GKE Workload Identity Federation Settings

Workload Identity Federation allows an easy way to grant GCP IAM roles to workloads executing inside a GKE cluster and is Google’s recommended mechanism for securing and managing how workloads on GKE access GCP services. For more information on this topic see Google’s Documentation.

Requirements

In order to use this feature Workload Identity must be enabled at the cluster-level. On Autopilot clusters this is set automatically. If you’re not using Autopilot this can be done via GCP or via the GCPManagedControlPlane CustomResource as follows:

kind: GCPManagedControlPlane
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
metadata:
  name: "my-cluster-control-plane"
spec:
  project: "my-project"
  clusterSecurity:
    workloadIdentityConfig:
      workloadPool: "myproject.svc.id.goog"
...

Note: This must be set on cluster creation if using the CustomResource and is not reconciled afterwards

Enabling on Node Pools

The GCP Provider for Cluster API allows configuration of the nodepools to use a specific type of metadata server, via the .spec.nodeSecurity.workloadMetadataMode field on the GCPManagedMachinePool CustomResource. As can be seen in the example below:

apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: GCPManagedMachinePool
metadata:
  name: "${CLUSTER_NAME}-mp-0"
spec:
  nodeSecurity:
    workloadMetadataMode: "GKE_METADATA"
...

The above example would also work with the GCPManagedMachinePoolTemplate CustomResource with appropriate changes.

Note: When this is enabled on a nodepool it will take effect immediately, potentially causing workload disruption if your workloads rely on being able to use the service account that the node uses. See Google’s Documentation for more details.

Valid Values

The two valid values for workloadMetadataMode are GKE_METADATA & GCE_METADATA.

• GKE_METADATA configures the node pool to route metadata requests to a pod running on each node via a Daemonset.
• GCE_METADATA on the other hand lets pods access the metadata server on the underlying VM.

If workloadMetadataMode is unset it simply means CAPG does not manage that field and so it could take either value or be unset on the cluster itself. The only way to ensure a value is to choose from one of the two valid ones.