Create and use non-default service accounts in GKE

[annuay-google]

Approach

• Allow user to create new SA from blueprint and use the same in cluster and node pool
• Do not fetch default SA from a data source, instead construct using project id
• User can pass a pre existing SA with appropriate permissions. Checking for the right permissions is not in the scope of this PR and will be covered in a follow up PR

Testing

• Deployed hpc-gke.yaml with non default new SA and verified provisioning and destruction, and that SA with appropriate roles was created. Verified all node pools used the SA specified
• Deployed hpc-gke.yaml with non default pre-existing SA and verified provisioning and destruction, and that no new SA was created. Verified all node pools used the SA specified
• Deployed hpc-gke.yaml with no SA passed. Verified default SA was used in all node pools
• Verified all GKE integration tests passed
• Verified logs are pushed from k8s pods and visible in GCP logging from Pantheon

User Guide

Create and use new SA (one per node pool) - recommended

Check updated example blueprints

Use pre-existing SA

  - id: gke_cluster
    source: modules/scheduler/gke-cluster
    use: [network1]
    settings:
      enable_private_endpoint: false  # Allows for access from authorized public IPs
      service_account_email: ml-01-gke-sa@ns-playground-a.iam.gserviceaccount.com
    outputs: [instructions]

  - id: compute_pool
    source: modules/compute/gke-node-pool
    use: [gke_cluster]
    settings:
      service_account_email: ml-01-gke-sa@ns-playground-a.iam.gserviceaccount.com

Use default SA

  - id: gke_cluster
    source: modules/scheduler/gke-cluster
    use: [network1]
    settings:
      enable_private_endpoint: false  # Allows for access from authorized public IPs
    outputs: [instructions]

  - id: compute_pool
    source: modules/compute/gke-node-pool
    use: [gke_cluster]

Submission Checklist

NOTE: Community submissions can take up to 2 weeks to be reviewed.

Please take the following actions before submitting this pull request.

• Fork your PR branch from the Toolkit "develop" branch (not main)
• Test all changes with pre-commit in a local branch #
• Confirm that "make tests" passes all tests
• Add or modify unit tests to cover code changes
• Ensure that unit test coverage remains above 80%
• Update all applicable documentation
• Follow Cluster Toolkit Contribution guidelines #