Allow to assign a service account to a GKE autopilot cluster

[KaoruDev]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

There doesn't appear to be a way to assign a service account to GKE nodes in autopilot mode although gcloud api does support it. The TF module however does not yet see hashicorp/terraform-provider-google#9505

Here's the resolved issue on GCP's side: https://issuetracker.google.com/issues/186511728

Affected area/feature

GKE autopilot cluster

[danielrbradley]

From a quick check of the api specifications I couldn't see this available yet. As soon as it's published it should be available in the subsequent release.

[tedchang77]

Any update on when this will be available? We are blocked on this as we need to access artifact registry in a different project.

[KaoruDev]

@tedchang77 If you give your gke-project's (the project hosting your GKE cluster) gcp compute service account access to the registry that should fix your issue.

In other words, give <project-with-gke-number>-compute@developer.gserviceaccount.com access to the artifact registry.

https://cloud.google.com/iam/docs/service-accounts#default