Cloud Composer 2 uses the Default Compute Engine service account for GKE Autopilot nodes

[mikejuliettetango]

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

If this is a bug report (for when something is there, but doesn't work how it should), please use the bug issue template instead.

If this is an enhancement / feature request (for when something (a resource, field, etc.) is missing, and should be added), please use the enhancement template instead.

If you have a support request or question, please check out the other resources listed here.

If your issue does not fit into one of the above templates, please fill out the following:

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment or link the pull request to this issue.

Terraform Version

• terraform <= 1.1.2

Affected Resource(s)

• google_composer_environment

Issue Description

Because Composer 2 uses the Default Compute Engine service account and Workload Identity to manage the GKE Autopilot clusters, you may not specify a service account for your GKE Nodepool as an optional argument as currently stated:

service_account - (Optional) The Google Cloud Platform Service Account to be used by the node VMs. If a service account is not specified, the "default" Compute Engine service account is used. Cannot be updated. If given, note that the service account must have roles/composer.worker for any GCP resources created under the Cloud Composer Environment.

References

• https://cloud.google.com/composer/docs/composer-2/create-environments#grant-permissions

b/301065829

[mbajer42]

Correct me if I misunderstood your question, but it seems that it is possible to specify a service account: https://cloud.google.com/composer/docs/composer-2/create-environments#service-account

[mbajer42]

Please close this issue @rileykarson

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.