Installing a GCP Connector with Helm (Project Wide)

This guide is intended for admins managing a Connector in the environment

Overview

Integrating a cloud account with Apono, syncs your resources so that you can easily use Apono to discover existing privileges and identities, manage employee and application provisioning to cloud assets and data repositories with delegated approval workflows and granular permissions to customer sensitive data.

πŸ“˜

You have chosen the advanced installation method

If can also easily connect GCP in Apono following this UI guide here

Deploy in a new GKE cluster

Prerequisites

  • A Google project to connect to Apono
  • Google Cloud CLI
  • A GCP user with project Owner permissions
  • Kubernetes command-line tool (kubectl)

Optional - run the installation from the GCP Console

Install Apono

1. Prepare parameters for Apono installation

Fill and set the values for the following variables:

export PROJECT_ID=#Your GCP Project ID
export APONO_TOKEN=#The token from your Apono Account
export APONO_CONNECTOR_ID=apono-google-integration #The connector identifier
export NAMESPACE=apono-connector-namespace #The namespace to deploy the cluster on

Set the following variable:

export [email protected]$PROJECT_ID.iam.gserviceaccount.com

2. Enable Cloud Resource Manager API

gcloud services enable cloudresourcemanager.googleapis.com  --project $PROJECT_ID

3. Create IAM Service Account and grant it with the roles: Security Admin, Secret Accessor

gcloud iam service-accounts create apono-connector-iam-sa --project $PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$GCP_SERVICE_ACCOUNT_EMAIL" \
    --role="roles/secretmanager.secretAccessor" \
    --project $PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$GCP_SERVICE_ACCOUNT_EMAIL" \
    --role="roles/iam.securityAdmin" \
    --project $PROJECT_ID

4. Verifying default GKE cluster for installation

  • Open the Kubernetes command-line tool
  • Run kubectl get-contexts to see the GKE clusters list
  • Set the desired cluster to be the default - kubectl config use-context #the name of the cluster
  • Run kubectl get-contexts - verify the "*" indicates the correct cluster.

5. Install Helm Chart

The helm chart installs the following:

  • Kubernetes Deployment containing the Apono-Connector image container
  • Kubernetes Service Account annotated with GCP IAM Service Account
  • Kubernetes Secret containing Docker Registry credentials
helm install apono-connector https://apono-io.github.io/apono-helm-charts/apono-connector/apono-connector-2.0.0.tgz \
    --set-string apono.token=$APONO_TOKEN \
    --set-string apono.connectorId=$APONO_CONNECTOR_ID \
    --set-string serviceAccount.gcpServiceAccountEmail=$GCP_SERVICE_ACCOUNT_EMAIL \
    --namespace $NAMESPACE \
    --create-namespace

6. Bind the IAM Service Account to the K8S Service Account

gcloud iam service-accounts add-iam-policy-binding $GCP_SERVICE_ACCOUNT_EMAIL \
    --member="serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/apono-connector-service-account]" \
    --role="roles/iam.workloadIdentityUser" \
    --project $PROJECT_ID

Verify the Connector has been successfully installed

You can validate the Connector is installed in the Connector status page.

πŸ‘

Hurray!

You've successfully installed a GCP Connector using Helm!

You can now enable more GCP integrations in the Integrations Catalog.


What’s Next