[Doc] Example setting up access for google cloud storage

[yc2984]

Search before asking

• I had searched in the issues and found no similar feature requirement.

Description

Original question: https://discuss.ray.io/t/ray-cluster-google-cloud-storage-access/10568

I'm deploying ray on GKE, I'd like to access google cloud storage from the ray cluster. What it the best practice for this?

Related to: Google cloud storage access from worker, however the content seems outdated, since it uses serviceAccounts in the config.

I see in this PR serviceAccounts field is deprecated in helm chart values? #969

Also the new serviceAccountName is a Kubernetes service account and here it’s a service account in google cloud.

Is there an example for this using helm chart? I see in the helm template there is only serviceAccountName, but noserviceAccounts.

Use case

I'm deploying ray on GKE, I'd like to access google cloud storage from the ray cluster.

Related issues

#969

https://discuss.ray.io/t/ray-cluster-google-cloud-storage-access/10568

https://discuss.ray.io/t/google-cloud-storage-access-from-worker/1899

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

[kevin85421]

A related doc for EKS: https://github.com/ray-project/kuberay/blob/master/docs/guidance/aws-eks-iam.md

[yc2984]

One way to do this is to use workload-identity, can be set up following the guide below. The service account name in the helm chart field is the kubernetes service account that can impersonate the google service account.
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

[yc2984]

@kevin85421 I can also help contribute to the documentation on this topic if needed :)

[kevin85421]

This is very helpful! I reached out to the Google GKE team last week to contribute to the documentation. I guess that this issue is not currently prioritized. Hence, welcome to open the PR!

[kevin85421]

Close by https://docs.ray.io/en/master/cluster/kubernetes/user-guides/gke-gcs-bucket.html