Kubernetes Cookbook - Second Edition

Using the GCP service account to grant a long-lived credential

We need to integrate to pull an image from the Kubernetes node, which requires a long-lived credential that can be stored to the Kubernetes secret. To do that, perform the following steps:

1. Create a GCP service account (container-sa):

$ gcloud iam service-accounts create container-sa Created service account [container-sa]. //full name is as below $ gcloud iam service-accounts list | grep container [e-mail] 

2. Assign container-sa (use full name) to the roles/storage.admin role:

$ gcloud projects add-iam-policy-binding kubernetes-cookbook \> --member serviceAccount:[e-mail] \> --role=roles/storage.admin ...