Difference between revisions of "Workload Identity Federation"
Jump to navigation
Jump to search
| Line 3: | Line 3: | ||
Lets Kubernetes pods authenticate to GCP APIs using a distinct, scoped GCP service account per workload, instead of the node's shared one. | Lets Kubernetes pods authenticate to GCP APIs using a distinct, scoped GCP service account per workload, instead of the node's shared one. | ||
* Replaces the old model where every pod on a node inherited the same broad [[oauth_scopes]] identity. | * Replaces the old model where every pod on a node inherited the same broad [[oauth_scopes]] identity. | ||
| − | * Uses short-lived tokens tied to an explicit | + | * Uses short-lived tokens tied to an explicit [[KSA]]→[[GSA]] binding — no static keys stored anywhere. |
* Limits blast radius: a compromised pod only has its own workload's permissions, not everything the node can do. | * Limits blast radius: a compromised pod only has its own workload's permissions, not everything the node can do. | ||
* Enabling it (via GKE_METADATA mode) also blocks the old fallback path — so any pod without an explicit binding now gets no GCP access at all. | * Enabling it (via GKE_METADATA mode) also blocks the old fallback path — so any pod without an explicit binding now gets no GCP access at all. | ||
Revision as of 09:08, 16 July 2026
https://docs.cloud.google.com/iam/docs/workload-identity-federation
Lets Kubernetes pods authenticate to GCP APIs using a distinct, scoped GCP service account per workload, instead of the node's shared one.
- Replaces the old model where every pod on a node inherited the same broad oauth_scopes identity.
- Uses short-lived tokens tied to an explicit KSA→GSA binding — no static keys stored anywhere.
- Limits blast radius: a compromised pod only has its own workload's permissions, not everything the node can do.
- Enabling it (via GKE_METADATA mode) also blocks the old fallback path — so any pod without an explicit binding now gets no GCP access at all.
Related
See also
- GKE, Features: Autopilot,
gcloud container, gke-gcloud-auth-plugin, GKE release channels, GKE Ingress, GCP Node logs, GCP Node logs severity Error, GKE roles, Provide access to GKE cluster, Deploy GKE cluster using Terraform,cluster_autoscaling, addons_config, GKE Node Pool, node auto-provisioning, GKE authentication, GKE security, publicEndpoint, Workload Identity Federation
Advertising:
