Disclosure: I work in GCP engineering, thoughts are my own and not Google's, etc.

My impression is that Anthos is probably not what you need if your use case is deployment of a managed product into customer GCP projects (or AWS accounts).

Instead, copy the P4SA architecture that GCP uses for managing its own services in your project. Create one service account per customer, and have the customer grant that service account whatever permissions your control plane needs to manage the resources deployed into the customer project.

You can package those permissions into a Role for easier use.

You can see how this works by looking at Google's existing P4SA permissions in one of your cloud projects. They show up in your cloud IAM console if you remove the filter for "Google-Managed Grants".

the goal was really to stand up stuff via Config Sync / Config Controller, then hook it into Private Service Connect endpoints which are exposed to the customer's cloud. as far as I know, that's how Elastic and similar companies do it (at least from the developer's angle, we get a provisioned GCP project and/or PSC endpoint).

you're right that we don't need Service Mesh, perhaps most of the Anthos suite, but Config Management from Git is pretty slick (if it only worked as advertised).

anyway this is good guidance and i will see if i can wiggle out of anthos, but that was our intent/understanding in trying it.

Google Support is not easy.

But I wonder if it is because Anthos is not right for your company, it is primarily from my understanding companies with big VMWare setups and the price for Anthos is heavy.

Why will you want to use Anthos? I was at the Google Cloud Next where it was announced and was also excited, but asked a lot about from my closer Google relations and it was not something for the public was my learnings. Very complicated, heavy and expensive.

we want anthos multi-cloud K8S so that we can launch private cloud clusters within customers VPCs. we thought anthos was a good way to do this, maybe.

looking at the market for multi-cloud k8s, anthos seems like a leader. we were using it with GKE Autopilot and similar tech with less overhead than, say, a VMware fleet.

just using Anthos Config Sync and perhaps Service Mesh isn't that heavy, and didn't require much change from our existing k8s configs.

that being said, the platform seems to fall short in other ways (cost, support, docs).

Another vote for the awfulness of GCP as a business “partner”. I’m hardly an Amazon fan but the difference is incredible. Ditto for Microsoft. Google doesn’t give a rat’s rectum about most of their customers.

As someone who uses GCP and AWS, I would be weary of putting your eggs on one specific product from Google. THey historically always complicate things and will discontinue / change things on the fly that's not in a users best interest generally.

GCP support is horrible. Go to AWS

that's what we're considering, but we want to support private cloud deployments :( how are elastic et al. able to deploy into VPCs so seamlessly? surely there is a product that does this

anyway thank you for that review, noted