Configure Workload Manager to use with VPC Service Controls

This page describes how to configure ingress and egress rules to run Workload Manager evaluations in projects that are protected with VPC Service Controls.

When you run Workload Manager evaluations in projects that are protected by VPC Service Controls, you must configure ingress and egress rules to the service account attached to the Compute Engine instance that runs your Agent for Compute Workloads. These rules let the service account access the required APIs within the VPC Service Controls perimeter. If you don't configure these rules, the agent cannot send data to Workload Manager, and your evaluations fail.

For more information, see Overview of VPC Service Controls.

Before you begin

Before setting up VPC Service Controls for your project, do the following:

1. Set up a VPC Service Controls perimeter.
2. Identify the service account attached to the Compute Engine instance that runs your Agent for Compute Workloads. For example, [e-mail]. You can find this on the VM instance details page in the Google Cloud console.
3. Verify that the service account has the required roles. For example, see Required roles for the agent and SAP workloads.

Required roles

To get the permissions that you need to configure Workload Manager for use within VPC Service Controls perimeters, ask your administrator to grant you the Access Context Manager Editor (roles/accesscontextmanager.policyEditor) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create ingress and egress rules for a service perimeter

To let the Agent for Compute Workloads communicate with required services, you must configure ingress and egress rules in your VPC Service Controls perimeter.

Note: Egress rules are required only if the target project (where your workload runs) is different from the consumer project (where you run evaluations). For more information about these project types, see Workload Manager projects. If your setup involves cross-project communication, you must configure egress rules to allow the required traffic.

For more information about how to create ingress rules, see Configuring ingress and egress policies.

Console

1. In the Google Cloud console, go to the VPC Service Controls page.

   Go to the VPC Service Controls

2. Select your project.

3. Click the name of the service perimeter, and then click Edit.

4. Click Ingress policy or Egress policy.

5. Click Add an ingress rule.

6. In the From section, specify the identity for the service agent:

   1. For Identities, select Select identities & groups.
   2. Click Add identities.
   3. Enter the email address of the agent service account. For example, [e-mail].

7. In the To section, specify the allowed operations:

   1. For Resources, select All projects.
   2. For Operations, select Select operations.
   3. Click Add operations, and then add the following services with All methods selected:
      • compute.googleapis.com
      • workloadmanager.googleapis.com
      • secretmanager.googleapis.com

8. Click Done, and then click Save.

gcloud

To add the ingress rule, create a YAML file that contains the ingress rule and use the gcloud access-context-manager perimeters update command with the --set-ingress-policies flag.

1. Create an ingress policy YAML file named ingress_policy.yaml with the following contents:

   - ingressFrom:
       identities:
        - serviceAccount:SERVICE_ACCOUNT_EMAIL
       sources:
       - accessLevel: '*'
     ingressTo:
       operations:
       - serviceName: compute.googleapis.com
         methodSelectors:
         - method: "*"
       - serviceName: workloadmanager.googleapis.com
         methodSelectors:
         - method: "*"
       - serviceName: secretmanager.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - "*"
   

   Replace SERVICE_ACCOUNT_EMAIL with the email address of the service account attached to the Compute Engine instance that runs the Agent for Compute Workloads.

2. Add the ingress policy to the perimeter:

      gcloud access-context-manager perimeters update PERIMETER_NAME \
        --set-ingress-policies=ingress_policy.yaml
   

   Replace PERIMETER_NAME with the name of your service perimeter. For example, accessPolicies/1234567890/servicePerimeters/example_perimeter.

Troubleshoot VPC Service Controls violations

To view VPC Service Controls violations in your project and troubleshoot issues, use Logs Explorer.

For more information, see Troubleshooting VPC Service Controls.

What's next

• Create and run an evaluation