Google Cloud

Google Cloud is a provider: connect it once with a service account, and Nexus can reach the projects behind it. From there it queries your logs, metrics, and traces, and inspects the Kubernetes clusters running on GKE, all through a single set of credentials.

​

What it provides

Connecting Google Cloud lets Nexus discover and query the data sources behind your projects: Each has its own page covering what it supports and how it’s enabled.

​

Setup

What you’ll need:

• A Google Cloud service account key in JSON.
• The IAM permissions below, granted to that service account.

We recommend a read-only service account: Nexus only ever reads from Google Cloud, never writes. Grant the permissions through read-only roles rather than broad editor or owner roles.

​

Permissions

Grant the service account this permission on each project you want Nexus to reach:

• logging.logEntries.list: read Cloud Logging entries.

To let the service account discover your projects automatically, also grant:

• cloudresourcemanager.projects.list: list the projects the account can reach.

These permissions help Nexus find and identify the workloads in a project, so it knows what’s worth querying:

• container.clusters.list: discover GKE clusters.
• logging.buckets.list: read each log bucket’s retention window.

Without project discovery, you can still connect a single project by supplying its ID directly (see below).

​

Connect Google Cloud

1. From the Nexus telemetry settings, add a telemetry data source and choose Google Cloud.
2. Paste your service account JSON key. If the account can’t list projects across your organization, enter a single project ID instead and we’ll connect just that project.
3. Test the connection. We check the key is valid and confirm the account holds the permissions it needs.

​

Enabling projects

Once connected, Nexus discovers every project the service account can reach. Each project arrives disabled by default, so you opt in deliberately rather than exposing every project at once. Review the list and enable the ones your team runs production workloads in. Enabling a project turns on its Cloud Logging access and surfaces the GKE clusters running inside it, which you then enable individually.

​

Private clusters

If a GKE cluster’s API endpoint is private, attach a proxy to the Google Cloud connection. Discovered clusters use that proxy by default, and each one can instead choose a different proxy or the public internet from Network access in its settings. If you change the proxy on the connection later, clusters still inheriting it follow the change. The proxy is only used to reach your clusters. Nexus calls Cloud Logging, Cloud Monitoring, Cloud Trace, and the rest of Google’s APIs over the public internet.

​

Related