Workload Identity

Related topics

• Workload Identity depends on service account impersonation From the official documentation: “Workload Identity is the recommended approach as it uses short-lived access tokens using service account impersonation.”
• Cloud Service Mesh depends on Workload Identity From the official documentation: “Cloud Service Mesh uses Workload Identity to provide secure access to required Google APIs and resources.”
• GKE works with Workload Identity From the official documentation: “To configure workload identity for installations on GKE (optional):”
• Identity and Access Management works with Workload Identity From the official documentation: “Using [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) is the recommended way to allow GKE workloads to authenticate with Google APIs and for administrators to apply "least privilege" authorization controls using IAM.”
• Workload Identity is part of GKE From the official documentation: “Ensure Workload Identity is enabled on Google Kubernetes Engine clusters.”
• Workload Identity depends on service account From the official documentation: “Workload Identity is the recommended approach because it uses short-lived tokens by using service account impersonation.”
• Workload Identity configures service account From the official documentation: “Workload Identity binds a KSA to a GSA, causing any deployments with that KSA to authenticate as the GSA in their interactions with Google Cloud.”
• Apigee hybrid works with Workload Identity From the official documentation: “Added the ability to enable Workload Identity with Apigee hybrid.”
• IAM service account works with Workload Identity From the official documentation: “If you use Workload Identity, grant the new environment's Kubernetes service accounts access to the IAM service accounts.”
• Secret Manager works with Workload Identity From the official documentation: “Secrets from Secret Manager can be accessed from the cluster using the [client library](/secret-manager/docs/reference/libraries) and [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity) authentication, or using the [Secrets Store CSI…”
• Workload Identity secures Cloud Storage From the official documentation: “In this tutorial, you create a dedicated Kubernetes service account named `snapshot-sa` and configure Workload Identity to authorize the sandboxed Pod to securely read and write snapshot objects in Cloud Storage.”
• Cloud SQL works with Cloud Storage From the official documentation: “Exports data from a Cloud SQL instance to a Cloud Storage bucket as a SQL dump or CSV file.”
• Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Cloud Service Mesh works with GKE From the official documentation: “# Set up a proxyless gRPC service mesh on GKE”
• Compute Engine works with service account From the official documentation: “A common method is to attach a service account to a resource like a Compute Engine instance.”
• Cloud Run works with Cloud Service Mesh From the official documentation: “This section shows you how to troubleshoot common errors with Cloud Service Mesh and Cloud Run.”
• Cloud Run works with Cloud SQL From the official documentation: “Connecting from Cloud Run (fully managed) to Cloud SQL”
• Cloud SQL works with Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
• Compute Engine is an alternative to GKE From the official documentation: “You can also deploy a third-party model to either Vertex AI Model Garden or self-host on GKE or Compute Engine.”
• Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
• Cloud Run depends on service account From the official documentation: “The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.”
• Cloud Service Mesh depends on GKE From the official documentation: “Provision managed Cloud Service Mesh on a GKE cluster.”
• Cloud SQL works with GKE From the official documentation: “The app uses Cloud SQL, Vertex AI, and either Google Kubernetes Engine (GKE) or Cloud Run.”
• Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
• Cloud Storage works with Compute Engine From the official documentation: “For example, you can create a service account that your Compute Engine instances use to access objects stored in Cloud Storage buckets.”
• Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
• GKE works with Workload Identity Federation for GKE From the official documentation: “Workload Identity Federation for GKE (for workloads running on Google Kubernetes Engine only)”
• service account works with Workload Identity Federation From the official documentation: “When an application uses Workload Identity Federation, it impersonates a service account.”
• Apigee hybrid works with Workload Identity Federation From the official documentation: “To use Workload Identity Federation with Apigee hybrid, first configure your cluster and then apply the feature to your Apigee hybrid installation.”
• Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Cloud Run works with Cloud Storage From the official documentation: “Receive events from Cloud Storage in a Cloud Run service”
• Cloud Run is an alternative to GKE From the official documentation: “For your containerized websites, you can also deploy them to [Cloud Run](/run) in addition to [using GKE](#kubernetes-engine).”
• Cloud Run works with Identity and Access Management From the official documentation: “For example, a remote backend deployed on Cloud Run can use Identity and Access Management (IAM) to:”
• Cloud Run works with Secret Manager From the official documentation: “The secret is configured to be accessible by Cloud Run and Cloud Build.”
• Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• GKE depends on Compute Engine From the official documentation: “For example, GKE deploys clusters on Compute Engine VMs.”
• GKE works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
• GKE works with Workload Identity Federation From the official documentation: “To allow GitHub Actions authenticate Google Cloud and deploy to GKE, use [workload identity federation](/iam/docs/workload-identity-federation).”
• Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
• Identity and Access Management works with Workload Identity Federation for GKE From the official documentation: “Instead, your GKE cluster directly authenticates workloads using Google Cloud IAM.”
• Secret Manager works with Workload Identity Federation for GKE From the official documentation: “Kubernetes Pods use Workload Identity Federation for GKE to authenticate to the Secret Manager API.”
• service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
• Workload Identity Federation for GKE is part of GKE From the official documentation: “Enable Workload Identity Federation for GKE:”
• Apigee hybrid works with GKE From the official documentation: “You can install Apigee hybrid on a number of platforms, including Google Distributed Cloud (on bare metal or VMware), AWS, Bare Metal, EKS, Google Kubernetes Engine (GKE), OpenShift, and others.”
• Application Default Credentials works with Cloud SQL From the official documentation: “Application Default Credentials are part of the client libraries you can use to access Cloud SQL.”
• Application Default Credentials configures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see [Set up authentication for client libraries](/storage/docs/authentication#client-libs).”
• Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
• Application Default Credentials works with service account From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
• Application Default Credentials works with service account impersonation From the official documentation: “You can use service account impersonation to set up a local Application Default Credentials (ADC) file.”
• Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Cloud Run works with GKE From the official documentation: “Leverage Google Kubernetes Engine (GKE) and Cloud Run to deploy applications to the Google Cloud, optimizing costs, performance, and management overhead.”
• Cloud Service Mesh works with Compute Engine From the official documentation: “Cloud Service Mesh supports a variety of infrastructures (GKE/Kubernetes, Compute Engine) and environments (on-premises, other clouds).”
• Cloud Service Mesh works with Workload Identity Federation for GKE From the official documentation: “When Envoy (`envoy-proxy`) connects to Cloud Service Mesh to fetch the xDS configuration, it uses Workload Identity Federation for GKE and the Compute Engine VM default service account (unless the bootstrap was changed).”
• Cloud SQL works with Secret Manager From the official documentation: “This page describes four use cases for using Secret Manager to manage secrets with Cloud SQL:”
• Cloud Storage works with service account From the official documentation: “The service account can manage objects in the Cloud Storage bucket.”
• Identity and Access Management secures Compute Engine From the official documentation: “Compute Engine uses Identity and Access Management (IAM) for authorization.”
• Identity and Access Management secures Secret Manager From the official documentation: “Secret Manager uses Identity and Access Management (IAM) for authorization.”
• Secret Manager depends on Application Default Credentials From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”