Creating a service account to use a key encryption key

Before you begin

Download the following files:

• kek_serviceaccount.yaml
• kek_role.yaml
• kek_rolebinding.yaml
• sts-utility-sa.yml
• sts-utility-role.yml
• sts-utility-rolebinding.yml

To create a service account, role, and role binding

1. In the kek_serviceaccount.yaml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the service account name in the file.
      The service account name must be sa-cm-secrets-reader-writer.
2. In the kek_role.yaml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the role name in the file.
      The role name must be role-cm-secrets-reader-writer.
3. In the kek_rolebinding.yaml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the role binding name in the file.
      The role binding name must be role rb-cm-secrets-reader-writer.
4. In the sts-utility-sa.yml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the service account name in the file.
      The service account name must be sts-utility.
5.  In the sts-utility-role.yml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the role name in the file.
      The role name must be sts-utility-role.
6. In the sts-utility-rolebinding.yml file, update the following parameters:
   1. Replace the <<ITSM NAMESPACE>> parameter with your BMC Helix Innovation Suite namespace name.
   2. Make sure that you do not modify the role binding name in the file.
      The role binding name must be role sts-utility-role-binding.
7. On the Deployment Engine that is your Jenkins server, run the following commands:
   1. To create the service account, run the following command:  kubectl create -f kek_serviceaccount.yaml
   2. To create the role, run the following command:  kubectl create -f kek_role.yaml

   3. To create role binding, run the following command:

      kubectl create -f kek_rolebinding.yaml

   4. To associate the service account with your StatefulSet, run the following command:

      kubectl create -f sts-utility-sa.yml

   5. To associate the role with your StatefulSet, run the following command:

      kubectl create -f sts-utility-role.yml 

   6. To associate the role binding with your StatefulSet, run the following command:

      kubectl create -f sts-utility-rolebinding.yml 

8. Confirm that the service account, role, and role binding are created by using the following commands:

   kubectl get serviceaccount -n <BMC Helix Innovation Suite namespace>
   kubectl get role -n <BMC Helix Innovation Suite namespace>
   kubectl get rolebinding -n <BMC Helix Innovation Suite namespace>

Where to go from here

Performing-the-BMC-Helix-Service-Management-installation