In Google Kubernetes Engine (GKE), applications leverage Workload Identity to securely connect with Google Cloud Platform (GCP) services through IAM service accounts. This seamless integration enables fine-grained access control and eliminates the need for managing credentials within the application code, enhancing both security and operational efficiency in the GKE environment.
- Export important variables
export PROJECT_ID="" export CLUSTER_NAME="" export GKE_REGION=""
- Authenticate using
gcloud auth login
- Set your project ID
gcloud config set project $PROJECT_ID
Workload identity needs to be enabled for your GKE cluster so that pods can leverage this to authenticate to GCP services without credentials. If you have used TrueFoundry's Onboarding CLI to deploy the cluster then you can skip this step.
- If workload identity is not enabled for your GKE cluster, run the below command to enable it
gcloud container clusters update $CLUSTER_NAME \ --region=$GKE_REGION \ --workload-pool=$PROJECT_ID.svc.id.goog
- The above step will enable workload identity only in the new node pool. To enable the workload identity in the existing node pool
gcloud container node-pools create <NODEPOOL_NAME> \ --cluster=$CLUSTER_NAME \ --region=$GKE_REGION \ --workload-metadata=GKE_METADATA
- Export the namespace and the
serviceaccount. TrueFoundry's workspace is analogous to Kubernetes namespace.
export APP_NS="" export APP_SA=""
- Go to Workspaces tab from the left panel of the portal and create the workspace with same name as of your namespace $APP_NS
- Click on
+ New Workspaceto create a new workspace. If you already have a workspace created click on the Edit section from the right side of the workspace card.
- Select the cluster where you want to create the serviceaccount and enter the name of the workspace (namespace).
- Click on
In this section we will create an IAM
serviceaccount which has access to buckets. We will try to use this to access the bucket files in GCP
- Export these variables and enter the name of the google serviceaccount you want to give in the variable
GSA_NAME. We are assigning this serviceaccount Storage admin permission. You can assign the permissions that you want for accessing your GCP application.
# google serviceaccount export GSA_NAME="" export ROLE_NAME="roles/storage.admin"
- Create the IAM serviceaccount and assign the role using the below command. We are also assigning
roles/iam.workloadIdentityUserrole to the IAM serviceaccount on itself so that it can be accessed from inside GKE.
# creating the IAM serviceaccount gcloud iam service-accounts create $GSA_NAME \ --project=$PROJECT_ID # assigning the role gcloud projects add-iam-policy-binding $PROJECT_ID \ --member "serviceAccount:$GSA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \ --role "$ROLE_NAME" # assign the roles/iam.workloadIdentityUser gcloud iam service-accounts add-iam-policy-binding $GSA_NAME@$PROJECT_ID.iam.gserviceaccount.com \ --role roles/iam.workloadIdentityUser \ --member "serviceAccount:$PROJECT_ID.svc.id.goog[$APP_NS/$APP_SA]"
The policy contains bindings with conditions
When you are trying to run the command
gcloud projects add-iam-policy-bindingyou might get the below output
Created service account [test-iam-sa].  EXPRESSION=resource.name.startsWith("projects/_/buckets/xxxxxxxx"), TITLE=xxxxxxx Admin  None  Specify a new condition The policy contains bindings with conditions, so specifying a condition is required when adding a binding. Please specify a condition.:
You can enter a condition if you want to restrict the GCP IAM serviceaccount to a certain bucket or you can use option 2 and continue.
- Go to Workspaces tab from the left panel of the portal and click on the pencil icon to edit your workspace.
- Click on
Show Advanced fieldson bottom of the screen and enable
- Click on
+ Add Service Accountsto add a Serviceaccount
- Enter the name of your Kubernetes Serviceaccount which is in the variable $APP_SA
- Enter the IAM Serviceaccount name which will be
# run this command to get your IAM serviceaccount name echo $GSA_NAME@$PROJECT_ID.iam.gserviceaccount.com
- Click on update to continue
- Create the below pod
kubectl apply -f -<<EOF apiVersion: v1 kind: Pod metadata: name: workload-identity-test namespace: $APP_NS spec: containers: - image: google/cloud-sdk:slim name: workload-identity-test command: ["sleep","infinity"] serviceAccountName: $APP_SA nodeSelector: iam.gke.io/gke-metadata-server-enabled: "true" EOF
- Check if you are able to list buckets without passing creds
kubectl exec -it workload-identity-test -n $APP_NS -- gcloud storage ls
Updated 2 days ago