Content Comparison

To deploy Kyvos using Kubernetes, read the Common Prerequisites for Dataproc and Kubernetes section for the complete set of permissions required for deploying Kyvos.

...

You must have an existing GKE cluster to complete the following prerequisites.

1. Cloud Storage FUSE CSI driver Add-on must be enabled.

2. VNet peering is necessary if the Kyvos VPC differs from the VPC associated with the existing Kubernetes cluster.

3. Firewall rule on GKE Cluster VPC: An inbound rule allows TCP traffic on the 6903 port that is required with the source IP range set to the Kyvos VPC.

4. Permissions required by GKE Service Account: For the GKE Service Account, the following roles and permissions are required:

   roles/iam.serviceAccountTokenCreator

   • roles/iam.workloadIdentityUserroles/container.clusterAdmin

   • roles/container.developer

   • compute.instanceGroupManagers.update

   • compute.instanceGroupManagers.get

   • roles/iam.serviceAccountTokenCreator

   • roles/iam.workloadIdentityUser: The above permission [roles/iam.workloadIdentityUser] is associated with the Kubernetes namespace and service account used for Kyvos deployment.

   • Command:

     Code Block

     gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:PROJECT_ID.svc.id.goog[KYVOS_NAMESPACE/kyvos-monitoring/default]" gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:PROJECT_ID.svc.id.goog[kyvos-compute/default]"sa]"

5. Namespace for Kyvos Compute Worker.

   • Dedicated Node Pool: Kyvos will create a namespace on its own.

   • Shared Node Pool: Users should create this namespace before proceeding with the Kyvos deployment

6. Node pool for Kyvos Compute Worker: A Node pool should be created before proceeding with the Kyvos deployment with existing GKE.

7. Permissions for Kyvos Service Account:

Case 1: Dedicated Node Pool:

For a Dedicated Node Pool in a Shared GKE Cluster, the Kyvos Service Account needs the following permissions:

Roles:

• roles/container.viewer

• container.configMaps.create

• container.jobs.create

• container.persistentVolumeClaims.create

• container.persistentVolumes.create

• container.serviceAccounts.create

• container.serviceAccounts.update

• container.pods.getLogs

• container.jobs.delete

• container.storageClasses.create

• container.namespaces.list

• container.namespaces.create

Additional Permissions for Node Pool Management:

• container.clusters.update

• compute.instanceGroupManagers.get

• compute.instanceGroupManagers.update

Case 2: Shared Node Pool:

For a Shared Node Pool in a Shared GKE Cluster, the Kyvos Service Account requires the following permissions.

Roles:

• roles/container.viewer

• container.configMaps.create

• container.jobs.create

• container.persistentVolumeClaims.create

• container.persistentVolumes.create

• container.serviceAccounts.create

• container.serviceAccounts.update

• container.pods.getLogs

• container.jobs.delete

• container.storageClasses.create

• container.namespaces.list