# Support for GKE Workload Identities for Okteto Self-Hosted

**URL:** <https://community.okteto.com/t/support-for-gke-workload-identities-for-okteto-self-hosted/39>\
**Category:** Feature Requests\
**Created:** [April 26, 2022, 8:24pm UTC](https://community.okteto.com/t/support-for-gke-workload-identities-for-okteto-self-hosted/39 "2022-04-26T20:24:19Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![provecho](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/provecho/32/45_2.png) [@provecho](https://community.okteto.com/u/provecho)\
**Post date:** [May 27, 2022, 7:05pm UTC](https://community.okteto.com/t/support-for-gke-workload-identities-for-okteto-self-hosted/39/4 "2022-05-27T19:05:47Z")

</div>

Hi everyone,

I’m excited to announce that GCP Workload Identity and AWS IAM Roles for Service Accounts support for Okteto Enterprise Self Hosted is now available.

You’ll need version 0.12 of our Okteto Enterprise Helm chart for this feature to work.

Check out the following examples for enabling it in GCP and AWS:

# GCP Workload Identity

Follow the Okteto Enterprise GKE guide, but omit the creation of “okteto-cloud-secret”.

> **[Google Kubernetes Engine (GKE) | Okteto Documentation](https://www.okteto.com/docs/get-started/install/google-gke)**
>
> How to install Okteto onto Google Kubernetes Engine (GKE)

Bind the GCP Service Account you just created with the K8S Service Account of cert-manager and Okteto Enterprise Registry. Replace the variables below with your own information.

```bash
gcloud iam service-accounts add-iam-policy-binding \
  ${GSA_NAME}@${GSA_PROJECT}.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:${PROJECT_ID}.svc.id.goog[${RELEASE_NAMESPACE}/certmanager]"

gcloud iam service-accounts add-iam-policy-binding \
  ${GSA_NAME}@${GSA_PROJECT}.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:${PROJECT_ID}.svc.id.goog[${RELEASE_NAMESPACE}/${RELEASE_NAME}-okteto-enterprise-registry]"

```

Merge or set the following YAML properties with your specific configuration. Replace the variables below with your own information.

```yaml
cloud:
  provider:
    gcp:
      workloadIdentity:
        enabled: true

cert-manager:
  extraArgs: [--issuer-ambient-credentials=true]
  serviceAccount:
    annotations:
      iam.gke.io/gcp-service-account: GSA_NAME@GSA_PROJECT.iam.gserviceaccount.com

registry:
  serviceAccount:
    create: true
    annotations:
      iam.gke.io/gcp-service-account: GSA_NAME@GSA_PROJECT.iam.gserviceaccount.com

```

# AWS

Follow the Okteto Enterprise EKS guide, but omit the creation of “okteto-cloud-secret” and the IAM user. Instead create an IAM policy with the actions specified in the guide.

> **[Amazon Elastic Kubernetes Service (EKS) | Okteto Documentation](https://www.okteto.com/docs/get-started/install/amazon-eks)**
>
> How to install Okteto onto Amazon Elastic Kubernetes Service (EKS)

Associate your AWS EKS cluster OIDC provider with your AWS IAM. Replace the variables below with your own information.

```bash
eksctl utils associate-iam-oidc-provider \
  --cluster $CLUSTER_NAME \
  --region $REGION \
  --approve

```

Create an AWS IAM Role for Service Account for cert-manager and Okteto Enterprise Registry. Replace the variables below with your own information.

```bash
eksctl create iamserviceaccount \
  --cluster $CLUSTER_NAME \
  --region $REGION \
  --name cert-manager \
  --namespace $RELEASE_NAMESPACE \
  --attach-policy-arn $POLICY_ARN \
  --role-name ${RELEASE_NAME}-cert-manager \
  --role-only \
  --approve

eksctl create iamserviceaccount \
  --cluster $CLUSTER_NAME \
  --region $REGION \
  --name ${RELEASE_NAME}-okteto-enterprise-registry \
  --namespace $RELEASE_NAMESPACE \
  --attach-policy-arn $POLICY_ARN \
  --role-name ${RELEASE_NAME}-okteto-enterprise-registry \
  --role-only \
  --approve

```

Merge or set the following YAML properties with your specific configuration. Replace the variables below with your own information.

```yaml
cloud:
  provider:
    aws:
      iam:
        enabled: false

cert-manager:
  extraArgs: [--issuer-ambient-credentials=true]
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: 'arn:aws:iam::${AWS_ACCOUNT_ID}:role/${RELEASE_NAME}-cert-manager'

registry:
  serviceAccount:
    create: true
    annotations:
      eks.amazonaws.com/role-arn: 'arn:aws:iam::${AWS_ACCOUNT_ID}:role/${RELEASE_NAME}-okteto-enterprise-registry'

```

---

_[View the full topic](https://community.okteto.com/t/support-for-gke-workload-identities-for-okteto-self-hosted/39)._