[Using Workload Identity | Kubernetes Engine Documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
- k8sのサービスアカウントを構成して、GCPのサービスアカウントとして使用可能
- AWSのインスタンスプロファイルみたいなもの
#### 設定方法
1. 既存のクラスタで Workload Identity を有効にする。`gcloud container clusters update CLUSTER_NAME --workload-pool=PROJECT_ID.svc.id.goog`
```shell-session
$ gcloud container clusters update microservices-experiment --workload-pool=$PROJECT_ID.svc.id.goog
Updating microservices-experiment...done.
Updated [https://container.googleapis.com/v1/projects/<project_id>/zones/asia-northeast1-a/clusters/microservices-experiment].
```
2. 既存のノードプールでGKE_METADATAを有効にする。
```shell-session
$ gcloud container node-pools update control-pool --cluster=microservices-experiment --workload-metadata=GKE_METADATA
Updating node pool control-pool... Updating control-pool, done with 1 out of 1 nodes (100.0%): 1 succeeded...done.
```
既存ノードプール内のpodは再起動する。
3. Googleサービスアカウント（GSA）を作成する。`gcloud iam service-accounts create GSA_NAME`
```shell-session
$ gcloud iam service-accounts create microservices-experiment
Created service account [microservices-experiment].
```
4. GSAにIAM Roleを追加する。
```shell-session
$ gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:microservices-experiment@$PROJECT_ID.iam.gserviceaccount.com --role roles/storag
e.objectAdmin
Updated IAM policy for project [PROJECT_ID].
bindings:
- members:
- serviceAccount:
[email protected]
role: roles/compute.serviceAgent
- members:
- serviceAccount:service-684774652816@container-engine-robot.iam.gserviceaccount.com
role: roles/container.serviceAgent
- members:
- serviceAccount:
[email protected]
- serviceAccount:
[email protected]
- serviceAccount:
[email protected]
role: roles/editor
- members:
- user:-
role: roles/owner
- members:
- serviceAccount:microservices-experiment@$PROJECT_ID.iam.gserviceaccount.com
role: roles/storage.objectAdmin
etag: BwXFUMq76DU=
version: 1
```
4. KSAとGSAの間のIAM policy bindingを作成する。
```shell-session
$ gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:$PROJECT_ID.svc.id.goog[litmus/argo-chaos]" microservices-experiment@$PROJECT_ID.iam.gserviceaccount.com
Updated IAM policy for serviceAccount [microservices-experiment@<project id>.iam.gserviceaccount.com].
bindings:
- members:
- serviceAccount:<project_id>.svc.id.goog[litmus/argo-chaos]
role: roles/iam.workloadIdentityUser
etag: BwXFRhezLxw=
version: 1
```
5. GSAのメールアドレスを使用して、アノテーションをKSAに追加する。
```shell-session
$ kubectl annotate serviceaccount --namespace litmus argo-chaos iam.gke.io/gcp-service-account=microservices-experiment@$PROJECT_ID.iam.gserviceaccount.com
serviceaccount/argo-chaos annotated
```