[説明] このページは機械翻訳された日本語版です。内容に誤りがございましたら、報告していただけると助かります。

Create a Cross-Account Service Account

Contact Sales to Enable BYOC

This page describes how to create and configure a cross-account service account for Zilliz Cloud to bootstrap your project data plane. This service account grants Zilliz Cloud the necessary permissions to manage VPC resources on your behalf.

📘Notes

Zilliz BYOC is currently available in General Availability. For access and implementation details, please contact Zilliz Cloud sales.

Procedures

You can use the Google Cloud Platform (GCP) dashboard to create the EKS role. Alternatively, you can use the Terraform script Zilliz Cloud provides to bootstrap the infrastructure for your Zilliz Cloud project on GCP. For details, refer to Terraform Provider.

Step 1: Create a service account

In this step, you will create a service account for Zilliz Cloud to manage VPC resources on your behalf and paste the service account email address back to Zilliz Cloud console.

The steps for creating a service account are as follows:

1. On the GCP console, find and click IAM & Admin.

2. Choose Service Accounts on the left navigation pane.

3. Click Create service account.

4. Set a proper name for the service account to create.

   In this demo, you can set it to your-org-cross-account-sa. The service account ID is the first 18 characters of the service account name. You can manually set it to a proper value.

5. Click Create and continue.

6. Keep the default settings for Permissions and Principals.

7. Click Done.

Step 2: Grant permissions

In this step, you will assign permissions to the service account created above by linking several roles to the service account.

Create an instance group manager custom role

You will create an instance group manager custom role and assign the custom role to the service account created above so that the service account has the minimum required permissions to manage GKE nodes.

The steps for creating the instance group manager custom role are as follows:

1. On the GCP console, find and click IAM & Admin.

2. Choose Roles from the left navigation pane.

3. Click Create role.

4. Set a title and description for the custom role to create.

5. Change Role launch stage from Alpha to General Availability.

6. Click Add permissions. The permissions to add in this step are as follows:

   • compute.instanceGroupManagers.get

   • compute.instanceGroupManagers.update

7. Click Create.

Create an IAM custom role

You will create an IAM custom role and assign the custom role to the service account created above so that the service account has the minimum required permissions to manage IAM policies.

The steps for creating a custom role are as follows:

1. On the GCP console, find and click IAM & Admin.

2. Choose Roles from the left navigation pane.

3. Click Create role.

4. Set a title and description for the custom role to create.

5. Change Role launch stage from Alpha to General Availability.

6. Click Add permissions. The permissions to add in this step are as follows:

   • iam.serviceAccounts.getIamPolicy

   • iam.serviceAccounts.setIamPolicy

7. Click Create.

Assign roles to the service account

You will assign the custom role created above with several GCP-managed roles to the cross-account service account.

The steps for assigning roles to the cross-account service account are as follows:

1. On the GCP console, find and click IAM & Admin.

2. On the IAM page, click Grant access.

3. Select the cross-account service account created in the previous step in the Grant access pane that moves inward.

4. Add the custom roles created in the previous steps and several GCP-managed roles to the service account.

   The following table lists the roles to be assigned to the service account.

   Role	Type	Condition
   Instance group manager custom role	Custom	resource.name.extract("projects/{name}").startsWith("PROJECT_ID") &&resource.name.extract("zones/{name}").startsWith("REGION") &&resource.name.extract("instanceGroupManagers/{name}").startsWith("gke-CLUSTER_NAME")
   IAM custom role	Custom	api.getAttribute("iam.googleapis.com/modifiedGrantsByRole", []).hasOnly(["roles/iam.workloadIdentityUser"])
   Kubernetes Engine Admin	GCP-managed	N/A
   Storage Object Viewer	GCP-managed	resource.name.startsWith("projects/_/buckets/YOUR_BUCKET_NAME")

   📘Notes

   You need to replace the three placeholders in the above expression with actual values:

   • PROJECT_ID

   This should be your GCP project ID.

   • REGION

   This should be the cloud region of your BYOC project.

   • CLUSTER_NAME

   This should be the name of the GKE cluster that Zilliz Cloud will create on your behalf.

   • YOUR_BUCKET_NAME

   This should be the name of the bucket created in the previous step.

5. Click Save.

Grant access to other service accounts

You will grant the cross-account service account created in the previous step access to several other service accounts.

Follow the steps below to grant the cross-account service account access to these service accounts.

1. On the GCP console, find and click Service Account.

2. Find and click one of the above-mentioned service accounts to view its details.

   	Description
   your-org-gke-node-sa	This service account is created in this step.
   PROJECT_NUMBER-compute@developer.gserviceaccount.com	This service account is automatically created when you enable the Compute Engine API.

   📘Notes

   • You need to replace your-org-gke-node-sa with the actual name of the GKE service account created in Create GKE Service Account.

   • You need to replace PROJECT_NUMBER with your own GCP project number.

3. Switch to the Principals with access tab and click Grant access.

4. Enter the cross-account service account created in the previous step in Add principals > New principals.

5. Select Service Account User in Assign roles > Role.

Impersonate Zilliz Cloud's service account

You will have the cross-account service account to impersonate Zilliz Cloud's service account provided on the Zilliz Cloud console.

The steps for impersonating the service account that Zilliz Cloud provides are as follows:

1. On the Zilliz Cloud console, copy the service account Zilliz Cloud provides.

2. Go to the GCP console, find and click IAM & Admin.

3. Choose Service Accounts in the left navigation pane.

4. Filter your cross-account service account and click its name to view its details.

5. Switch to the Principals with access tab and click Grant access.

6. Paste the service account copied from the Zilliz Cloud console in Add principals > New principals.

7. Select Service Account Token Creator in Assign roles > Role.

8. Click Save.