Why it matters

Workload identity replaces API keys with identity federation. Modern architecture.

Advertisement

The architecture

K8s service account.

Cloud provider federation.

SPIFFE for cross-cloud.

Workload identity flowK8s SApod identityFederatecloud identityAccess servicesas workloadGCP Workload Identity, AWS IRSA, Azure Managed Identity + SPIFFE cross-cloud
Identity federation.
Advertisement

How it works end to end

GCP Workload Identity: K8s SA → GCP SA.

AWS IRSA: K8s SA → IAM role.

SPIFFE: cross-cloud identity.

Zero long-lived secrets.