Versions Compared

Version Old Version 8 New Version 9
Changes made by

Sarabjeet Kaur

Sarabjeet Kaur

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Cloud Storage FUSE CSI driver Add-on must be enabled.

  2. VNet peering is necessary if the Kyvos VPC differs from the VPC associated with the existing Kubernetes cluster.

  3. Firewall rule on GKE Cluster VPC: An inbound rule allows TCP traffic on the 6903 port that is required with the source IP range set to the Kyvos VPC.

  4. Permissions required by GKE Service Account: For the GKE Service Account, the following roles and permissions are required:

    • roles/iam.workloadIdentityUserroles/container.clusterAdmin

    • roles/container.developer

    • compute.instanceGroupManagers.update

    • compute.instanceGroupManagers.getNamespace for Kyvos Compute Worker.

  5. Dedicated Node Pool: Kyvos will create a namespace on its own.

  6. Shared Node Pool: Users should create this namespace before proceeding with the Kyvos deployment

  7. Node pool for Kyvos Compute Worker: A Node pool should be created before proceeding with the Kyvos deployment.

  8. Permissions required by GKE Service Account: For the GKE Service Account, the following roles and permissions are required:
    IAM Roles:

    • roles/iam.serviceAccountTokenCreator

    • roles/iam.workloadIdentityUser: The above permission [roles/iam.workloadIdentityUser] is associated with the Kubernetes namespace and service account used for Kyvos deployment.

    • Command:

      Code Block
      gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:PROJECT_ID.svc.id.goog[KYVOS_NAMESPACE/kyvos-sa]"

  9. Permissions for Kyvos Service Account:

...