roles/iam.serviceAccountUser

roles/cloudrun.developer

bash
   gcloud container clusters describe YOUR_CLUSTER_NAME --zone=YOUR_ZONE | grep workloadPool

bash
   kubectl describe serviceaccount prefect-worker -n YOUR_NAMESPACE

yaml
   <http://iam.gke.io/gcp-service-account=YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com|iam.gke.io/gcp-service-account=YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com>

bash
   gcloud iam service-accounts get-iam-policy <mailto:YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com|YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com>

yaml
   roles/iam.workloadIdentityUser:
     members:
     - serviceAccount:YOUR-PROJECT.svc.id.goog[YOUR-NAMESPACE/prefect-worker]

yaml
   serviceAccountName: prefect-worker  # or whatever your K8s service account name is

bash
   kubectl run -it \
     --serviceaccount=prefect-worker \
     --image=google/cloud-sdk:slim \
     --namespace=YOUR_NAMESPACE \
     workload-identity-test -- /bin/bash
   
   # Inside the pod:
   gcloud auth list

bash
   gcloud iam service-accounts add-iam-policy-binding <mailto:YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com|YOUR-GSA@YOUR-PROJECT.iam.gserviceaccount.com> \
     --role roles/iam.workloadIdentityUser \
     --member "serviceAccount:YOUR-PROJECT.svc.id.goog[YOUR-NAMESPACE/prefect-worker]"

iam.serviceAccounts.getAccessToken

yaml
- PREFECT_API_KEY
- PREFECT_API_URL
- GCP_REGION  # The region where Cloud Run jobs will be created

yaml
- project_name  # Your GCP project
- location     # GCP region
- cpu          # CPU allocation for Cloud Run jobs
- memory       # Memory allocation for Cloud Run jobs

yaml
- service_account_name: <mailto:your-service-account@your-project.iam.gserviceaccount.com|your-service-account@your-project.iam.gserviceaccount.com>

yaml
- service_account_email: <mailto:your-service-account@your-project.iam.gserviceaccount.com|your-service-account@your-project.iam.gserviceaccount.com>

bash
kubectl exec -it <worker-pod-name> -- env | grep PREFECT

bash
prefect work-pool inspect <your-workpool-name>

bash
kubectl logs <worker-pod-name>

yaml
'serviceAccount': '<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>'

GCP_REGION

GOOGLE_CLOUD_PROJECT

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "your-project-id"
  - name: GCP_REGION
    value: "europe-west6"  # match your work pool region

- roles/run.developer
- roles/run.invoker
- roles/iam.serviceAccountUser

- roles/vpcaccess.user

yaml
env:
  - name: PREFECT_LOGGING_LEVEL
    value: "DEBUG"
  - name: GOOGLE_API_USE_CLIENT_CERTIFICATE
    value: "true"

bash
gcloud services list | grep <http://run.googleapis.com|run.googleapis.com>

bash
gcloud services enable <http://run.googleapis.com|run.googleapis.com>

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": null  # Remove the explicit service account
        }
      }
    }
  }
}'

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "your-project-id"
  - name: USE_GKE_GCLOUD_AUTH_PLUGIN
    value: "True"
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"

bash
# Add Cloud Run Admin role
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/run.admin"

# Add Service Account User role
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountUser"

# Add Service Account Token Creator role
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountTokenCreator"

python
from google.auth import default
from google.cloud import run_v2

credentials, project = default()
client = run_v2.JobsClient(credentials=credentials)

