Google Cloud Platform (GCP)

Cloud Management Platform (CMP) works with GCP projects, where each imported project becomes a CMP environment that users can order into. Connect via an OAuth client ID or a service account key. With a service account key, CMP can list your projects immediately. With an OAuth client ID, you authorize in Google first and import projects afterward.

Before you begin

• A Google Cloud account with permission to create credentials.
• At least one Google Cloud project, with billing enabled.
• The following APIs enabled on each project CMP manages: Compute Engine, Cloud Resource Manager, and Identity and Access Management (IAM). Also enable Cloud Monitoring to collect CPU, disk, and network statistics for GCP servers.

Create credentials in Google Cloud

CMP accepts an OAuth client ID or a service account key. Create one of them in Google Cloud before you add the resource handler.

OAuth client ID

1. Open the Credentials page in the Google Cloud console. The active project must have the Cloud Resource Manager API enabled.
2. Select Create Credentials > OAuth client ID.
3. Set the application type to Web application.
4. Add an Authorized redirect URI of https://<your CMP host>/google-oauth2/. For a CMP instance at https://example.com, that is https://example.com/google-oauth2/. CMP builds the redirect URI from the address you use to reach it, so register that exact scheme and hostname. Google does not accept private IP addresses, so use a resolvable hostname.
5. Download the JSON for the new client ID.

Service account key

Create a service account in the project you want CMP to manage, and download its key in JSON format. Grant the account the roles listed in Required GCP permissions.

Add a GCP resource handler

Start by going to Admin > Resource Handlers, select Add, then select Google Cloud Platform under Public Cloud.

The submit button reads Import, or Save if you choose to enter the JSON directly.

Connect with an OAuth client ID

1. In the credentials dialog, leave Web Application OAuth Client ID JSON set to Upload .json file, select your client ID JSON in Key file, and select Import. To paste the JSON instead, select Enter JSON data directly and use Key contents.
2. CMP sends you to Google to authorize the connection. Log in as a Google account that has the roles listed in Required GCP permissions, and select Allow.
3. Google returns you to the handler, and CMP opens Edit resource handler settings. Name the handler and select Save. This dialog has no project list yet.
4. Import your projects from the Projects tab, as described in Import projects.

Connect with a service account key

1. In the credentials dialog, select your service account key in Key file and select Import.
2. CMP reads the key and lists the projects it can reach. Name the handler, select projects in Projects, and select Done.
3. CMP queues a metadata job that creates one environment per selected project and then imports that project’s networks. Follow the job link in the confirmation message to watch its progress.

There is no Google consent screen on this route, because the key authorizes CMP directly.

Import projects

Import at least one project to use a GCP resource handler. The Projects tab shows a warning icon until you import a project. Importing a project creates a CMP environment.

1. On the handler, open the Projects tab and select Sync Projects. CMP asks Google which projects the credentials can access and reports Synced projects successfully! If it asks you to verify the connection, do that on the Overview tab and try again.
2. Select Import Projects. The Import GCP Projects dialog lists what Sync Projects found under Available GCP Projects. If it reports that no projects were found, run Sync Projects first.
3. Select projects, then select Import selected projects. CMP queues a job that creates an environment for each one.

Projects imported this way do not include their networks. Open each project and use Import Networks on its Networks tab.

The Projects tab lists each project’s name, project ID, project number, and environments. Select a project name to open it, or use the plus icon in the Environment column to create another environment.

Inside a project

A project has Overview, Networks, and Servers tabs. The Overview tab is where you verify the project’s connection, edit it, or remove it from CMP.

A project that is not a Shared VPC host also has a Shared VPC tab, with Sync shared subnets for pulling in the subnets its host project shares. A host project has no Shared VPC tab; its Networks tab lists every subnet.

Create a project from CMP

The Create GCP Project blueprint orders a new project in Google Cloud. Choosing a billing account on the order form requires the billing account permission in GCP.

1. On the Create GCP Project blueprint, select Order.
2. Choose a GCP Resource Handler, name the project, and choose a Billing Account.
3. Submit the order, then confirm the project exists in Google Cloud.

Import images

Importing a project brings its images. Use the handler’s Images tab to add more from private projects or from Google’s public image projects.

1. Go to Admin > Resource Handlers, open your GCP handler, and select the Images tab.
2. Select Images from Public Projects. CMP offers Google’s common ones, including debian-cloud, rhel-cloud, ubuntu-os-cloud, and windows-cloud. Select Add Custom to name one that is not listed, then select Save. Images from the projects you select appear in the Import Images dialog.
3. Select Import Images, then choose the images to bring into CMP.

Shared images are listed when the GCP user has a role that can see them.

Required roles

The GCP user associated with the resource handler needs the Compute Image User role, granted in IAM & Admin > IAM in Google Cloud.

Grant it in the project that holds the image. If you have imported Project A and the image lives in Project B, add the user to Project B and grant the role there.

GCP servers

Set a custom hostname

Add the DNS Domain parameter to the environment for your project, and CMP sets each new server’s hostname in GCP to {name}.{dns_domain}.

1. Go to Admin > Environments and open the GCP project environment.
2. On the Parameters tab, select Add > DNS Domain, then enter your domain.
3. Order a server into that environment and check the hostname in GCP.

If the parameter has no value, CMP falls back to the DNS domain set on the server’s network.

Run startup scripts on GCP servers

CMP passes startup scripts to GCP as instance metadata during provisioning. Each script is a parameter you add to the environment; the parameter decides the script language and when GCP runs it.

1. Go to Admin > Environments and open the GCP project environment.

2. On the Parameters tab, select Add and choose the parameter for the script you want to run.

   Parameter	What you supply	When it runs
   GCP Initial Batch File Script	A batch file script of up to 256 KB.	During the initial boot.
   GCP Initial Command Shell Script	A command shell script of up to 256 KB.	During the initial boot.
   GCP Initial PowerShell Script	An unsigned PowerShell script of up to 256 KB.	During the initial boot.
   GCP Initial Windows Script URL	A URL to a batch file, command shell, or signed or unsigned PowerShell script held in Cloud Storage, for scripts over 256 KB.	During the initial boot.
   GCP Startup Batch File Script	A batch file script of up to 256 KB.	During each boot after the initial boot.
   GCP Startup Command Shell Script	A command shell script of up to 256 KB.	During each boot after the initial boot.
   GCP Startup PowerShell Script	An unsigned PowerShell script of up to 256 KB.	During each boot after the initial boot.
   GCP Startup Windows Script URL	A URL to a batch file, command shell, or signed or unsigned PowerShell script held in Cloud Storage, for scripts over 256 KB.	During each boot after the initial boot.
   GCP Startup Linux Script	A Linux script, run after the instance starts.	On every boot.
   GCP Startup Linux Script URL	A URL to a Linux script, run after the instance starts.	On every boot.

   For example, this GCP Startup Linux Script writes the server’s hostname to a file:

   #!/usr/bin/env bash
   hostname=$(hostname)
   echo $hostname > /tmp/vmname.host
   

3. Select Add.

4. In the Options column, select the pencil icon next to No options.

5. Paste in your script or its URL, depending on the chosen parameter, and select Save.

Tag GCP servers

CMP supports two-way tagging of GCP servers. GCP calls these tags labels. Add tag mappings from the handler’s Tags tab; tags are applied at provision time and refreshed when the server syncs.

Tags appear in the Google Cloud Platform Details section of a provisioned server. Editing a tag value in CMP updates the label in GCP at the next sync.

GCP rates

CMP calculates GCP server rates from pricing data published by Google. Google controls what pricing data is available, so the rates CMP can reach may lag current prices. To check a figure, use the Google Cloud pricing calculator.

GCP blueprints

A GCP resource handler manages projects, servers, networks, and images. To deploy other Google Cloud services from CMP, download one of these blueprints from the Content Library.

Troubleshooting