GKE Connect

As explained in Google Anthos in Action

GKE Connect is an Anthos component that connects external Kubernetes clusters to Google Cloud for centralized registration and management.

GKE Connect is the Anthos component that links Kubernetes clusters to Google Cloud. Its Connect Agent opens a persistent outbound connection, allowing Google Cloud services and users to proxy authenticated Kubernetes operations without exposing the cluster to inbound internet traffic. section 2.3.2 section 5.1.1

Connect divides responsibility across the cluster, Google Cloud, and identity systems:

• Deploys the Connect Agent as a Kubernetes deployment and maintains a persistent TLS 1.2 connection to Google Cloud. section 5.1.1
• Proxies console requests to Kubernetes APIs while preserving cluster RBAC and authenticating each request stage. section 2.3.2
• Requires project-level Google Cloud IAM access in addition to permission within the cluster. section 2.3.2
• Uses egress from the cluster to Google Cloud; inbound firewall access from Google Cloud is unnecessary. section 5.1.1

Register clusters with the gcloud command-line tool, selecting the Google Cloud project and fleet and installing the agent through Workload Identity or a Google Cloud service account. Anthos-created GKE, AWS, and Azure clusters receive the agent during creation; EKS, AKS, OpenShift, Rancher, and other external clusters require separate deployment. Console interaction additionally requires Cloud Identity through Connect Gateway, a bearer token, or OIDC. section 2.3.3 section 5.1.1 section 5.3

Attaching an external cluster

For an EKS or AKS cluster, generate a kubeconfig containing the cluster server, certificate authority data, and service-account token. Provide that kubeconfig, a Google service account, and its key to the generated gcloud registration command. After the Connect Agent is deployed, the cluster appears in Google Cloud Console. section 5.3

Use the console to inspect workloads, node conditions, Docker and kubelet information, memory pressure, and unschedulable Pods across clusters. Console YAML editing can help with triage or development, but production changes should not rely on this emergency-oriented workflow. section 5.1.3

Figure 2.3 Request validation steps from Google Cloud to cluster

Trace request validation from Google Cloud through the Connect Agent to the cluster and back. section 2.3.2

How Google Anthos in Action covers it

How deep it goes

Explains agent deployment, outbound tunneling, layered authentication, registration, and console operations, stopping short of full command syntax.

Examples

Uses EKS, AKS, OpenShift, Rancher, kubeconfig registration, console YAML editing, and unschedulable Pod diagnosis.

What it assumes

Assumes Kubernetes cluster administration, kubeconfig handling, Google Cloud projects, service accounts, and basic IAM and networking knowledge.

What you can do after

Operate/configure registered clusters through Google Cloud Console and gcloud while preserving cluster authorization boundaries.

How it connects

Links Anthos, Kubernetes RBAC, Google Cloud IAM, Workload Identity, Connect Gateway, OIDC, and TLS.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• Connect Gatewayused by · Connect Gateway is an Anthos capability that provides authenticated access to registered clusters through Google Cloud.
• TLSuses · Transport Layer Security (TLS) is a cryptographic protocol that protects network communications through confidentiality, integrity, and authentication of communicating endpoints.
• persistent connectionproduces · A persistent connection is a communication link kept open for reuse across multiple messages or operations, rather than reestablished for each exchange.
• attached clusterused by · An attached cluster is a remotely managed conformant Kubernetes cluster registered to Anthos.
• Google Cloud consoleused by · Google Cloud console is a web-based interface for viewing, configuring, and managing Google Cloud resources and services.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.