# Try to list jobs
parent = f"projects/{project}/locations/europe-west6"
jobs = client.list_jobs(parent=parent)

<http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token>

bash
kubectl get serviceaccount prefect-worker -n your-namespace -o yaml

bash
prefect work-pool create-type cloud-run-v2 \
  --name base \
  --base-job-template '{
    "job_configuration": {
      "template": {
        "serviceAccount": null,  # Remove the hardcoded service account
        "containers": [{
          "image": "{{ image }}",
          "resources": {
            "limits": {
              "cpu": "{{ cpu }}",
              "memory": "{{ memory }}"
            }
          }
        }]
      }
    }
  }'

yaml
spec:
  template:
    spec:
      serviceAccountName: prefect-worker  # Your K8s service account name
      containers:
        - name: prefect-worker
          env:
            - name: GOOGLE_CLOUD_PROJECT
              value: "your-project-id"
            - name: USE_GKE_GCLOUD_AUTH_PLUGIN
              value: "True"
            - name: CLOUDSDK_CORE_PROJECT
              value: "your-project-id"

bash
gcloud iam service-accounts get-iam-policy <mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>

bash
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountTokenCreator"

gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/iam.workloadIdentityUser"

gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/run.developer"

bash
gcloud iam service-accounts add-iam-policy-binding \
    <mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com> \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:your-project-id.svc.id.goog[your-namespace/prefect-worker]"

bash
kubectl run -it --rm \
    --serviceaccount=prefect-worker \
    --image=google/cloud-sdk:slim \
    --namespace=your-namespace \
    workload-identity-test -- bash -c \
    'gcloud auth list && gcloud projects list'

kubectl get serviceaccount prefect-worker -n your-namespace -o yaml

bash
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/run.developer"

gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/run.invoker"

bash
gcloud services enable <http://run.googleapis.com|run.googleapis.com>

bash
gcloud projects add-iam-policy-binding your-project-id \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/vpcaccess.user"

bash
prefect work-pool create --type cloud-run-v2 --update base \
  --job-variables '{
    "region": "europe-west6",
    "image": "prefecthq/prefect:2-latest",
    "cpu": "1000m",
    "memory": "512Mi",
    "env": {
      "PREFECT_LOGGING_LEVEL": "DEBUG",
      "GOOGLE_CLOUD_PROJECT": "your-project-id"
    }
  }'

bash
kubectl run -it \
  --serviceaccount=prefect-worker \
  --image=google/cloud-sdk:slim \
  --namespace=your-namespace \
  cloud-run-test -- /bin/bash

# Inside the pod:
gcloud auth list
gcloud run jobs create test-job \
  --image=<http://gcr.io/cloudrun/hello|gcr.io/cloudrun/hello> \
  --region=europe-west6

bash
gcloud iam service-accounts get-iam-policy <mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "your-project-id"  # Replace with your actual project ID
  - name: CLOUDSDK_CORE_PROJECT
    value: "your-project-id"  # Same as above
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"
  - name: USE_GKE_GCLOUD_AUTH_PLUGIN
    value: "True"

bash
# Replace with your actual service account and project
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"
export PROJECT_ID="your-project-id"

# Add necessary roles
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountTokenCreator"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.admin"

# This is important - add permission to act as itself
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prefect-worker
  annotations:
    <http://iam.gke.io/gcp-service-account|iam.gke.io/gcp-service-account>: "<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

yaml
spec:
  template:
    spec:
      serviceAccountName: prefect-worker

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": null
        }
      }
    }
  }
}'

bash
kubectl exec -it <worker-pod> -- bash -c "curl -H 'Metadata-Flavor: Google' <http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token>"

test_auth.py

bash
# Create the test file
cat << 'EOF' > test_auth.py
from google.auth import default
from google.cloud import run_v2
import google.auth.transport.requests

def test_auth():
    print("1. Getting default credentials...")
    credentials, project = default()
    
    print(f"2. Project ID: {project}")
    
    print("3. Refreshing credentials...")
    request = google.auth.transport.requests.Request()
    credentials.refresh(request)
    
    print("4. Token info:", credentials.token)
    
    print("5. Creating Cloud Run client...")
    client = run_v2.JobsClient(credentials=credentials)
    
    print("6. Trying to list jobs...")
    parent = f"projects/{project}/locations/europe-west6"
    jobs = client.list_jobs(parent=parent)
    for job in jobs:
        print(f"Found job: {job.name}")

if __name__ == "__main__":
    test_auth()
EOF

# Copy it to the pod
kubectl cp test_auth.py <pod-name>:/tmp/test_auth.py -n <namespace>

# Execute it in the pod
kubectl exec -it <pod-name> -n <namespace> -- python /tmp/test_auth.py

bash
# Replace with your actual service account email
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# Check IAM bindings
gcloud iam service-accounts get-iam-policy $SA_EMAIL

bash
kubectl get serviceaccount prefect-worker -n <namespace> -o yaml

google-cloud-run

prefect-worker-base

prefect-worker

bash
# Remove old binding
gcloud iam service-accounts remove-iam-policy-binding \
    <mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com> \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:my-project.svc.id.goog[prefect/prefect-worker]"

# Add correct binding
gcloud iam service-accounts add-iam-policy-binding \
    <mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com> \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:my-project.svc.id.goog[prefect/prefect-worker-base]"

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "your-project-id"  # Replace with your actual project ID
  - name: CLOUDSDK_CORE_PROJECT
    value: "your-project-id"  # Same as above

bash
export PROJECT_ID="your-project-id"  # Replace with your project
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# Add all necessary roles
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.admin"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountTokenCreator"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/vpcaccess.user"

python
from google.auth import default
import google.auth.transport.requests

def test_auth():
    print("1. Getting default credentials...")
    credentials, project = default()
    print(f"2. Project ID: {project}")
    
    print("3. Refreshing credentials...")
    request = google.auth.transport.requests.Request()
    credentials.refresh(request)
    
    print("4. Token info:", credentials.token[:20] + "...")  # Only show start of token

if __name__ == "__main__":
    test_auth()

bash
prefect work-pool inspect base

bash
# Replace these with your actual values
export PROJECT_ID="my-project"
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# Add Cloud Run Admin role (this is needed for creating jobs)
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.admin"

# Add Service Account User role (needed to act as the service account)
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

# Add VPC Access User role (since you're using a VPC connector)
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/vpcaccess.user"

my-location

my-region

serviceAccount

None

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "region": "{{ region }}",
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": "<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>",
          "vpcAccess": {
            "connector": "projects/my-net-proj/locations/my-location/connectors/name"
          }
        }
      }
    }
  }
}'

bash
prefect work-pool update base --set-base-job-variable region="my-location"

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": "",
          "vpcAccess": {
            "connector": "projects/my-net-proj/locations/my-location/connectors/name"
          },
          "containers": [
            {
              "env": [],
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              }
            }
          ]
        }
      }
    }
  }
}'

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "my-project"  # Your actual project ID
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"
  - name: CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"
  - name: USE_GKE_GCLOUD_AUTH_PLUGIN
    value: "True"
  - name: PREFECT_CLOUD_RUN_JOB_CREDENTIALS_MODE
    value: "workload_identity"

bash
export PROJECT_ID="my-project"
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# Remove all existing bindings first
for role in roles/run.admin roles/run.developer roles/run.invoker roles/iam.serviceAccountUser roles/iam.serviceAccountTokenCreator roles/vpcaccess.user; do
    gcloud projects remove-iam-policy-binding $PROJECT_ID \
        --member="serviceAccount:$SA_EMAIL" \
        --role="$role"
done

# Add them back one by one
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.admin"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/vpcaccess.user"

# Add workload identity binding
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:$PROJECT_ID.svc.id.goog[prefect/prefect-worker-base]"

bash
gcloud services enable <http://run.googleapis.com|run.googleapis.com>

bash
# Delete the worker pod to force a refresh
kubectl delete pod -l <http://app.kubernetes.io/name=prefect-worker|app.kubernetes.io/name=prefect-worker> -n prefect

# Wait for the new pod to be ready
kubectl wait --for=condition=ready pod -l <http://app.kubernetes.io/name=prefect-worker|app.kubernetes.io/name=prefect-worker> -n prefect

python
from google.auth import default
from google.auth.transport import requests
import json

credentials, project = default()
request = requests.Request()
credentials.refresh(request)

print("Project:", project)
print("Token type:", credentials.token_type)
print("Scopes:", credentials.scopes)
print("Valid:", credentials.valid)
print("Expired:", credentials.expired)

kubectl describe pod <worker-pod-name> -n prefect

python
from google.auth import default
from google.auth.transport import requests
import json

def test_auth():
    try:
        print("1. Getting default credentials...")
        credentials, project = default()
        print(f"2. Project ID: {project}")
        
        print("3. Credential type:", type(credentials).__name__)
        
        print("4. Refreshing credentials...")
        request = requests.Request()
        credentials.refresh(request)
        
        print("5. Token available:", bool(credentials.token))
        print("6. Token (first 20 chars):", credentials.token[:20] if credentials.token else "No token")
        
        print("7. Credential attributes:", dir(credentials))
        
    except Exception as e:
        print(f"Error occurred: {type(e).__name__} - {str(e)}")

if __name__ == "__main__":
    test_auth()

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "containers": [
            {
              "image": "{{ image }}",
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              },
              "env": [
                {
                  "name": "PREFECT_API_URL",
                  "value": "{{ prefect.api.url }}"
                },
                {
                  "name": "PREFECT_API_KEY",
                  "value": "{{ prefect.api.key }}"
                }
              ]
            }
          ],
          "vpcAccess": {
            "connector": "projects/my-net-proj/locations/my-location/connectors/name"
          }
        }
      }
    },
    "region": "my-location"
  }
}'

yaml
worker:
  env:
    - name: GOOGLE_CLOUD_PROJECT
      value: "my-project"  # Your actual project ID
    - name: CLOUDSDK_CORE_PROJECT
      value: "my-project"  # Same as above
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: "/var/run/secrets/kubernetes.io/serviceaccount/token"
    - name: USE_GKE_GCLOUD_AUTH_PLUGIN
      value: "True"

bash
export PROJECT_ID="my-project"
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# Grant Cloud Run Admin role at the project level
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.admin"

# Grant Service Account User role
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

# Grant Service Account Token Creator
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountTokenCreator"

# Grant VPC Access User
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/vpcaccess.user"

# Grant Cloud Run Invoker
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/run.invoker"

# Grant Service Account User on itself
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": "<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>",
          "containers": [
            {
              "image": "{{ image }}",
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              }
            }
          ],
          "vpcAccess": {
            "connector": "projects/my-net-proj/locations/my-location/connectors/name"
          }
        }
      }
    },
    "region": "my-location"
  }
}'

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "my-project"
  - name: CLOUDSDK_CORE_PROJECT
    value: "my-project"
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"
  - name: USE_GKE_GCLOUD_AUTH_PLUGIN
    value: "True"
  - name: PREFECT_LOGGING_LEVEL
    value: "DEBUG"
  - name: PREFECT_CLOUD_RUN_JOB_CREDENTIALS_MODE
    value: "workload_identity"

bash
# Enable the API
gcloud services enable <http://run.googleapis.com|run.googleapis.com>

# Verify the service account can list jobs (run this in Cloud Shell or similar)
gcloud run jobs list \
  --impersonate-service-account=prefect@my-project.iam.gserviceaccount.com \
  --project=my-project \
  --region=my-location

bash
# Delete the worker pod to force a refresh
kubectl delete pod -l <http://app.kubernetes.io/name=prefect-worker|app.kubernetes.io/name=prefect-worker> -n prefect

kubectl logs <pod-name> -n prefect

gcloud projects get-iam-policy my-project --flatten="bindings[].members" --filter="bindings.members:prefect@my-project.iam.gserviceaccount.com" --format="table(bindings.role)"

serviceAccount

None

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": "<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>",
          "vpcAccess": {
            "connector": "projects/my-net-proj/locations/my-location/connectors/name"
          },
          "containers": [
            {
              "env": [],
              "args": "{{ args }}",
              "image": "{{ image }}",
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              }
            }
          ]
        }
      }
    },
    "region": "my-location"
  }
}'

bash
prefect work-pool update base --set-base-job-variable region="my-location"

bash
export PROJECT_ID="my-project"
export SA_EMAIL="<mailto:prefect@my-project.iam.gserviceaccount.com|prefect@my-project.iam.gserviceaccount.com>"

