Istio GCP template, (incl. bookinfo) doesn't add GCR read permissions to the service account created.

[jwhitlark]

Is this a BUG or FEATURE REQUEST?:

Did you review https://istio.io/help/ and existing issues to identify if this is already solved or being worked on?: Y

Bug: Y

What Version of Istio and Kubernetes are you using, where did you get Istio from, Installation details Created from https://raw.githubusercontent.com/istio/istio/master/install/gcp/deployment_manager/istio-cluster.jinja

istioctl version:
Version: release-0.8-20180520-18-17
GitRevision: 6dbbacac0b478017179480778637c9d8d781ac25
User: root@2e233c7ab40f
Hub: gcr.io/istio-release
GolangVersion: go1.10.1
BuildStatus: Clean

kubectl version: Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.7", GitCommit:"dd5e1a2978fd0b97d9b78e1564398aeea7e7fe92", GitTreeState:"clean", BuildDate:"2018-04-19T00:05:56Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"darwin/amd64"}

Is Istio Auth enabled or not ? Vanilla cluster from GCP jinja template, with all boxes checked.

What happened: Created a new cluster via the jinja template. Tried to run my own container, from GCR, in the same project. What you expected to happen: My container should have started. Following the tutorial comes to a bit of a rude end, if you can't try adding your own stuff to it to see how it plays together. Considering how hard it is to upgrade node pool permissions after the fact, I'd suggest either adding the permission to the template, or clearly saying that the bookinfo example can not be extended with custom, non-public images. How to reproduce it: On GCP, create a cluster from the template, then try to start an private image from GCR.

I spent a couple of hours digging around on this one. I believe the problem is the service account created in the template isn't given the necessary scope to pull from GCR. https://www.googleapis.com/auth/devstorage.read_only is required. When creating clusters from the cmd line or the UI, this permission is normally given.

Feature Request: N

Describe the feature:

[roeeyn]

Any news on this? I'd love to use the template.