:

container.clusters.list

container.clusters.getIn addition to the above permissions, the credentials should include permissions to connect to and use the GKE cluster (i.e. some or all permissions in the Kubernetes Engine Developer role).

If set, the resource name must identify a GKE cluster using one of the following formats:

GKE cluster name: {cluster-name}

GKE cluster names are project scoped. The connector can only be used to access GKE clusters in the GCP project that it is configured to use.

GCR container registry

Allows Stack Components to access a GCR registry as a standard Docker registry resource. When used by Stack Components, they are provided a pre-authenticated Python Docker client instance.

The configured credentials must have at least the following GCP permissions:

storage.buckets.get

storage.multipartUploads.abort

storage.multipartUploads.create

storage.multipartUploads.list

storage.multipartUploads.listParts

storage.objects.create

storage.objects.delete

storage.objects.list

The Storage Legacy Bucket Writer role includes all of the above permissions while at the same time restricting access to only the GCR buckets.

The resource name associated with this resource type identifies the GCR container registry associated with the GCP-configured project (the repository name is optional):

GCR repository URI: [https://]gcr.io/{project-id}[/{repository-name}]

Authentication Methods

Implicit authentication

Implicit authentication to GCP services using Application Default Credentials.

This method may constitute a security risk, because it can give users access to the same cloud resources and services that the ZenML Server itself is configured to access. For this reason, all implicit authentication methods are disabled by default and need to be explicitly enabled by setting the ZENML_ENABLE_IMPLICIT_AUTH_METHODS environment variable or the helm chart enableImplicitAuthMethods configuration option to true in the ZenML deployment.