Skip to main content

Manage GCP service accounts

This page describes how to use and manage service accounts for Anyscale Clouds on GCP.

Within an Anyscale Cloud, clusters run with a service account. Grant proper permissions to this service account for developers to access all required resources.

Default service account​

When you deploy an Anyscale Cloud on GCP, Anyscale configures a default service account that runs all Ray clusters within it. This service account looks like the following:

<Anyscale Cloud ID with dashes, not underscores>@<project_id>.iam.gserviceaccount.com
for example cld-xyzabc@<project_id>.iam.gserviceaccount.com
  • For GCE-based deployments, the project ID is the GCP project associated with your cloud.
  • For legacy GKE deployments, you can find the service account in the Provider Identity column in clouds table on the configurations page.
info

Determine the service account on a running cluster by running:

python -c "import google.auth.transport.requests; c,_=google.auth.default(); \
c.refresh(google.auth.transport.requests.Request()); print(c.service_account_email)"

Use an existing service account​

This section walks through the steps to configure Anyscale Clusters to use an existing service account. For help on how to create a service account, see this guide.

Configure an existing service account​

To use a service account on Anyscale, grant Anyscale access to the service account and then grant the service account access to the GCS Bucket.

Access to the service account​

No additional setup is required for service accounts in the same GCP Project as your Anyscale Cloud. If this doesn't work, ensure the Compute Engine Service Agent has the compute.serviceAgent role on the specified service account.

Service accounts in a separate GCP project require additional configuration:

  1. Disable the iam.disableCrossProjectServiceAccountUsage boolean constraint in the service account's project.

  2. Grant the Compute Engine Service Agent (format below) in the Anyscale Cloud's project the compute.serviceAgent role on the desired service account.

service-<Anyscale Cloud Project Number>@compute-system.iam.gserviceaccount.com

  1. Grant the Anyscale access service account the roles/iam.serviceAccountUser role on the desired service account. This is necessary for the access service account to attach your service account to an instance.

  2. Ensure the service account that you are configuring has read, write, and list access to the Google Storage bucket associated with your Anyscale cloud.

note

The GCP Project returned by Application Default Credentials is the Anyscale Cloud's Project, not the service account's project.

Access to cloud storage​

Anyscale Clusters require permission to read and write from their Anyscale Cloud's GCS Bucket. Grant this service account the Storage Admin role on the GCS Bucket associated with this Cloud to provide the broadest set of permissions.

Configure clusters to use this service account​

With service account setup completed, configure clusters to use it. Use the service account email from the previous step.

  1. Create a new compute config within the cloud tied to the service account.

  2. In the Advanced settings field, paste the following JSON, replacing SERVICE_ACCOUNT_EMAIL with the actual email. You can also define the access scope of your service account.

{
  "instance_properties": {
    "service_accounts": [
      {
        "email": SERVICE_ACCOUNT_EMAIL,
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform"
        ]
      }
    ]
  }
}

Advanced Configuration Field

  1. Create the compute config and ensure that you use this compute config when you launch clusters.
note

Each cluster runs with a single service account and uses the newly configured service account instead of the default.