GKE Workload Identity

GKE Workload Identity allows Spice.ai pods on Google Kubernetes Engine to authenticate as a Google Cloud service account for accessing GCP services (GCS, BigQuery, Secret Manager, etc.).

Configuration

Annotate the Spice ServiceAccount with the GCP service account email:

Helm Chart

serviceAccount:
  create: true
  annotations:
    iam.gke.io/gcp-service-account: my-gcp-sa@my-project.iam.gserviceaccount.com

SpicepodSet (Kubernetes Operator)

apiVersion: spice.ai/v2
kind: SpicepodSet
metadata:
  name: my-spicepod
spec:
  replicas: 1
  serviceAccount:
    enabled: true
    create: true
    annotations:
      iam.gke.io/gcp-service-account: my-gcp-sa@my-project.iam.gserviceaccount.com
  spicepod:
    name: my-spicepod
    kind: Spicepod
    version: v1

Prerequisites

1. Enable Workload Identity on your GKE cluster.
2. Create a GCP service account with the required IAM roles.
3. Bind the Kubernetes ServiceAccount to the GCP service account:

gcloud iam service-accounts add-iam-policy-binding \
  my-gcp-sa@my-project.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:my-project.svc.id.goog[NAMESPACE/SERVICE_ACCOUNT_NAME]"

Replace NAMESPACE with the namespace of the Spice pods and SERVICE_ACCOUNT_NAME with the name of their ServiceAccount. A ServiceAccount that the operator creates with no name takes the name of the SpicepodSet, so the example above uses my-spicepod.