> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # K8s service accounts workload identity remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of using Dedicated GCP Service Accounts and Workload Identity for Clusters in GCP, follow these steps: 1. Open the GCP Console and navigate to the Kubernetes Engine. 2. Select the cluster for which you want to remediate the misconfiguration. 3. Click on the "Edit" button at the top of the page. 4. Under the "Security" section, select "Workload Identity." 5. Select the checkbox "Enable Workload Identity." 6. In the "Service Account" field, enter the name of the dedicated service account that you want to use for the cluster. 7. Click on the "Save" button to apply the changes. 8. Once the changes are applied, verify that the dedicated service account is being used for the cluster by running the following command in the Cloud Shell: ``` kubectl get pods --namespace kube-system -o=jsonpath='{.items[*].spec.serviceAccountName}' ``` This command will return the name of the service account being used by the pods in the kube-system namespace. Verify that it matches the dedicated service account that you specified in step 6. By following these steps, you have successfully remediated the misconfiguration of using Dedicated GCP Service Accounts and Workload Identity for Clusters in GCP. # To remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" for GCP using GCP CLI, you can follow the below steps: 1. Create a dedicated service account for your cluster: ``` gcloud iam service-accounts create [SA-NAME] --display-name [SA-DISPLAY-NAME] ``` Replace \[SA-NAME] with the name of the service account you want to create and \[SA-DISPLAY-NAME] with the display name of the service account. 2. Grant the necessary permissions to the service account: ``` gcloud projects add-iam-policy-binding [PROJECT-ID] --member=serviceAccount:[SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com --role=[ROLE] ``` Replace \[PROJECT-ID] with the ID of the project where the cluster is located, \[SA-NAME] with the name of the service account you created in step 1, and \[ROLE] with the necessary role to access the resources required by the cluster. 3. Enable workload identity for your cluster: ``` gcloud container clusters update [CLUSTER-NAME] --workload-pool=[PROJECT-ID].svc.id.goog ``` Replace \[CLUSTER-NAME] with the name of the cluster and \[PROJECT-ID] with the ID of the project where the cluster is located. 4. Associate the service account with the cluster: ``` gcloud iam service-accounts add-iam-policy-binding [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com --member="serviceAccount:[PROJECT-ID].svc.id.goog[NAMESPACE]/[SA-NAME]" --role="roles/iam.workloadIdentityUser" ``` Replace \[SA-NAME] with the name of the service account you created in step 1, \[PROJECT-ID] with the ID of the project where the cluster is located, and \[NAMESPACE] with the namespace of the cluster. By following these steps, you will have remediated the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" for GCP using GCP CLI. To remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" in GCP using Python, follow the below steps: 1. Create a dedicated GCP service account for the cluster. You can use the below Python code to create a service account: ``` from google.oauth2 import service_account credentials = service_account.Credentials.from_service_account_file( '/path/to/service_account_key.json') ``` 2. Assign the required IAM roles to the service account based on the cluster's requirements. You can use the below Python code to grant IAM roles to the service account: ``` from google.cloud import iam client = iam.IAMClient(credentials=credentials) policy = client.get_policy(request={"resource": "projects/{project_id}"}) bindings = policy.bindings for binding in bindings: if binding.role == "roles/editor": binding.members.append("serviceAccount:{service_account_email}") break policy.bindings = bindings client.set_iam_policy(request={"resource": "projects/{project_id}", "policy": policy}) ``` 3. Enable Workload Identity for the cluster. You can use the below Python code to enable Workload Identity: ``` from google.cloud import container_v1 client = container_v1.ClusterManagerClient(credentials=credentials) cluster = client.get_cluster(request={"name": "projects/{project_id}/locations/{location}/clusters/{cluster_name}"}) cluster.workload_identity_config = { "workload_pool": "projects/{project_id}/locations/{location}/workloadPools/{pool_name}" } update_mask = {"paths": ["workload_identity_config"]} client.update_cluster(request={"update_mask": update_mask, "cluster": cluster}) ``` 4. Associate the service account with the cluster. You can use the below Python code to associate the service account with the cluster: ``` from google.cloud import container_v1 client = container_v1.ClusterManagerClient(credentials=credentials) cluster = client.get_cluster(request={"name": "projects/{project_id}/locations/{location}/clusters/{cluster_name}"}) cluster.master_auth.workload_identity_config = { "identity_namespace": "projects/{project_id}.svc.id.goog", "identity_provider": "google" } update_mask = {"paths": ["master_auth.workload_identity_config"]} client.update_cluster(request={"update_mask": update_mask, "cluster": cluster}) ``` By following these steps, you can remediate the misconfiguration "Use Dedicated GCP Service Accounts And Workload Identity For Clusters" in GCP using Python. ```hcl theme={null} # GKE cluster with Workload Identity enabled resource "google_container_cluster" "GKE_CLUSTER" { name = "GKE_CLUSTER_NAME" # replace with your cluster name location = "GKE_CLUSTER_LOCATION" # e.g. "us-central1" or "us-central1-a" project = "GCP_PROJECT_ID" # replace with your GCP project ID network = "VPC_NETWORK_NAME" # replace as appropriate subnetwork = "VPC_SUBNETWORK_NAME" # replace as appropriate remove_default_node_pool = true initial_node_count = 1 # This enables Workload Identity on the cluster workload_identity_config { workload_pool = "GCP_PROJECT_ID.svc.id.goog" # replace GCP_PROJECT_ID } } # Node pool configured to use GKE metadata server (needed for Workload Identity) resource "google_container_node_pool" "GKE_NODE_POOL" { name = "GKE_NODE_POOL_NAME" # replace with node pool name location = google_container_cluster.GKE_CLUSTER.location project = google_container_cluster.GKE_CLUSTER.project cluster = google_container_cluster.GKE_CLUSTER.name node_count = 3 node_config { machine_type = "e2-medium" # This ensures Pods use the metadata server for Workload Identity workload_metadata_config { mode = "GKE_METADATA" } } } # Dedicated GCP service account for a specific Kubernetes workload resource "google_service_account" "WORKLOAD_SA" { account_id = "WORKLOAD_SA_ID" # e.g. "payments-backend-sa" display_name = "WORKLOAD_SA_DISPLAY_NAME" # e.g. "Payments backend GCP SA" project = "GCP_PROJECT_ID" # same project as cluster } # Grant IAM roles to the GCP service account as needed by the workload resource "google_project_iam_member" "WORKLOAD_SA_ROLE" { project = "GCP_PROJECT_ID" role = "roles/YOUR_REQUIRED_ROLE" # e.g. "roles/storage.objectViewer" member = "serviceAccount:${google_service_account.WORKLOAD_SA.email}" } # Allow the Kubernetes service account to impersonate the GCP service account via Workload Identity resource "google_service_account_iam_binding" "WORKLOAD_SA_WI_BINDING" { service_account_id = google_service_account.WORKLOAD_SA.name role = "roles/iam.workloadIdentityUser" members = [ # Replace NAMESPACE and KSA_NAME with your Kubernetes namespace and service account name "serviceAccount:GCP_PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]", ] } # (Optional) Kubernetes ServiceAccount annotated to use the GCP service account # Requires the Kubernetes provider configured against the GKE cluster resource "kubernetes_service_account" "KSA" { metadata { name = "KSA_NAME" # must match NAMESPACE/KSA_NAME above namespace = "NAMESPACE" annotations = { "iam.gke.io/gcp-service-account" = google_service_account.WORKLOAD_SA.email } } } ``` Enabling `workload_identity_config` and `workload_metadata_config` updates the existing cluster and node pools in place (no forced resource replacement expected, but check your specific plan output). After you add these blocks and run `terraform plan`, you should see: * An update to `google_container_cluster.GKE_CLUSTER` adding `workload_identity_config.workload_pool`. * An update to `google_container_node_pool.GKE_NODE_POOL` adding `node_config.workload_metadata_config.mode = "GKE_METADATA"`. * Creation of `google_service_account.WORKLOAD_SA`, its IAM role binding, and the `google_service_account_iam_binding` granting `roles/iam.workloadIdentityUser`. * (If used) creation of the annotated `kubernetes_service_account.KSA`.