Service account for CI

Create SA for pipelines; bind least-privilege roles separately

yc iam service-account create --name sa-ci --description 'CI deployer'
tool
yc32 commands
tags
yciamcisecurity

More yc commands

  • Authorized key for SA
    yc iam key create --service-account-name sa-ci --output key.json

    Authorized key JSON for non-interactive auth; note: rotate & vault it

  • Grant role to SA
    yc resource-manager folder add-access-binding <id> --role editor --service-account-name sa-ci

    Scope-bind a role at folder level; prefer narrow roles over editor

  • Write kubeconfig for cluster
    yc managed-kubernetes cluster get-credentials <name> --external --force

    Merge external endpoint into kubeconfig; drop --external for internal VPC

  • List clusters as JSON
    yc managed-kubernetes cluster list --format json | jq -r '.[]|[.name,.status,.id]|@tsv'

    Tabulate cluster name/status/id for scripting and audits

  • Create autoscaling node group
    yc managed-kubernetes node-group create --cluster-name <name> --name ng-1 --platform standard-v3 --auto-scale min=1,max=5,initial=2 --location zone=ru-central1-a

    Cluster autoscaler node group with min/max bounds in one zone

all 32 yc commands