Deckhouse Platform in Google Cloud
Before starting the installation, ensure you have the cloud provider quotas required to deploy your cluster.
You need to create a service account so that Deckhouse Platform can manage resources in the Google Cloud. The detailed instructions for creating a service account are available in the documentation. Below is a brief sequence of required actions (run them on the personal computer):
List of roles required:
roles/compute.admin
roles/iam.serviceAccountUser
roles/networkmanagement.admin
Export environment variables:
export PROJECT=sandbox
export SERVICE_ACCOUNT_NAME=deckhouse
export PROJECT=sandbox
export SERVICE_ACCOUNT_NAME=deckhouse
Select a project:
Create a service account:
gcloud iam service-accounts create $SERVICE_ACCOUNT_NAME
gcloud iam service-accounts create $SERVICE_ACCOUNT_NAME
Connect roles to the service account:
for role in roles/compute.admin roles/iam.serviceAccountUser roles/networkmanagement.admin; do \
gcloud projects add-iam-policy-binding ${PROJECT} --member=serviceAccount:${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com --role=${role}; done
for role in roles/compute.admin roles/iam.serviceAccountUser roles/networkmanagement.admin; do \
gcloud projects add-iam-policy-binding ${PROJECT} --member=serviceAccount:${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com --role=${role}; done
Verify service account roles:
gcloud projects get-iam-policy ${PROJECT} --flatten="bindings[].members" --format='table(bindings.role)' \
--filter="bindings.members:${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com"
gcloud projects get-iam-policy ${PROJECT} --flatten="bindings[].members" --format='table(bindings.role)' \
--filter="bindings.members:${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com"
Create a service account key:
gcloud iam service-accounts keys create --iam-account ${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com \
~/service-account-key-${PROJECT}-${SERVICE_ACCOUNT_NAME}.json
gcloud iam service-accounts keys create --iam-account ${SERVICE_ACCOUNT_NAME}@${PROJECT}.iam.gserviceaccount.com \
~/service-account-key-${PROJECT}-${SERVICE_ACCOUNT_NAME}.json