How to manage remote GKE clusters using Workload Identity? #4548
-
|
Hi, What I want to do is, to use a single instance of FluxV2 to manage workloads on multiple remote clusters. We managed to do this before by manually creating user tokens on the remote clusters and putting them inside the Now what I want to do is basically the same, but instead of static tokens I want to use Workload Identity. I have created the necessary SA bindings and have also added the necessary annotation on the Now this is how a kubeconfig manifest generally looks like: I wonder if there is a way to make Flux controllers authenticate via the serviceAccount token instead of this |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments
-
|
Is this possible wrt flux? Looking at the source-code, it doesn't seem to be as the If GCP WiF is possible with respect to storage it should be allowed for GKE Service Accounts. Argo support it - https://github.com/argoproj/argo-cd/blob/master/cmd/argocd-k8s-auth/commands/gcp.go as well. Would be a lovely feature to have! |
Beta Was this translation helpful? Give feedback.
-
|
We will investigate a solution for this after the implementation of RFC-0010, you can track it here: #5022 |
Beta Was this translation helpful? Give feedback.
-
|
This is being introduced here and will be released in Flux 2.7 |
Beta Was this translation helpful? Give feedback.
-
|
Implemented in kustomize-controller here: fluxcd/kustomize-controller#1476 |
Beta Was this translation helpful? Give feedback.
Implemented in kustomize-controller here: fluxcd/kustomize-controller#1476
Implemented in helm-controller here: fluxcd/helm-controller#1249