Apigee hybrid service account

[aramkrishna6]

Per listed link, which list service account for Apigee hybrid.

Do we require separate service for Apigee Connect Agent  ? and also for mart service account..

listed table does not indicate about Connect Agent service account in the list 

About service accounts  |  Apigee X  |  Google Cloud

@dino 

[ganadurai]

Apigee Connect enables a channel for communication from Mgmt plane to MART service in Runtime plane. So the Service Account attached to MART should have the permission "apigeeconnect.endpoints.connect".

Apigee Connect service is an enabler for MART, so there is no specific SA needed for Connect agent. You can find more info here.

Thanks

[aramkrishna6]

@ganadurai  Does this means that if mart SA is with permission "apigeeconnect.endpoints.connect" access then we will not require Apigee Connect service account. Or not sure, in any other cases Apigee Connect service account is required if not for this ?

[kidiyoor]

Currently connect and mart uses default k8s service account in. Since these application do not talk to apiserver, it doesn't special k8s roles. It not a good practice to use default k8s service account hence we will create dedicated k8s service account for both the components with no k8s roles in upcoming releases.