ZenMLServerSecretsStoreCreator \

--condition None# NOTE: use the GCP project NUMBER, not the project ID in the condition

gcloud projects add-iam-policy-binding <your GCP project ID> \

--member serviceAccount:<your GCP service account email> \

--role projects/<your GCP project ID>/roles/ZenMLServerSecretsStoreEditor \

--condition 'title=limit_access_zenml,description="Limit access to secrets with prefix zenml-",expression=resource.name.startsWith("projects/<your GCP project NUMBER>/secrets/zenml-")'

Example configuration for the GCP Secrets Store:

zenml:

# ...

# Secrets store settings. This is used to store centralized secrets.

secretsStore:

# Set to false to disable the secrets store.

enabled: true

# The type of the secrets store

type: gcp

# Configuration for the GCP Secrets Manager secrets store

gcp:

# The GCP Service Connector authentication method to use.

authMethod: service-account

# The GCP Service Connector configuration.

authConfig:

# The GCP project ID to use. This must be set to the project ID where the

# GCP Secrets Manager service that you want to use is located.

project_id: my-gcp-project

# GCP credentials JSON to use to authenticate with the GCP Secrets

# Manager instance.

google_application_credentials: |

"type": "service_account",

"project_id": "my-project",

"private_key_id": "...",

"private_key": "-----BEGIN PRIVATE KEY-----\n...=\n-----END PRIVATE KEY-----\n",

"client_email": "...",

"client_id": "...",

"auth_uri": "https://accounts.google.com/o/oauth2/auth",

"token_uri": "https://oauth2.googleapis.com/token",

"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

"client_x509_cert_url": "..."

serviceAccount:

# If you're using workload identity, you need to annotate the service

# account with the GCP service account name (see https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)

annotations:

iam.gke.io/gcp-service-account: <SERVICE_ACCOUNT_NAME>@<PROJECT_NAME>.iam.gserviceaccount.com