-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Adding extra permissions to the cluster's default service account #1943
feat: Adding extra permissions to the cluster's default service account #1943
Conversation
ba1bbe8
to
f985310
Compare
/gcbrun |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution @jullianow!
From the Integration Test:
Error: Reference to undeclared resource
on ../../../sa.tf line 57, in resource "google_project_iam_member" "cluster_service_account-metric_writer":
57: project = google_project_iam_member.cluster_service_account-log_writer[0].project
A managed resource "google_project_iam_member"
"cluster_service_account-log_writer" has not been declared in
module.example.module.gke.
Error: Reference to undeclared resource
on ../../../sa.tf line 64, in resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer":
64: project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project
A managed resource "google_project_iam_member"
"cluster_service_account-monitoring_viewer" has not been declared in
module.example.module.gke.}
8cb45e7
to
0155eaf
Compare
Signed-off-by: Julliano Goncalves <jullianow@gmail.com>
Signed-off-by: Julliano Goncalves <jullianow@gmail.com>
0155eaf
to
d99f8fa
Compare
@apeabody Adjusted. |
/gcbrun |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution @jullianow!
Confirmed description of these roles here: https://cloud.google.com/iam/docs/understanding-roles
I think the correct approach is to use Workload Identity for the GMP and the HPA Adapter. Please read how to set up the identity in step 4 of the docs. Nodes should have as little permissions as possible. |
Hm I just saw this change when trying to upgrade to Wouldn't it have been sufficient for solving your problem to just assign Also I don't see at all why it needs |
…nt (terraform-google-modules#1943) Signed-off-by: Julliano Goncalves <jullianow@gmail.com>
Recently, I started testing a component suggested by Google to consume GMP metrics (Google Manager Prometheus).
Ref: https://cloud.google.com/stackdriver/docs/managed-prometheus/hpa
This component, until the version of this module in 28.0.0, worked normally, and after I updated to version 30.2.0, it stopped working.
Trying to understand better, I realized that one of the main changes in the module version was due to this PR.
What happens is that the role
roles/container.nodeServiceAccount
does not have all the necessary permissions for the Adapter to work, especially themonitoring.metricDescriptors.get
permission.This caused me to get this error when I updated the service account permissions.
Therefore, the objective of this change is to revert at least two roles that were removed (roles/monitoring.metricWriter and roles/stackdriver.resourceMetadata.writer) so that the GMP Adapter works normally again.