Google Cloud Run and GKE

Vendor key: gcp_containers. In Arthur this source appears as Cloud Run and GKE. For how source fields and scan configs fit together, see Agent Discovery Integrations.

Lists every Cloud Run service, Cloud Run job and GKE workload in the GCP projects you name. Arthur reports a workload when one of its images is a known agent's, or when the service account it runs as called a Vertex AI model, as the project's Data Access audit log shows. Each agent names the service account the workload runs as, and lists the models that account called.

A GKE workload is a Deployment, StatefulSet, DaemonSet or CronJob, or a Job or Pod that no listed workload owns. System namespaces such as kube-system are left out. A pod without Workload Identity calls Google as its node pool's service account, which every pod on the node shares. Arthur labels that account node account, and a model call from it doesn't select the workload.

Before you start

Make sure your Arthur engine can reach each GKE cluster's control plane endpoint.
To find workloads by the models they call, turn on Data Access audit logs for the Vertex AI API (aiplatform.googleapis.com) in each project. Without them, Arthur selects workloads by image only.

For step-by-step instructions, see Enable Data Access audit logs in the Google Cloud documentation.

Source fields

Field	Required	Sensitive	Default	Description
`project_ids`	Yes	No		Comma-separated GCP project IDs, for example `my-project-123456`, not project names or numbers.
`regions`	No	No	Every Cloud Run region	Comma-separated regions to list Cloud Run jobs in, for example `us-central1,us-east4`. Leaving it empty takes one call per region, which is most of a scan's time.
`report_all_workloads`	No	No	`false`	`true` or `false`. Reports every workload with the service account it runs as, not only known agents' images and Vertex AI callers.
`service_account_key`	Yes*	Yes		The full JSON key of a GCP service account.

* Required unless your Arthur engine runs on GCP and has been configured to use its own Application Default Credentials (ARTHUR_ENGINE_GCP_CONTAINERS_ALLOW_ADC=true).

Scan config

Setting	Value
`query`	`""` to use Arthur's built-in agent catalog, or your own catalog YAML.
`query_language`	`none`
`lookback_window_seconds`	Every scan lists every workload. The window applies only to reading Vertex AI callers from the audit log. `0` reads the last 30 days.

Required permissions

roles/run.viewer on each project.
roles/container.viewer on each project. It also covers the Kubernetes reads, and it doesn't grant reading Secrets. No cluster RBAC binding is needed.
roles/logging.privateLogViewer on each project. Needed only to select workloads by the Vertex AI models their service accounts called.

If a cluster can't be reached, or an API or its audit log is off or refused in a project, the scan reads the rest and reports it as a denied scope. If the credential is refused (HTTP 401), or the scan can list nothing at all, the scan fails.