create-serice-account overview

create-serice-account is a command-line tool provided with Apigee hybrid that creates Google Cloud service accounts with roles that allow individual Apigee hybrid components to make authorized API calls and downloads the associated service account key files. You can use the service account key files generated by this command in your configuration overrides file.

create-service-account creates one or more service accounts in your current Google Cloud project or the project you specify, assigns the correctIAM role to the service account, and downloads the certificate file for the service account into a directory on your local machine.

To learn more about service accounts and read the full list of service accounts recommended for production environments, see the following:

• About service accounts
• Service accounts and roles used by hybrid components

You can also create service accounts in the Google Cloud console. See alsoCreating and managing service accounts.

Prerequisites

Role

Thecreate-service-account tool requires that thegcloud CLI be installed. Users invoking the utility should have the roleService Account Admin.

Project

Service accounts are bound to a specific Google Cloud project.create-service-account creates service accounts in your current project or in the project you specify, and binds the IAM roles to the service accounts within that project.create-service-account also uses the Project ID as part of the service account key file name and email. For example, if your project is namedmy-hybrid-project, the apigee-logger service account key file will be namedmy-hybrid-project-apigee-logger.json and the service account's email address will beapigee-logger@my-hybrid-project.iam.gserviceaccount.com.

You can specify a project by defining aPROJECT_ID environment variable or with the--project-id flag.create-service-account reads the value of thePROJECT_ID environment variable. If it is not present, you can use the--project-id flag.

If you do not specify a Cloud project ID,create-service-account uses the project in your current gcloud project configuration.

You can check current setgcloud project configuration with the following command:

gcloud config list project

If you need to change the current project ID, use the following command:

gcloud config set projectPROJECT_ID

WherePROJECT_ID is the ID of your current Cloud project. Instructions for creating a Cloud Project are covered inStep 2: Create a Google Cloud project.

File location

You can find thecreate-service-account tool in the following directory:

$APIGEE_HELM_CHARTS_HOME/apigee-operator/etc/tools/

Verifying thecreate-service-account tool is executable

Verify you can executecreate-service-account. If you have just downloaded the Apigee Helm charts, the command line tools might not be in an executable mode. Navigate to the directory wherecreate-service-account is installed and verify that it is executable by running it with--help:

./create-service-account --help

If your output sayspermission denied you need to make the file executable, for example withchmod in Linux, MacOS, or UNIX or in the Windows Explorer or with theicacls command in Windows. For example:

chmod +x ./create-service-account

Usingcreate-service-account

The following examples show usingcreate-service-account for common Apigee hybrid setup tasks.

Create service accounts for a production environment

In a production hybrid environment Apigee recommends using a separate service account for each component. Use the following command to create all the service accounts for the hybrid components with their default names in the default directory.

./tools/create-service-account --env prod

This will create the following service accounts with the cert files downloaded in the./tools/service-accounts directory:

Create a single service account for a non-production environment

For non-production environments, like an experimental or demo environment, you can create a single service account named "apigee-non-prod" that you can use for all components. This service account will have all the IAM roles in the previous example assigned to it.

./tools/create-service-account --env non-prod

This will create as single service account namedapigee-non-prod and download the cert file in the./tools/service-accounts directory:

create-service-account syntax

Thecreate-service-account tool uses the following syntax:

create-service-account [flags]

The following table lists thecreate-service-account flags:

For more information about the service accounts used by Apigee hybrid, seeAbout service accounts.

You can also create service accounts in the Google Cloud console. See alsoCreating and managing service accounts.