[D] GCP connection with workload identity [airflow]

["Unb0rn (via GitHub)" <gi...@apache.org>]

GitHub user Unb0rn created a discussion: GCP connection with workload identity

Hey! I'm trying to set up an instance with remote logging and I want to store the logs in gcs.
The docs (and some examples) suggest using the standard JSON with keys, however I want to use Workload Identity and an annotated SA, if it's possible.

The thing is - I'm a bit lost. 
I'm installing with helm, so I set up remote logging:
```
config:
  logging:
    colored_console_log: 'True'
    remote_logging: 'True'
    logging_level: 'INFO'
    remote_base_log_folder: "gs://my-bucket/logs"
    remote_log_conn_id: 'gcp_stage'
    delete_local_logs: 'True'
```
Then, the envvar with the connection:
```
secret:
  - envName: "AIRFLOW_CONN_GCP_STAGE"
    secretName: "airflow-connections"
    secretKey: "AIRFLOW_CONN_GCP"
```
And, finally the secret with connstring providing the project id:
```
extraSecrets:
  airflow-connections:
    stringData: |
      AIRFLOW_CONN_GCP: 'google-cloud-platform://?project=my-awesome-project&scope=https://www.googleapis.com/auth/cloud-platform'
```
Now, the chart creates like 7 serviceaccounts by default and I have no idea which one is used by pod responsible for writing logs. So, is it even possible? Is this example correct? Which SA should be annotated with the SA name to impersonate?

GitHub link: https://github.com/apache/airflow/discussions/52575

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org