Configure GKE node service accounts

Console

1. Go to the Welcome page:

   Go to Welcome

2. In the Project number field, click content_copy Copy to clipboard.
3. Go to the IAM page:

   Go to IAM

4. Click person_add Grant access.
5. In the New principals field, specify the following value:

   PROJECT_NUMBER-compute@developer.s3ns-system.iam.gserviceaccount.com

   Replace PROJECT_NUMBER with the project number that you copied.
6. In the Select a role menu, select the Kubernetes Engine Default Node Service Account role.
7. Click Save.

gcloud

1. Find your Cloud de Confiance project number:

   gcloud projects describe PROJECT_ID \
       --format="value(projectNumber)"

   Replace PROJECT_ID with your project ID.

   The output is similar to the following:

   12345678901
   

2. Grant the roles/container.defaultNodeServiceAccount role to the Compute Engine default service account:

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member="serviceAccount:PROJECT_NUMBER-compute@developer.s3ns-system.iam.gserviceaccount.com" \
       --role="roles/container.defaultNodeServiceAccount"

   Replace PROJECT_NUMBER with the project number from the previous step.

Console

1. Go to the Service accounts page:

   Go to Service accounts

2. Click add Create service account.
3. Enter a name for the service account. The Service account ID field automatically generates a unique ID for the service account based on the name.
4. Click Create and continue.
5. In the Select a role menu, select the Kubernetes Engine Default Node Service Account role.
6. Click Done.

gcloud

1. Create the service account:

   gcloud iam service-accounts create SA_NAME

   ReplaceSA_NAME with a unique name that identifies the service account.

2. Grant the Kubernetes Engine Default Node Service Account (roles/container.defaultNodeServiceAccount) role to the service account:

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member="serviceAccount:SA_NAME@PROJECT_ID.s3ns.iam.gserviceaccount.com" \
       --role=roles/container.defaultNodeServiceAccount

   Replace the following:

   • PROJECT_ID: your Cloud de Confiance project ID.
   • SA_NAME: the name of the service account that you created.

Terraform

Create an IAM service account and grant it the roles/container.defaultNodeServiceAccount role on the project:

resource "google_service_account" "default" {
  account_id   = "gke-node-service-account"
  display_name = "GKE node service account"
}

data "google_project" "project" {
}

resource "google_project_iam_member" "default" {
  project = data.google_project.project.project_id
  role    = "roles/container.defaultNodeServiceAccount"
  member  = "serviceAccount:${google_service_account.default.email}"
}

Config Connector

Note: This step requires Config Connector. Follow the installation instructions to install Config Connector on your cluster.

1. To create the service account, download the following resource as service-account.yaml:
   apiVersion: iam.cnrm.cloud.google.com/v1beta1
   kind: IAMServiceAccount
   metadata:
     name: [SA_NAME]
   spec:
     displayName: [DISPLAY_NAME]

   Replace the following:

   • [SA_NAME]: the name of the new service account.
   • [DISPLAY_NAME]: a display name for the service account.
2. Create the service account:

   kubectl apply -f service-account.yaml

3. Apply the roles/logging.logWriter role to the service account:
   1. Download the following resource as policy-logging.yaml.
      apiVersion: iam.cnrm.cloud.google.com/v1beta1
      kind: IAMPolicyMember
      metadata:
        name: policy-logging
      spec:
        member: serviceAccount:[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com
        role: roles/logging.logWriter
        resourceRef:
          kind: Project
          name: [PROJECT_ID]

      Replace the following:

      • [SA_NAME]: the name of the service account.
      • [PROJECT_ID]: your Cloud de Confiance project ID.
   2. Apply the role to the service account:

      kubectl apply -f policy-logging.yaml

4. Apply the roles/monitoring.metricWriter role to the service account:
   1. Download the following resource as policy-metrics-writer.yaml. Replace [SA_NAME] and [PROJECT_ID] with your own information.
      apiVersion: iam.cnrm.cloud.google.com/v1beta1
      kind: IAMPolicyMember
      metadata:
        name: policy-metrics-writer
      spec:
        member: serviceAccount:[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com
        role: roles/monitoring.metricWriter
        resourceRef:
          kind: Project
          name: [PROJECT_ID]

      Replace the following:

      • [SA_NAME]: the name of the service account.
      • [PROJECT_ID]: your Cloud de Confiance project ID.
   2. Apply the role to the service account:

      kubectl apply -f policy-metrics-writer.yaml

5. Apply the roles/monitoring.viewer role to the service account:
   1. Download the following resource as policy-monitoring.yaml.
      apiVersion: iam.cnrm.cloud.google.com/v1beta1
      kind: IAMPolicyMember
      metadata:
        name: policy-monitoring
      spec:
        member: serviceAccount:[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com
        role: roles/monitoring.viewer
        resourceRef:
          kind: Project
          name: [PROJECT_ID]

      Replace the following:

      • [SA_NAME]: the name of the service account.
      • [PROJECT_ID]: your Cloud de Confiance project ID.
   2. Apply the role to the service account:

      kubectl apply -f policy-monitoring.yaml

6. Apply the roles/autoscaling.metricsWriter role to the service account:
   1. Download the following resource as policy-autoscaling-metrics-writer.yaml.
      apiVersion: iam.cnrm.cloud.google.com/v1beta1
      kind: IAMPolicyMember
      metadata:
        name: policy-autoscaling-metrics-writer
      spec:
        member: serviceAccount:[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com
        role: roles/autoscaling.metricsWriter
        resourceRef:
          kind: Project
          name: [PROJECT_ID]

      Replace the following:

      • [SA_NAME]: the name of the service account.
      • [PROJECT_ID]: your Cloud de Confiance project ID.
   2. Apply the role to the service account:

      kubectl apply -f policy-autoscaling-metrics-writer.yaml