You can use Google service accounts to give your Knative serving services the necessary permissions to access Google Cloud services, for example Cloud Monitoring. Each service account let you define a specific set of Identity and Access Management (IAM) permissions that you can associate with each of your services through Kubernetes Secrets.
To create a service account, you can use the following steps that are provided here for convenience. For complete details about creating and managing service accounts, see the Identity and Access Management documentation.
Console
To create a service account and then download the JSON key file using the Google Cloud console:
Go to the Service Accounts page in Google Cloud console.
Click add Create Service Account.
Under Service account details, specify a name of your choice in Service account name.
Optionally, modify the Service account ID and add a description.
Click Create and continue.
Under Grant this service account access to a project, from the Select a role drop-down list, select one or more roles for which you the permissions granted to the service account. For example, Monitoring Metric Writer role.
Click Continue, to
Optionally, you can specify users or groups who you want to associate with the service account.
Click Done to create the service account.
In the list of service accounts, next to the service account you created, click more_vert Actions > Manage keys.
Click Add Key > Create a new key.
Under Key type, select JSON.
Click Create.
gcloud
See the following pages to learn how to use the gcloud CLI to:
After you create a key and download the JSON file which contains the credentials of your service account, you use that key to create a secret that you can then associate with your Knative serving services.
See Using secrets to learn how to create and then associate secrets with your services.
Next steps
Learn how to manage access to your services.