Implementation:Kubeflow Pipelines GCP Workload Identity Setup
| Knowledge Sources | |
|---|---|
| Domains | GCP, Security, Deployment |
| Last Updated | 2026-02-13 14:00 GMT |
Overview
Interactive shell script that configures GKE Workload Identity bindings between Google Service Accounts and Kubernetes Service Accounts for secure KFP deployment on GCP.
Description
This script (202 lines) creates two Google Service Accounts (system GSA and user GSA), then binds KFP system KSAs (ml-pipeline-ui, visualization server, optionally minio-gcs-gateway and cloudsql-proxy) to the system GSA and user KSAs (pipeline-runner, container-builder, viewer) to the user GSA. Uses `gcloud iam service-accounts add-iam-policy-binding` for IAM bindings and `kubectl annotate` for KSA annotations. Workload Identity eliminates the need for exported service account keys.
Usage
Run this script interactively after deploying KFP on GKE with Workload Identity enabled. It configures the identity bindings needed for KFP components to authenticate with GCP services.
Code Reference
Source Location
- Repository: Kubeflow_Pipelines
- File: manifests/kustomize/gcp-workload-identity-setup.sh
- Lines: 1-202
Signature
#!/bin/bash
# Usage: ./gcp-workload-identity-setup.sh
# Requires: gcloud, kubectl configured for target cluster
# Environment: GKE cluster with Workload Identity enabled
Import
# Run directly
chmod +x gcp-workload-identity-setup.sh
./gcp-workload-identity-setup.sh
I/O Contract
Inputs
| Name | Type | Required | Description |
|---|---|---|---|
| GCP project | interactive | Yes | GCP project ID for GSA creation |
| GKE cluster | kubectl config | Yes | Target cluster with Workload Identity enabled |
| KFP namespace | interactive | Yes | Namespace where KFP is deployed |
Outputs
| Name | Type | Description |
|---|---|---|
| System GSA | Google Service Account | For KFP system components (UI, visualization) |
| User GSA | Google Service Account | For pipeline execution (runner, builder, viewer) |
| IAM bindings | side effect | Workload Identity bindings between GSAs and KSAs |
| KSA annotations | side effect | iam.gke.io/gcp-service-account annotations on KSAs |
Usage Examples
Running the Setup
# Ensure gcloud and kubectl are configured
gcloud container clusters get-credentials my-cluster --zone us-central1-a
# Run the setup script
cd manifests/kustomize/
./gcp-workload-identity-setup.sh
# Follow interactive prompts for project, namespace, and GSA names
# Script will print required IAM role grants at the end