GCP (GKE) deployment

Deploy Flyte on Google Kubernetes Engine with GCS, Cloud SQL, and Workload Identity.

This guide walks through deploying Flyte on GKE using the flyte-binary Helm chart, backed by Google Cloud Storage (GCS) and Cloud SQL PostgreSQL.

Prerequisites

GKE cluster

Create a GKE cluster with Workload Identity enabled:

gcloud container clusters create flyte \
  --region us-central1 \
  --machine-type n2-standard-4 \
  --num-nodes 3 \
  --workload-pool=<PROJECT_ID>.svc.id.goog

GCS bucket

gsutil mb -l us-central1 gs://my-flyte-bucket

Cloud SQL PostgreSQL

Create a Cloud SQL PostgreSQL 13+ instance. Enable the Cloud SQL Admin API and create a database named flyteadmin. Note the private IP address (or connection string if using Cloud SQL Auth Proxy).

Google Service Accounts (Workload Identity)

Flyte uses Workload Identity to let Kubernetes service accounts impersonate Google Service Accounts (GSAs) without static keys.

Create two GSAs:

# Backend GSA for Flyte control-plane components
gcloud iam service-accounts create flyte-backend \
  --project=<PROJECT_ID>

# Task GSA for user task pods
gcloud iam service-accounts create flyte-tasks \
  --project=<PROJECT_ID>

Grant GCS permissions:

gsutil iam ch \
  serviceAccount:flyte-backend@<PROJECT_ID>.iam.gserviceaccount.com:objectAdmin \
  gs://my-flyte-bucket

gsutil iam ch \
  serviceAccount:flyte-tasks@<PROJECT_ID>.iam.gserviceaccount.com:objectAdmin \
  gs://my-flyte-bucket

Bind the Kubernetes service accounts to the GSAs:

# Bind the flyte-backend KSA
gcloud iam service-accounts add-iam-policy-binding \
  flyte-backend@<PROJECT_ID>.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:<PROJECT_ID>.svc.id.goog[flyte/flyte-backend]"

Installation

1. Add the Flyte Helm repo

   helm repo add flyteorg https://flyteorg.github.io/flyte
   helm repo update
   
2. Download the GKE starter values

   curl -sL https://raw.githubusercontent.com/flyteorg/flyte/master/charts/flyte-binary/gke-starter.yaml \
     -o values.yaml
   
3. Edit values.yaml

   Replace all placeholder values. See the annotated reference below.

4. Install with Helm

   helm install flyte-backend flyteorg/flyte-binary \
     --namespace flyte \
     --create-namespace \
     --values values.yaml
   

GKE values reference

configuration:
  database:
    username: postgres
    password: ""              # Set to your Cloud SQL password
    host: 127.0.0.1           # Use Cloud SQL Auth Proxy sidecar or private IP
    dbname: flyteadmin

  storage:
    metadataContainer: "my-flyte-bucket"
    userDataContainer: "my-flyte-bucket"
    provider: gcs
    providerConfig:
      gcs:
        project: "<PROJECT_ID>"

  logging:
    level: 5
    plugins:
      stackdriver:
        enabled: true
        templateUri: |
          "https://console.cloud.google.com/logs/query;query=resource.labels.namespace_name%3D%22{{.namespace}}%22%0Aresource.labels.pod_name%3D%22{{.podName}}%22%0Aresource.labels.container_name%3D%22{{.containerName}}%22?project=<PROJECT_ID>"

  auth:
    enabled: false
    oidc:
      baseUrl: ""
      clientId: ""
      clientSecret: ""
    internal:
      clientId: flytepropeller
      clientSecret: ""
      clientSecretHash: ""
    authorizedUris: []

  inline:
    # Annotate default KSA in each project namespace with the task GSA
    cluster_resources:
      customData:
        - production:
          - defaultIamServiceAccount:
              value: flyte-tasks@<PROJECT_ID>.iam.gserviceaccount.com
        - staging:
          - defaultIamServiceAccount:
              value: flyte-tasks@<PROJECT_ID>.iam.gserviceaccount.com
        - development:
          - defaultIamServiceAccount:
              value: flyte-tasks@<PROJECT_ID>.iam.gserviceaccount.com

    plugins:
      k8s:
        inject-finalizer: true
        gpu-device-node-label: cloud.google.com/gke-accelerator
        gpu-partition-size-node-label: cloud.google.com/gke-gpu-partition-size
        resource-tolerations:
          - nvidia.com/gpu:
            - key: "nvidia.com/gpu"
              operator: "Equal"
              value: "present"
              effect: "NoSchedule"

    storage:
      cache:
        max_size_mbs: 10
        target_gc_percent: 100

    tasks:
      task-plugins:
        enabled-plugins:
          - container
          - sidecar
          - K8S-ARRAY
          - connector-service
          - echo
        default-for-task-types:
          - container: container
          - container_array: K8S-ARRAY

clusterResourceTemplates:
  inline:
    001_namespace.yaml: |
      apiVersion: v1
      kind: Namespace
      metadata:
        name: '{{ namespace }}'
    # Annotate the default KSA with the task GSA for Workload Identity
    002_serviceaccount.yaml: |
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: default
        namespace: '{{ namespace }}'
        annotations:
          iam.gke.io/gcp-service-account: '{{ defaultIamServiceAccount }}'

serviceAccount:
  create: true
  annotations:
    iam.gke.io/gcp-service-account: flyte-backend@<PROJECT_ID>.iam.gserviceaccount.com

rbac:
  create: true
  extraRules:
    - apiGroups: [""]
      resources: ["serviceaccounts"]
      verbs: ["create", "get", "patch"]

GCS IAM roles reference

GSA	Required role	Scope
flyte-backend	roles/storage.objectAdmin	Flyte metadata bucket
flyte-tasks	roles/storage.objectAdmin	User data bucket
flyte-backend	roles/cloudsql.client	Cloud SQL instance

Verify the installation

kubectl get pods -n flyte

# Port-forward before DNS is configured
kubectl -n flyte port-forward service/flyte-binary 8088:8088 8089:8089

Open http://localhost:8088/console.

What’s next

• Enable authentication with Google Identity or another OIDC provider
• Configure GCS storage for advanced use cases
• Deploy Spark on GCP