Rotating service account keys

This page describes how to rotate your service account keys using gkectl for Cloud Audit Logs, Usage Metering, and Stackdriver components on Google Distributed Cloud.

To rotate your service account keys:

  1. Create a directory to store a backup of your current secrets:

    mkdir backup

  2. Note the following information for the relevant component:

    Cloud Audit Logs

    Cluster Secret Namespace
    Admin create-config kube-system
    Admin create-config CLUSTER_NAME
    Admin audit-logging-config kube-system
    Admin kube-apiserver CLUSTER_NAME

    Usage Metering

    Cluster Secret Namespace
    Admin create-config CLUSTER_NAME
    User usage-metering-bigquery-service-account-key kube-system

    Stackdriver

    Cluster Secret Namespace
    Admin create-config kube-system
    Admin create-config CLUSTER_NAME
    User google-cloud-credentials kube-system
    User stackdriver-service-account-key knative-serving

  3. Create a backup of each secret using the following command:

    kubectl get secret SECRET --namespace NAMESPACE \
    --kubeconfig KUBECONFIG -o json > backup/SECRET-NAMESPACE.json

    Where:

    • NAMESPACE is the namespace where the secret is located. For example, kube-system.
    • KUBECONFIG is the path to the kubeconfig file for the admin or user cluster.
    • SECRET is the name of the secret. For example, create-config.

    For example, run the following commands for the Cloud Audit Logs component:

    kubectl get secret create-config --namespace kube-system \
        --kubeconfig KUBECONFIG -o json > backup/admin-create-config-kube-system.json

kubectl get secret create-config --namespace NAMESPACE \
        --kubeconfig KUBECONFIG -o json > backup/admin-create-config-NAMESPACE.json

kubectl get secret audit-logging-config --namespace kube-system \
        --kubeconfig KUBECONFIG -o json > backup/audit-logging-config-kube-system.json

kubectl get secret kube-apiserver --namespace NAMESPACE \
        --kubeconfig KUBECONFIG -o json > backup/kube-apiserver-NAMESPACE.json

  4. To create a new service account key file, run the following command:

    gcloud iam service-accounts keys create NEW_KEY_FILE --iam-account IAM_ACCOUNT

    Where:

    • NEW_KEY_FILE is the name for your new service account key file
    • IAM_ACCOUNT is your service account email address for either Cloud Audit Logs, Usage Metering, or Stackdriver.

  5. In the config yaml file for both the admin and user cluster, find the cloudauditlogging, usagemetering, or stackdriver section.

  6. Replace the serviceAccountKeyPath field with the NEW_KEY_FILE you created earlier.

  7. Save the changes you made using the following commands:

    gkectl update credentials COMPONENT --admin-cluster --kubeconfig \
  KUBECONFIG --config ADMIN_CONFIG

gkectl update credentials COMPONENT --kubeconfig \
   KUBECONFIG --config USER_CONFIG

    Where:

    • KUBECONFIG is the path to the kubeconfig file for the admin cluster.
    • ADMIN_CONFIG is the path to the config file for the admin cluster.
    • USER_CONFIG is the path to the config file for the user cluster.
    • COMPONENT is cloudauditlogging, usagemetering, or stackdriver.