Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update inverse proxy custom permission setting and role setting #2493

Merged
merged 4 commits into from
Oct 25, 2019
Merged

update inverse proxy custom permission setting and role setting #2493

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f6b0a92
update inverse proxy custom permission setting
Oct 25, 2019
e4e2f47
update doc
Oct 25, 2019
56625f5
update per comment
Oct 25, 2019
635399a
fix the role command
Oct 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions manifests/gcp_marketplace/guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,15 @@ export NAMESPACE=<namespace-where-kfp-was-installed>
gcloud iam service-accounts create $SA_NAME --display-name $SA_NAME --project "$PROJECT_ID"
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member=serviceAccount:$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com \
--role=roles/storage.admin \
--role=roles/storage.admin

gcloud projects add-iam-policy-binding $PROJECT_ID \
--member=serviceAccount:$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com \
--role=roles/ml.admin
# and other roles if needed, such as
# --role=roles/dataproc.admin
# --role=roles/dataflow.admin

# More roles can be binded if your pipeline requires it.
# --role=roles/dataproc.admin
# --role=roles/dataflow.admin
```

and store the service account credential as a Kubernetes secret `user-gcp-sa` in the cluster
Expand Down Expand Up @@ -87,5 +91,10 @@ Reason:
- Others created the cluster and deployed the instances for you.
- You don't have corresponding permission to access it.

Please ask admin to give your account `Project Editor` permission. It can be set
from [IAM](https://console.cloud.google.com/iam-admin/iam).
Actions:
- Please ask admin to find out the Google Service Account used to create the cluster and then add your account as its `Service Account User` via [Service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts). From the list table, check the
rmgogogo marked this conversation as resolved.
Show resolved Hide resolved
service account, click the `Info Panel`, you will find a button `Add member` and add it
as `Service Account User`. The Google Service Account is [Compute Engine default service account](https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_service_account) if you didn't set it when creating the cluster.
- Please also add your account as `Project Viewer` via [IAM](https://console.cloud.google.com/iam-admin/iam).

For simplicity but not good for security, adding as `Project Editor` also can work.