ation use-case: local gcloud CLI with user accountThis configuration use-case assumes you have configured the gcloud CLI to authenticate locally with your GCP account (i.e. by running gcloud auth login). It also assumes the following:

your GCP account has permissions to create a job in Vertex Pipelines, (e.g. the Vertex AI User role).

the Compute Engine default service account for the GCP project in which the pipeline is running is updated with additional permissions required to run a Vertex AI pipeline, (e.g. the Vertex AI Service Agent role).

This is the easiest way to configure the Vertex AI Orchestrator, but it has the following drawbacks:

the setup is not portable on other machines and reproducible by other users.

it uses the Compute Engine default service account, which is not recommended, given that it has a lot of permissions by default and is used by many other GCP services.

We can then register the orchestrator as follows:

zenml orchestrator register <ORCHESTRATOR_NAME> \

--flavor=vertex \

--project=<PROJECT_ID> \

--location=<GCP_LOCATION> \

--synchronous=true

Configuration use-case: GCP Service Connector with single service account

This use-case assumes you have already configured a GCP service account with the following permissions:

permissions to create a job in Vertex Pipelines, (e.g. the Vertex AI User role).

permissions to run a Vertex AI pipeline, (e.g. the Vertex AI Service Agent role).

the Storage Object Creator Role to be able to write the pipeline JSON file to the artifact store directly.

It also assumes you have already created a service account key for this service account and downloaded it to your local machine (e.g. in a connectors-vertex-ai-workload.json file). This is not recommended if you are conscious about security. The principle of least privilege is not applied here and the environment in which the pipeline steps are running has many permissions that it doesn't need.