How to configure Google Cloud Storage

This guide shows how to configure the GCS Integrator charm for OpenSearch backups.

Prepare the Google Cloud service account

In your Google Cloud project, create a service account and download its JSON key:

gcloud iam service-accounts create opensearch-backup
gcloud iam service-accounts keys create service-account.json \
    iam.gserviceaccount.com/opensearch-backup@<project-id>.iam.gserviceaccount.com

Grant the service account permission to list, read, and write objects in the bucket:

gcloud projects add-iam-policy-binding <project-id> \
    --member=serviceAccount:opensearch-backup@<project-id>.iam.gserviceaccount.com \
    --role=roles/storage.objectAdmin

Note

If the bucket does not exist yet, Charmed OpenSearch creates it during credential verification, which also requires permission to create buckets in the project (roles/storage.admin). Bucket names in Google Cloud Storage are globally unique.

Deploy and configure the integrator

Deploy the charm:

juju deploy gcs-integrator --channel 1/stable

Store the service-account key in a Juju secret and grant access to the integrator:

juju add-secret gcs-secret secret-key#file=service-account.json
juju grant-secret gcs-secret gcs-integrator

The #file= suffix tells Juju to read the value from the local file rather than from the command-line argument, keeping the private key out of your shell history.

Note

Charmed OpenSearch accepts service-account keys as plain JSON or base64-encoded JSON, so no decoding is required.

Point the integrator at the secret and configure the bucket:

juju config gcs-integrator \
    credentials=secret:<secret-id> \
    bucket=<bucket-name> \
    path=<path>

See the gcs-integrator configuration reference for all available options.

Integrate with Charmed OpenSearch

Connect the integrator to OpenSearch:

juju integrate gcs-integrator opensearch

Once the integration is established, juju status --relations shows the gcs-integrator application active with a gcs-credentials relation to opensearch. The OpenSearch application remains active.

Caution

Only one object storage integrator can be related at a time. Relating both the GCS integrator and the S3 or Azure Storage integrator places OpenSearch in a blocked state with the message Too many object storage relations. Only one is supported. until you remove the extra relations.

Next steps