(projectId,name)"

Set the variables for the project and Workload Identity configuration.

PROJECT=<project ID>
gcloud config set project "$PROJECT"
PROJECT_NUMBER=$(gcloud projects describe "$PROJECT" --format="value(projectNumber)")
POOL_ID=ox-pool
PROVIDER_ID=ox-oidc

Enable the required Google Cloud APIs.

gcloud services enable accepts up to 20 APIs per call, so the list runs in two batches.

[Complete first API enablement command from the engineer screenshot]

[Complete second API enablement command from the engineer screenshot]

Create the read-only service account and set SA to its email.
OX assumes this identity to read your project. No key is created for it. To reuse an existing service account, set SA to its email.
```
gcloud iam service-accounts create ox-readonly --display-name="OX read-only"    # skip when reusing
SA=ox-readonly@$PROJECT.iam.gserviceaccount.com
```

Grant the read-only roles to the service account.

See Roles granted to OX for what each covers.

ROLES="roles/viewer roles/iam.securityReviewer roles/storage.objectViewer roles/accessapproval.viewer roles/accesscontextmanager.policyReader roles/discoveryengine.viewer roles/firebaserules.viewer roles/firebase.viewer roles/healthcare.datasetViewer"

for R in $ROLES; do gcloud projects add-iam-policy-binding "$PROJECT" --member="serviceAccount:$SA" --role="$R"; done

In OX, open Connectors > GCP > Workload Identity (Keyless) and copy the Issuer URI.
Return to your Google Cloud shell and set ISSUER_URI to the Issuer URI that you copied from OX.
```
ISSUER_URI=<Issuer URI from OX>
```

Create the Workload Identity Pool.

gcloud iam workload-identity-pools create "$POOL_ID" --location=global --display-name="OX"

Create the Workload Identity provider.

[Complete Workload Identity provider command from the engineer screenshot]

Allow identities that authenticated through the pool to obtain credentials for the service account.
This grant is what lets the token OX presents become the identity of the service account.
```
[Complete service account Workload Identity User binding command from the engineer screenshot]
```

Step 2: Complete the connection in OX

To complete the connection in OX:

In OX, go to Connectors > GCP.

Select Workload Identity (Keyless).
Enter the connection details:
Field
Description
Workload Identity Pool Provider (audience)
Enter the Workload Identity Pool Provider value generated during the Google Cloud configuration.
Service account to impersonate
Enter the service account email generated during the Google Cloud configuration.
Connection Name
Enter a name that identifies the connection in OX.
Select Verify Connectivity.
After OX verifies the connection, select Connect.

Step 3: Connect GKE

You can connect GKE clusters in the connected Google Cloud project to OX. GKE uses the credentials configured for the GCP connector.

OX reads each GKE cluster through its Kubernetes API from the following IP addresses:

108.128.213.11
34.247.61.212

If the cluster restricts control-plane access using a private endpoint or authorized networks, add both OX IP addresses to the allowlist.

To connect GKE clusters:

Add 108.128.213.11 to the allowlist if access to the cluster control plane is restricted.
Add 34.247.61.212 to the allowlist if access to the cluster control plane is restricted.
In OX, go to Connectors > GKE.

Select Connect.
Select the clusters that you want to connect.
Save the connection.

Last updated 2 days ago