I am attempting to follow the documentation found here to enable the KubernetesPodOperator within DAGs running on a Composer 3 Environment. I have done this for Composer 2 and we are looking to migrate to Composer 3. The docs seem to link to the same guidance as setting-up Workload Identity for GKE (docs). The key steps that I’m having trouble with are:

• Creating a Kubernetes Service Account and Namespace within the Cluster.

I understand that Composer 3 is a “serverless” offering and that the K8 Cluster Airflow pods are running on is not in the customer project, but in the tenant project (using the language from the docs linked above). So, for configuring with Composer 2, the answer was easy: use gcloud to get credentials for kubectl to then execute the commands in the linked doc.

However, the docs for Composer 3 above do seem to indicate this configuration is possible, but I’m stumped on how to create the Namespace and/or Kubernetes Service Account since I can’t use gcloud to fetch credentials for kubectl (specifically, the command: gcloud container clusters get-credentials).

Am I missing something? How do I set-up the Namespace and K8 Service account for Composer 3 to bind to my IAM Service Account?