Connector · GCP
Connect GCP
Service-account JSON + Resource Manager probe. No org admin, no key-rotation drama.
Permission scope
- roles/resourcemanager.projectIamPolicyViewer at the folder or project you govern.
- roles/storage.objectViewer on bucket-level resources Yarrow should enumerate.
- roles/secretmanager.secretAccessor on the secrets the sprinkles govern.
- roles/monitoring.viewer for resource health states during a reconcile loop.
- No Owner, no Editor, no *.projects.setIamPolicy. The service account key is the boundary.
What Yarrow asks for
These are the exact fields the live connector setup flow accepts for GCP. Anything you prepare here matches what you provide there.
| Field | Required | Note |
|---|---|---|
| label | required | Short workspace identifier. e.g. prod-gcp-project. |
| serviceAccountJson | required | The full key file GCP downloads. Must include client_email + private_key. Stored encrypted; only the probe result is ever shown. |
Steps
- 1
Create a service account in the project
IAM & Admin → Service accounts → Create. Name it "yarrow-operator". Bind the roles listed in Permission scope.
- 2
Create a JSON key
On the service account, Keys → Add key → Create new key → JSON. The browser downloads the file. Keep the entire JSON ready for the connector setup flow.
- 3
Open the workspace connector roster
/workspaces/<slug>/connectors → choose the GCP setup guide.
- 4
Prepare label + the JSON
The connector setup expects client_email and private_key fields in the JSON. Keep both intact so the service-account identity can be checked.
- 5
Return to the roster to review status
Once the connection is configured, Yarrow runs a Resource Manager project lookup using the supplied service account. A green card confirms the project is reachable via the bound role. A red card shows the IAM error verbatim.
Verify
After the GCP connection is configured, Yarrow runs a reachability probe: one minimal permissions call against the cloud, then stores the encrypted bundle under the chosen label. A green card confirms the probe passed. A red card shows the cloud's error verbatim — rotate keys, fix the IAM policy, and try again.
Failed probes still save the bundle so you can inspect and rotate without re-pasting.