Intelligent Health Checks - GCP

Gremlin can monitor your Google Cloud Platform (GCP) services using Intelligent Health Checks. Intelligent Health Checks monitor key metrics—request rate, throughput, and latency—for each of your GCP services during Scenarios and reliability tests. When enabled, Gremlin automatically creates Health Checks for the service and sets error thresholds using the service’s baseline performance profile.

‍

How it works

Gremlin integrates with the Google Cloud Monitoring API to fetch metrics in real time during test runs. Metrics can be captured for any part of the Google Cloud load balancing stack (ForwardingRules, UrlMaps, BackendServices, etc.), or directly from a Cloud Run service.

Gremlin accesses your Google Cloud Run project(s) via a service account that has read-only access to compute metrics. The account requires the following roles:

• roles/run.viewer
• roles/compute.viewer
• roles/monitoring.viewer

‍

Using a custom role

If you prefer to use a custom role, these are the minimum permissions required:

• compute.backendServices.get
• compute.backendServices.list
• compute.forwardingRules.get
• compute.forwardingRules.list
• compute.globalForwardingRules.get
• compute.networkEndpointGroups.list
• compute.regionBackendServices.get
• compute.regionUrlMaps.get
• compute.urlMaps.get
• compute.urlMaps.list
• monitoring.timeSeries.list
• run.services.get
• run.services.list

‍

Prerequisites

Gremlin requires several APIs to be enabled in your Google Cloud Project. If you’re integrating a new GCP project, please use the following links to ensure the relevant API is enabled for the project you want to integrate:

• Compute Admin API
• Cloud Run Admin API
• Monitoring API

‍

Permissions required

Your Google Cloud account will need to set up a service account throughout this setup. Make sure your user has (at least) the following permissions:

• roles/iam.serviceAccountCreator
• roles/iam.resourceManager.projectIamAdmin‍
• roles/iam.organizationRoleAdmin (or any other role with iam.roles.create)

‍

Authenticating Gremlin to GCP

To authenticate Gremlin:

1. Open the Gremlin web app and navigate to the service that you want to add Intelligent Health Checks to.
2. On the Service’s overview page, click Settings > Health Checks.
3. Under Intelligent Health Checks, click on the Type drop-down box, select GCP, and click + Add.
4. Select Add a new Project ID.
5. Log into the Google Cloud Console and navigate to the project containing the service(s) you want to monitor.
6. (Optional) If you want to create a custom role for Gremlin, follow the steps below. Otherwise, skip to step 7.
   
   1. Navigate to IAM & Admin and select Roles.
   2. Create a custom role with the following properties:
      
      1. Enter a Title, Description, and ID.
      2. Set the Role launch stage to General Availability.
      3. Click Add Permissions and select the permissions listed under Using a custom role.
      4. Click Create.
7. Navigate to IAM & Admin. Under Service Accounts, click create a new service account:
   
   1. Enter a service account name, such as gremlin-access. Optionally, enter a description and display name.
   2. Click Create and continue.
   3. In the Permissions tab, grant the following roles (or if you created a custom role in step 6, add that role):
      
      1. roles/run.viewer
      2. roles/compute.viewer
      3. roles/monitoring.viewer
   4. Under Principals with access to this service account, click Grant access and enter the following identifier: gremlinreliabilityanalyzer@gremlin-production.iam.gserviceaccount.com. Give this principal the Service Account Token Creator role.
   5. Click Save.
8. In the Gremlin web app, enter the email address of the service account.
9. Click Next.
10. Select the resource that you want to source metrics from, then click Next.
11. Click the checkbox next to Use GCP Intelligent Health Checks for this service, then click Save.

‍