title: Propagating google service account keys in large on-prem hadoop cluster for distCP -> HCFS->GCS
body: <p>As the title describes, I am trying to glean some details about how service accounts (multiple service accounts across a large cluster) can be handled in a secure manner in a large hadoop on-premesis cluster that runs workflows across many different teams.</p>
  <p>What's an effective way to manage propagation of these keys so they're available across data nodes without also making it available to multiple other different users? I know there are certain parameters one must pass through to core-site.xml but this is at a cluster level, how can this be done in a secure manner just for my project?</p>
  <p>I will have workflows scheduled via oozie jobs which push a subset of data in the direction of GCS (I already know this is possible manually, just using gsutil)</p>