This module can be used to create and manage a GCP service account via opta, including permissioning and mapping to kubernetes service accounts.
Map to K8s Service Account
You can designate your GCP service account to allow role assumption from a service account in one of your gke clusters.
This is done via the
allowed_k8s_services field which takes as input a list of entries holding a
service_account_name field, corresponding to a given namespace+service_account to trust.
Warning: This trust will be for all clusters in the project, not just the current one of this environment.
For more information, you can read the official GCP docs here
This module can also be linked to other resources, like in the k8s-service. It will then have the desired permissions for said resources. Currently supported resources:
- GCS Bucket
- name: deployer type: gcp-service-account allowed_k8s_services: - namespace: "blah" service_account_name: "baloney"
||K8s service accounts that this role should have access to.||
||A list of extra IAM role policies not captured by Opta which you wish to give to your service.||
||A list of extra project-level iam roles to grant to the service account||
||An explicit name to give to your service account (warning– must be unique per account)||
||The id of the GCP service account created|
||The email of the GCP service account created|
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.