<p>I’m investigating this letsencrypt controller (<a href="https://github.com/tazjin/kubernetes-letsencrypt" rel="noreferrer">https://github.com/tazjin/kubernetes-letsencrypt</a>).</p>

<p>It requires pods have permission to make changes to records in Cloud DNS. I thought with the pods running on GKE I’d get that access with the default service account, but the requests are failing. What do I need to do do to allow the pods access to Cloud DNS?</p>

<p>The Google Cloud DNS API's <a href="https://cloud.google.com/dns/api/v1/changes/create#auth" rel="noreferrer">changes.create call</a> requires either the <code>https://www.googleapis.com/auth/ndev.clouddns.readwrite</code> or <code>https://www.googleapis.com/auth/cloud-platform</code> scope, neither of which are enabled by default on a GKE cluster.</p>

<p>You can add a new <a href="https://cloud.google.com/container-engine/docs/node-pools" rel="noreferrer">Node Pool</a> to your cluster with the DNS scope by running:</p>

<pre><code>gcloud container node-pools create np1 --cluster my-cluster --scopes https://www.googleapis.com/auth/ndev.clouddns.readwrite
</code></pre>

<p>Or, you can create a brand new cluster with the scopes you need, either by passing the <code>--scopes</code> flag to <a href="https://cloud.google.com/sdk/gcloud/reference/container/clusters/create" rel="noreferrer"><code>gcloud container clusters create</code></a>, or in the <a href="https://pantheon.corp.google.com/kubernetes/add" rel="noreferrer">New Cluster dialog</a> in Cloud Console, click "More", and set the necessary scopes to "Enabled".</p>
