Checks for service account defined for GKE nodes
You should create and use a minimally privileged service account to run your GKE cluster instead of using the Compute Engine default service account.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Use limited permissions for service accounts to be effective
1
2
3
4
5
|
resource "google_container_cluster" "good_example" {
node_config {
service_account = "cool-service-account@example.com"
}
}
|
Links