Kubernetes Engine Node Service Agent doesn't exist

Google Cloud Serverless Applications
1

Hey All, I have both GKE Std and GKE Autopilot clusters in my gcp project that have been running for a few months.

Per the link https://cloud.google.com/iam/docs/service-agents#kubernetes-engine-node-service-agent, I would expect to see “Kubernetes Engine Node Service Agent” in my project. However, I am unable to find it on the IAM screen. I did check “Include Google-provided role grants”. I do see service-xxxx@container-engine-robot.iam.gserviceaccount.com but not the Kubernetes Engine Node Service Agent.

How and when does this account get created?

2

The account is only used as the default default service account for Autopilot clusters when you do not specify a service account during cluster creation.

3

Good to hear from you buddy. @garisingh

So, if I create a autopilot cluster with default service account. I should see the node service agent get created in my GCP project correct? I did create such a cluster but I don’t see the service agent account. please let me know what other information you need to help move this along. I am also open to GVC if that helps.

4

also @garisingh if you could get this documentation updated. https://cloud.google.com/iam/docs/service-agents#kubernetes-engine-node-service-agent to reflect that it only applies to autopilot running with default SA, that would be great.

5

Kubernetes Engine Service Agent is role you assign to a Service Account.

Click on IAM, click on Service Accounts, select your service account, Grant Permissions, find that role and assign it, save…

6

Yes and no, the service agent role is a role that Google assigns to the Google-managed service account called “Kubernetes Engine Node Service Agent”. You shouldn’t assign service agent roles to other principals.

Use the Kubernetes Engine Node Service Account role (roles/container.nodeServiceAccount) instead