Use Dedicated GCP Service Accounts And Workload Identity

More Info:

Kubernetes workloads should not use cluster node service accounts to authenticate to Google Cloud APIs. Each Kubernetes Workload that needs to authenticate to other Google services using Cloud IAM should be provisioned a dedicated Service account. Enabling Workload Identity manages the distribution and rotation of Service account keys for the workloads to use.

Risk Level

Medium

Address

Best Practice, Operational Excellence, Security

Compliance Standards

• CIS GKE

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of using Dedicated GCP Service Accounts and Workload Identity for Clusters in GCP, follow these steps:

1. Open the GCP Console and navigate to the Kubernetes Engine.

2. Select the cluster for which you want to remediate the misconfiguration.

3. Click on the "Edit" button at the top of the page.

4. Under the "Security" section, select "Workload Identity."

5. Select the checkbox "Enable Workload Identity."

6. In the "Service Account" field, enter the name of the dedicated service account that you want to use for the cluster.

7. Click on the "Save" button to apply the changes.

8. Once the changes are applied, verify that the dedicated service account is being used for the cluster by running the following command in the Cloud Shell:

kubectl get pods --namespace kube-system -o=jsonpath='{.items[*].spec.serviceAccountName}'

This command will return the name of the service account being used by the pods in the kube-system namespace. Verify that it matches the dedicated service account that you specified in step 6.

By following these steps, you have successfully remediated the misconfiguration of using Dedicated GCP Service Accounts and Workload Identity for Clusters in GCP.

Using CLI

To remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" for GCP using GCP CLI, you can follow the below steps:

1. Create a dedicated service account for your cluster:

gcloud iam service-accounts create [SA-NAME] --display-name [SA-DISPLAY-NAME]

Replace [SA-NAME] with the name of the service account you want to create and [SA-DISPLAY-NAME] with the display name of the service account.

2. Grant the necessary permissions to the service account:

gcloud projects add-iam-policy-binding [PROJECT-ID] --member=serviceAccount:[SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com --role=[ROLE]

Replace [PROJECT-ID] with the ID of the project where the cluster is located, [SA-NAME] with the name of the service account you created in step 1, and [ROLE] with the necessary role to access the resources required by the cluster.

3. Enable workload identity for your cluster:

gcloud container clusters update [CLUSTER-NAME] --workload-pool=[PROJECT-ID].svc.id.goog

Replace [CLUSTER-NAME] with the name of the cluster and [PROJECT-ID] with the ID of the project where the cluster is located.

4. Associate the service account with the cluster:

gcloud iam service-accounts add-iam-policy-binding [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com --member="serviceAccount:[PROJECT-ID].svc.id.goog[NAMESPACE]/[SA-NAME]" --role="roles/iam.workloadIdentityUser"

Replace [SA-NAME] with the name of the service account you created in step 1, [PROJECT-ID] with the ID of the project where the cluster is located, and [NAMESPACE] with the namespace of the cluster.

By following these steps, you will have remediated the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" in GCP using Python, follow the below steps:

1. Create a dedicated GCP service account for the cluster. You can use the below Python code to create a service account:

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file(
    '/path/to/service_account_key.json')

2. Assign the required IAM roles to the service account based on the cluster's requirements. You can use the below Python code to grant IAM roles to the service account:

from google.cloud import iam

client = iam.IAMClient(credentials=credentials)

policy = client.get_policy(request={"resource": "projects/{project_id}"})

bindings = policy.bindings

for binding in bindings:
    if binding.role == "roles/editor":
        binding.members.append("serviceAccount:{service_account_email}")
        break

policy.bindings = bindings

client.set_iam_policy(request={"resource": "projects/{project_id}", "policy": policy})

3. Enable Workload Identity for the cluster. You can use the below Python code to enable Workload Identity:

from google.cloud import container_v1

client = container_v1.ClusterManagerClient(credentials=credentials)

cluster = client.get_cluster(request={"name": "projects/{project_id}/locations/{location}/clusters/{cluster_name}"})

cluster.workload_identity_config = {
    "workload_pool": "projects/{project_id}/locations/{location}/workloadPools/{pool_name}"
}

update_mask = {"paths": ["workload_identity_config"]}

client.update_cluster(request={"update_mask": update_mask, "cluster": cluster})

4. Associate the service account with the cluster. You can use the below Python code to associate the service account with the cluster:

from google.cloud import container_v1

client = container_v1.ClusterManagerClient(credentials=credentials)

cluster = client.get_cluster(request={"name": "projects/{project_id}/locations/{location}/clusters/{cluster_name}"})

cluster.master_auth.workload_identity_config = {
    "identity_namespace": "projects/{project_id}.svc.id.goog",
    "identity_provider": "google"
}

update_mask = {"paths": ["master_auth.workload_identity_config"]}

client.update_cluster(request={"update_mask": update_mask, "cluster": cluster})

By following these steps, you can remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" in GCP using Python.

