Create least privilege default service account #1416
Labels
enhancement
New feature or request
good first issue
Good for newcomers
P2
high priority issues
triaged
Scoped and ready for work
TL;DR
safer-cluster previously used GKE's recommendations for a minimal service account, but a new "Kubernetes Engine Node Service Account" has since been introduced and it may be preferable to use that instead
Terraform Resources
No response
Detailed design
Change the created service account to use the single roles/container.nodeServiceAccount role, rather than the four roles we are currently using (roles/logging.logWriter, roles/monitoring.metricWriter, roles/monitoring.viewer, roles/stackdriver.resourceMetadata.writer):
terraform-google-kubernetes-engine/modules/beta-private-cluster-update-variant/sa.tf
Lines 46 to 71 in 92d7c67
Additional information
Changing the defaults would technically be a breaking change, but breaking changes that improve security are usually excluded from compatibility guidelines. If users want to preserve the existing behavior, they can grant the service account necessary permissions. Most clusters should not need to use the node service account for anything, instead relying on workload identity for individual service-scoped permissions
The text was updated successfully, but these errors were encountered: