> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp.md).
# Add a Google Cloud Platform (GCP) connector
Connect Harness to your GCP accounts and services.
Use a Harness Google Cloud Platform (GCP) connector to integrate GCP with Harness. You can use GCP with Harness to obtain or upload artifacts, communicate with GCP services, provision infrastructure, push images, and deploy microservices and other workloads. When a pipeline runs, Harness uses the credentials provided in the GCP connector's settings to authenticate and perform operations with GCP.
To connect to Kubernetes clusters in GCP, you can use a GCP connector or the [platform-agnostic Kubernetes Cluster connector](/harness-ai/use-harness-platform/connectors/cloud-providers/add-a-kubernetes-cluster-connector/kubernetes-cluster-connector-settings-reference.md).
***
## What you will learn from this topic
* How to [add a GCP connector](#create-a-gcp-connector) at the account, org, or project scope.
* How to [configure credentials](#create-a-gcp-connector) using a service account key, delegate credential inheritance, or OIDC.
* How to [select a connectivity mode](#create-a-gcp-connector) and complete the connector setup.
* How to configure the [roles and policies](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#role-requirements) required for GKE, GCS, GCR, GAR, or Stackdriver.
* How to [install the gke-gcloud-auth-plugin](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#install-the-gke-gcloud-auth-plugin-on-the-delegate) on a delegate for GKE authentication using Kubernetes 1.22 and later.
* How to define a GCP connector using a [YAML example](#yaml-examples).
***
## Before you begin
* **Assign IAM roles to the GCP service account or Harness Delegate that you will attach to the connector.**
* The necessary IAM roles and policies depend on which GCP service you will use with Harness and which operations you will want Harness to perform in GCP.
* GCP connectors can also inherit IAM roles from Harness Delegates running in GCP. If you want your connector to inherit from a delegate, make sure the delegate has the necessary roles.
* If you find that the IAM role associated with your GCP connector does not have the policies required by the GCP service you want to access, you can modify or change the role assigned to the GCP account or the Harness Delegate that your GCP connector is using. You might need to wait up to five minutes for the change to take effect.
* For details about the roles and policies required to use a GCP connector with GKE, GCS, GCR, GAR, or Stackdriver, go to [Google Cloud Platform (GCP) Connector Settings Reference](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md).
* The [GCP Policy Simulator](https://cloud.google.com/iam/docs/simulating-access) is useful for evaluating policies and access.
* **Check your GKE version.**
* Harness supports GKE 1.19 and later.
* If you use a version prior to GKE 1.19, please enable Basic Authentication. If Basic authentication is inadequate for your security requirements, use the [Kubernetes Cluster Connector](/harness-ai/use-harness-platform/connectors/cloud-providers/add-a-kubernetes-cluster-connector.md).
* **Add the GKE metadata server IP to your `NO_PROXY` list.**
* If your GCP connector will inherit credentials from a delegate that uses a proxy *and* the GKE cluster or VM where the delegate is installed uses Workload Identity to authenticate, then you must add the GKE metadata server IP (`169.254.169.254`) to your `NO_PROXY` list.
* To verify the IP address, go to [Understanding the GKE metadata server](https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity#metadata_server) in the GCP docs.
* To add the IP address to your `NO_PROXY` list, do the following:
* Open the `harness-delegate.yaml` you used to create the delegate, and add the GKE metadata server IP address to the `NO_PROXY` setting in the `StatefulSet` spec:
```yaml
- name: NO_PROXY
value: "169.254.169.254"
```
Apply `harness-delegate.yaml` again to restart the Kubernetes delegate (`kubectl apply -f harness-delegate.yaml`).
***
### Create a GCP connector
Perform the following steps to create the GCP connector.
The connector wizard guides you through four steps: **Overview**, **Details**, **Select Connectivity Mode**, and **Connection Test**. If you select **Connect through a Harness Delegate** in **Select Connectivity Mode**, the wizard adds a **Delegates Setup** step.
### Overview
Perform the following steps:
1. Go to **Project Settings** (or **Account Settings** or **Organization Settings**) -> **Connectors**.
2. Select **New Connector** -> **Cloud Providers** -> **GCP - Cloud Provider**.
3. Enter a **Name**. Harness automatically creates an **Id** based on the name using the [Entity Identifier](/harness-ai/use-harness-platform/references/entity-identifier-reference.md) format. You can edit the ID before saving; once saved, the ID is immutable.
4. Optionally, add a **Description** and [tags](/harness-ai/use-harness-platform/tags/overview.md#create-tags-for-pipelines).
5. Select **Continue** to proceed to **Details**.
### Details
The GCP connector supports three credential methods. Select the method that matches your GCP setup.
* **Specify credentials here**: Authenticate using a GCP service account key. For more information, go to [Details settings](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#details-settings) in the GCP connector settings reference.
* **Use the credentials of a specific Harness Delegate**: Allow the connector to inherit its authentication credentials from the Harness Delegate that is running in GCP. This option requires **Connect through a Harness Delegate** in the next step.
* **OIDC**: Enables OIDC authentication to access GCP resources without secrets or credentials. For more information, go to [Use OpenID Connect (OIDC)](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#use-openid-connect-oidc) in the GCP connector settings reference.
Select **Continue** to proceed to **Select Connectivity Mode**.
### Select connectivity mode
On the **Connect to the provider** page, select how you want Harness to communicate with GCP. The available options depend on what you chose for **Details** settings in the previous step.
