# Connect a Google Cloud provider link Connect a Google Cloud account to Northflank through a provider link. Choose the features for your task before granting project permissions. Available features depend on the provider and your account. Connecting the account does not create a cluster. Cluster quotas apply only when you deploy clusters. Review [provider-link features](provider-links) before selecting an authentication method. For workload access to Google Cloud resources, read [Configure workload identity](https://northflank.com/docs/v1/application/bring-your-own-cloud/configure-workload-identity). For cluster deployment, use [Google Cloud on Northflank](https://northflank.com/docs/v1/application/bring-your-own-cloud/gcp-on-northflank). ## Select or create your GCP project You can use Northflank with an existing Google Cloud Platform project, or create a new one. ### New GCP project setup 1. Open your [GCP console](https://console.cloud.google.com/) and create a new project, or select an existing one. 2. Make sure that [billing is enabled](https://cloud.google.com/billing/docs/how-to/modify-project). 3. Enable the [Cloud Resource Manager API](https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com). 4. If you deploy a cluster with Northflank, enable the [Kubernetes Engine API](https://console.cloud.google.com/marketplace/product/google/container.googleapis.com). Registry access and workload identity do not require the Kubernetes Engine API. ## Required permissions Select the integration features you need before assigning Google Cloud roles. Northflank shows the required roles and permissions for that selection. For Docker Registries, grant Artifact Registry Reader (`roles/artifactregistry.reader`). For Docker Registry Push, also grant Artifact Registry Writer (`roles/artifactregistry.writer`). See Google's [Artifact Registry access guidance](https://cloud.google.com/artifact-registry/docs/access-control) for role details. For BYOC cluster deployment, grant Service Account User (`roles/iam.serviceAccountUser`) and Kubernetes Engine Admin (`roles/container.admin`), or roles with equivalent permissions. Additional features, such as a custom VPC, require the permissions shown in Northflank. Registry-only integrations do not need these Kubernetes roles. The list below covers the base cluster permissions. Use the current list in Northflank for your selected features. Required GCP permissions - `iam.serviceAccounts.actAs` - `iam.serviceAccounts.get` - `container.clusterRoleBindings.create` - `container.clusterRoleBindings.delete` - `container.clusterRoleBindings.get` - `container.clusterRoleBindings.list` - `container.clusterRoleBindings.update` - `container.clusterRoles.bind` - `container.clusterRoles.create` - `container.clusterRoles.escalate` - `container.clusterRoles.get` - `container.clusterRoles.list` - `container.clusterRoles.update` - `container.clusters.create` - `container.clusters.delete` - `container.clusters.get` - `container.clusters.getCredentials` - `container.clusters.list` - `container.clusters.update` - `container.configMaps.create` - `container.configMaps.get` - `container.configMaps.list` - `container.configMaps.update` - `container.customResourceDefinitions.create` - `container.customResourceDefinitions.get` - `container.customResourceDefinitions.update` - `container.daemonSets.create` - `container.daemonSets.delete` - `container.daemonSets.get` - `container.daemonSets.list` - `container.daemonSets.update` - `container.deployments.create` - `container.deployments.get` - `container.deployments.list` - `container.deployments.update` - `container.horizontalPodAutoscalers.create` - `container.horizontalPodAutoscalers.list` - `container.horizontalPodAutoscalers.update` - `container.mutatingWebhookConfigurations.create` - `container.mutatingWebhookConfigurations.list` - `container.mutatingWebhookConfigurations.update` - `container.namespaces.create` - `container.namespaces.get` - `container.namespaces.update` - `container.networkPolicies.create` - `container.networkPolicies.get` - `container.networkPolicies.update` - `container.nodes.list` - `container.operations.list` - `container.persistentVolumeClaims.list` - `container.podDisruptionBudgets.create` - `container.podDisruptionBudgets.list` - `container.podDisruptionBudgets.update` - `container.pods.list` - `container.pods.proxy` - `container.podSecurityPolicies.create` - `container.podSecurityPolicies.get` - `container.podSecurityPolicies.update` - `container.replicaSets.list` - `container.resourceQuotas.create` - `container.resourceQuotas.get` - `container.resourceQuotas.update` - `container.roleBindings.create` - `container.roleBindings.get` - `container.roleBindings.list` - `container.roleBindings.update` - `container.roles.bind` - `container.roles.create` - `container.roles.escalate` - `container.roles.get` - `container.roles.list` - `container.roles.update` - `container.runtimeClasses.list` - `container.secrets.create` - `container.secrets.get` - `container.secrets.list` - `container.secrets.update` - `container.serviceAccounts.create` - `container.serviceAccounts.delete` - `container.serviceAccounts.get` - `container.serviceAccounts.list` - `container.serviceAccounts.update` - `container.services.create` - `container.services.get` - `container.services.list` - `container.services.update` - `container.statefulSets.create` - `container.statefulSets.get` - `container.storageClasses.create` - `container.storageClasses.get` - `container.storageClasses.update` - `container.thirdPartyObjects.create` - `container.thirdPartyObjects.get` - `container.thirdPartyObjects.list` - `container.thirdPartyObjects.update` - `container.validatingWebhookConfigurations.create` - `container.validatingWebhookConfigurations.get` - `container.validatingWebhookConfigurations.list` - `container.validatingWebhookConfigurations.update` - `container.volumeSnapshotClasses.create` - `container.volumeSnapshotClasses.get` - `container.volumeSnapshotClasses.update` ## Add your account with a cross-project service account A cross-project service account lets Northflank access your Google Cloud project without a service account key that you manage. Northflank creates a service account, and you grant that account access to your project. > [!note] Requirements > > You will need the following to get started: > > - A [Google Cloud project](#select-or-create-your-gcp-project) > - Permission to grant the [required roles](#required-permissions) in that project > - For cluster deployment: sufficient [quotas](https://northflank.com/docs/v1/application/bring-your-own-cloud/gcp-on-northflank#check-your-quotas) to deploy your cluster For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters. 1. Open Cloud → Provider links in Northflank. 2. Open the [GCP provider link form](https://app.northflank.com/s/account/cloud/integrations/new/gcp). 3. Under Basic information, enter a Name. Select the features you need under Desired features. 4. In Credentials, select Cross-project service account. 5. Enter your Google project ID. 6. Select Create provider link. 7. On the new provider link's Edit tab, copy the Service account email from Credentials. 8. Open the [IAM page](https://console.cloud.google.com/iam-admin/iam) in your Google Cloud project. 9. Select Grant access. Enter the copied email as the principal. 10. Assign the roles shown for your selected features in Northflank. 11. Save the assignment in Google Cloud. 12. In Northflank, select Verify all permissions under Credentials. > [!note] After changing permissions > > Google Cloud can take time to apply new permissions. An operation can fail before those changes apply. Wait for the updated permissions before you retry an operation. After access is available, use the integration for your registry or [create a cluster](https://northflank.com/docs/v1/application/bring-your-own-cloud/gcp-on-northflank#create-a-cluster). ## Add your account with a service key You can integrate Google Cloud with a service account key. Use a [cross-project service account](#add-your-account-with-a-cross-project-service-account) when it supports your selected features to avoid managing a long-lived key. > [!note] Requirements > > You will need the following to get started: > > - A [Google Cloud project](#select-or-create-your-gcp-project) > - Permission to create service accounts and service account keys > - Permission to grant the [required roles](#required-permissions) in that project > - For cluster deployment: sufficient [quotas](https://northflank.com/docs/v1/application/bring-your-own-cloud/gcp-on-northflank#check-your-quotas) to deploy your cluster For Artifact Registry access, select Docker Registries and, for project builds, Docker Registry Push. Select BYOC only if this integration also manages clusters. 1. Open Cloud → Provider links in Northflank. 2. Open the [GCP provider link form](https://app.northflank.com/s/account/cloud/integrations/new/gcp). 3. Under Basic information, enter a Name. Select the features you need under Desired features. 4. In Credentials, select Service account key. Review the required roles. 5. Open IAM & Admin → Service Accounts in your Google Cloud project. 6. Create a service account with a name and description. 7. Assign the roles required for your selected features. 8. Open the service account's Keys tab. Create a JSON key. 9. Copy the downloaded JSON into Service account key (keyfile.json) in Northflank. 10. Make sure that Google project ID matches your project. 11. Select Create provider link. > [!note] After changing permissions > > Google Cloud can take time to apply new permissions. An operation can fail before those changes apply. Wait for the updated permissions before you retry an operation. You can update the key and Google project ID in the integration. > [!warning] Keep access to existing resources > > Keep access to existing resources when you change these values. If you change the project while it still contains Northflank clusters, Northflank cannot manage those clusters. Deleting clusters directly in Google Cloud can leave unused resources.