Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doc: Image Repository: GCP: Direct resource access with WIF #656

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Doc: Image Repository: GCP: Direct resource access with WIF #656

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions docs/spec/v1beta2/imagerepositories.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -500,7 +500,7 @@ access to them.

##### Workload Identity

When using Workload Identity to enable access to GCR or Artifact Registry, add
When using Workload Identity to enable access to GCR or Artifact Registry with service account impersonation, add
the following patch to your bootstrap repository, in the
`flux-system/kustomization.yaml` file:

Expand All @@ -527,8 +527,12 @@ The Artifact Registry service uses the permission `artifactregistry.repositories
that is located under the Artifact Registry Reader role. If you are using
Google Container Registry service, the needed permission is instead `storage.objects.list`
which can be bound as part of the Container Registry Service Agent role.
Take a look at [this guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
for more information about setting up GKE Workload Identity.

Take a look at [this guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and
[this guide](https://cloud.google.com/iam/docs/workload-identity-federation-with-kubernetes#authenticate)
for more information about setting up GKE Workload Identity. Note that GCP now recommends using
[direct resource access](https://cloud.google.com/iam/docs/workload-identity-federation#direct-resource-access) as opposed
to service account impersonation when using Workload Identity.

#### Authentication on other platforms

Expand Down