-
Notifications
You must be signed in to change notification settings - Fork 104
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Setup: GCP workload identity configuration #366
Conversation
|
||
<a name="bq-name"></a>**BigQuery dataset** requires a BigQuery dataset prefix (e.g. billing_data) in addition to the BigQuery table name. A full example is `billing_data.gcp_billing_export_v1_018AIF_74KD1D_534A2`. | ||
<a name="bq-name"></a>**Service key** If you've created a service account key, copy the contents of the `compute-viewer-kubecost-key.json` file and paste them here (be careful with this!). If you've connected using Workload Identity federation, you should leave this box empty. | ||
|
||
### Configuring using values.yaml (Recommended) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We might want to update WI to be recommended
85b38b5
to
34227c8
Compare
34227c8
to
6748191
Compare
* Set `.Values.kubecostProductConfigs.projectID = <GCP Project ID that contains the BigQuery Export>` | ||
* Set `.Values.kubecostProductConfigs.bigQueryBillingDataDataset = <DATASET.TABLE_NAME that contains the billing export>` | ||
|
||
If you've connected using Workload Identity federation: | ||
* Set `.Values.nodeSelector = iam.gke.io/gke-metadata-server-enabled: "true"` to update the Kubecost deployment to run on nodes that use Workload Identity | ||
* Set `.Values.serviceAccount.annotations = iam.gke.io/gcp-service-account: compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com` where $PROJECT_ID defined in the `gcloud` commands above |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Sean-Holcomb I've also added a nodeSelector
constraint and moved the deployment annotation
to the helm params
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
very good
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
* Set `.Values.kubecostProductConfigs.projectID = <GCP Project ID that contains the BigQuery Export>` | ||
* Set `.Values.kubecostProductConfigs.bigQueryBillingDataDataset = <DATASET.TABLE_NAME that contains the billing export>` | ||
|
||
If you've connected using Workload Identity federation: | ||
* Set `.Values.nodeSelector = iam.gke.io/gke-metadata-server-enabled: "true"` to update the Kubecost deployment to run on nodes that use Workload Identity | ||
* Set `.Values.serviceAccount.annotations = iam.gke.io/gcp-service-account: compute-viewer-kubecost@$PROJECT_ID.iam.gserviceaccount.com` where $PROJECT_ID defined in the `gcloud` commands above |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
very good
Waiting for 1.98 to merge. |
Document steps to set up Workload Identity federation for GCP clusters.