Gke Autopilot workload identity

[Alex]

Hi folks! 

Have a question about workload identity. 

Flow: internet <-> gke Autopilot cluster - ingress (nginx) - namespace (front) - nginx router(deployment) - storage buckets(static sites). I've mapped k8s SA with gcp SA and grant to gcp SA storage object viewer role. When request came throughout ingress to nginx router form internet user, then nginx router routes request to bucket folder with static content, but all time I got permission denied even if I grant bucket admin role to mapped gcp SA.  The question is - how to grant permission and which one for k8s SA for access to bucket with static content and deliver that content to user from internet?

[Alex]

schema is:

[abdelfettah]

You should grant permissions on the bucket to the gcp SA which has mapping to the k8s SA attached to the nginx router pod. traffic between the Ingress nginx and the nginx router pod is internal to kubernetes and will not require authn. 

One question tough, why are you using nginx as an ingress layer ? Isn't the built-in Ingress good for you or do you have a specific use case our Ingress doesn't fullfil ?