Choosing an installation type

The page provides you with an overview of the different installations options you can use when installing Config Connector.

Installation methods

You can install Config Connector in one of two ways:

Authentication options

If you want to install Config Connector on GKE clusters, Workload Identity is the recommended approach. Workload Identity binds a Kubernetes service account to a Google service account. Config Connector then uses the Kubernetes service account within your cluster to create new resources. Config Connector can only create resources with the roles that you grant the Google service account.

If you want to install Config Connector on other Kubernetes distributions , you should use Cloud Identity instead of Workload Identity. This option requires you to create a Google service account key and import the key's credentials as a Secret to your clusters. You are responsible for rotating the key credentials when necessary.

Managing resources with service accounts

You can choose to manage resources with a single service account, or multiple service accounts.

Single service account

When you install Config Connector with the GKE add-on or manual installation, you can use cluster mode for your ConfigConnector CustomResource. With cluster mode, you can use a single Google service account to create and manage resources, even if you are using Config Connector to manage multiple projects.

The following diagram shows you how this mode works:

Diagram showing Config Connector managing multiple Projects using the same service account

Multiple service accounts

You can use multiple service accounts by using namespaced mode for your ConfigConnector CustomResource. Namespaced mode lets you manage multiple projects with multiple Google service accounts bound to your Config Connector cluster.

The following diagram shows you an overview of how namespaced mode works:

Diagram showing Config Connector managing multiple Projects using the two different service accounts

In namespaced mode, each Google service account is bound to a namespace by default. When you create resources within that namespace, Config Connector uses this service account to create Google Cloud resources.

Choose namespaced mode if you:

  • Want to manage resources in multiple Google Cloud projects.
  • Want to select a different Google service account to manage the resources in each project.

To learn how to configure namespaced mode, see Installing Config Connector using a namespaced mode.

What's next