unt as well as an IAM policy binding between them.Grant the Google service account permissions to push to your GCR registry and read from your GCP bucket.

Configure the image builder to run in the correct namespace and use the correct service account:

# register a new image builder with namespace and service account

zenml image-builder register <NAME> \

--flavor=kaniko \

--kubernetes_context=<KUBERNETES_CONTEXT> \

--kubernetes_namespace=<KUBERNETES_NAMESPACE> \

--service_account_name=<KUBERNETES_SERVICE_ACCOUNT_NAME>

# --executor_args='["--compressed-caching=false", "--use-new-run=true"]'

# or update an existing one

zenml image-builder update <NAME> \

--kubernetes_namespace=<KUBERNETES_NAMESPACE> \

--service_account_name=<KUBERNETES_SERVICE_ACCOUNT_NAME>

Check out the Kaniko docs for more information.

Create a Kubernetes configmap for a Docker config that uses the Azure credentials helper:

kubectl create configmap docker-config --from-literal='config.json={ "credHelpers": { "mycr.azurecr.io": "acr-env" } }'

Follow these steps to configure your cluster to use a managed identity

Configure the image builder to mount the configmap in the Kaniko build pod:

# register a new image builder with the mounted configmap

zenml image-builder register <NAME> \

--flavor=kaniko \

--kubernetes_context=<KUBERNETES_CONTEXT> \

--volume_mounts='[{"name": "docker-config", "mountPath": "/kaniko/.docker/"}]' \

--volumes='[{"name": "docker-config", "configMap": {"name": "docker-config"}}]'

# --executor_args='["--compressed-caching=false", "--use-new-run=true"]'

# or update an existing one

zenml image-builder update <NAME> \

--volume_mounts='[{"name": "docker-config", "mountPath": "/kaniko/.docker/"}]' \

--volumes='[{"name": "docker-config", "configMap": {"name": "docker-config"}}]'

Check out the Kaniko docs for more information.

Passing additional parameters to the Kaniko build

You can pass additional parameters to the Kaniko build by setting the executor_args attribute of the image builder.