10.13. 在 GCP 中创建 IAM 角色

流程

1. 复制 IAM 角色的 Deployment Manager 模板一节中的模板，并将它以 03_iam.py 形式保存到计算机上。此模板描述了集群所需的 IAM 角色。

2. 创建 03_iam.yaml 资源定义文件：

   $ cat <<EOF >03_iam.yaml
   imports:
   - path: 03_iam.py
   resources:
   - name: cluster-iam
     type: 03_iam.py
     properties:
       infra_id: '${INFRA_ID}' 

   1

   
   EOF

   Copy to Clipboard Toggle word wrap

   1

   INFRA _ID 是 提取步骤 中的 INFRA_ID 基础架构名称。

3. 使用 gcloud CLI 创建部署：

   $ gcloud deployment-manager deployments create ${INFRA_ID}-iam --config 03_iam.yaml

   Copy to Clipboard Toggle word wrap

4. 导出 master 服务帐户的变量：

   $ export MASTER_SERVICE_ACCOUNT=(`gcloud iam service-accounts list --filter "email~^${INFRA_ID}-m@${PROJECT_NAME}." --format json | jq -r '.[0].email'`)

   Copy to Clipboard Toggle word wrap

5. 导出 worker 服务帐户的变量：

   $ export WORKER_SERVICE_ACCOUNT=(`gcloud iam service-accounts list --filter "email~^${INFRA_ID}-w@${PROJECT_NAME}." --format json | jq -r '.[0].email'`)

   Copy to Clipboard Toggle word wrap

6. 导出托管计算机器的子网的变量：

   $ export COMPUTE_SUBNET=(`gcloud compute networks subnets describe ${INFRA_ID}-worker-subnet --region=${REGION} --format json | jq -r .selfLink`)

   Copy to Clipboard Toggle word wrap

7. 由于 Deployment Manager 的限制，模板不会创建策略绑定，因此您必须手动创建它们：

   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${MASTER_SERVICE_ACCOUNT}" --role "roles/compute.instanceAdmin"
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${MASTER_SERVICE_ACCOUNT}" --role "roles/compute.networkAdmin"
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${MASTER_SERVICE_ACCOUNT}" --role "roles/compute.securityAdmin"
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${MASTER_SERVICE_ACCOUNT}" --role "roles/iam.serviceAccountUser"
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${MASTER_SERVICE_ACCOUNT}" --role "roles/storage.admin"
   
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${WORKER_SERVICE_ACCOUNT}" --role "roles/compute.viewer"
   $ gcloud projects add-iam-policy-binding ${PROJECT_NAME} --member "serviceAccount:${WORKER_SERVICE_ACCOUNT}" --role "roles/storage.admin"

   Copy to Clipboard Toggle word wrap

8. 创建服务帐户密钥并将其存储在本地以供以后使用：

   $ gcloud iam service-accounts keys create service-account-key.json --iam-account=${MASTER_SERVICE_ACCOUNT}

   Copy to Clipboard Toggle word wrap