Connect Kubernetes service account to Google Cloud service account

Question

I'm developing a service running in Google Kubernetes Engine and I would like to use Google Cloud functionality from that service. I have created a service account in Google Cloud with all the necessary roles and I would like to use these roles from the pod running my service.

I have read this: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform and I was wondering if there is an easier way to "connect" the two kinds of service accounts ( defined in Kubernetes - defined in Google Cloud IAM )?

Thanks

Answer 1

I don't think there is any direct link. K8s service accounts are purely internal. You could try granting GIAM permissions to serviceaccount:name but that seems unlikely to work. More likely you would put the Google SA credentials in a secret and then write an RBAC policy giving your K8s SA read access to it.

Answer 2

Read that topic. You need to enbale Workload Identity on your cluster and than you can annotate kubernetes service account with IAM on google. https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity