About g3289ds

g3289ds

https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity has two methods to configure workload identify federation. One is to create an iam policy via a binding with a kubernetes service account. The alternative is to "link Kubernetes...

g3289ds · 03-27-2024

Lets say I have a configuration cluster that goes down:1. Before switching config cluster to another cluster, I would first need to somehow sync the Gateway, HealthCheckPolicy, HTTPRoute, etc.. to the secondary cluster beforehand since configuration ...

g3289ds · 03-27-2024

https://cloud.google.com/kubernetes-engine/docs/how-to/enabling-multi-cluster-gateways#enable_multi-cluster_gateway_in_the_fleet andhttps://cloud.google.com/kubernetes-engine/docs/how-to/multi-cluster-ingress-setup#specifying_a_config_cluster show ho...

g3289ds · 02-08-2024

I am looking to create a kubernetes gateway with an internal ip. I see I would need a gatewayclass to be one of gke-l7-rilb gke-l7-rilb-mc. I see on https://cloud.google.com/kubernetes-engine/docs/how-to/gatewayclass-capabilities#spec-rules-backendre...

g3289ds · 02-05-2024

I am trying to set up a multicluster gateway. We are planning to have many different domains mapped to a single ip. I see that this would be done with URLRewrite with HTTPRoute. I also followed the enabling multicluster documentation. I was using the...

g3289ds

@videap It works, but you have to modify it using a gateway class that allows external ip. The table listing them is near where link takes you. Here is a resource showing the capabilities of the different gateway classes: https://cloud.google.com/kub...

g3289ds

I wanted to do alternative because we may need cloud functions or one of the many other functions listed in https://cloud.google.com/iam/docs/federated-identity-supported-services. But this clarifies things. For the alternative method is there a way ...

g3289ds

"But in that case would it be more manageable to create IAM policies that directly reference the associated k8s SA without adding the IAM SA on top?"Can you show how to do this?

g3289ds

Can you clarify what you mean by dedicated service account? Are you referring to KSAs or dedicated IAM service account? To be clear I was talking about for each service an IAM service account and ksa pair would be created. I don't understand how bind...

g3289ds

@AlfredBAdditionally, when would the resources ever be identical if different clusters have different names and different regions?

My Stats

EdRamos's Bio

Badges g3289ds Earned

Recent Activity

Question about best practices for service accounts GKE Autopilot

GKE Autopilot: Clarification about cluster configuration outages

GKE Autopilot: Multicluster gateway: What commands to use to switch to another configuration cluster

How to specify BackendRefs for gke-l7-rilb or gke-l7-rilb-mc gatewayclass?

How to get URLRewrite working for global gateway

Re: How to assign non ephemeral global static ip to API Gateway (GKE Autopilot)

Re: Question about best practices for service accounts GKE Autopilot

Re: Question about best practices for service accounts GKE Autopilot

Re: Question about best practices for service accounts GKE Autopilot

Re: GKE Autopilot: Clarification about cluster configuration outages