CODEWITHSUNDEEP
google-cloud-platformgoogle-kubernetes-enginekubernetes-secrets
Shalanki Gupta
Shalanki Gupta

Reputation: 131

Kubernetes Application Level Encryption on GKE

I aim to enable Application Level Encryption on my GKE cluster. I am using a custom service account (with required permissions to Encrypt/Decrypt a KMS key) to create this cluster, but it still asks me to grant Encrypt/Decrypt permissions to my Kubernetes service agent account(SA that gets created when you enable the Kubernetes API on the GCP project).

Error: The service-xxxxxxxxxxxxx@container-engine-robot.iam.gserviceaccount.com service account does not have permissions to encrypt/decrypt with the selected key.

Upvotes: 0

Views: 263

Answers (1)

Patrick W
Patrick W

Reputation: 4909

This is required because the master will also need to be able to decrypt. There is no way for you to use your custom service account on the GKE master node.

Upvotes: 2

Related Questions