-
Notifications
You must be signed in to change notification settings - Fork 152
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for GKE Workload Identity #1324
Comments
@nicolas-g Sorry for the late response. AIUI, to get Kanister to work with Workload Identity, it's just a matter of annotating the Kanister's service account with your IAM service account, right? We recently merged #1248 that let you do that. PTAL to see if that resolves your issue. Thanks. |
I will give it a try as soon as I can, @ihcsim thank you for getting back to me. |
This issue is marked as stale due to inactivity. Add a new comment to reactivate it. |
This issue is closed due to inactivity. Feel free to reopen it, if it's still relevant. |
Is your feature request related to a problem? Please describe.
Right now I only see the option to create secrets manually that needs to be added to the Profile.
Creating secrets is not a good practice since they can expire and require manual rotation.
Describe the solution you'd like
Will be great if Kanister can support GKE workload identity.
https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
Environment
Storage Provider: GCP/GCS
Additional context
This is similar to AWS IRSA, or 'IAM Roles for Service Accounts' which I also think is not by supported Kanister but correct me if I'm wrong.
The text was updated successfully, but these errors were encountered: