Core concept

Kubernetes service account bound to GCP service account. Pod uses K8s SA → GCP identity. Automatic.

Advertisement

How it works

Requires GKE cluster + workload identity enabled. Some config per pod (service account annotation).

Advertisement

Trade-offs + gotchas

Every GKE workload accessing GCP services. Standard modern security. Replaces key files.