# First, grant project-level permissions
for role in \
    "roles/run.admin" \
    "roles/run.invoker" \
    "roles/iam.serviceAccountUser" \
    "roles/vpcaccess.user"; do
    gcloud projects add-iam-policy-binding $PROJECT_ID \
        --member="serviceAccount:$SA_EMAIL" \
        --role="$role"
done

# Grant the service account permission to act as itself
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL \
    --member="serviceAccount:$SA_EMAIL" \
    --role="roles/iam.serviceAccountUser"

# Update the Workload Identity binding
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL \
    --member="serviceAccount:$PROJECT_ID.svc.id.goog[prefect/prefect-worker-base]" \
    --role="roles/iam.workloadIdentityUser"

yaml
env:
  - name: GOOGLE_CLOUD_PROJECT
    value: "my-project"
  - name: CLOUDSDK_CORE_PROJECT
    value: "my-project"
  - name: PREFECT_LOGGING_LEVEL
    value: "DEBUG"
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: "/var/run/secrets/kubernetes.io/serviceaccount/token"

python
from google.auth import default
from google.cloud import run_v2
import google.auth.transport.requests

def test_permissions():
    print("1. Getting credentials...")
    credentials, project = default()
    
    print("2. Refreshing token...")
    auth_req = google.auth.transport.requests.Request()
    credentials.refresh(auth_req)
    
    print("3. Creating Cloud Run client...")
    client = run_v2.JobsClient(credentials=credentials)
    
    print("4. Testing list jobs...")
    parent = f"projects/{project}/locations/my-location"
    try:
        jobs = client.list_jobs(request={"parent": parent})
        print("Successfully listed jobs!")
    except Exception as e:
        print(f"Error listing jobs: {str(e)}")

if __name__ == "__main__":
    test_permissions()

pip install google-cloud-run

bash
gcloud projects get-iam-policy $PROJECT_ID \
    --flatten="bindings[].members" \
    --filter="bindings.members:$SA_EMAIL" \
    --format="table(bindings.role)"

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "containers": [
            {
              "image": "{{ image }}",
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              }
            }
          ]
        }
      }
    },
    "region": "my-location"
  }
}'

bash
# Create a new service account for running jobs
gcloud iam service-accounts create prefect-runner \
    --display-name="Prefect Runner Service Account"

# Grant it Cloud Run permissions
gcloud projects add-iam-policy-binding my-project \
    --member="serviceAccount:prefect-runner@my-project.iam.gserviceaccount.com" \
    --role="roles/run.developer"

# Grant the worker service account permission to impersonate it
gcloud iam service-accounts add-iam-policy-binding \
    <mailto:prefect-runner@my-project.iam.gserviceaccount.com|prefect-runner@my-project.iam.gserviceaccount.com> \
    --member="serviceAccount:prefect@my-project.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountUser"

bash
prefect work-pool update base --update-base-job-template '{
  "job_configuration": {
    "job_body": {
      "template": {
        "template": {
          "serviceAccount": "<mailto:prefect-runner@my-project.iam.gserviceaccount.com|prefect-runner@my-project.iam.gserviceaccount.com>",
          "containers": [
            {
              "image": "{{ image }}",
              "resources": {
                "limits": {
                  "cpu": "{{ cpu }}",
                  "memory": "{{ memory }}"
                }
              }
            }
          ]
        }
      }
    },
    "region": "my-location"
  }
}'

kubernetes

bash
prefect work-pool create kubernetes-pool --type kubernetes

bash
prefect work-pool create process-pool --type process