Creating a New Service Account

Veeam Kasten requires a newly created service account to contain the following roles:

roles/compute.storageAdmin

Note

Currently, the Google Service Account key needs to be created in the same GCP account as the GKE cluster.

The following steps should be used to create the service account and add the required permissions:

$ myproject=$(gcloud config get-value core/project)
$ gcloud iam service-accounts create k10-test-sa --display-name "K10 Service Account"
$ k10saemail=$(gcloud iam service-accounts list --filter "k10-test-sa" --format="value(email)")
$ gcloud iam service-accounts keys create --iam-account=${k10saemail} k10-sa-key.json
$ gcloud projects add-iam-policy-binding ${myproject} --member serviceAccount:${k10saemail} --role roles/compute.storageAdmin

Installing Veeam Kasten with the new Service Account

Use the base64 tool to encode the k10-sa-key.json file generated above, and then install Veeam Kasten with the newly created credentials.

$ sa_key=$(base64 -w0 k10-sa-key.json)
$ helm install k10 kasten/k10 --namespace=kasten-io --set secrets.googleApiKey=$sa_key

Using a Custom Project ID

If the Google Service Account belongs to a project other than the one in which the cluster is located, then the project's ID for the cluster must also be provided during the installation.

$ sa_key=$(base64 -w0 k10-sa-key.json)
$ helm install k10 kasten/k10 \
      --namespace=kasten-io \
      --set secrets.googleApiKey=$sa_key \
      --set secrets.googleProjectId=<project-id>

Existing Secret Usage

It is possible to use an existing secret to provide Service Account and Project ID.

To do so, the following Helm option can be used:

--set secrets.googleClientSecretName=<secret name>

Note

Please ensure that the secret exists in the namespace where Veeam Kasten is installed. The default namespace assumed throughout this documentation is kasten-io.

apiVersion: v1
kind: Secret
metadata:
  name: my-google-creds
  namespace: kasten-io
data:
  google-api-key: MjMzODAyNWMEXAMPLEAPIKEY
  google-project-id: UlVMOFF+dnpwM1EXAMPLEPROJECTID
type: Opaque