How to install the Google Config Connector

In order to bind the Service Account from Kubernetes with the Service Account from Google Cloud Platform, you need to install the Google Config Connector on your cluster.

Here is the documentation from Google on Installing, upgrading, and uninstalling Config Connector , but we'll also take all the steps one by one on this tutorial.

We will install Config Connector with a GKE Workload Identity.


  1. You need to have installed on your local computer the gcloud command-line tool (see quickstarts for Linux , macOS , Windows ) and kubectl .

  2. Go to the Google Cloud Console and ensure that you have enabled the Google Kubernetes Engine API .

  3. Go to see your cluster's details and note down the project ID where the cluster was created and the region. Get your project ID

    Open your terminal and save them as variables, e.g. for this example they are:


    But make sure to replace them with your own data.

  4. Set your default project ID:

    gcloud config set project $project_id
  5. If you are working with regional clusters, set your default compute region:

    gcloud config set compute/region $compute_region
  6. Update gcloud to the latest version:

    gcloud components update
  7. Configure kubectl to connect to your clusters. Follow the steps for GKE clusters or GKE On-Prem clusters .

Create an Identity

Setting up the identity includes:

  1. Create the cnrm-system Service Account with gcloud:

    gcloud iam service-accounts create cnrm-system
  2. Give the IAM Service Account elevated permissions on your project:

    gcloud projects add-iam-policy-binding $project_id \
    --member="serviceAccount:cnrm-system@$" \
  3. Create a Cloud IAM policy binding between the IAM Service Account and the predefined Kubernetes service account run by KCC:

    gcloud iam service-accounts add-iam-policy-binding cnrm-system@$ \
    --member="serviceAccount:$[cnrm-system/cnrm-controller-manager]" \

Deploying Config Connector

  1. Connect to the cluster

    In your cluster details, simply press “Connect”, then copy and run the command line from here:

    Connect to the cluster

  2. Download the latest installation bundle tarball:

    gsutil cp gs://cnrm/latest/release-bundle.tar.gz release-bundle.tar.gz
  3. Extract the tar file:

    tar zxvf release-bundle.tar.gz
  4. Replace ${PROJECT_ID?} with your project ID in the installation manifest:

    sed -i "s/\${PROJECT_ID?}/$project_id/" install-bundle-workload-identity/0-cnrm-system.yaml
  5. Apply the manifests to your cluster:

    kubectl apply -f install-bundle-workload-identity/

Verify Your Installation

Config Connector runs a single system process named cnrm-system. You can verify the pod for this process has a STATUS of Running, by executing the following command:

kubectl wait -n cnrm-system \
 --for=condition=Initialized pod \

If Config Connector is installed correctly, the output is similar to the following:

pod/cnrm-controller-manager-0 condition met

Now you can continue with the other prerequisites before installing the Presslabs Dashboard.

See Also

Install the Presslabs Dashboard

The Presslabs dashboard can be installed with a simple click from Google's Marketplace, after making [...]

Presslabs Dashboard Prerequisites

Before installing the Presslabs Dashboard from Google Cloud's Marketplace, there are some [...]