Workload identity to connect a GKE cluster to a different GCP project

[austingebauer]

Hello,

I followed the exact instructions in https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to to set up workload identity for my application which is running in GKE.

Now I'd like the workload identity to be able to access APIs in another GCP project. The guidance I've seen tells me to add the email of the service account (in say, project A) to the IAM principals in the other project (say, project B). I also added the correct role when I added the service account from project A into project B. I'm getting PermissionDenied errors when trying to access project B APIs using the GKE workload identity in project A.

It would be super helpful if anyone has guidance on what I might be doing wrong. A concrete example would go a long way. Thanks!

[MaxImbrox]

Hi austingbauer,

I implemented many times the configuration that you want, and initially I had exactly your problems. Please be sure that you are inserting the GCP SA and project ID's in the correct form. Have your cluster Workload Identity feature enabled?

[lawrencenelson]

It seems like @austingebauer is encountering an error while trying to grant access, based on another GCC thread - Workload Identity to connect a GKE cluster to a different GCP project. He is attempting to grant access to a service agent instead of a service account that he created, and I believe this is the root issue.

@austingebauer , it appears the core issue is a mix-up between service agents and service accounts. Service agents (service-PROJECT_NUMBER@gcp-sa-gkenode.iam.gserviceaccount.com) are managed by Google and used internally by GKE. They are not meant for direct use in cross-project access.

What you need to do is create a Service Account in Project A for your GKE workloads. Then, set up Workload Identity in GKE to utilize this SA. Finally, grant this SA access to resources in Project B by adding it to Project B's IAM with the appropriate roles.