Workload Identity & Federation

Exam guide§4.2

The whole theme here is keyless authentication: let an external or in-cluster identity get Google credentials without a downloaded SA key. Three related but distinct features - keep them straight.

• Workload Identity Federation for GKE (formerly just "Workload Identity") - maps a Kubernetes service account (KSA) to a Google service account (GSA). Pods authenticate as the GSA. The recommended way for GKE workloads to call Google APIs.
• Workload Identity Federation - lets an external workload (AWS, Azure, GitHub Actions, any OIDC/SAML IdP) exchange its own token for a Google token. No SA key on the other cloud.
• Workforce Identity Federation - lets external human users (from Okta, Azure AD, any IdP) sign in and access GCP without provisioning Google accounts for them.

◎Exam cueWorkload vs Workforce - the one-word tell

Workload = machines/apps. Workforce = people/employees.

Non-Google users logging in to the console/gcloud→Workforce Identity Federation

Code/services in AWS/GitHub/GKE calling Google APIs→Workload Identity (Federation)

⚠GotchaWorkload Identity (GKE) mapping direction

You bind the KSA to the GSA by granting the KSA the role roles/iam.workloadIdentityUser on the GSA. Enable it on the cluster/node pool, annotate the KSA with the GSA email. Do NOT mount SA key secrets into pods - that is the anti-pattern this replaces.

≡FactsFederation building blocks

• Workload Identity Pool - container for external identities.
• Provider - the trust config for the external IdP (OIDC or AWS/SAML) inside the pool.
• Attribute mapping - maps external token claims to Google attributes for conditions.
• External identity impersonates a GSA via workloadIdentityUser; tokens are short-lived.
• GKE Workload Identity pool name: PROJECT_ID.svc.id.goog.

CommandsGKE Workload Identity binding

# Allow the KSA to impersonate the GSA

gcloud iam service-accounts add-iam-policy-binding \

GSA@PROJECT_ID.iam.gserviceaccount.com \

--role="roles/iam.workloadIdentityUser" \

--member="serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"

 

# Annotate the KSA to point at the GSA

kubectl annotate serviceaccount KSA_NAME \

--namespace NAMESPACE \

iam.gke.io/gcp-service-account=GSA@PROJECT_ID.iam.gserviceaccount.com

?DECISIONWhich federation feature?

Pod inside GKE→Workload Identity (KSA → GSA)

App on AWS/Azure/GitHub Actions→Workload Identity Federation

Employee from Okta/Azure AD→Workforce Identity Federation

Anything else = downloading a key→Reconsider - almost never right

Pick this when: match on WHO the external identity is - a pod, another cloud's workload, or a human