Allow to assign a service account to a GKE autopilot cluster

KaoruDev commented 2 years ago

Hello!

Vote on this issue by adding a 👍 reaction
If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

There doesn't appear to be a way to assign a service account to GKE nodes in autopilot mode although gcloud api does support it. The TF module however does not yet see https://github.com/hashicorp/terraform-provider-google/issues/9505

Here's the resolved issue on GCP's side: https://issuetracker.google.com/issues/186511728

Affected area/feature

GKE autopilot cluster

danielrbradley commented 2 years ago

From a quick check of the api specifications I couldn't see this available yet. As soon as it's published it should be available in the subsequent release.

tedchang77 commented 2 years ago

Any update on when this will be available? We are blocked on this as we need to access artifact registry in a different project.

KaoruDev commented 2 years ago

@tedchang77 If you give your gke-project's (the project hosting your GKE cluster) gcp compute service account access to the registry that should fix your issue.

In other words, give <project-with-gke-number>-compute@developer.gserviceaccount.com access to the artifact registry.

https://cloud.google.com/iam/docs/service-accounts#default

pulumi / pulumi-google-native