Google Drive Connector Setup

Installing the Google Drive Connector

Note: For this step, your deployment engineer will be required.

The Gmail and Google Drive connectors depend on a shared Google Workspace configuration section. Google Workspace requires three properties to be set during configuration:

• ProjectID must reference the project created in GCP. The id, not the name, must be specified.
• ServiceUser is currently a reference to a super user or administrator within your organization. For example, the primary IT email. This may change in the future.
• ServiceAccountKey is the base64-encoded string as obtained during initial install of the Google source.

To obtain the service account key, your deployment engineer will run the following Terraform command:

terraform output -raw google_connector_service_account_key

And optionally:

• Domains is a comma-delimited list of domains applicable to this deployment.
• Parallelism is an optimization to increase the concurrency with respect to indexing Google data. Default is 32, so if set, should be higher than this value.

Once the Google source is configured, the Google Drive and Gmail sources can be configured with the same values.

Required Configuration Values

Enter these values in the Atolio Admin console (v4.24 and later), or send them to Atolio Support (your Deployment Engineer).

This connector uses the GCP Project ID and Google Workspace admin email listed in the Google connector’s Required Configuration Values. In addition:

Provided by Atolio: the connector service account key (service_account_key), generated from Terraform output by your Deployment Engineer, used for authenticating the connector to Google Workspace.

Configuration Example

Add this block to connector-values.yaml. Replace each <PLACEHOLDER> with the matching value from the table above, and remove any line marked “Only if” that doesn’t apply.

connectors:
  google:
    default:
      gdrive:
        connector: google
        instance: default
        source: gdrive
        common:
          enabled: true
          identity-provider: false
        secrets:
          service_account_key:
            value: "<SERVICE_ACCOUNT_KEY_FROM_TERRAFORM>"
        configuration:
          project-id: "<GCP_PROJECT_ID>"
          service-user: "<WORKSPACE_ADMIN_EMAIL>"
          domains:                   # Only if you limit indexing to some domains
            - "<ALLOWED_DOMAIN>"

Configuration

Source configuration can be applied in two ways:

Recommended (v4.24+): Use the Admin console to configure this source through the browser. You can paste the YAML from the Configuration Example directly into the Admin console.

Alternative: Use atolioctl via the command line (for Deployment Engineers). If using atolioctl, follow Configuring Sources first. The commands below also need an API token in JWT_TOKEN and the address the feeder server’s gRPC endpoint, both described next.

Edit and Apply the Configuration

Source configuration is stored as a single document that covers every configured connector. The supported workflow is to export the current configuration, edit it, then import it back. Always start from a fresh export so you do not overwrite a change made elsewhere.

Export the current configuration to a local file:

atolioctl configure export --jwt-token-sdk ${JWT_TOKEN} --feeder-address :8889 lumen-connectors.yaml

Add the entry from the Configuration Example alongside the connectors already in the file, keeping the existing entries in place.

Exported entries also carry a rendezvous-completed flag and a status block reporting each source’s current state and last validation result. Those fields are managed by Atolio. Leave them untouched on existing entries, and omit them when adding a new entry by hand.

Import the edited file to write the configuration back into the stack:

atolioctl configure import lumen-connectors.yaml --jwt-token-sdk ${JWT_TOKEN} --feeder-address :8889

Import writes the configuration into the stack after checking that the YAML is well formed. It does not contact Google. The connector validates the credentials and connection itself when it starts and picks up the configuration, and it reads users after that. If something is wrong, the source reports as misconfigured and the connector pod logs the error. See Troubleshooting for the specific messages.

Sharing a file with Target Audiences

A Google Drive file can be shared with a target audience, which is a group of people your Workspace administrator defines. Anyone in that audience can access the original file.

See Target Audiences to configure target audiences in Google IdP connector.

Document Permissions

Atolio mirrors each file’s Drive sharing settings when deciding who can find it in search. Drive’s “Can find in search results” toggle (shown when you share to your whole domain) is respected: a file that is not discoverable in Drive is not discoverable in Atolio.

A file whose only sharing setting is link-based has no directly shared users or groups, so it is indexed but returned to no one. Share it with specific people, or turn on “Can find in search results”, to make it discoverable.

Configuration Schema

In the exported file, every source lives at connectors.<connector>.<instance>.<source>, so the Google Drive source sits at connectors.google.default.gdrive.

GoogleDriveSourceConfiguration

Google Drive connector configuration.

Common

Common settings shared across all connectors.

Secrets

Sensitive configuration values for authentication.

SecretValue

A reference to a secret value.

GDriveConfiguration

Google Drive-specific connector configuration.