Onboard a GKE Cluster in a Shared VPC

1. Set the Host project ID.

   gcloud config set project [HOST_PROJECT_ID]

2. (optional) Set compute zone or region for clusters.
   If the cluster is zonal, enter the following:

   gcloud config set compute/zone [COMPUTE_ZONE]

   If the cluster is regional, enter the following:

   gcloud config set compute/region [COMPUTE_REGION]

3. In the Host project, update secondary ranges in the Trust VPC subnet.

   gcloud compute networks subnets update [TRUST_SUBNETWORK_NAME]
     --add-secondary-ranges 
     [PODS_IP_RANGE_NAME] = [POD_RANGE_CIDR],
     [SERVICE_IP_RANGE_NAME]=[SERVICE_RANGE_CIDR]

   Pods and service IP ranges must be within: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and cannot collide with existing IP ranges in the subnetwork.
4. In the Service project, create a private cluster in the shared VPC.
   1. Set the Service project ID.

      gcloud config set project [SERVicE_PROJECT_ID]

   2. Create a private cluster in the shared VPC.

      gcloud container clusters create  [CLUSTER_NAME] 
        --project [SERVICE_PROJECT_ID]
        --zone=[ZONE_NAME]
        --enable-ip-alias
        --enable-private-nodes
        --network projects/[HOST_PROJECT_ID]/global/networks/[NETWORK_NAME]
        --subnetwork projects/[HOST_PROJECT_ID]/regions/[REGION_NAME]
        /subnetworks/[TRUST_SUBNETWORK_NAME] 
        --cluster-secondary-range-name=[PODS_IP_RANGE_NAME] 
        --services-secondary-range-name=[SERVICE_IP_RANGE_NAME] 
        --master-ipv4-cidr=[MASTER_IPV4_CIDR]
        --enable-master-authorized-networks
        --master-authorized-networks=[PANORAMA_MANAGEMENT_IP/32],
        [MY_MANAGEMENT_IP/32]

5. Check your current cluster context:

   kubectl config current-context

6. Check all cluster contexts.

   kubectl config get-context

7. Change to another cluster.

   kubectl config use-context [CONTEXT_NAME]

   If you created your cluster in the GCP console, generate a kubeconfig entry:

   gcloud container clusters get-credentials [CLUSTER_NAME]

8. Create a cluster role in a .yaml file—for example, gke_cluster_role.yaml.

   apiVersion: rbac.authorization.k8s.io/v1beta1
   kind: ClusterRole
   metadata:
     name: gke-plugin-role
   rules:
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - list

9. Apply the cluster role.

   kubectl apply -f gke_cluster_role.yaml

10. Create a cluster role binding in a .yaml file—for example, gke_cluster_role_binding.yaml.

    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: gke-plugin-role-binding
    subjects:
      - kind: ServiceAccount
        name: [SERVICEACCOUNT_NAME]
        namespace: default
    roleRef:
      kind: ClusterRole
      name: gke-plugin-role
      apiGroup: rbac.authorization.k8s.io

11. Apply the cluster role binding.

    kubectl apply -f gke_cluster_role_binding.yaml

12. Create a service account.

    kubectl create serviceaccount [SERVICEACCOUNT_NAME]

13. Export the service account secret token in JSON format.

    MY_TOKEN=`kubectl get serviceaccounts [SERVICEACCOUNT_NAME] 
    -o jsonpath='{.secrets[0].name}'`
    
    kubectl get secret $MY_TOKEN -o json > [FILE_NAME].json

14. Get the API server address.

    kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "

15. In the Panorama plugin for GCP, add the service account information.
    Select PanoramaGoogle Cloud PlatformSetup.

    Name the credential, enter a description, and enter the API server address from step 14, and for GKE Service Account Credential, upload the JSON file you exported in step 13.

    After you add a service account credential, you can validate the credential from your Panorama command line (you cannot validate from the web interface):

    request plugins gcp validate-service-account gke_service_account <svc-acct-credential-name>

16. Set up auto scaling on the Panorama plugin for GCP.
    1. In the Panorama context, expand Google Cloud Platform, select AutoScaling, and click Add.
    2. Supply the Firewall Deployment Name and an optional description for the deployment.
    3. For the GCP Service Account Credential, supply the GCP service account name created in Prepare a Host Project and Required Service Accounts, step 4.
    4. Chose the Device Group and the Template Stack you created in when you configured the Panorama plugin.
    5. Disable License Management Only to ensure traffic is secured.
    6. Enter the exact GKE Cluster Name.
    7. (Optional) Enter a Description of the GKE cluster.
    8. Enter the Network CIDR for the GKE cluster.
    9. Select the GKE Service Account corresponding to the GKE cluster.
17. Commit your changes.
18. (Optional) Create and deploy a service template according to Using the Sample GKE Service Templates, or deploy a GKE service in the GCP console. .