Skip to main content
GCP credentials store a service account key that Ankra uses to estimate the infrastructure cost of your clusters, discover clusters, and provision Google Kubernetes Engine (GKE). For cost and inventory, Ankra requests Google’s read-only OAuth scope and never modifies resources. The key is validated against the GCP Cloud Resource Manager API when you save it, so an invalid key or a project the service account can’t read is rejected immediately.
Provisioning GKE requires the Kubernetes Engine Admin (roles/container.admin) and Service Account User (roles/iam.serviceAccountUser) roles and the Kubernetes Engine API enabled - broader than the read-only cost scope. See Google Kubernetes Engine (GKE).

​
What Ankra Accesses

For cost estimation, Ankra calls three Google APIs with the service account, all read-only:
APIWhy it’s used
Cloud Resource Manager APIVerify the service account can read the project (the Test connection check)
Cloud Billing APIRead the public Compute Engine price catalog (SKUs) for cost estimates
Compute Engine APIRead machine-type specs (vCPU and memory) to price your nodes

​
Creating a GCP Credential

1

Enable the required APIs

In the Google Cloud Console, select your project and enable the Cloud Resource Manager API, Cloud Billing API, and Compute Engine API.Or with the gcloud CLI:
export PROJECT_ID="your-gcp-project-id"   # replace with your real project ID
gcloud config set project "$PROJECT_ID"

gcloud services enable \
  cloudresourcemanager.googleapis.com \
  cloudbilling.googleapis.com \
  compute.googleapis.com
2

Create a read-only service account

  1. Go to IAM & Admin → Service Accounts → Create service account
  2. Give it a name such as ankra-cost-readonly
  3. Grant it the Viewer role (roles/viewer) on the project - or a custom read-only role
Or with gcloud (reusing the PROJECT_ID from the previous step):
gcloud iam service-accounts create ankra-cost-readonly \
  --display-name="Ankra cost (read-only)"

gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="serviceAccount:ankra-cost-readonly@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role="roles/viewer"
If this fails with does not have permission to access projects instance [...:getIamPolicy] (or it may not exist), either PROJECT_ID is still set to the placeholder, or your account lacks the resourcemanager.projects.setIamPolicy permission. Confirm echo $PROJECT_ID shows your real project ID, and that you hold roles/owner or roles/resourcemanager.projectIamAdmin on it (otherwise ask a project admin to run this one command).
3

Create and download a JSON key

  1. Open the service account → Keys → Add key → Create new key
  2. Choose JSON and download the file
Or with gcloud:
gcloud iam service-accounts keys create ankra-key.json \
  --iam-account="ankra-cost-readonly@${PROJECT_ID}.iam.gserviceaccount.com"
The downloaded JSON must contain client_email, private_key, and token_uri.
4

Add to Ankra (UI)

Go to Credentials → Add → Google Cloud (GCP), then provide:
  • Name: a unique identifier - lowercase letters and numbers only, cannot start with a hyphen (e.g. gcp-prod)
  • Project ID: your GCP project ID (e.g. acme-prod)
  • Service Account Key (JSON): paste the full contents of the downloaded key file
Click Test connection to verify access, then Add.

​
Troubleshooting GCP Credentials

For gcloud setup errors during service-account creation (such as does not have permission ... (or it may not exist)), see the warning in the Create a read-only service account step above - it’s almost always an unsubstituted PROJECT_ID placeholder or a missing setIamPolicy permission. The table below covers the Test connection result in the Ankra UI:
Test connection resultCauseSolution
The service account key is not valid JSON or is missing required fieldsThe pasted key isn’t the full JSON filePaste the entire downloaded JSON; it must include client_email, private_key, and token_uri
Google rejected the service account credentialsThe key is disabled or deletedConfirm the key is active, or create a new JSON key
The service account lacks read access to this projectMissing IAM role or disabled APIGrant the Viewer role and enable the Cloud Resource Manager API
The project was not foundWrong project IDCheck the Project ID matches your GCP project exactly
Could not reach the GCP Resource Manager APINetwork or connectivity issueRetry; ensure outbound access to *.googleapis.com