// Module included in the following assemblies:
//
// * osd_planning/gcp-ccs.adoc
:_mod-docs-content-type: PROCEDURE
[id="ccs-gcp-customer-procedure-sa_{context}"]

= Service account authentication type procedure
// TODO: Same as other module - Better procedure heading that tells you what this is doing

[role="_abstract"]
Besides the required customer procedures listed in _Required customer procedure_, there are other specific actions that you must take when creating an {product-title} cluster on {GCP} using a service account as the authentication type.

.Procedure

. To ensure that Red Hat can perform necessary actions, you must create an `osd-ccs-admin` IAM link:https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account[service account] user within the {gcp-short} project.

+

The following roles must be link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource[granted to the service account]:
+
.Required roles
[cols="2a,3a",options="header"]

|===

|Role|Console role name

|Compute Admin
|`roles/compute.admin`

|DNS Administrator
|`roles/dns.admin`

|Organization Policy Viewer
|`roles/orgpolicy.policyViewer`

|Service Management Administrator
|`roles/servicemanagement.admin`

|Service Usage Admin
|`roles/serviceusage.serviceUsageAdmin`

|Storage Admin
|`roles/storage.admin`

|Compute Load Balancer Admin
|`roles/compute.loadBalancerAdmin`

|Role Viewer
|`roles/viewer`

|Role Administrator
|`roles/iam.roleAdmin`

|Security Admin
|`roles/iam.securityAdmin`

|Service Account Key Admin
|`roles/iam.serviceAccountKeyAdmin`

|Service Account Admin
|`roles/iam.serviceAccountAdmin`

|Service Account User
|`roles/iam.serviceAccountUser`

|===

+

. link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Create the service account key] for the `osd-ccs-admin` IAM service account. Export the key to a file named `osServiceAccount.json`; this JSON file will be uploaded in {cluster-manager-first} when you create your cluster.

