Google Cloud integration¶
Connect DXDT to your Google Cloud project(s) for read-only SRE and FinOps visibility. DXDT uses a dedicated service account it manages for you — you simply grant that account a read-only role on your project. DXDT only runs read-only gcloud/kubectl calls.
| Setup time | ~10 minutes |
| Difficulty | Moderate |
Access required: GCP IAM permission to grant a role on your project(s) (Project IAM Admin or Owner)
Prerequisites¶
- A Google Cloud project (or several) you want DXDT to observe.
- Permission to add an IAM policy binding on those projects.
- Your GCP project ID(s).
Setup¶
1. Start the install to get your DXDT service account¶
Open the Google Cloud plugin and begin the install. DXDT fills in the Service Account Email field for you automatically — this is the identity DXDT will use to read your project. Copy that email address.
Note
The Service Account Email is read-only and populated by DXDT. You do not type it in — you grant it access on your side.
2. Grant the DXDT service account read-only access¶
In the Google Cloud Console → IAM & Admin → IAM → Grant access, add the DXDT service-account email as a principal and assign the basic Viewer role (roles/viewer), or a narrower predefined read-only role.
- Principal: the Service Account Email DXDT showed you at install.
- Role: Viewer (
roles/viewer) — read-only. - For GKE/
kubectlread access, also add Kubernetes Engine Viewer (roles/container.viewer). - Repeat on every project you want DXDT to observe.
Note
Grant read-only roles only — never Editor, Owner, or any write/admin role. DXDT never modifies your cloud resources.
3. Set your default project in DXDT¶
Back in the plugin Configuration tab, enter your Default GCP Project (gcp_project_id) so DXDT targets the right project when running commands. Save to finish.
Configuration fields¶
| Field | Where to find it |
|---|---|
Service Account Email (sa_email) |
Auto-populated by DXDT at install (read-only). Copy it and grant it the Viewer role on your GCP project — do not edit this field. |
Default GCP Project (gcp_project_id) |
The project ID you granted the DXDT service account Viewer on, e.g. my-gcp-project-id (from the Console project selector). |
Verify the connection¶
After granting the role and saving, open the plugin's Live Status panel. A healthy connection lists the accessible project(s) at a read-only permission level. If it shows no projects, the role grant hasn't propagated yet — wait a minute and refresh.
Security
DXDT runs only read-only gcloud/kubectl calls using its own managed service account — no key files are stored on your side. Grant that account the least-privilege read-only role (Viewer) only; never Editor, Owner, or write/admin.
Troubleshooting¶
Live Status shows no accessible projects
The DXDT service account hasn't been granted a role on your project, or the grant hasn't propagated. Grant the DXDT Service Account Email the Viewer (roles/viewer) role in IAM & Admin → IAM, then wait ~1 minute and refresh.
Commands run against the wrong project
gcp_project_id is missing or incorrect. Enter the correct project ID in the Default GCP Project field.
GKE/kubectl reads fail while gcloud reads work
The service account has project Viewer but no Kubernetes read role. Also grant Kubernetes Engine Viewer (roles/container.viewer) on the project.
PERMISSION_DENIED on resources you expected to see
The granted role is narrower than Viewer for those APIs. Grant the basic Viewer role (roles/viewer), which covers read access across services.
Vendor documentation: https://cloud.google.com/iam/docs/granting-changing-revoking-access