Workload Identity Federation

https://docs.cloud.google.com/iam/docs/workload-identity-federation

Lets Kubernetes pods authenticate to GCP APIs using a distinct, scoped GCP service account per workload, instead of the node's shared one.

• Replaces the old model where every pod on a node inherited the same broad oauth_scopes identity.
• Uses short-lived tokens tied to an explicit KSA→GSA binding — no static keys stored anywhere.
• Limits blast radius: a compromised pod only has its own workload's permissions, not everything the node can do.
• Enabling it (via GKE_METADATA mode) also blocks the old fallback path — so any pod without an explicit binding now gets no GCP access at all.

Related

• OAuth 2.0 token exchange
• IRSA

See also

• GKE, Features: Autopilot, gcloud container, gke-gcloud-auth-plugin, GKE release channels, GKE Ingress, GCP Node logs, GCP Node logs severity Error, GKE roles, Provide access to GKE cluster, Deploy GKE cluster using Terraform, cluster_autoscaling, addons_config, GKE Node Pool, node auto-provisioning, GKE authentication, GKE security, publicEndpoint, Workload Identity Federation