Core concept
Kubernetes service account bound to GCP service account. Pod uses K8s SA → GCP identity. Automatic.
Advertisement
How it works
Requires GKE cluster + workload identity enabled. Some config per pod (service account annotation).
Advertisement
Trade-offs + gotchas
Every GKE workload accessing GCP services. Standard modern security. Replaces key files.