Skip to main content

Creating secrets for GCP experiments

This section describes the steps you can follow to create a secret to execute GCP chaos experiments.

Step 1: Create a service account

Create a service account to derive the authentication secret to run experiments on GCP. To create the service account and secret:

  1. Set your current project. Replace <project-id> with your project ID:
gcloud config set project <project-id>
  1. Create a new service account. Replace <service-account-name> with the name you want to give to the service account:
gcloud iam service-accounts create <service-account-name>

Step 2: Generate new JSON key file

  1. After you create a new service account, generate a new JSON key file. Replace <service-account-name> with the name of your service account and <key-file> with the path where you want to save the key file:
gcloud iam service-accounts keys create <key-file> \
--iam-account <service-account-name>@<project-id>

The generated JSON key file will contain the fields you mentioned, and it looks something like this:

"type": "service_account",
"project_id": "<project-id>",
"private_key_id": "<private-key-id>",
"private_key": "<private-key>",
"client_email": "<service-account-name>@<project-id>",
"client_id": "<client-id>",
"auth_uri": "",
"token_uri": "",
"auth_provider_x509_cert_url": "",
"client_x509_cert_url": "<service-account-name>%40<project-id>"

Step 3: Prepare the secret YAML

  1. Based on the JSON key file you created earlier, prepare the secret YAML:
  apiVersion: v1
kind: Secret
name: cloud-secret
type: Opaque
type: "<type>"
project_id: "<project-id>"
private_key_id: "<private-key-id>"
private_key: <private-key>
client_email: "<client-email>"
client_id: "<client-id>"
auth_uri: "<auth-uri>"
token_uri: "<token-uri>"
auth_provider_x509_cert_url: "<auth-provider-x509-cert-url>"
client_x509_cert_url: "<client-x509-cert-url>"

Newline (\n) characters within the private key are crucial. Avoid using double quotes to prevent their loss.

Step 4: Apply the secret YAML in desired namespace

  1. Apply the secret YAML file you created earlier in the chaos infrastructure namespace using the command:
kubectl apply -f secret.yaml -n <CHAOS-NAMESPACE>