Workload Identity

Related topics

• Workload Identity depends on service account impersonation From the official documentation: “Workload Identity is the recommended approach as it uses short-lived access tokens using service account impersonation.”
• Workload Identity depends on service account From the official documentation: “Workload Identity is the recommended approach because it uses short-lived tokens by using service account impersonation.”
• Cloud Service Mesh depends on Workload Identity From the official documentation: “Cloud Service Mesh uses Workload Identity to provide secure access to required Google APIs and resources.”
• GKE works with Workload Identity From the official documentation: “To configure workload identity for installations on GKE (optional):”
• Identity and Access Management works with Workload Identity From the official documentation: “Using [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) is the recommended way to allow GKE workloads to authenticate with Google APIs and for administrators to apply "least privilege" authorization controls using IAM.”
• Workload Identity is part of GKE From the official documentation: “Ensure Workload Identity is enabled on Google Kubernetes Engine clusters.”
• Workload Identity configures service account From the official documentation: “Workload Identity binds a KSA to a GSA, causing any deployments with that KSA to authenticate as the GSA in their interactions with Google Cloud.”
• Config Connector depends on Workload Identity From the official documentation: “Create or identify a GKE cluster where Config Connector has not yet been installed and that has [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity#enable_on_new_cluster) and [Kubernetes Engine Monitoring](/monitoring/kubernetes-engine/installing) enabled.”
• Config Connector works with Workload Identity From the official documentation: “Setup Workload Identity if installing Config Connector for the first time.”
• GKE attached clusters depends on Workload Identity From the official documentation: “Existing clusters from GKE attached clusters (previous generation) must have Workload Identity enabled before being migrated to the current generation of GKE attached clusters.”
• HashiCorp Vault works with Workload Identity From the official documentation: “Access Vault secrets through the [API](https://vaultproject.io/api) and authenticate using [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity).”
• Secret Manager works with Workload Identity From the official documentation: “Secrets from Secret Manager can be accessed from the cluster using the [client library](/secret-manager/docs/reference/libraries) and [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) authentication, or using the [Secrets Store CSI…”
• Workload Identity secures Cloud Storage From the official documentation: “In this tutorial, you create a dedicated Kubernetes service account named `snapshot-sa` and configure Workload Identity to authorize the sandboxed Pod to securely read and write snapshot objects in Cloud Storage.”
• Workload Identity secures Memorystore From the official documentation: “Requests to access Google Cloud services (for example: [Cloud SQL for MySQL](/sql) or [Memorystore](/memorystore)) are authenticated via [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity).”
• BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
• BigQuery works with Cloud Storage From the official documentation: “Sample to load Avro data from Cloud Storage into a new BigQuery table”
• Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
• Cloud SQL works with Cloud Storage From the official documentation: “Exports data from a Cloud SQL instance to a Cloud Storage bucket as a SQL dump or CSV file.”
• Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
• Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Cloud Service Mesh works with GKE From the official documentation: “# Set up a proxyless gRPC service mesh on GKE”
• Compute Engine works with service account From the official documentation: “A common method is to attach a service account to a resource like a Compute Engine instance.”
• BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• Cloud Run works with Cloud Service Mesh From the official documentation: “This section shows you how to troubleshoot common errors with Cloud Service Mesh and Cloud Run.”
• Cloud Run works with Cloud SQL From the official documentation: “Connecting from Cloud Run (fully managed) to Cloud SQL”
• Cloud SQL works with Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
• Compute Engine is an alternative to GKE From the official documentation: “You can also deploy a third-party model to either Vertex AI Model Garden or self-host on GKE or Compute Engine.”
• Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Cloud Run depends on service account From the official documentation: “The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.”
• Cloud Service Mesh depends on GKE From the official documentation: “Provision managed Cloud Service Mesh on a GKE cluster.”
• Cloud SQL works with GKE From the official documentation: “The app uses Cloud SQL, Vertex AI, and either Google Kubernetes Engine (GKE) or Cloud Run.”
• Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
• Cloud Storage works with Compute Engine From the official documentation: “For example, you can create a service account that your Compute Engine instances use to access objects stored in Cloud Storage buckets.”
• Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
• GKE works with Workload Identity Federation for GKE From the official documentation: “Workload Identity Federation for GKE (for workloads running on Google Kubernetes Engine only)”
• Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Cloud Run works with Cloud Storage From the official documentation: “Receive events from Cloud Storage in a Cloud Run service”
• Cloud Run is an alternative to GKE From the official documentation: “For your containerized websites, you can also deploy them to [Cloud Run](/run) in addition to [using GKE](#kubernetes-engine).”
• Cloud Run works with Identity and Access Management From the official documentation: “For example, a remote backend deployed on Cloud Run can use Identity and Access Management (IAM) to:”
• Cloud Run works with Secret Manager From the official documentation: “The secret is configured to be accessible by Cloud Run and Cloud Build.”
• Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• GKE depends on Compute Engine From the official documentation: “For example, GKE deploys clusters on Compute Engine VMs.”
• GKE works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
• Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
• Identity and Access Management works with Workload Identity Federation for GKE From the official documentation: “Instead, your GKE cluster directly authenticates workloads using Google Cloud IAM.”
• Secret Manager works with Workload Identity Federation for GKE From the official documentation: “Kubernetes Pods use Workload Identity Federation for GKE to authenticate to the Secret Manager API.”
• service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
• Workload Identity Federation for GKE is part of GKE From the official documentation: “Enable Workload Identity Federation for GKE:”
• Application Default Credentials works with Cloud SQL From the official documentation: “Application Default Credentials are part of the client libraries you can use to access Cloud SQL.”
• Application Default Credentials configures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see [Set up authentication for client libraries](/storage/docs/authentication#client-libs).”
• Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
• Application Default Credentials works with service account From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
• Application Default Credentials works with service account impersonation From the official documentation: “You can use service account impersonation to set up a local Application Default Credentials (ADC) file.”
• BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
• Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Cloud Run works with GKE From the official documentation: “Leverage Google Kubernetes Engine (GKE) and Cloud Run to deploy applications to the Google Cloud, optimizing costs, performance, and management overhead.”