anouarchattouna
commented
5 years ago Hello, this is how I'm making the cloud storage provisioning working :
- Even though the sample applications only use a single Google Cloud service, a typical application may use a number of different Google Cloud services.
==> I first create a cloud-iam-service-account instance (a single service account) to manage the authentication with all Google Cloud services
apiVersion: servicecatalog.k8s.io/v1beta1 kind: ServiceInstance metadata: name: gcp-iam namespace: test-deploy spec: # This should match with a SERVICE EXTERNAL NAME # in the list of available services. clusterServiceClassExternalName: cloud-iam-service-account # This should match with a PLAN EXTERNAL NAME # in the list of available service plans. clusterServicePlanExternalName: beta parameters: # The service account name length must be between 6 and 30 characters accountId: google-cloud-services-sa displayName: "A service account used to authenticate with all Google Cloud services" - Then I create the binding for it
apiVersion: servicecatalog.k8s.io/v1beta1 kind: ServiceBinding metadata: name: gcp-iam-binding namespace: test-deploy spec: instanceRef: name: gcp-iam secretName: gcp-credentialsThis way you will have a kubernetes secret (gcp-credentials) having the gcp credentials (privateKeyData)
- Now let's move to the cloud-storage instance
apiVersion: servicecatalog.k8s.io/v1beta1 kind: ServiceInstance metadata: name: storage-instance namespace: test-deploy spec: clusterServiceClassExternalName: cloud-storage clusterServicePlanExternalName: beta parameters: location: europe-west1 bucketId: bucket-d4dfcc6f-2a3a-4554-9f0c-efc9b5290944 - And the binding : note the usage of the previously created service account serviceAccount: google-cloud-services-sa
apiVersion: servicecatalog.k8s.io/v1beta1 kind: ServiceBinding metadata: name: storage-binding namespace: test-deploy spec: instanceRef: name: storage-instance secretName: storage-credentials parameters: serviceAccount: google-cloud-services-sa roles: - roles/storage.objectCreator - roles/storage.objectViewer - roles/storage.admin - When everything is ready, you can deploy your application. 3 steps are required
volumes:
# Make the 'gcp-credentials' secret available as volume
# 'google-cloud-key'.
- name: google-cloud-key
secret:
secretName: gcp-credentials volumeMounts:
# Mount the 'google-cloud-key' volume into the container file
# system.
- name: google-cloud-key
mountPath: /var/secrets/google env:
# Pass the path to the private key JSON file from the mounted volume
# to the environment variable.
# the env var name must be GOOGLE_APPLICATION_CREDENTIALS
- name: "GOOGLE_APPLICATION_CREDENTIALS"
value: /var/secrets/google/privateKeyData
# The two environment variables below come from the 'storage-credentials'
# secret and, together, point at the Cloud Storage Bucket to use.
# choose the env var name that have been used inside the app
- name: "GOOGLE_CLOUD_STORAGE_PROJECT_ID"
valueFrom:
secretKeyRef:
# Use the projectId value from the 'storage-credentials' secret created
# as a result of binding to the Storage service instance.
name: storage-credentials
key: projectId
# choose the env var name that have been used inside the app
- name: "GOOGLE_CLOUD_STORAGE_BUCKET_ID"
valueFrom:
secretKeyRef:
# Use the topicId value from the 'storage-credentials' secret created
# as a result of binding to the Storage service instance.
name: storage-credentials
key: bucketId- This way, you can easily add a pub/sub instance for example and use the same service account with additional roles.
Hope it helps.
I've managed to get the GCP broker fully working in other projects, however in this instance while I can create
ServiceInstanceresources OK, attempting to create aServiceBindinggives forbidden errors (This was a brand new project/cluster)SC version:
0.1.1 darwin/amd64(Built from master) Kubectl version:(Gcloud config is set with the right project and zone corresponding to the Kubernetes master for good measure.
gcloud auth loginandgcloud auth application-default loginhave both been completed.)Reproduction steps:
Create admin role binding:
kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=<>@gmail.comsc check-- Passedsc install-- Passedsc add-gcp-broker:Create a ServiceInstance, for example the below:
Bucket is created in GCP,
svcat get instanceshows it in a Ready stateTry to create a ServiceBinding to that Instance, with the below:
The binding enters a Failed state, describing it shows the below message:
I can see the corresponding error in the API metrics for
google.iam.admin.v1.IAM.GetServiceAccountbut it's not clear to me which permissions are actually incorrectI can see similar errors in the google oauth pod as per #213, unsure if related