<p>I am spinning up a <code>kubernetes</code> job as a <code>helm</code> <code>pre-install</code> hook on GKE.
The job uses <code>google/cloud-sdk</code> image and I want it to create a compute engine persistent disk.</p>

<p>Here is its <code>spec</code>:</p>

<pre><code>    spec:
      restartPolicy: OnFailure
      containers:
      - name: create-db-hook-container
        image: google/cloud-sdk:latest
        command: ["gcloud"]
        args: ["compute", "disks", "create", "--size={{ .Values.volumeMounts.gceDiskSize  }}", "--zone={{ .Values.volumeMounts.gceDiskZone }}", "{{ .Values.volumeMounts.gceDiskName }}"]
</code></pre>

<p>However this fails with the following error:</p>

<pre><code>brazen-lobster-create-pd-hook-nc2v9 create-db-hook-container ERROR: 
(gcloud.compute.disks.create) Could not fetch resource: brazen-lobster-create-pd-hook-nc2v9 
create-db-hook-container  
- Insufficient Permission: Request had insufficient authentication scopes. 
brazen-lobster-create-pd-hook-nc2v9 create-db-hook-container
</code></pre>

<p>Apparently I have to grant the <code>gcloud.compute.disks.create</code> permission.</p>

<p>My question is <strong>to whom I have to grant this permission</strong>?</p>

<p>This is a GCP IAM permission therefore I assume it cannot be granted specifically on a <code>k8s</code> resource (?) so it cannot be dealt within the context of <code>k8s</code> RBAC, right?</p>

<p><strong>edit</strong>: I have created a <code>ComputeDiskCreate</code> custom role, that encompasses two permissions:</p>

<ul>
<li><code>gcloud.compute.disks.create</code></li>
<li><code>gcloud.compute.disks.list</code></li>
</ul>

<p>I have attached it to service account</p>

<p><code>service-2340842080428@container-engine-robot.uam.gserviceaccount.com</code> that my <code>IAM</code> google cloud console has given the name </p>

<blockquote>
  <p>Kubernetes Engine Service Agent</p>
</blockquote>

<p>but the outcome is still the same.</p>

<p>In GKE, all nodes in a cluster are actually Compute Engine VM instances. They're assigned a service account at creation time to authenticate them to other services. You can check the service account assigned to nodes by checking the corresponding node pool.</p>

<p>By default, GKE nodes are assigned the Compute Engine default service account, which looks like <code>PROJECT_NUMBER-compute@developer.gserviceaccount.com</code>, unless you set a different one at cluster/node pool creation time.</p>

<p>Calls to other Google services (like the <code>compute.disks.create</code> endpoint in this case) will come from the node and be authenticated with the corresponding service account credentials.</p>

<p>You should therefore add the <code>gcloud.compute.disks.create</code> permission to your nodes' service account (likely <code>PROJECT_NUMBER-compute@developer.gserviceaccount.com</code>) in your Developer Console's <a href="https://console.cloud.google.com/iam-admin/iam" rel="nofollow noreferrer">IAM page</a>.</p>

<p><strong>EDIT</strong>: Prior to any authentication, the mere ability for a node to access a given Google service is defined by its <a href="https://cloud.google.com/compute/docs/access/service-accounts#accesscopesiam" rel="nofollow noreferrer">access scope</a>. This is defined at node pool's creation time and can't be edited. You'll need to create a new node pool and ensure you grant it the <code>https://www.googleapis.com/auth/compute</code> access scope to Compute Engine methods. You can then instruct your particular pod to <a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/" rel="nofollow noreferrer">run on those specific nodes</a>.</p>
