Workload Identity Federation for GKE

Related topics

• GKE works with Workload Identity Federation for GKE From the official documentation: “Workload Identity Federation for GKE (for workloads running on Google Kubernetes Engine only)”
• Identity and Access Management works with Workload Identity Federation for GKE From the official documentation: “Instead, your GKE cluster directly authenticates workloads using Google Cloud IAM.”
• Secret Manager works with Workload Identity Federation for GKE From the official documentation: “Kubernetes Pods use Workload Identity Federation for GKE to authenticate to the Secret Manager API.”
• Workload Identity Federation for GKE is part of GKE From the official documentation: “Enable Workload Identity Federation for GKE:”
• Cloud Service Mesh works with Workload Identity Federation for GKE From the official documentation: “When Envoy (`envoy-proxy`) connects to Cloud Service Mesh to fetch the xDS configuration, it uses Workload Identity Federation for GKE and the Compute Engine VM default service account (unless the bootstrap was changed).”
• Eventarc depends on Workload Identity Federation for GKE From the official documentation: “It is also needed to forward GKE events using Eventarc.”
• IAM works with Workload Identity Federation for GKE From the official documentation: “The cluster you are using for this tutorial is configured to use Workload Identity Federation for GKE, which allows you to grant IAM roles directly to Kubernetes ServiceAccounts.”
• Workload Identity Federation for GKE secures Cloud Storage From the official documentation: “This command is required to grant the GKE service account permission to access the Cloud Storage bucket using Workload Identity Federation for GKE.”
• Workload Identity Federation for GKE depends on GKE From the official documentation: “Workload Identity Federation for GKE provides a highly secure and automated authentication mechanism, simplifying key management. This method is specific to GKE clusters.”
• Cloud Service Mesh depends on Workload Identity Federation for GKE From the official documentation: “Cloud Service Mesh requires Workload Identity Federation for GKE and is the recommended way to access Google APIs from GKE workloads.”
• Config Connector depends on Workload Identity Federation for GKE From the official documentation: “Config Connector creates and manages Google Cloud resources by authenticating with an Identity and Access Management (IAM) service account and using Workload Identity Federation for GKE to bind IAM service accounts with Kubernetes service accounts.”
• Envoy proxy depends on Workload Identity Federation for GKE From the official documentation: “When Envoy (`envoy-proxy`) connects to Cloud Service Mesh to fetch the xDS configuration, it uses Workload Identity Federation for GKE and the Pod's Kubernetes ServiceAccount.”
• GKE depends on Workload Identity Federation for GKE From the official documentation: “Your GKE cluster can access the Spanner API through [Workload Identity Federation for GKE](/kubernetes-engine/docs/concepts/workload-identity).”
• multi-cluster Services works with Workload Identity Federation for GKE From the official documentation: “Because this scenario uses Workload Identity Federation for GKE, the fleet host project's MCS Importer GKE service account needs the Network User role for its own project.”
• service account works with Workload Identity Federation for GKE From the official documentation: “use [Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity#authenticating_to) to attach service accounts to Kubernetes pods.”
• service account is an alternative to Workload Identity Federation for GKE From the official documentation: “If you do not enable Workload Identity Federation for GKE, you need to register the cluster with a Google Cloud service account for authentication, and complete the additional steps in [Authenticating service accounts](#authenticating).”
• Workload Identity Federation for GKE is part of Google Kubernetes Engine From the official documentation: “Create a GKE cluster using GKE version 1.27 or later with [Workload Identity Federation for GKE](/kubernetes-engine/docs/how-to/workload-identity) and [GKE Gateway](/kubernetes-engine/docs/how-to/deploying-gateways) enabled.”
• Workload Identity Federation for GKE secures Google Kubernetes Engine From the official documentation: “Workload Identity Federation is the recommended secure method for Google Kubernetes Engine workloads.”
• BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
• BigQuery works with Cloud Storage From the official documentation: “Sample to load Avro data from Cloud Storage into a new BigQuery table”
• Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• Cloud SQL works with Cloud Storage From the official documentation: “Exports data from a Cloud SQL instance to a Cloud Storage bucket as a SQL dump or CSV file.”
• BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
• Cloud Run depends on Pub/Sub From the official documentation: “Cloud Run function triggered by Pub/Sub to fetch HYPR MFA logs and write to GCS.”
• Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
• Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Cloud Run works with Eventarc From the official documentation: “Create a Cloud Run service as an event destination for the Eventarc trigger:”
• Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Cloud Service Mesh configures Envoy proxy From the official documentation: “Cloud Service Mesh configures the Envoy proxy to do the following:”
• Cloud Service Mesh works with GKE From the official documentation: “# Set up a proxyless gRPC service mesh on GKE”
• Compute Engine works with service account From the official documentation: “A common method is to attach a service account to a resource like a Compute Engine instance.”
• BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• Cloud Run works with Cloud Service Mesh From the official documentation: “This section shows you how to troubleshoot common errors with Cloud Service Mesh and Cloud Run.”
• Cloud Run works with Cloud SQL From the official documentation: “Connecting from Cloud Run (fully managed) to Cloud SQL”
• Cloud SQL works with Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
• Compute Engine is an alternative to GKE From the official documentation: “You can also deploy a third-party model to either Vertex AI Model Garden or self-host on GKE or Compute Engine.”
• Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Cloud Run depends on service account From the official documentation: “The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.”
• Cloud Service Mesh depends on GKE From the official documentation: “Provision managed Cloud Service Mesh on a GKE cluster.”
• Cloud SQL works with GKE From the official documentation: “The app uses Cloud SQL, Vertex AI, and either Google Kubernetes Engine (GKE) or Cloud Run.”
• Cloud Storage works with Eventarc From the official documentation: “Trigger functions from Cloud Storage using Eventarc”
• Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
• Pub/Sub works with Secret Manager From the official documentation: “Receive notifications via Pub/Sub when Secret Manager resources change.”
• Application Default Credentials configures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
• Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
• BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
• Cloud Storage works with Compute Engine From the official documentation: “For example, you can create a service account that your Compute Engine instances use to access objects stored in Cloud Storage buckets.”
• Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
• Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
• Envoy proxy is part of Cloud Service Mesh From the official documentation: “Cloud Service Mesh works by placing an [Envoy](https://www.envoyproxy.io) sidecar proxy in each Pod.”
• Envoy proxy depends on Cloud Service Mesh From the official documentation: “Envoy proxies running as sidecars receive their service routing configuration from Cloud Service Mesh.”
• Eventarc works with Pub/Sub From the official documentation: “Trigger functions from Pub/Sub using Eventarc”
• Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Application Default Credentials secures IAM From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
• BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
• Cloud Run works with Cloud Storage From the official documentation: “Receive events from Cloud Storage in a Cloud Run service”