Introduction to Workload Identity

Workload Identity on Kubernetes Engine on GCP enables us to assign permissions to Kubernetes workloads that can interact with Google Cloud resources. Google Cloud has the concept of service accounts. Service accounts are used for machines to interact with resources. A compute engine, a lambda function, or even an App Engine on Google Cloud can be assigned with a service account that has permissions to interact with Google Cloud resources. With Workload Identity, we can map service accounts on GCP with service accounts on Kubernetes.

In Kubernetes, we might use several types of deployments for our applications. We can use Deployment, StatefulSet, DaemonSet, and more. Behind the scenes, a Pod will be created, which is the base component for running applications on Kubernetes. The Pod can be assigned a service account. By using Workload Identity on Kubernetes and binding a Kubernetes service account to a Google Cloud service account, the Pod with the...