Configure Service Directory for GKE

This page provides information about how to configure Service Directory with Google Kubernetes Engine (GKE) and automatically register your GKE clusters with Service Directory. You can configure Service Directory for GKE with Autopilot GKE clusters or Standard GKE clusters. For information about the two modes, see Choose a GKE mode of operation.

To learn more about Service Directory for GKE, see Service Directory for GKE overview.

Limitations

Service Directory for GKE has the following limitations:

  • You can only register services using the Service Directory-GKE integration. You must register ingresses, gateways, and other resources manually using the Service Directory API.
  • You must register your GKE clusters by using Fleets before you can sync services in those clusters to Service Directory. For details on how to register your GKE clusters, see Registering a cluster.
  • All Service Directory resources are registered in the fleet project, not the project of the cluster.
  • You can not modify the Service Directory entities registered using this integration. You must make all changes to the GKE service resources themselves so that they propagate to Service Directory.

Before you begin

  • Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  • In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  • Verify that billing is enabled for your Google Cloud project.

  • In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  • Verify that billing is enabled for your Google Cloud project.

  • You must register your GKE cluster to a fleet. To register your GKE cluster, follow the instructions in Registering a cluster.

Set up the GKE cluster

To set up the GKE cluster, follow these steps.

  • Enable the Service Directory GKE fleet feature.
  • Configure the Service Directory registration policy.
  • Deploy the GKE service.

Enable the Service Directory GKE fleet feature

To enable the Service Directory GKE fleet feature, run the gcloud container hub command.

gcloud 

gcloud alpha container hub service-directory enable

Configure the Service Directory registration policy for the service

The registration policy defines what kinds of services within GKE are automatically imported by Service Directory. The following list shows the configurable options for this policy:

  • resources: the type of GKE resources that are imported. You can specify multiple resource types. Resources are identified by Group and Kind. By default, the Group is core. Only Kind: service is available.
  • selector: a GKE label selector which matches on key:value labels that are applied on the GKE resource. By default, no resources are selected.
  • annotationsToSync: the annotation keys on the resource that are synced to Service Directory. If this list is empty, then resources are synced to Service Directory without annotations.

Each namespace should define a single policy. This policy must have name: "default". The Controller does not allow or reconcile other names.

Configure a ServiceDirectoryRegistrationPolicy.

The following manifest describes a ServiceDirectoryRegistrationPolicy:

apiVersion: networking.gke.io/v1alpha1
kind: ServiceDirectoryRegistrationPolicy
metadata:
    # Only the name "default" is allowed.
    name: default
    # The ServiceDirectoryRegistrationPolicy is a namespaced resource
    namespace: NAMESPACE
spec:
  resources:
    # Kind specifies the types of Kubernetes resources that can be synced into Service Directory.
    - kind: Service
      # Selector