* **Connect through Harness Platform**: Harness communicates with GCP through a direct, secure communication between Harness and GCP. All credentials are encrypted and stored in the Secret Manager configured in Harness. A Harness Delegate still performs deployment operations, even when you select this connectivity mode. This connectivity mode is required for [Harness Cloud build infrastructure](https://developer.harness.io/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/use-harness-cloud-build-infrastructure).
* **Connect through a Harness Delegate**: Harness communicates with GCP behind your corporate firewall, through a Harness Delegate you install in your environment. You must choose this option if you chose to inherit delegate credentials.
* **Connect through Harness Platform for OIDC workflow**: This option appears only if you selected **OIDC** in **Details**. It uses OIDC authentication to access public cloud resources without secrets or credentials. For more information, go to [Use OpenID Connect (OIDC)](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#use-openid-connect-oidc) in the GCP connector settings reference.
Select **Continue** (or **Save and Continue** for the OIDC connectivity mode) to proceed.
**Delegates Setup**
If you selected **Connect through a Harness Delegate**, select the Delegates this connector will use:
* **Use any available Delegate**: Harness selects an available delegate at runtime. To learn how Harness selects delegates, go to [Delegate overview](/harness-ai/use-harness-platform/delegates/delegate/delegate-concepts/delegate-overview.md).
* **Only use Delegates with all of the following tags**: Use **Tags** to match one or more suitable delegates. To learn more about delegate tags, go to [Use delegate selectors](/harness-ai/use-harness-platform/delegates/delegate/manage-delegates/select-delegates-with-selectors.md). You can select **Install new Delegate** to add a delegate without exiting connector configuration. For guidance on installing delegates, go to [Delegate installation overview](/harness-ai/use-harness-platform/delegates/delegate/install-delegates/overview.md).
{% hint style="info" %}
It is possible to create a connector with a non-existent delegate. This behavior is intended. This design allows customers to replace a delegate with a new one of the same name or tag.
{% endhint %}
Select **Save and Continue** to proceed to **Connection Test**.
### Connection Test
Harness validates the GCP connector authentication and permissions and shows the delegate that executed the check. If the test succeeds, select **Finish** to complete the connector setup.
{% hint style="info" %}
For private network connectivity options with Harness Cloud, see [Private network connectivity options](broken://pages/UFMoHpXBRlXWG56DJzU0).
{% endhint %}
***
## YAML examples
The following YAML examples show how to configure a GCP connector for each credential type.
**Specify credentials here**
The following YAML defines a GCP connector that uses the **Specify credentials here** credential type with a GCP service account key, and connects through a Harness Delegate.
GCP connector YAML
```yaml
connector:
name: GCP-qa-target # Connector display name shown in the Harness UI
identifier: GCPqatarget # Unique connector identifier, cannot be changed after creation
accountIdentifier: # Harness account identifier that owns the connector
type: Gcp # Connector type
spec:
credential:
type: ManualConfig # Use the Specify credentials here credential type
spec:
secretKeyRef: account. # Identifier of the Harness secret storing the GCP service account key
executeOnDelegate: true # Connect through a Harness Delegate
proxy: false # Set to true if the delegate connects to GCP through a proxy
ignoreTestConnection: false # Run the connection test when the connector is saved
```
**Use the credentials of a specific Harness Delegate**
The following YAML defines a GCP connector that uses the **Use the credentials of a specific Harness Delegate** credential type, and selects a delegate by tag.
GCP connector YAML
```yaml
connector:
name: GcpManualSXp0MjZmBY # Connector display name shown in the Harness UI
identifier: GcpManualYH6md2VtFy # Unique connector identifier, cannot be changed after creation
description: GcpManualSXp0MjZmBY # Optional connector description
accountIdentifier: # Harness account identifier that owns the connector
type: Gcp # Connector type
spec:
credential:
type: InheritFromDelegate # Use the Use the credentials of a specific Harness Delegate credential type
delegateSelectors:
- # Delegate tag used to select a delegate for this connector
executeOnDelegate: true # Connect through a Harness Delegate
proxy: false # Set to true if the delegate connects to GCP through a proxy
ignoreTestConnection: false # Run the connection test when the connector is saved
```
***
## Troubleshooting
Troubleshoot GCP connector errors
If the connection test fails due to a credentials issue, use the GCP CLI or console to check the credentials of the GCP service account or delegate. The [GCP Policy Simulator](https://cloud.google.com/iam/docs/simulating-access) is useful for evaluating policies and access.
Due to the limited scope of the initial connection test, credentials can pass the connection test and then fail when you use the connector in a pipeline if the IAM role the connector is using does not have the roles and policies needed for the pipeline's operations. For example, if a pipeline has a Run step that references a GCP connector, the connector may need specific roles or policies to execute the operations required by the Run step.
If you experience any errors with GCP connectors, verify that the IAM roles and policies it is using are correct. For a list of roles and policies, go to the [GCP connector settings reference](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md#role-requirements).
***
## Next steps
* [GCP connector settings reference](/harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp/gcs-connector-settings-reference.md): review GCP connector settings, credential options, required roles and permissions, and the gke-gcloud-auth-plugin setup.
* [Configure OIDC with GCP WIF for Harness Cloud](https://developer.harness.io/continuous-integration/use-harness-ci/secure-harness-ci/configure-oidc-gcp-wif-ci-hosted): use Workload Identity Federation to authenticate Harness Cloud builds with GCP.
* [Kubernetes infrastructure](https://developer.harness.io/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/kubernetes/define-your-kubernetes-target-infrastructure#google-kubernetes-engine-gke): define a GKE target infrastructure for a Kubernetes deployment.
{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/connectors/cloud-providers/connect-to-google-cloud-platform-gcp" %}