Using Terraform

# GKE cluster with Workload Identity enabled
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
  location = "GKE_CLUSTER_LOCATION"      # e.g. "us-central1" or "us-central1-a"
  project  = "GCP_PROJECT_ID"           # replace with your GCP project ID

  network    = "VPC_NETWORK_NAME"       # replace as appropriate
  subnetwork = "VPC_SUBNETWORK_NAME"    # replace as appropriate

  remove_default_node_pool = true
  initial_node_count       = 1

  # This enables Workload Identity on the cluster
  workload_identity_config {
    workload_pool = "GCP_PROJECT_ID.svc.id.goog"  # replace GCP_PROJECT_ID
  }
}

# Node pool configured to use GKE metadata server (needed for Workload Identity)
resource "google_container_node_pool" "GKE_NODE_POOL" {
  name       = "GKE_NODE_POOL_NAME"     # replace with node pool name
  location   = google_container_cluster.GKE_CLUSTER.location
  project    = google_container_cluster.GKE_CLUSTER.project
  cluster    = google_container_cluster.GKE_CLUSTER.name

  node_count = 3

  node_config {
    machine_type = "e2-medium"

    # This ensures Pods use the metadata server for Workload Identity
    workload_metadata_config {
      mode = "GKE_METADATA"
    }
  }
}

# Dedicated GCP service account for a specific Kubernetes workload
resource "google_service_account" "WORKLOAD_SA" {
  account_id   = "WORKLOAD_SA_ID"                 # e.g. "payments-backend-sa"
  display_name = "WORKLOAD_SA_DISPLAY_NAME"       # e.g. "Payments backend GCP SA"
  project      = "GCP_PROJECT_ID"                 # same project as cluster
}

# Grant IAM roles to the GCP service account as needed by the workload
resource "google_project_iam_member" "WORKLOAD_SA_ROLE" {
  project = "GCP_PROJECT_ID"
  role    = "roles/YOUR_REQUIRED_ROLE"            # e.g. "roles/storage.objectViewer"
  member  = "serviceAccount:${google_service_account.WORKLOAD_SA.email}"
}

# Allow the Kubernetes service account to impersonate the GCP service account via Workload Identity
resource "google_service_account_iam_binding" "WORKLOAD_SA_WI_BINDING" {
  service_account_id = google_service_account.WORKLOAD_SA.name
  role               = "roles/iam.workloadIdentityUser"

  members = [
    # Replace NAMESPACE and KSA_NAME with your Kubernetes namespace and service account name
    "serviceAccount:GCP_PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]",
  ]
}

# (Optional) Kubernetes ServiceAccount annotated to use the GCP service account
# Requires the Kubernetes provider configured against the GKE cluster
resource "kubernetes_service_account" "KSA" {
  metadata {
    name      = "KSA_NAME"              # must match NAMESPACE/KSA_NAME above
    namespace = "NAMESPACE"

    annotations = {
      "iam.gke.io/gcp-service-account" = google_service_account.WORKLOAD_SA.email
    }
  }
}

Enabling workload_identity_config and workload_metadata_config updates the existing cluster and node pools in place (no forced resource replacement expected, but check your specific plan output). After you add these blocks and run terraform plan, you should see:

• An update to google_container_cluster.GKE_CLUSTER adding workload_identity_config.workload_pool.
• An update to google_container_node_pool.GKE_NODE_POOL adding node_config.workload_metadata_config.mode = "GKE_METADATA".
• Creation of google_service_account.WORKLOAD_SA, its IAM role binding, and the google_service_account_iam_binding granting roles/iam.workloadIdentityUser.
• (If used) creation of the annotated kubernetes_service_account.KSA.

Additional Reading:

• https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity