Secure access to GKE workloads with Workload Identity

What authorization types are available for GKE? How do you manage access to your GKE workloads at the cloud and cluster levels? Workload Identity is the recommended way to access Google Cloud services in a secure and manageable way. In this episode of GKE Essentials, Kaslin Fields discusses how to simplify access management for Kubernetes workloads with Google Cloud Workload Identity. Watch along and learn how to secure your GKE clusters!

Chapters:
0:00 - Intro
0:33 - Authorization types in GKE
0:45 - Cloud IAM role
2:22 - Kubernetes role-based access control
3:11 - Service accounts for Kubernetes and Google Cloud
4:13 - What is Workload Identity?
5:07 - How to deploy Workload Identity
5:51 - Wrap up

#GKEEssentials

[AlejandroBiancucci]

Thanks for simplifying these topics. They can be really confusing at times ñ. This helps.

[thecloudcareers]

This is one of best feature.
Which avoids rotation of keys

[patricknelson]

I’ve been getting into Workload Identity more lately. One thing I’ve really been wondering about is if it’s possible to differentiate between the service account performing image pulling vs. the service account actually used to execute the workload (i.e. at the pod level). Is that possible? You can use imagePullSecrets but that’s precisely what I’m trying to avoid using, and I just want a SA who’s sole purpose is just for pulling images from a separate project. 🤦‍♂️

[aravindpoojari]

All good but wasted first 3 minutes explaining IAM.