Create a service account for nodes if one isn't provided.

[morgante]

We need a holistic solution here which permanently removes the dependency on the default service account. Including:

1. Adding a top-level variable of service_account which accepts three values:
   a. the email of a custom Service Account,
   b. default-compute (the default compute service account), or
   c. create - automatically creates a service account for use

This top-level service account will be default for all node pools which don't explicitly provided.

These flags can optionally be implemented incrementally.

[Jberlinsky]

@morgante Picking this up.

One quick clarification -- I read this as create should create a service account for the cluster for use, that is to say that it will have the cluster name in the service account ID. Please let me know if you had something else in mind.

[morgante]

Correct.

…

On Tue, Dec 18, 2018 at 18:06 Jason Berlinsky ***@***.***> wrote: @morgante <https://github.com/morgante> Picking this up. One quick clarification -- I read this as create should create a service account *for the cluster* for use, that is to say that it will have the cluster name in the service account ID. Please let me know if you had something else in mind. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABjWmZpowN-cd01NiAGqiO-ck9W4itgrks5u6XTsgaJpZM4WT6xy> .

[morgante]

One addendum: I would still like us to do some discovery on why a service account is even required. GCE VMs do not all require service accounts, so it's not clear why the module would break without a service account at all.

[Jberlinsky]

Based on https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa, the service account is necessary to enable Stackdriver for monitoring and logging, and pulling images from GCR.

[aaron-lane]

Fixed by #80.