Unable to Bind Google Service Account to Kubernetes Service Account

Question

I am trying to bind my Google Service Account (GSA) to my Kubernetes Service Account (KSA) so I can connect to my Cloud SQL database from the Google Kubernetes Engine (GKE). I am currently using the follow guide provided in Google's documentation (https://cloud.google.com/sql/docs/sqlserver/connect-kubernetes-engine).

Currently I have a cluster running on GKE named MY_CLUSTER, a GSA with the correct Cloud SQL permissions named MY_GCP_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com, and a KSA named MY_K8S_SERVICE_ACCOUNT. I am trying to bind the two accounts using the following command.

gcloud iam service-accounts add-iam-policy-binding \
  --member "serviceAccount:PROJECT_ID.svc.id.goog[K8S_NAMESPACE/MY_K8S_SERVICE_ACCOUNT]" \
  --role roles/iam.workloadIdentityUser \
  MY_GCP_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

However when I run the previous command I get the following error message.

ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Identity Pool does not exist (PROJECT_ID.svc.id.goog). Please check that you specified a valid resource name as returned in the `name` attribute in the configuration API.

Why am I getting this error when I try to bind my GSA to my KSA?

Riley Conrardy Riley Conrardy · Accepted Answer · 2021-01-29T02:50:47

In order to bind your Google Service Account (GSA) to you Kubernetes Service Account (KSA) you need to enable Workload Identity on the cluster. This is explained in more details in Google's documentation (https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity).

To enable Workload Identity on an existing cluster you can run.

gcloud container clusters update MY_CLUSTER \
  --workload-pool=PROJECT_ID.svc.id.goog

Unable to Bind Google Service Account to Kubernetes Service Account

1 Answers