Google Kubernetes Engine (GKE) | Entitle

Overview

GKE is a Google-managed implementation of the Kubernetes open-source container orchestration platform. It provides the operational power of Kubernetes while managing many of the underlying components, such as the control plane and nodes, for you.

Entitle can manage Clusters and Namespaces in GKE.

This page will provide you with instructions on how to integrate Entitle and GKE.

General guidelines

To integrate your Google Kubernetes Engine in Entitle, you will need to run the entitle_google_integrator setup you downloaded and unzipped on the Google Integrations page and configure a Domain-Wide Delegation.

Set up GKE to work with Entitle

Stage 1: Running the setup script

The setup will consist of the following actions:

• Create an Entitle service account in the chosen project
• Create an organization-level role with the required permissions or add permissions to it if it already exists
• Bind the role to the service account at the chosen project
• Enable the required API service for the integration:
  • Admin SDK page
• Generate a key for the service account and download it to your local machine

1. Go to your GCP web console.
2. Choose the project which you chose to create Entitle's service account at the top left corner.
3. Click on the shell icon at the top right corner.

4. Navigate to the path of the unzipped folder entitle_google_integrator, and run the following commands:

# For a basic configuration, create a service account in the current project and assign the role to it at the project-level
bash run.sh -i gke -k

# You may also assign the role in the parent folder or organization-level
bash run.sh -i gke -b folder -k
bash run.sh -i gke -b organization -k

# For more options use the -h flag
bash run.sh -h

5. Download the created JSON file on setup completion. You will use it later in this guide.

Stage 2: Configure domain-wide delegation

Your service account needs to have domain-wide delegation on a certain scope.

1. Go to the Manage Domain-Wide Delegation page.
2. Click Add new:

3. In the Client ID field, enter the 21-digit number obtained from the key JSON file under the client_id field.
4. In the OAuth scopes field, enter the following scopes:

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly

5. Click Authorize.

Creating the integration in Entitle

1. Log in to Entitle and go to the Integrations page.

2. After clicking the Add Integration button, type Google Kubernetes Engine in the Application field.

3. Don't forget to set Save on correctly on your agent or Entitle's cloud.

   

4. Under the "service_account_key" field, paste the downloaded key JSON of your service account.

5. Under "credential_subject", enter an email of an admin in your organization who has permission to view all users in your organization.

6. Optionally, to limit which organizations, folders, or projects Entitle syncs, add one or more of the following lists to an "options": {} object beneath "credential_subject": "":

   Option	What it limits	Value
   organization_ids_constraints	Organizations	Numeric organization IDs, for example "123456789012" or "organizations/123456789012"
   folder_ids_constraints	Folders	Numeric folder IDs, for example "222" or "folders/222"
   project_ids_constraints	Projects	Project IDs, for example "my-project-id-1"

   This is useful when the service account is bound at the folder or organization level, but you only want to expose clusters and namespaces from part of your hierarchy in Entitle. If an option is omitted or empty, it does not filter anything.

   🚧

   project_ids_constraints filters projects only. To limit discovery by organization or folder, use organization_ids_constraints and folder_ids_constraints.

   🚧

   organization_ids_constraints and folder_ids_constraints require Entitle agent version 2.30.0 or later. Older agents ignore these options without an error, so discovery is not scoped. Confirm your agent version before you rely on them.

   For details on how these options work together, see How scope constraints work.

   ✅

   Example configuration JSON

   Entitle Configuration

   {
     "service_account_key": {
       // A dictionary from the downloaded JSON file
     },
     "credential_subject": "an email of an admin in your organization which has permission to view all users",
     "options": {
       "organization_ids_constraints": ["123456789012"],
       "folder_ids_constraints": ["folders/222"],
       "project_ids_constraints": ["my-project-id-1", "my-project-id-2"]
     }
   }

7. Click Save.

How scope constraints work

Use organization_ids_constraints, folder_ids_constraints, and project_ids_constraints to control which parts of your GCP resource hierarchy Entitle scans. GKE clusters exist only in projects, so the GKE integration never syncs folder or organization resources. Instead, the constraints decide which projects Entitle scans for clusters and namespaces.

Rules

• An empty option means no filter. If an option is not set or is an empty list, it does not filter anything. If none of the three options are set, Entitle scans every project the service account can see.
• project_ids_constraints filters projects only. If it is the only option set, discovery works the same as in earlier agent versions. The hierarchy check runs only when organization_ids_constraints or folder_ids_constraints is set.
• Options combine with AND. A resource must pass every option that is set. If a project's organization or folder is not allowed, Entitle drops the project, and its clusters and namespaces, even when the project is listed in project_ids_constraints.
• A listed folder includes its whole subtree. Entitle scans projects in the listed folder and in all its subfolders. You don't need to list parent folders. If you also set organization_ids_constraints, a listed folder under an organization that isn't listed is excluded.
• Projects outside any folder pass a folder-only constraint. Projects directly under the organization, and projects with no organization, are still scanned when only folder_ids_constraints is set. If those projects have clusters you don't want, also set project_ids_constraints.

Filter order

Entitle applies the constraints from the top of the hierarchy down:

1. Organizations: If organization_ids_constraints is set, Entitle keeps only the listed organizations.
2. Folders: If folder_ids_constraints is set, Entitle keeps only the listed folders and their subfolders.
3. Projects: If project_ids_constraints is set, Entitle keeps only the listed projects.

Scope constraints example

The following example uses this hierarchy:

Organization (organizations/1000)
├── Folder A (folders/111)
│   ├── Folder B (folders/222)
│   │   ├── Folder C (folders/333)
│   │   │   └── project-c
│   │   └── project-b
│   └── project-a
├── Folder X (folders/444)
│   └── project-x
└── project-org-level            <- directly under the organization, in no folder

With "folder_ids_constraints": ["222"], Entitle scans the following projects for clusters:

Invalid values

The following values are rejected:

• Display names, such as "Folder B"
• The wrong prefix, such as "folders/1000" for an organization or "organizations/222" for a folder
• Project values, such as "projects/my-project"
• Full paths, such as "organizations/1000/folders/222"
• Trailing slashes

Surrounding whitespace is ignored.

Permissions

The organization and folder constraints rely on the service account being able to see the folders. GCP folder search returns only folders on which the caller has resourcemanager.folders.get. If the service account can't see a project's folder path:

• With organization_ids_constraints set: Entitle excludes the project, because it can't confirm the project's organization.
• With only folder_ids_constraints set: Entitle keeps the project if the listed folder is on the visible part of its path, including its first hidden parent.

Frequently asked questions

gcloud organizations list
gcloud resource-manager folders list --organization=<ORG_ID>
gcloud resource-manager folders list --folder=<FOLDER_ID>    # subfolders