GCP: using image from one account's Artifact Registry on other account

Viewed 64

Hello and wish you a great time! I've got following terraform service account deffinition:

resource "google_service_account" "gke_service_account" {
  project = var.context
  account_id   = var.gke_account_name
  display_name = var.gke_account_description
}

That I use in GCP kubernetes node pool:


resource "google_container_node_pool" "gke_node_pool" {
  name       = "${var.context}-gke-node"
  location   = var.region
  project    = var.context
  cluster    = google_container_cluster.gke_cluster.name

  management {
    auto_repair = "true"
    auto_upgrade = "true"
  }

  autoscaling {
    min_node_count = var.gke_min_node_count
    max_node_count = var.gke_max_node_count
  }
  initial_node_count = var.gke_min_node_count

  node_config {
    machine_type = var.gke_machine_type
    service_account = google_service_account.gke_service_account.email

    metadata = {
      disable-legacy-endpoints = "true"
    }

    # Needed for correctly functioning cluster, see
    # https://www.terraform.io/docs/providers/google/r/container_cluster.html#oauth_scopes
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/servicecontrol",
      "https://www.googleapis.com/auth/cloud-platform"
    ]
  }
}

However the current solution requires the prod and dev envs to be on various GCP accounts but use the same image from prod artifact registry. As for now I have JSON key file for service account in prod having access to it's registry. Maybe there's a pretty way to use the json file as a second service account for kubernetes or update current k8s service account with json file to have additional permissions to the remote registry? I've seen the solutions like put it to a secret or user cross-account-service-account. But it's not the way I want to resolve it since we have some internal restrictions.

Hope someone faced similar task and has a solution to share - it'll save me real time.

Thanks in advance!

0 Answers
Related