Hi, First, huge thanks for your help and work on this project. Have been using Airflow in prod for several years now & looking forward to making a switch. I am in the process of testing a deployment of metaflow on GCP / GKE, following the tutorial here: https://outerbounds.com/engineering/deployment/gcp-k8s/deployment/. I'm familiar with terraform & we use it for all our deployments. My question concerns a step where the deployment violates a pretty common security constraint:

constraints/iam.disableServiceAccountKeyCreation

, by asking for the key for the security account to be created & exported as part of

module.infra.google_service_account_key.metaflow_kubernetes_workload_identity_service_account_key

. My question: Is this necessary for the architecture? As described here: https://cloud.google.com/kubernetes-engine/docs/how-to/service-accounts but does not seem to require sharing keys.

hey Jacqueline, its not necessary. The idea there was to provide a starter template for GCP that works end-to-end out of the box, blank slate GCP account. The most straightforward way to provide user creds is generating a GSA key, so that template does this; however in a more mature environment you'd want provision end users access to GCP creds some other, more secure way, like you pointed out How exactly depends on the organization so it didn't make sense to include all that in the instruction (that would be a huuge decision tree...). The expectation that you can use that template just as a starting point and customize depending on your org

Thank you so much for this info! This is very helpful context & appreciate the use case for "starter" configs