Ajay tripathy gcp key

[AjayTripathy]

Fixes #498

Add a secret to the same name as kubecost like this:

kubectl create secret generic gcp-secret --from-file compute-viewer-kubecost-key.json -n kubecost

the secret has form

{
  "type": "service_account",
  "project_id": "",
  "private_key_id": "07ea38ce0e4969ec8be4883d9ffe6941c478165c",
  "private_key": "-----BEGIN PRIVATE KEY-----foo-----END PRIVATE KEY-----\n",
  "client_email": "compute-viewer-kubecost@guestbook-227502.iam.gserviceaccount.com",
  "client_id": "103549887095203286466",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/compute-viewer-kubecost%40guestbook-227502.iam.gserviceaccount.com"
}

and can be created via the following steps:

export PROJECT_ID=$(gcloud config get-value project)
gcloud iam service-accounts create compute-viewer-kubecost --display-name "Compute Read Only Account Created For Kubecost" --format json
gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com --role roles/compute.viewer
gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com --role roles/bigquery.user
gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com --role roles/bigquery.dataViewer
gcloud iam service-accounts keys create ./compute-viewer-kubecost-key.json --iam-account compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com

Tested by adding a secret and checking it is placed in the correct filepath.

[dwbrown2]

is this intentional? actually feels like a potential improvement if it doesn't cause errors

[jdn-za]

If the secret is applied after the initial deployment of the cost-analyzer chart, would a simple restart of the kubecost-cost-analyzer be required?

[AjayTripathy]

Yes-- a restart is required to pick up the new secret.