Choosing an installation type

The page provides you with an overview of the different installations options you can use when installing Config Connector.

Installation methods

Note: Config Connector 1.33.0 and higher only supports installation with the GKE add-on or manually installed operator. Other installation methods are deprecated. To upgrade to the operator, see upgrading to the operator

You can install Config Connector in one of two ways:

• Using the Google Kubernetes Engine (GKE) Config Connector add-on: The Config Connector add-on lets you install Config Connector during cluster creation. Due to the Config Connector add-on's simplicity, we recommend this method for most users.

• Manual installation: To use manual installation, you need to download and use a Kubernetes Operator. Manual installations track the current release of Config Connector more closely; the Operator applies new versions faster than the add-on. If you want to install Config Connector on other Kubernetes distributions you need to use a manual installation.

Authentication options

If you want to install Config Connector on GKE clusters, Workload Identity is the recommended approach. Workload Identity binds a Kubernetes service account to a Google service account. Config Connector then uses the Kubernetes service account within your cluster to create new resources. Config Connector can only create resources with the roles that you grant the Google service account.

If you want to install Config Connector on other Kubernetes distributions , you should use Cloud Identity instead of Workload Identity. This option requires you to create a Google service account key and import the key's credentials as a Secret to your clusters. You are responsible for rotating the key credentials when necessary.

Managing resources with service accounts

You can choose to manage resources with a single service account, or multiple service accounts.

Note: Your organization administrator might disable the creation of service accounts. If this setting is applied, coordinate with your organization administrator before installing Config Connector.

Single service account

When you install Config Connector with the GKE add-on or manual installation, you can use cluster mode for your ConfigConnector CustomResource. With cluster mode, you can use a single Google service account to create and manage resources, even if you are using Config Connector to manage multiple projects.

The following diagram shows you how this mode works:

Multiple service accounts

You can use multiple service accounts by using namespaced mode for your ConfigConnector CustomResource. Namespaced mode lets you manage multiple projects with multiple Google service accounts bound to your Config Connector cluster.

The following diagram shows you an overview of how namespaced mode works:

In namespaced mode, each Google service account is bound to a namespace by default. When you create resources within that namespace, Config Connector uses this service account to create Google Cloud resources.

Choose namespaced mode if you:

• Want to manage resources in multiple Google Cloud projects.
• Want to select a different Google service account to manage the resources in each project.

To learn how to configure namespaced mode, see Installing Config Connector using a namespaced mode.

What's next

• Learn about Identity and Access Management service accounts.
• Learn how to install Config Connector as a GKE add-on.
• Learn how to install Config Connector on other Kubernetes distributions.
• Learn how to manually install Config Connector.