Search code examples
kubernetesdeploymentgcloudservice-accounts

Unable to pass service account in gcloud run deploy command. Getting regex validation error for the passed service account

In Sandbox environment I can see the service account for the deployed container and we can access all the data. but while deploying the container in dev environment I can't see the service account in GKE project. Please check the below image for reference. So, I am trying to pass the service account in gcloud run command with below command, but getting regex error.

enter image description here

gcloud run deploy $service_name \
--no-cpu-throttling \
--image=$image_name \
--project=$GKE_PROJECT \
--platform=gke \
--cluster=$CLUSTER \
--cluster-location=$CLUSTER_LOCATION \
--impersonate-service-account=$IMP_SERVICE_ACCOUNT \
--service-account=$SERVICE_ACCOUNT \
--namespace=$test

Error: (gcloud.run.deploy) HTTPError 400: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"admission webhook "validation.webhook.serving.knative.dev" denied the request: validation failed: invalid value: [email protected]: spec.template.spec.serviceAccountName\na lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is 'a-z0-9?(\.a-z0-9?)*')","reason":"BadRequest","code":400}

I can see this service account has editor and service account user roles. tried with different service accounts but still getting same erorr.

enter image description here

Solution

  • The command gcloud run deploy is used to deploy a container to Cloud Run. While you deploy container images to Google Cloud Run and when you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace.
    As the error describes, there seems to be an issue with the naming annotation.The name of a ServiceAccount object must be a valid DNS subdomain name. As the error also mentions the name should be valid for the RFC 1123 label, check for the naming rules,which includes as below.

    RFC 1123 Label Names
    Some resource types require their names to follow the DNS label standard as defined in RFC 1123.
    This means the name must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or '-' start with an alphanumeric character
    • end with an alphanumeric character

    You may want to verify these standards and check again to see if this works.

    Also please note that the Service account is associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. For the managed platform, this is the email address of an IAM service account. For the Kubernetes-based platforms (gke, kubernetes), this is the name of a Kubernetes service account in the same namespace as the service. If not provided, the revision will use the default service account of the project, or default Kubernetes namespace service account respectively.