<p>I'm trying to improve my knowledge in GCP-GKE as a newbie and in the way to do that, I found out a little concept that I don't quite understand yet. In GKE, there is a <strong>Service Account</strong> called <code>service-PROJECT_NUM@container-engine-robot.iam.gserviceaccount.com</code> (where the <code>PROJECT_NUM</code> is the ID of our project) and after several hours googling, I couldn't find any article or definition about this stuff. So could you guys please explain to me</p>
<ul>
<li>What is this <strong>Service Account</strong> ? How was it created (by who)?</li>
<li>What is this thing for? How important is it in GKE?</li>
<li>What happens if we delete it ? Could we re-created it manually ?</li>
</ul>
<p>In fact, I found out that in GCP, we have some <strong>Service Account</strong> that have a &quot;robot&quot; suffix: <code>...robot.iam.gserviceaccount.com/</code> (like <code>@gcf-admin-robot.iam.gserviceaccount.com/</code>, <code>@serverless-robot-prod.iam.gserviceaccount.com</code>, etc). What could we say about this, please ?</p>
<p>If I misunderstand something, please, point it out for me, I really appreciate that.</p>
<p>Thank you guys !!!</p>

<p><a href="https://cloud.google.com/iam/docs/service-accounts" rel="nofollow noreferrer">Service Accounts</a> aka &quot;robots&quot; contrast with user (&quot;human&quot;) accounts and represent two forms of Google identity.</p>
<blockquote>
<p><strong>NOTE</strong> Robots was the original name for Service Accounts and is a more colorful description of the intent of these accounts, to run software.</p>
</blockquote>
<p>(Google) User accounts include consumer (Gmail) e.g. you@gmail.com and you@employee.com (Workspace) accounts. User accounts are used by humans to interact with Google services and must be used (or a suitable delegate) to acccess user-owned content such as Workspace docs, sheets etc.</p>
<p>Software (&quot;robots&quot;) generally should run as a Service Account <strong>not</strong> as a User account. In part, you can't easily run software using User accounts because the User OAuth flow is 3-legged and requires interacting with an OAuth Consent Screen to permit an app access to data.</p>
<p>There are two flavors of Service Account: Google-created|managed and User-created|managed. The difference is essentially the owner. If you create applications, generally you should create a Service Account for each app and run the app using its Service Account.</p>
<p>User-managed Service Accounts take the form <code>{something}@{project}.iam.gserviceaccount.com</code> where you get to define the value of <code>{something}</code> and the Google Project in which the Service Account is created (the project that owns the Service Account) is represented by <code>{project}</code> (actually the Project ID).</p>
<p>When Google provides app functionality, it also creates Service Accounts and often, Google &quot;binds&quot; these Service Accounts to your projects that use them in addition to defining the role that the Service Account has in your project.</p>
<p>Google-managed Service Accounts take the form <code>{something}@{label}.iam.gserviceaccount.com</code>. Unlike User-managed Service Accounts, Google uses more descriptive labels (<code>{label}</code>) to help explain the role of the Service Account.</p>
<blockquote>
<p><strong>NOTE</strong> With Google-managed Service Accounts <code>{something}</code> often includes the Project Number (not ID) of (your!) project for which the Google-managed account has been created.</p>
</blockquote>
<p>You <strong>cannot</strong> delete Google-managed Service Accounts because you(r Google account) does not own the Service Account.</p>
<p>You <strong>can</strong> (but <strong>should not</strong>) delete the role binding between one of your projects and a Google-managed Service Account. It may be possible for you to revert (recreate) the binding but you may not have permission to do this.</p>
