- Adds service account associated to each compute instance with read only access (needed for prometheus self discovery) - adds DNS routing *.name == name so that subdomains are routed to the same server (useful when multiple services run on the same server)