@@ -28,7 +28,8 @@ In general, we would just need permissions to receive messages
28
28
(` roles/pubsub.subscriber ` ). However, in the case of the ` Channel ` , we would
29
29
also need the ability to publish messages (` roles/pubsub.publisher ` ).
30
30
31
- 1 . Create a new Service Account named ` cre-dataplane ` with the following command:
31
+ 1 . Create a new Service Account named ` cre-dataplane ` with the following
32
+ command:
32
33
33
34
``` shell
34
35
gcloud iam service-accounts create cre-dataplane
@@ -46,21 +47,24 @@ also need the ability to publish messages (`roles/pubsub.publisher`).
46
47
--member=serviceAccount:cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com \
47
48
--role roles/pubsub.editor
48
49
```
49
-
50
- *** Note:***
51
- If you are going to use metrics and tracing to track your resources,
52
- you also need ` roles/monitoring.metricWriter ` for metrics functionality:
53
- ``` shell
54
- gcloud projects add-iam-policy-binding $PROJECT_ID \
55
- --member=serviceAccount:cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com \
56
- --role roles/monitoring.metricWriter
57
- ```
50
+
51
+ ** _ Note:_ ** If you are going to use metrics and tracing to track your
52
+ resources, you also need ` roles/monitoring.metricWriter ` for metrics
53
+ functionality:
54
+
55
+ ``` shell
56
+ gcloud projects add-iam-policy-binding $PROJECT_ID \
57
+ --member=serviceAccount:cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com \
58
+ --role roles/monitoring.metricWriter
59
+ ```
60
+
58
61
and ` roles/cloudtrace.agent ` for tracing functionality:
59
- ` ` ` shell
60
- gcloud projects add-iam-policy-binding $PROJECT_ID \
61
- --member=serviceAccount:cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com \
62
- --role roles/cloudtrace.agent
63
- ` ` `
62
+
63
+ ``` shell
64
+ gcloud projects add-iam-policy-binding $PROJECT_ID \
65
+ --member=serviceAccount:cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com \
66
+ --role roles/cloudtrace.agent
67
+ ```
64
68
65
69
## Configure the Authentication Mechanism for GCP (the Data Plane)
66
70
86
90
87
91
- ** _ Non-default scenario:_ **
88
92
89
- Using the Google Cloud Service Account ` cre-dataplane` you just created and using
93
+ Using the Google Cloud Service Account ` cre-dataplane ` you just created and
94
+ using
90
95
[ Option 1 (Recommended): Workload Identity] ( ../install/authentication-mechanisms-gcp.md/#option-1-recommended-workload-identity )
91
96
in
92
97
[ Authentication Mechanism for GCP] ( ../install/authentication-mechanisms-gcp.md )
@@ -97,9 +102,9 @@ Plane:
97
102
configuration in the Control Plane)
98
103
99
104
You will have a Kubernetes Service Account after the above configuration,
100
- which is bound to the Google Cloud Service Account ` cre-dataplane` . Remember to
101
- put this Kubernetes Service Account name as the ` spec.serviceAccountName` when
102
- you create resources in the
105
+ which is bound to the Google Cloud Service Account ` cre-dataplane ` . Remember
106
+ to put this Kubernetes Service Account name as the ` spec.serviceAccountName `
107
+ when you create resources in the
103
108
[ example] ( https://github.com/google/knative-gcp/tree/master/docs/examples ) .
104
109
105
110
- ** _ Default scenario:_ **
@@ -136,18 +141,18 @@ Plane:
136
141
default-cre-dataplane: cre-dataplane@$PROJECT_ID .iam.gserviceaccount.com
137
142
```
138
143
139
- Here, `default-cre-dataplane` refers to a Kubernetes Service Account bound to the
140
- Google Cloud Service Account `cre-dataplane`. Remember to put this Kubernetes
141
- Service Account name as the `spec.serviceAccountName` when you create
142
- resources in the
144
+ Here, ` default-cre-dataplane ` refers to a Kubernetes Service Account bound to
145
+ the Google Cloud Service Account ` cre-dataplane ` . Remember to put this
146
+ Kubernetes Service Account name as the ` spec.serviceAccountName ` when you
147
+ create resources in the
143
148
[ example] ( https://github.com/google/knative-gcp/tree/master/docs/examples ) .
144
149
145
150
Kubernetes Service Account ` default-cre-dataplane ` doesn't need to exist in a
146
151
specific namespace. Once it is set in the ConfigMap ` config-gcp-auth ` , the
147
152
Control Plane will create it for you and configure the corresponding Workload
148
153
Identity relationship between the Kubernetes Service Account
149
- ` default-cre-dataplane` and the Google Cloud Service Account ` cre-dataplane` when
150
- you create resources using the Kubernetes Service Account
154
+ ` default-cre-dataplane ` and the Google Cloud Service Account ` cre-dataplane `
155
+ when you create resources using the Kubernetes Service Account
151
156
` default-cre-dataplane ` .
152
157
153
158
A ` Condition ` ` WorkloadIdentityConfigured ` will show up under resources'
0 commit comments