-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
beta-autopilot-private-cluster uses default service account #1488
Comments
@TrieBr Thanks for the report! I believe we initially did not add this due to the |
Hi @bharathkkb ! I tried fixing this in #1495 :) |
So does changing an Autopilot cluster's service account work for anyone yet? I've read a lot of threads now and I've put in a support ticket, but I keep seeing resolved and merged PRs, but with the latest 4.54 provider using cluster_autoscaling {
auto_provisioning_defaults {
### https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#service_account
service_account = var.service_account
}
} I get a successful plan, but the apply gives:
|
per google support :
I'm going to ask about why they have an |
1 similar comment
per google support :
I'm going to ask about why they have an |
TL;DR
Using the
beta-autopilot-private-cluster
uses a the default service account for the cluster created in GCP.gcloud container clusters describe --region northamerica-northeast2 cluster-main-test-29420926 | grep serviceAccount serviceAccount: default serviceAccount: default serviceAccount: default
Looking in cluster.tf I don't even see any reference to the service_account variable.
Expected behavior
The cluster should use the service account created by the module.
Observed behavior
Cluster uses default service account which is against GKE hardening guidelines.
Terraform Configuration
Terraform Version
Additional information
No response
The text was updated successfully, but these errors were encountered: