Hi flyte team, we would like to acquire google ser...
# flyte-supportm
mammoth-quill-44336
03/19/2025, 1:37 PMHi flyte team, we would like to acquire google service account credential in the task, is there any practice? like how to mount the volume to the task? Thanks
e
echoing-account-76888
03/19/2025, 2:31 PMI'm not sure if there is a better way, but you can use
ImageSpec/rootGOOGLE_APPLICATION_CREDENTIALS Copy code
image_spec = ImageSpec(
name="image",
registry="localhost:30000",
copy=["credential.json"],
env={"GOOGLE_APPLICATION_CREDENTIALS": "/root/credential.json"}
)
@task(container_image=image_spec)
...m
mammoth-quill-44336
03/19/2025, 2:34 PMour secops is asking us not to put the credential file into docker image
d
damp-lion-88352
03/19/2025, 2:54 PMare you asking for somthing like pod template?
https://docs.flyte.org/en/latest/deployment/configuration/general.html#deployment-configuration-general
m
mammoth-quill-44336
03/19/2025, 2:55 PMI'll look into this, thanks!
g
gentle-tomato-480
03/19/2025, 4:19 PMAre you running in GKE, @mammoth-quill-44336?
m
mammoth-quill-44336
03/19/2025, 4:20 PM@gentle-tomato-480 yes
mammoth-quill-44336
03/19/2025, 4:21 PMit seems like imagespec packs our credential file automaticallu
mammoth-quill-44336
03/19/2025, 4:21 PMso we are trying to decouple it
g
gentle-tomato-480
03/19/2025, 4:23 PMA cloud vendor agnostic approach is to use secrets https://docs.flyte.org/en/latest/user_guide/productionizing/secrets.html
gentle-tomato-480
03/19/2025, 4:27 PMAnother way would be is to create a k8s service account, annotate it with the google service account like you do with the default service account and add an IAM policy binding for the workload identity federation thing. https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#kubernetes-sa-to-iam
Then for the task you would pass a podtemplate where you specify it to use the newly created k8s service account and then the credentials should be automatically available in the container.
Bit more steps, but then you don't need to use secrets and locally
m
mammoth-quill-44336
03/19/2025, 4:37 PMthanks, will look into it!
c
careful-australia-19356
03/21/2025, 4:49 PMthanks @gentle-tomato-480
hey @mammoth-quill-44336 is it working for you? Do you need additional help?
m
mammoth-quill-44336
03/21/2025, 4:49 PMHi David, we are solving some permission issue here, wheh it comes to technical, i will reach out, thank you so much for following up