Service Access on Container Engine

Question

Hi is there a best practice to access google cloud services such as bigtable and pubsub when running services inside kubernetes? Or should I just place the json credentials available for each pod during deployment?

Regards

Answer 1

When creating your cluster (or node pool) you can set the scopes (which are permissions) that will be applied to each of the VMs. For example, to allow access to pubsub, you could set either https://www.googleapis.com/auth/pubsub or https://www.googleapis.com/auth/cloud-platform (the second one has much broader permissions so if you only want pubsub you should use the first to stick to the principle of least privilege).