Setup inCloud Managed with GCP
Last updated
Last updated
Note: groundcover inCloud is available only to users subscribed to one of our paid plans.
groundcover inCloud is a managed enterprise solution for installing groundcover’s observability infrastructure in a customer-owned cloud environment.
To set up groundcover inCloud, you need to create an isolated project within your GCP organization. groundcover's control plane will automatically manage these project resources, establishing, configuring, and maintaining the infrastructure and workloads within the account. These include GCP VPC, GCS, GKE, and LB services.
groundcover Control-Plane is a secure reconciliation controller designed to manage enterprise InCloud infrastructure environments. It is compliant with ISO-27001 and SOC-2 standards.
The control plane can securely access the isolated project’s service account within the customer organization using a cross-organization IAM delegation chain with the matching roles. It is important to note that groundcover inCloud setup does not require access to customer production data or workloads and is not granted such access.
Create a new GCP project for groundcover deployment. We strongly suggest following Google’s guide and isolating this project using the right folder hierarchy and IAM rules: https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy
Finally, select the inCloud project in the project picker.
To manage environment resources, we would need to have a dedicated project owner service account
Navigate to IAM & Admin > Service Accounts and create a new service account. You can choose any name for it, but we suggest naming it groundcover-managed.
Click on “CREATE AND CONTINUE”.
Under "Grant this service account access to project", open "Select a role" and choose Roles > Owner.
Then, press Done at the bottom (no need to fill the optional "Grant users access to this service account" field).
Click the service account created in the previous step:
Click on the "PERMISSIONS" tab
Click "GRANT ACCESS"
Under Add principals > New principals, add the following SA:
controlplane@groundcover-managed-prod.iam.gserviceaccount.com
Under Assign roles > Role, select "Service Account Token Creator" and press SAVE:
Search “Service Usage API” using the GCP search bar and click on "Service Usage API"
Click on ENABLE
After completing the previous steps, share with your dedicated groundcover integration manager the service account email (created in Step 2)
At this stage, our automation kicks in. Please allow approximately 2 hours for the initial reconciliation loop to stabilize.
Once stabilized, your integration manager will share with you (using a private channel) the incloud-values.yaml that should be used during sensor deployment on production workload, in the following manner:
Please see API Key Secret for additional information.
You can now log in to app.groundcover.com to use groundcover Managed inCloud, with total data control and privacy.
