Google Cloud (GCP) Classic: Installation & Configuration

Installation

The Google Cloud (GCP) Classic provider is available as a package in all Pulumi languages:

• JavaScript/TypeScript: @pulumi/gcp
• Python: pulumi-gcp
• Go: github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp
• .NET: Pulumi.Gcp
• Java: com.pulumi.gcp

Authentication Methods

To provision resources with the Pulumi Google Cloud Provider, you need to have Google credentials.

Pulumi can authenticate to Google Cloud via several methods:

• Google Cloud CLI
• OpenID Connect (OIDC)
• Service account

Configuration

There are a few different ways you can configure your Google Cloud credentials to work with Pulumi.

Authenticate using the CLI

When developing locally, we recommend that you install the Google Cloud SDK and then authorize access with a user account. Next, Pulumi requires default application credentials to interact with your Google Cloud resources, so run auth application-default login command to obtain those credentials:

$ gcloud auth application-default login

To configure Pulumi to interact with your Google Cloud project, set it with the pulumi config command using the project’s ID:

$ pulumi config set gcp:project your-gcp-project-id

You may also set your Google Cloud Project via environment variable (listed in order of precedence):

• GOOGLE_PROJECT
• GOOGLE_CLOUD_PROJECT
• GCLOUD_PROJECT
• CLOUDSDK_CORE_PROJECT

$ export GOOGLE_PROJECT=your-gcp-project-id

Authenticate using a service account

If you are using Pulumi in a non-interactive setting (such as a CI/CD system) you will need to configure and use a service account instead.

Authenticate with dynamically generated credentials

In addition to configuring the GCP provider locally, you also have the option to centralize your configurations using Pulumi ESC (Environments, Secrets, and Configuration). Using this service will enable you to run Pulumi CLI commands with dynamically generated credentials, removing the need to configure and manage your credentials locally.

To do this, you will need to complete the following steps:

Configure OIDC between Pulumi and GCP

Refer to the Configuring OpenID Connect for GCP Guide for the step-by-step process on how to do this. Once you have completed these steps, you can define and expose environment variables as shown below:

values:
  gcp:
    login:
      fn::open::gcp-login:
        project: <your-project-id>
        oidc:
          workloadPoolId: <your-pool-id>
          providerId: <your-provider-id>
          serviceAccount: <your-service-account>
  environmentVariables:
    GOOGLE_OAUTH_ACCESS_TOKEN: ${gcp.login.accessToken}
    GOOGLE_PROJECT: ${gcp.login.project}
    GOOGLE_REGION: <your-region>
    GOOGLE_ZONE: <your-zone>

Import your environment

The last step is to update your project’s stack settings file (Pulumi.<stack-name>.yaml) to import your ESC environment as shown below:

environment:
  - <your-environment-name>

Make sure to replace <your-environment-name> with the name of the ESC environment you created in the previous steps.

You can test that your configuration is working by running the pulumi preview command. This will validate that your GCP resources can be deployed using the dynamically generated credentials in your environment file.

To learn more about projecting environment variables in Pulumi ESC, refer to the relevant Pulumi ESC documentation.

Configuration options

Use pulumi config set gcp:<option> or pass options to the constructor of new gcp.Provider.