Skip to content

Commit 7123efe

Browse files
BrendanGallowaymoshloop
BrendanGalloway
and
moshloop
authored
docs: update gke install guide (#388)
* docs: update gke install guide * Update mission-control/docs/installation/_gke_iam.mdx --------- Co-authored-by: Moshe Immerman <[email protected]>
1 parent 3d1c3f1 commit 7123efe

File tree

1 file changed

+52
-37
lines changed

1 file changed

+52
-37
lines changed

‎mission-control/docs/installation/_gke_iam.mdx‎

Lines changed: 52 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
import Domain from '@site/docs/partials/_domain.mdx'
22

3-
## Create an IAM Role
3+
## Choosing an IAM Role
44

5-
Depending on how you want to use Mission Control you need to create an IAM role for mission control to use:
5+
Depending on usecase, Mission Control can be associated with the following GCP IAM roles:
66

7-
| Use Case | Role |
7+
| Use Case | Role Name |
88
| -------------------------------------------- | ---------------|
99
| Read Only Scraping | `roles/viewer` |
1010
| Playbooks to create and update GCP Resources | `roles/editor` |
@@ -15,48 +15,41 @@ Depending on how you want to use Mission Control you need to create an IAM role
1515
<TabItem label="Workload Identity" value="Workload Identity">
1616

1717
<Tabs>
18-
<TabItem label="Bind policy to service account" value="federation">
18+
<TabItem label="Assign Role to Kubernetes service account principal" value="federation">
1919

2020
You can also refer the official docs for [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
2121

2222
1. Enable workload identity
2323
```bash
2424
# The name of the GKE cluster mission control is being deployed to
2525
export CLUSTER=<CLUSTER_NAME>
26-
# the default namespace the mission-control helm chart uses
27-
export NAMESPACE=mission-control
2826
# GCP Project ID
2927
export PROJECT_ID=gcp-project-id
3028
# GCP Project Number
3129
export PROJECT_NUMBER=gcp-project-number
3230
# Location of GKE Cluster
3331
LOCATION=us-east1
32+
# the default namespace the mission-control helm chart uses
33+
export NAMESPACE=mission-control
3434

35+
# enable workload identity in the host cluster
3536
gcloud container clusters update $CLUSTER \
3637
--location=$LOCATION \
37-
--workload-pool=PROJECT_ID.svc.id.goog
38+
--workload-pool=$PROJECT_ID.svc.id.goog
3839
```
3940
<p/>
4041

4142
2. Bind IAM Policy
4243

43-
The `$KSA_NAME` refers to the Kubernetes service account name. In our case, we need to bind to 3 service accounts: `mission-control-sa`, `canary-checker-sa` and `config-db-sa`
44+
`$KSA_NAME` refers to the Kubernetes service account name. In our case, we need to bind to 3 service accounts: `mission-control-sa`, `canary-checker-sa` and `config-db-sa`
4445

4546
```bash
46-
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
47-
--role=$ROLE \
48-
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/mission-control-sa \
49-
--condition=None
50-
51-
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
52-
--role=$ROLE \
53-
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/canary-checker-sa \
54-
--condition=None
55-
56-
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
57-
--role=$ROLE \
58-
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/config-db-sa \
59-
--condition=None
47+
for KSA_NAME in "mission-control-sa" "canary-checker-sa" "config-db-sa"; do
48+
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
49+
--role=$ROLE_NAME \
50+
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/$KSA_NAME \
51+
--condition=None
52+
done
6053
```
6154
<p/>
6255

@@ -69,53 +62,75 @@ Depending on how you want to use Mission Control you need to create an IAM role
6962
</TabItem>
7063

7164

72-
<TabItem label="Allow ServiceAccount to impresonate IAM Role" value="impersonate">
65+
<TabItem label="Allow Kubernetes service account to impersonate GCP service account" value="impersonate">
7366

7467
You can also refer the official docs: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
75-
1. Create a new IAM ServiceAccount
68+
1. Enable workload identity in the host cluster
69+
```bash
70+
# The name of the GKE cluster mission control is being deployed to
71+
export CLUSTER=<CLUSTER_NAME>
72+
# GCP Project ID
73+
export PROJECT_ID=gcp-project-id
74+
# Location of GKE Cluster
75+
LOCATION=us-east1
76+
# the default namespace the mission-control helm chart uses
77+
export NAMESPACE=mission-control
78+
# IAM service account name
79+
export IAM_SA_NAME=mission-control
80+
81+
# enable workload identity in the host cluster
82+
gcloud container clusters update $CLUSTER \
83+
--location=$LOCATION \
84+
--workload-pool=$PROJECT_ID.svc.id.goog
85+
```
86+
<p/>
87+
88+
2. Create a new IAM ServiceAccount
7689

7790
```bash
7891
gcloud iam service-accounts create $IAM_SA_NAME \
79-
--project=$IAM_SA_PROJECT_ID
92+
--project=$PROJECT_ID
8093
```
8194
<p/>
8295

83-
2. Bind GCP Service Account to IAM Role
96+
3. Bind GCP Service Account to IAM Role
8497

8598
```bash
86-
gcloud projects add-iam-policy-binding $IAM_SA_PROJECT_ID \
87-
--member "serviceAccount:$IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com" \
99+
gcloud projects add-iam-policy-binding $PROJECT_ID \
100+
--member "serviceAccount:$IAM_SA_NAME@PROJECT_ID.iam.gserviceaccount.com" \
88101
--role "$ROLE_NAME"
89102
```
90-
3. Create an IAM allow policy that gives the Kubernetes ServiceAccount access to impersonate the IAM service account:
103+
4. Create an IAM allow policy that gives the Kubernetes service account access to impersonate the IAM service account:
91104

92105
The `$KSA_NAME` refers to the Kubernetes service account name. In our case, we need to bind to 3 service accounts: `mission-control`, `canary-checker` and `config-db`
93106

94107
```bash
95-
gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com \
96-
--role roles/iam.workloadIdentityUser \
97-
--member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/$KSA_NAME]"
108+
for KSA_NAME in "mission-control-sa" "canary-checker-sa" "config-db-sa"; do
109+
gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@PROJECT_ID.iam.gserviceaccount.com \
110+
--role roles/iam.workloadIdentityUser \
111+
--member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/$KSA_NAME]"
112+
done
98113
```
99114

100-
4. Install Mission Control
115+
5. Install Mission Control
101116
<Helm chart={props.chart} values={props.values} valueFile={`
102117
serviceAccount:
103118
annotations:
104-
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
119+
iam.gke.io/gcp-service-account=IAM_SA_NAME@PROJECT_ID.iam.gserviceaccount.com
105120
106121
canary-checker:
107122
serviceAccount:
108123
annotations:
109-
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
124+
iam.gke.io/gcp-service-account=IAM_SA_NAME@PROJECT_ID.iam.gserviceaccount.com
110125
111126
config-db:
112127
serviceAccount:
113128
annotations:
114-
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
129+
iam.gke.io/gcp-service-account=IAM_SA_NAME@PROJECT_ID.iam.gserviceaccount.com
115130
`}/>
116131

117132

118-
5. <Domain/>
133+
6. <Domain/>
119134
</TabItem>
120135
</Tabs>
121136

0 commit comments

Comments
 (0)