[Core] Add NO_UPLOAD for remote_identity

docs/source/reference/config.rst

@@ -244,6 +244,10 @@ Available fields and semantics:
     # instances. SkyPilot will auto-create and reuse a service account (IAM
     # role) for AWS instances.
     #
+    # SKIP: Skip setting the remote identity. No credentials will be uploaded to
+    # the instances. Useful for avoiding overriding any existing credentials
+    # that may be automounted on the cluster.
+    #
     # Customized service account (IAM role): <string> or <list of single-element dict>
     # - <string>: apply the service account with the specified name to all instances.
     #    Example:
@@ -406,6 +410,10 @@ Available fields and semantics:
     # instances. SkyPilot will auto-create and reuse a service account for GCP
     # instances.
     #
+    # SKIP: Skip setting the remote identity. No credentials will be uploaded to
+    # the instances. Useful for avoiding overriding any existing credentials
+    # that may be automounted on the cluster.
+    #
     # Two caveats of SERVICE_ACCOUNT for multicloud users:
     #
     # - This only affects GCP instances. Local GCP credentials will still be
@@ -491,6 +499,10 @@ Available fields and semantics:
     # SkyPilot will auto-create and reuse a service account with necessary roles
     # in the user's namespace.
     #
+    # SKIP: Skip setting the remote identity. No credentials will be uploaded to
+    # the pods. Useful for avoiding overriding any existing credentials that may
+    # be automounted on the cluster.
+    #
     # <string>: The name of a service account to use for all Kubernetes pods.
     # This service account must exist in the user's namespace and have all
     # necessary permissions. Refer to https://skypilot.readthedocs.io/en/latest/cloud-setup/cloud-permissions/kubernetes.html

sky/backends/backend_utils.py

@@ -706,6 +706,14 @@ def write_cluster_config(
                 'is not supported by this cloud. Remove the config or set: '
                 '`remote_identity: LOCAL_CREDENTIALS`.')
         excluded_clouds = [cloud]
+
+    for cloud_str, cloud_obj in cloud_registry.CLOUD_REGISTRY.items():
+        remote_identity_config = skypilot_config.get_nested(
+            (cloud_str.lower(), 'remote_identity'), None)
+        if remote_identity_config:
+            if remote_identity_config == schemas.RemoteIdentityOptions.SKIP.value:
+                excluded_clouds.append(cloud_obj)
+
     credentials = sky_check.get_cloud_credential_file_mounts(excluded_clouds)
 
     auth_config = {'ssh_private_key': auth.PRIVATE_SSH_KEY_PATH}

sky/utils/schemas.py

@@ -655,6 +655,7 @@ class RemoteIdentityOptions(enum.Enum):
     """
     LOCAL_CREDENTIALS = 'LOCAL_CREDENTIALS'
     SERVICE_ACCOUNT = 'SERVICE_ACCOUNT'
+    SKIP = 'SKIP'
 
 
 def get_default_remote_identity(cloud: str) -> str: