create-service-account

Creates Google Cloud Platform (GCP) service accounts with roles that allow individual Apigee hybrid components to make authorized API calls and downloads the associated service account key files. You can use the service account key files generated by this command in your configuration overrides file.

The create-service-account tool is located in hybrid_root_dir/tools directory.

Prerequisites

The create-service-account tool requires that the gcloud CLI be installed. Users invoking the utility should have the role Service Account Admin.

To get started, be sure your gcloud project configuration is set to the project you created in Step 2: Create a Google Cloud project:

gcloud config list project

If you need to change the current project ID, use this command:

gcloud config set project gcp_project_id

Where gcp_project_id is the project created in Step 2: Create a Google Cloud project.

create-service-account syntax

The create-service-account tool uses the following syntax:

create-service-account component_name output_dir [gcp_project_id]

Where:

component_name: Specifies the hybrid service that uses the service account. Valid values are:
- apigee-cassandra
- apigee-logger
- apigee-mart
- apigee-metrics
- apigee-synchronizer
- apigee-udca
Note that the create-service-account tool cannot create the apigee-org-admin service account. You must create that either with the GCP or gCloud APIs, as described in Create service accounts.
output_dir: The output directory in which to store the downloaded service account key.
gcp_project_id: (Optional) Specifies the GCP project ID of the project that is bound to your hybrid-enabled organization. If the GCP project ID is not provided, the tool attempts to retrieve it from the current gcloud configuration.

NOTE: When you generate a service account for apigee-mart you'll see this error:

[ERROR]: No roles found for component apigee-mart

You can ignore the error—the service account for MART does not need a role and is created with no role assigned to it.

Detailed description

The create-service-account tool:

Creates GCP service accounts used by hybrid components. The created service account is granted the role required by the specific component to operate.
Downloads the service account key to your system. You place the service account keys in your hybrid configuration overrides file, as explained in the hybrid installation instructions.

The tool creates service accounts for the following components:

Component^*	Role	Description
`apigee-cassandra`	Storage Object Admin	Allows Cassandra backups to Google Cloud Storage, as described in Backup and recovery.
`apigee-logger`	Logs Writer	Allows logging data collection, as described in Logging. Only required for non-GKE cluster installations.
`apigee-mart`	No role	Allows MART service authentication. This service account should not have a role associated with it; as a result, when you create this service account, do not assign a role to it.
`apigee-metrics`	Monitoring Metric Writer	Allows metrics data collection, as described in Metrics collection
`apigee-org-admin`	Apigee Organization Admin	Lets you call the getSyncAuthorization API and setSyncAuthorization API. You cannot create this service account with the `create-service-account` tool.
`apigee-synchronizer`	Apigee Synchronizer Manager	Allows the synchronizer to download proxy bundles and environment configuration data. Also enables operation of the trace feature.
`apigee-udca`	Apigee Analytics Agent	Allows the transfer of trace, analytics and deployment status data to the management plane.
^* This name is used in the downloaded service account key's filename.

You can also create service accounts in the GCP Console. See also Creating and managing service accounts.

Example

The following example creates a new service account for the apigee-logger service and places the downloaded key in the ./service-accounts directory.

./my-hybrid-root/tools/create-service-account apigee-logger ./service-accounts