Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Add KMS IAM binding #45

Merged
merged 4 commits into from
May 13, 2024
Merged

fix: Add KMS IAM binding #45

merged 4 commits into from
May 13, 2024

Conversation

dpappa
Copy link
Member

@dpappa dpappa commented May 10, 2024 •
edited
Loading

Even though we specify a new service account, we need to grant this one access to KMS.

Note: For CMEK-protected node boot disks and CMEK-protected attached disks, this Compute Engine service account is the account which requires permissions to do encryption using your Cloud KMS key. This is true even if you are using a custom service account on your nodes.

https://cloud.google.com/kubernetes-engine/docs/how-to/using-cmek

@dpappa dpappa requested a review from a team as a code owner May 10, 2024 17:48
@dpappa dpappa requested a review from mitch-hamm May 10, 2024 17:48
@dpappa dpappa self-assigned this May 10, 2024
maxsxu
maxsxu approved these changes May 12, 2024
View reviewed changes
Copy link
Member

@maxsxu maxsxu left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you help provide related docs link in PR description? so we can get better understand why need this fix

@dpappa dpappa merged commit ce695f1 into master May 13, 2024
3 checks passed
@dpappa dpappa deleted the dpappa/add-kms-sa branch May 13, 2024 15:24
@github-actions github-actions bot mentioned this pull request May 13, 2024
Merged
@github-actions github-actions bot mentioned this pull request Jun 7, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@maxsxu maxsxu maxsxu approved these changes

@mitch-hamm mitch-hamm Awaiting requested review from mitch-hamm

Assignees

@dpappa dpappa

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dpappa @maxsxu