TLDR; Configuring cluster resources in Helm chart (on GCP) - specific for permissions with IAM service accounts Hi! I have some issues with configuring cluster resources for IAM permissions (in Console and CLI) I deployed Flyte helm chart on GCP and configured

cluster_resource_manager

as documented, but still getting permissions errors. I followed the documentation, specifically in here: https://docs.flyte.org/en/latest/deployment/configuration/general.html#cluster-resources This is my configuration in `values.yaml`:

configmap:
  domain:
    domains:
      - id: development
        name: development
      - id: staging
        name: staging
  namespace_config:
    namespace_mapping:
      template: "{{ domain }}"
cluster_resource_manager:
  config:
    cluster_resources:
      customData:
        - development:
          - projectQuotaCpu:
              value: "5"
          - projectQuotaMemory:
              value: 4000Mi
          - gsa:
              value: <mailto:flyte@projectid.iam.gserviceaccount.com|flyte@projectid.iam.gserviceaccount.com>
        - staging:
          - projectQuotaCpu:
              value: "5"
          - projectQuotaMemory:
              value: 4000Mi
          - gsa:
              value: <mailto:flyte@projectid.iam.gserviceaccount.com|flyte@projectid.iam.gserviceaccount.com>
  templates:
    - key: aa_namespace
      value: |
        apiVersion: v1
        kind: Namespace
        metadata:
          name: {{ namespace }}
        spec:
          finalizers:
          - kubernetes
    - key: aab_default_service_account
      value: |
        apiVersion: v1
        kind: ServiceAccount
        metadata:
          name: default
          namespace: {{ namespace }}
          annotations:
            <http://iam.gke.io/gcp-service-account|iam.gke.io/gcp-service-account>: <mailto:flyte@projectid.iam.gserviceaccount.com|flyte@projectid.iam.gserviceaccount.com>
    - key: ab_project_resource_quota
      value: |
        apiVersion: v1
        kind: ResourceQuota
        metadata:
          name: project-quota
          namespace: {{ namespace }}
        spec:
          hard:
            limits.cpu: {{ projectQuotaCpu }}
            limits.memory: {{ projectQuotaMemory }}

In console, I don’t see any IAM and serviceaccounts assigned to the project (attached a screenshot). Using

pyflyte

, I’m trying to run the

hello-world

workflow (I use the basic workflow just for testing, it’s from

flytesnacks/cookbook/core/flyte_basics/hello_world.py

) - and I get 403 Permissions denied. Is there something I need to configure in the workflow itself / in

./flyte/config.yaml

?

@Ariel Kaspit can you check if the corresponding ConfigMap is in place with the correct info? it should be:

kubectl describe cm flyte-clusterresourcesync-config -n <your-flyte-namespace>

There's another way to specify the service account running workflows should use depending on project/domains: https://docs.flyte.org/projects/flytectl/en/latest/gen/flytectl_update_workflow-execution-config.html#id1 But it's not the same outcome as doing it from the Helm chart

@David Espejo (he/him) Thanks for the answer. Yes, the configmap is in place with this configuration:

Data
====
domain.yaml:
----
domains:
- id: development
  name: development
- id: staging
  name: staging

namespace_config.yaml:
----
namespace_mapping:
  template: '{{ domain }}'

cluster_resources.yaml:
----
cluster_resources:
  customData:
  - development:
    - projectQuotaCpu:
        value: "5"
    - projectQuotaMemory:
        value: 4000Mi
    - gsa:
        value: <mailto:xxx@projectid.iam.gserviceaccount.com|xxx@projectid.iam.gserviceaccount.com>
  - staging:
    - projectQuotaCpu:
        value: "5"
    - projectQuotaMemory:
        value: 4000Mi
    - gsa:
        value: <mailto:xxx@projectid.iam.gserviceaccount.com|xxx@projectid.iam.gserviceaccount.com>
  refresh: 5m
  refreshInterval: 5m
  standaloneDeployment: false
  templatePath: /etc/flyte/clusterresource/templates

clusters.yaml:
----
clusters:
  clusterConfigs: []
  labelClusterMap: {}

@Ariel Kaspit can you try using

defaultIamRole

cluster_resources:
      customData:
      - development:
        - defaultIamRole:
            value: <mailto:xxx@projectid.iam.gserviceaccount.com|xxx@projectid.iam.gserviceaccount.com>

instead of

gsa

?

Still get the same. no change

@Ariel Kaspit That's great and thanks for sharing!