Connect Gateway provides authenticated access to registered Anthos clusters through Google Cloud. The Connect Agent runs on each enrolled cluster, while the gateway brokers access without requiring direct connectivity to the cluster API. section 2.3.3 section 12.4.3
The operational flow has four main parts:
- Register the cluster with a Google Cloud project and fleet using Workload Identity or a Google Cloud service account. section 2.3.3
- Install and start the Connect Agent during enrollment so Google Cloud can reach the cluster through the registered connection. section 2.3.3
- Configure an impersonation policy allowing the Connect Agent service account to impersonate a user account for Kubernetes commands. section 5.5
- Generate gateway-backed kubeconfig and use kubectl locally or from automation, including against GKE on-prem, AWS, or Azure clusters. section 5.5
# [USER_ACCOUNT] is an email, either USER_EMAIL_ADDRESS or GCPSA_EMAIL_ADDRESS
$ USER_ACCOUNT=foo@example.com
$ cat <<EOF > /tmp/impersonate.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gateway-impersonate
rules:
- apiGroups:
- ""
resourceNames:
- ${USER_ACCOUNT}
resources:
- users
verbs:
- impersonate
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: gateway-impersonate
roleRef:
kind: ClusterRole
name: gateway-impersonate
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: connect-agent-sa
namespace: gke-connect
EOF
Use the example RBAC manifest to grant the Connect Agent service account permission to impersonate the specified user account. section 5.5
Deploying through Cloud Build
A Cloud Build step can obtain a gateway kubeconfig and apply myapp.yaml to a registered VMware cluster. The request travels through Anthos Hub and the gateway, so Cloud Build does not need Cloud VPN, Interconnect, or direct cluster-API connectivity. section 12.4.3
Cloud Identity supplies the recommended authentication path for console and kubectl access. The same gateway model supports local administration and pipelines while keeping authorization dependent on Google Cloud identity and Kubernetes impersonation policy. section 2.3.3 section 5.5
