How to create a GKE node pool running as a service account in another project?

user_6180803 0
Viewed 194

I have two GCP projects, A and B, and I want to create a cluster in project B with a node pool also in project B running as a service account in project A.

I am able to create the cluster but when I try to create the node pool I get the following error:

The user does not have access to service account: gke-node@project-A.iam.gserviceaccount.com. Ask a project owner to grant you the iam.serviceAccountUser role on the service account.

I have given project B's Kubernetes Agent Service Account (service-<project-B-number>@container-engine-robot.iam.gserviceaccount.com) the iam.serviceAccountUser role in project A for gke-node@project-A.iam.gserviceaccount.com but this didn't seem to work.

Is this possible to do?

google-kubernetes-engine google-cloud-platform
1 Answers

I post this community wiki answer to provide more visibility of the solution provided at the comment section. Feel free to change or expand.

As it was suggested by @Gari Singh you should follow the documentation. The root cause of an issue accordingly to @dippynark was that the iam.disableCrossProjectServiceAccountUsage constraint is enabled. Here you can find more details.

user_124287940
Related