Is it possible to use a different service account?

[kartikwatwani]

I want to use a different service account for my Google cloud project to create theia on kubernetes but currently default service account is being used. My default service account is deleted by mistake.

[kartikwatwani]

Yes, I figured it out. It is possible to do so by updating the files:

1. terraform/configurations/gke_getting_started/gke_getting_started.tf

variable "project_id" {
  description = "The GCE project id"
}

variable "service_account_email" {
  description = "The email of the service account for the GKE nodes"
}

variable "location" {
  description = "The zone of the created cluster"
  default     = "asia-south2-a"
}

variable "cert_manager_issuer_email" {
  description = "Email address used to create certificates."
}

variable "keycloak_admin_password" {
  description = "Keycloak Admin Password"
  sensitive   = true
}

variable "postgres_postgres_password" {
  description = "Keycloak Postgres DB Postgres (Admin) Password"
  sensitive   = true
}

variable "postgres_password" {
  description = "Keycloak Postgres DB Password"
  sensitive   = true
}

provider "google" {
  project = var.project_id
  zone    = var.location
}

module "cluster" {
  source = "../../modules/cluster_creation/gke/"

  # adjust values below
  project_id = var.project_id
  location   = var.location
  service_account_email = var.service_account_email
}

resource "google_compute_address" "host_ip" {
  depends_on = [module.cluster]
  name       = "theia-cloud-nginx-ip"
}

provider "helm" {
  kubernetes {
    host                   = module.cluster.cluster_host
    token                  = module.cluster.cluster_token
    cluster_ca_certificate = module.cluster.cluster_ca_certificate
  }
}

provider "kubectl" {
  load_config_file       = false
  host                   = module.cluster.cluster_host
  token                  = module.cluster.cluster_token
  cluster_ca_certificate = module.cluster.cluster_ca_certificate
}

module "helm" {
  source = "../../modules/helm"

  install_ingress_controller  = true
  cert_manager_issuer_email   = var.cert_manager_issuer_email
  cert_manager_cluster_issuer = "letsencrypt-prod"
  cert_manager_common_name    = "${google_compute_address.host_ip.address}.sslip.io"
  hostname                    = "${google_compute_address.host_ip.address}.sslip.io"
  keycloak_admin_password     = var.keycloak_admin_password
  postgresql_enabled          = true
  postgres_postgres_password  = var.postgres_postgres_password
  postgres_password           = var.postgres_password
  loadBalancerIP              = google_compute_address.host_ip.address
}

provider "keycloak" {
  client_id     = "admin-cli"
  username      = "admin"
  password      = var.keycloak_admin_password
  url           = "https://${google_compute_address.host_ip.address}.sslip.io/keycloak"
  initial_login = false
}

module "keycloak" {
  source = "../../modules/keycloak"

  depends_on = [module.helm]

  hostname                        = "${google_compute_address.host_ip.address}.sslip.io"
  keycloak_test_user_foo_password = "foo"
  keycloak_test_user_bar_password = "bar"
  valid_redirect_uri              = "https://${google_compute_address.host_ip.address}.sslip.io/*"
}

2. terraform/modules/cluster_creation/gke/main.tf

variable "project_id" {
  description = "The GCE project id"
}

variable "service_account_email" {
  default     = "[email protected]"
  description = "The email of the service account for the GKE nodes"
}

variable "location" {
  description = "The zone of the created cluster"
}
variable "cluster_name" {
  default     = "gke-theia-cloud"
  description = "The name of the created cluster"
}

variable "primary_node_pool_name" {
  default     = "default-pool"
  description = "The name of the primary node pool"
}

variable "primary_node_pool_machine" {
  default     = "e2-standard-2"
  description = "Machine Type of the primary node pool"
}

variable "primary_node_pool_initial_nodes" {
  default     = 1
  description = "Initial number of nodes for the primary node pool"
}

variable "primary_node_pool_max_nodes" {
  default     = 2
  description = "Maximum number of nodes for the primary node pool"
}


resource "google_container_cluster" "primary" {
  name                     = var.cluster_name
  location                 = var.location
  remove_default_node_pool = true
  initial_node_count       = 1
    node_config {
    service_account = var.service_account_email
   }
}

resource "google_container_node_pool" "primary_nodes" {
  name               = var.primary_node_pool_name
  location           = var.location
  cluster            = var.cluster_name
  initial_node_count = var.primary_node_pool_initial_nodes
  depends_on         = [google_container_cluster.primary]

  autoscaling {
    max_node_count = var.primary_node_pool_max_nodes
  }

  node_config {
    service_account = var.service_account_email
    preemptible  = false
    machine_type = var.primary_node_pool_machine
    metadata = {
      disable-legacy-endpoints = "true"
    }
  }

  provisioner "local-exec" {
    command = "gcloud container clusters get-credentials ${var.cluster_name} --zone ${var.location} --project ${var.project_id}"
  }
}

data "google_client_config" "default" {
  depends_on = [google_container_cluster.primary, google_container_node_pool.primary_nodes]
}