GCP: what is the Robot Service Account in GKE

user_12127115 0
Viewed 133

I'm trying to improve my knowledge in GCP-GKE as a newbie and in the way to do that, I found out a little concept that I don't quite understand yet. In GKE, there is a Service Account called service-PROJECT_NUM@container-engine-robot.iam.gserviceaccount.com (where the PROJECT_NUM is the ID of our project) and after several hours googling, I couldn't find any article or definition about this stuff. So could you guys please explain to me

  • What is this Service Account ? How was it created (by who)?
  • What is this thing for? How important is it in GKE?
  • What happens if we delete it ? Could we re-created it manually ?

In fact, I found out that in GCP, we have some Service Account that have a "robot" suffix: ...robot.iam.gserviceaccount.com/ (like @gcf-admin-robot.iam.gserviceaccount.com/, @serverless-robot-prod.iam.gserviceaccount.com, etc). What could we say about this, please ?

If I misunderstand something, please, point it out for me, I really appreciate that.

Thank you guys !!!

google-kubernetes-engine kubernetes google-cloud-platform
1 Answers

Service Accounts aka "robots" contrast with user ("human") accounts and represent two forms of Google identity.

NOTE Robots was the original name for Service Accounts and is a more colorful description of the intent of these accounts, to run software.

(Google) User accounts include consumer (Gmail) e.g. you@gmail.com and you@employee.com (Workspace) accounts. User accounts are used by humans to interact with Google services and must be used (or a suitable delegate) to acccess user-owned content such as Workspace docs, sheets etc.

Software ("robots") generally should run as a Service Account not as a User account. In part, you can't easily run software using User accounts because the User OAuth flow is 3-legged and requires interacting with an OAuth Consent Screen to permit an app access to data.

There are two flavors of Service Account: Google-created|managed and User-created|managed. The difference is essentially the owner. If you create applications, generally you should create a Service Account for each app and run the app using its Service Account.

User-managed Service Accounts take the form {something}@{project}.iam.gserviceaccount.com where you get to define the value of {something} and the Google Project in which the Service Account is created (the project that owns the Service Account) is represented by {project} (actually the Project ID).

When Google provides app functionality, it also creates Service Accounts and often, Google "binds" these Service Accounts to your projects that use them in addition to defining the role that the Service Account has in your project.

Google-managed Service Accounts take the form {something}@{label}.iam.gserviceaccount.com. Unlike User-managed Service Accounts, Google uses more descriptive labels ({label}) to help explain the role of the Service Account.

NOTE With Google-managed Service Accounts {something} often includes the Project Number (not ID) of (your!) project for which the Google-managed account has been created.

You cannot delete Google-managed Service Accounts because you(r Google account) does not own the Service Account.

You can (but should not) delete the role binding between one of your projects and a Google-managed Service Account. It may be possible for you to revert (recreate) the binding but you may not have permission to do this.

user_6092900
Related