Choosing an installation type


You can install Config Connector in one of the following ways:

  • A Google Cloud Identity Service Account,
  • A Google Kubernetes Engine (GKE) Workload Identity, or
  • Namespaced mode, to support managing multiple Projects, each with their own Google Cloud identities.

Installation modes and service accounts

The installation mode you choose determines the number of service accounts that can create resources.

Both the Google Cloud Identity and Workload Identity installation options use a single service account to create and manage resources, even if you are using Config Connector to manage multiple projects.

Diagram showing Config Connector managing multiple Projects using the same service account

Namespaced mode installation allows you to use multiple service accounts for multiple Projects.

Diagram showing Config Connector managing multiple Projects using the two different service accounts

Each of these modes is described in the following sections.

Google Cloud Identity

The easiest way to install Config Connector is with a single Google Cloud service account.

By default, your project's Compute Engine service account is granted the editor role, which will allow Config Connector to create most resources, with the exception of certain Organization-level features such as Identity and Access Management.

Workload Identity

Choose Workload Identity if you want more control over the permissions given to your Config Connector cluster.

GKE Workload Identity allows you to bind a Kubernetes service account to a Google service account (GSA). Config Connector then uses the Kubernetes service account (KSA) within your cluster to create new resources. Config Connector can only create resources with the roles granted the GSA.

For example, if you will use a Config Connector cluster to manage only Cloud Storage resources, you can limit the service account to create only Storage resources by granting the roles/storage.admin role.

Namespaced mode

Namespaced mode is an extension of the Workload Identity installation. It allows you to manage multiple projects with multiple Google Service Accounts bound to your your Config Connector cluster.

In namespaced mode, each Google service account is bound to a Namespace by default. When you create resources within that Namespace, Config Connector uses this service account to create Google Cloud resources.

Choose namespaced mode if you:

  • Want to manage resources in multiple Google Cloud projects.
  • Want to select a different Google service account to manage the resources in each project.

What's Next?