> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SeekrFlow cloud identity

> Connect the cloud identity you created to SeekrFlow's service accounts.

You created the role or managed identity in [Set up cloud identity](/self-managed/flow/provision/cloud-identity), and recorded its settings in your values file. This page connects it to SeekrFlow's service accounts.

<Note>
  Skip this page if either applies:

  * **On-premises deployment** – Storage credentials come from a Kubernetes secret you create in [Create SeekrFlow secrets](/self-managed/flow/prepare/secrets-and-tokens). You don't need a cloud identity.
  * **Amazon Web Services (AWS) Identity and Access Management (IAM) roles for service accounts** – The role annotation in your values file connects the identity.
</Note>

<Tabs>
  <Tab title="With the sfe CLI">
    Your AWS identity needs these permissions:

    * `iam:UpdateAssumeRolePolicy` and `iam:PassRole` on the SeekrFlow role
    * `eks:CreatePodIdentityAssociation` and `eks:ListPodIdentityAssociations` on the cluster

    <Steps>
      <Step title="Preview the changes">
        Replace `<role-arn>` with the Amazon Resource Name (ARN) of the role you created for SeekrFlow:

        ```bash theme={null}
        sfe cloud-identity aws -f my-values.yaml --role-arn <role-arn> --dry-run
        ```
      </Step>

      <Step title="Connect the identity">
        ```bash theme={null}
        sfe cloud-identity aws -f my-values.yaml --role-arn <role-arn>
        ```

        The command updates the role's trust policy and creates an Amazon Elastic Kubernetes Service (Amazon EKS) Pod Identity association for each SeekrFlow service account.
      </Step>

      <Step title="Restart External Secrets Operator">
        External Secrets Operator gets its AWS credentials only when it starts. If you use it, restart it now:

        ```bash theme={null}
        kubectl rollout restart deployment external-secrets -n external-secrets
        ```
      </Step>
    </Steps>
  </Tab>

  <Tab title="Without the sfe CLI">
    Your AWS identity needs `iam:PassRole` on the SeekrFlow role and `eks:CreatePodIdentityAssociation` on the cluster.

    Your role's trust policy must already allow Amazon EKS Pod Identity. See [Set up cloud identity](/self-managed/flow/provision/cloud-identity). Create a Pod Identity association for each of these service accounts:

    | Namespace | Service accounts |
    | - | - |
    | `seekrflow` | `seekrflow-agent`<br />`seekrflow-auth`<br />`seekrflow-data-ready`<br />`seekrflow-frontend`<br />`seekrflow-flowmodel`<br />`seekrflow-explainability`<br />`seekrflow-ingestion`<br />`seekrflow-keycloak`<br />`seekrflow-license`<br />`seekrflow-operator`<br />`seekrflow-router`<br />`seekrflow-serving`<br />`seekrflow-training`<br />`seekrflow-tool`<br />`seekrflow-mlflow-run`<br />`seekrflow-mlflow-tracking`<br />`seekrflow-lora-controller`<br />`seekrflow-argo-workflows-workflow-controller` |
    | `argo-workflows` | `seekrflow-argo-workflows-workflow-controller` |
    | `external-secrets` | `external-secrets`, if you use External Secrets Operator |

    For example:

    ```bash theme={null}
    aws eks create-pod-identity-association \
      --cluster-name <cluster-name> \
      --namespace seekrflow \
      --service-account seekrflow-agent \
      --role-arn <role-arn>
    ```

    External Secrets Operator gets its AWS credentials only when it starts. If you use it, restart it now:

    ```bash theme={null}
    kubectl rollout restart deployment external-secrets -n external-secrets
    ```
  </Tab>
</Tabs>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.