GKE项目缺失服务账户：重建集群配置数据库加密遇阻

尝试为GKE私有集群配置数据库加密，此前执行过destroy操作销毁集群，现在重建时遇到问题：

• Terraform计划显示将创建KMS密钥的IAM成员绑定，指向服务账户service-<project_number>@container-engine-robot.iam.gserviceaccount.com
• 执行terraform apply时报错，提示该服务账户不存在

Terraform计划输出：

# module.private_cluster.google_kms_crypto_key_iam_member.gke_database_encryption_key will be created
  + resource "google_kms_crypto_key_iam_member" "gke_database_encryption_key" {
      + crypto_key_id = "projects/my-project/locations/europe-west2/keyRings/prod-keyring/cryptoKeys/prod-gke-encryption-key"
      + etag          = (known after apply)
      + id            = (known after apply)
      + member        = "serviceAccount:service-<project_number>@container-engine-robot.iam.gserviceaccount.com"
      + role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
    }

报错信息：

│ Error: Error applying IAM policy for KMS CryptoKey "projects/my-project/locations/europe-west2/keyRings/prod-keyring/cryptoKeys/prod-gke-encryption-key": 
  Error setting IAM policy for KMS CryptoKey "projects/my-project/locations/europe-west2/keyRings/prod-keyring/cryptoKeys/prod-gke-encryption-key": googleapi: 
  Error 400: Service account service-<project_number>@container-engine-robot.iam.gserviceaccount.com does not exist., badRequest
│ 
│   with module.private_cluster.google_kms_crypto_key_iam_member.gke_database_encryption_key,
│   on ../../../modules/private_cluster/kms.tf line 18, in resource "google_kms_crypto_key_iam_member" "gke_database_encryption_key":
│   18: resource "google_kms_crypto_key_iam_member" "gke_database_encryption_key" {

相关KMS Terraform代码：

resource "google_kms_crypto_key" "gke_database_encryption_key" {
  name     = var.kms_gke_encryption_key
  key_ring = google_kms_key_ring.kms_keyring.id
  purpose  = "ENCRYPT_DECRYPT"
  # rotation_period = "0s"

  lifecycle {
    prevent_destroy = true
  }
}

resource "google_kms_crypto_key_iam_member" "gke_database_encryption_key" {
  crypto_key_id = google_kms_crypto_key.gke_database_encryption_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:service-${var.project_number}@container-engine-robot.iam.gserviceaccount.com"
}

询问：是否可以事后创建该服务账户，还是需要新建项目重新开始？

不需要新建项目，可通过以下步骤恢复服务账户并解决时序问题：

1. 恢复GKE默认服务账户 #

该账户是GKE的Container Engine Robot服务账户，属于Google管理的服务身份，首次启用GKE API时自动生成。若被意外删除，按以下步骤恢复：

• 确认GKE API是否启用：

gcloud services list --enabled | grep container.googleapis.com

• 若未启用，先启用API：

gcloud services enable container.googleapis.com

• 若API已启用但账户仍不存在，执行命令重新生成服务身份：

gcloud beta services identity create --service=container.googleapis.com --project=你的项目ID

此命令会重新创建对应的service-<project_number>@container-engine-robot.iam.gserviceaccount.com账户。

2. 修复Terraform资源时序问题 #

当前KMS IAM绑定资源未依赖GKE集群资源，导致Terraform会先尝试创建IAM绑定，而此时集群尚未创建、服务账户也未生成。需为IAM资源添加依赖：

resource "google_kms_crypto_key_iam_member" "gke_database_encryption_key" {
  crypto_key_id = google_kms_crypto_key.gke_database_encryption_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:service-${var.project_number}@container-engine-robot.iam.gserviceaccount.com"
  
  # 添加依赖，确保集群创建完成后再绑定IAM
  depends_on = [module.private_cluster.google_container_cluster.集群资源名称]
}

替换集群资源名称为私有集群模块中实际的Google容器集群资源名称。

3. 重新执行Terraform #

完成上述步骤后，重新运行：

terraform apply

内容的提问来源于stack exchange，提问作者markwalker_