Storage
Google Cloud Storage
Google Cloud Storage as object storage, with workload identity or a service account key.
Relic uses Application Default Credentials: GKE workload identity, the
attached service account, or GOOGLE_APPLICATION_CREDENTIALS.
Create the buckets
This command creates the artifacts bucket:
gcloud storage buckets create gs://example-relic-artifacts --location=europe-west3 --uniform-bucket-level-access
This command creates the temporary bucket:
gcloud storage buckets create gs://example-relic-temporary --location=europe-west3 --uniform-bucket-level-access
Leave versioning, soft delete and retention off on the artifacts bucket. This command turns soft delete off:
gcloud storage buckets update gs://example-relic-artifacts --clear-soft-delete
Save this one-day expiry rule as temporary-lifecycle.json:
{ "rule": [ { "action": { "type": "Delete" }, "condition": { "age": 1 } } ] }
This command applies it to the temporary bucket:
gcloud storage buckets update gs://example-relic-temporary --lifecycle-file=temporary-lifecycle.json
Service account
This command creates the service account relic:
gcloud iam service-accounts create relic
This command grants it access to the artifacts bucket:
gcloud storage buckets add-iam-policy-binding gs://example-relic-artifacts \
--member=serviceAccount:relic@<project>.iam.gserviceaccount.com --role=roles/storage.objectAdmin
This command grants access to the temporary bucket:
gcloud storage buckets add-iam-policy-binding gs://example-relic-temporary \
--member=serviceAccount:relic@<project>.iam.gserviceaccount.com --role=roles/storage.objectAdmin
On GKE, this command binds it to Relic's Kubernetes service account:
gcloud iam service-accounts add-iam-policy-binding relic@<project>.iam.gserviceaccount.com \
--role=roles/iam.workloadIdentityUser --member="serviceAccount:<project>.svc.id.goog[relic/relic]"
Settings
RELIC_OBJECT_STORAGE_TYPE=gcs
RELIC_OBJECT_STORAGE_ARTIFACTS_BUCKET=example-relic-artifacts
RELIC_OBJECT_STORAGE_TEMPORARY_BUCKET=example-relic-temporary
Helm, with workload identity:
seaweedfs:
enabled: false
serviceAccount:
annotations:
iam.gke.io/gcp-service-account: relic@<project>.iam.gserviceaccount.com
objectStorage:
type: gcs
defaultCredentials: true
artifactsBucket: example-relic-artifacts
temporaryBucket: example-relic-temporary
RELIC_OBJECT_STORAGE_ENDPOINT is only for an emulator.