The page provides you with an overview of the different installations options you can use when installing Config Connector.
You can install Config Connector in one of two ways:
Using the Google Kubernetes Engine (GKE) Config Connector add-on: The Config Connector add-on lets you install Config Connector during cluster creation. Due to the Config Connector add-on's simplicity, we recommend this method for most users. The Config Connector add-on is only available on GKE Standard clusters, and not supported in Autopilot. If you want to reduce the operational cost of managing a GKE Standard cluster, consider using Config Controller.
Manual installation: To use manual installation, you need to download and use a Kubernetes Operator. Manual installations track the current release of Config Connector more closely; the Operator applies new versions faster than the add-on. If you want to install Config Connector on other Kubernetes distributions you need to use a manual installation.
If you want to install Config Connector on GKE clusters, Workload Identity is the recommended approach. Workload Identity binds a Kubernetes service account to a Google service account. Config Connector then uses the Kubernetes service account within your cluster to create new resources. Config Connector can only create resources with the roles that you grant the Google service account.
If you want to install Config Connector on other Kubernetes distributions , you should use Cloud Identity instead of Workload Identity. This option requires you to create a Google service account key and import the key's credentials as a Secret to your clusters. You are responsible for rotating the key credentials when necessary.
Managing resources with service accounts
You can choose to manage resources with a single service account, or multiple service accounts.
Single service account
When you install Config Connector with the GKE add-on or manual
installation, you can use cluster mode for your
With cluster mode, you can use a single Google service account to create and manage
resources, even if you are using Config Connector to manage multiple projects.
The following diagram shows you how this mode works:
Multiple service accounts
You can use multiple service accounts by using namespaced mode for your
ConfigConnector CustomResource. Namespaced mode lets you manage multiple
projects with multiple Google service accounts bound to your Config Connector
The following diagram shows you an overview of how namespaced mode works:
In namespaced mode, each Google service account is bound to a namespace by default. When you create resources within that namespace, Config Connector uses this service account to create Google Cloud resources.
Choose namespaced mode if you:
- Want to manage resources in multiple Google Cloud projects.
- Want to select a different Google service account to manage the resources in each project.
To learn how to configure namespaced mode, see Installing Config Connector using a namespaced mode.
- Learn about Identity and Access Management service accounts.
- Learn how to install Config Connector as a GKE add-on.
- Learn how to install Config Connector on other Kubernetes distributions.
- Learn how to manually install Config Connector.