Configure the MART service account

This topic explains how to configure the MART service account.

Adding the MART service account

MART and Apigee Connect require a Google Cloud service account for authentication.

Note: Installations on GKE using workload identity do not require a Google Cloud service account key file (.json). See Enabling Workload Identity with Apigee hybrid.

Locate the key file for the apigee-mart service account. The file should have a .json extension.
```
ls $HYBRID_FILES/service-accounts
```
- PROD installations: apigee-mart.json
- NON-PROD installations: apigee-non-prod.json

If you do not see the MART service account file, create and download it with the create-service-account utility:

Make sure your PROJECT_ID environment variable is set:
```
echo $PROJECT_ID
```
Define it if needed:
```
export PROJECT_ID=my-project-id
```

Create the MART service account. You can find the create-service-account tool in:

For Helm Charts installations:

APIGEE_HELM_CHARTS_HOME/
└── apigee-operator/
    └── etc/
        └── tools/
            └── create-service-account

For apigeectl installations:

APIGEECTL_HOME/
└── tools/
    └── create-service-account

PROD

create-service-account \
  --env prod \
  --profile apigee-mart \
  --dir PATH_TO_SERVICE_ACCOUNTS_DIR

NON-PROD

$HYBRID_FILES/tools/create-service-account \
  --env non-prod \
  --profile apigee-mart \
  --dir PATH_TO_SERVICE_ACCOUNTS_DIR

Edit your overrides.yaml file and add the key file path to the connectAgent and mart.serviceAccountPath properties:

PROD

connectAgent:
  serviceAccountPath: path_to_apigee-mart.json

mart:
  serviceAccountPath: path_to_apigee-mart.json

NON-PROD

connectAgent:
  serviceAccountPath: path_to_apigee-non-prod.json

mart:
  serviceAccountPath: path_to_apigee-non-prod.json

For example:

Helm

...
      connectAgent:
        serviceAccountPath: /apigee/hybrid/helm-charts/apigee-org/apigee-mart.json

      mart:
        serviceAccountPath: /apigee/hybrid/helm-charts/apigee-org/apigee-mart.json
      ...

`apigeectl`

...
connectAgent:
  serviceAccountPath: /apigee/hybrid/hybrid-files/service-accounts/apigee-mart.json

mart:
  serviceAccountPath: /apigee/hybrid/hybrid-files/service-accounts/apigee-mart.json
...

Apply your changes:
Helm
```
helm upgrade ORG_NAME apigee-org/ \
  --namespace apigee \
  --atomic \
  -f OVERRIDES_FILE.yaml
```
Note: If you see an error saying Error: UPGRADE FAILED: "ORG_NAME" has no deployed releases, replace upgrade with install and try the command again.
apigeectl
```
$APIGEECTL_HOME/apigeectl apply -f OVERRIDES_FILE.yaml --org
```