Prefer Using Dedicated GCP Service Accounts And Workload Identity

#!/usr/bin/env bash
#
# Report GKE Workload Identity usage at cluster and workload level.
#
# Requirements:
# - gcloud configured with access to the project
# - kubectl configured to talk to the target cluster
# - jq installed
#
# Usage:
#   PROJECT_ID="my-project" CLUSTER_NAME="my-cluster" LOCATION="us-central1" ./report-workload-identity.sh

set -euo pipefail

PROJECT_ID="${PROJECT_ID:?Set PROJECT_ID}"
CLUSTER_NAME="${CLUSTER_NAME:?Set CLUSTER_NAME}"
LOCATION="${LOCATION:?Set LOCATION}"

echo "=== Cluster-level Workload Identity configuration ==="
gcloud container clusters describe "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID" \
  --format="json(workloadIdentityConfig,workloadIdentityConfig.workloadPool,workloadIdentityConfig.identityNamespace)" \
  | jq .

echo
echo "Interpretation:"
echo "- If workloadIdentityConfig is null or {} => Workload Identity NOT enabled at cluster level (non-compliant with CIS 5.2.2)."
echo "- If workloadIdentityConfig.workloadPool ends with '.svc.id.goog' => Workload Identity ENABLED."

echo
echo "=== Node pool metadata configuration (Workload Identity plumbing) ==="
gcloud container node-pools list \
  --cluster "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --project "$PROJECT_ID" \
  --format="table(name,config.workloadMetadataConfig.mode)"

echo
echo "Interpretation:"
echo "- For each node pool, config.workloadMetadataConfig.mode should be 'GKE_METADATA'."
echo "- Any node pool with mode 'GCE_METADATA' or empty => nodes still exposing VM metadata, workloads not using Workload Identity on those nodes."

echo
echo "=== Namespaces and service accounts annotated for Workload Identity ==="
echo "Listing service accounts with potential Workload Identity annotations..."
echo

# Check namespace-level annotation (rare, but sometimes used for policy)
echo "Namespace-level annotations related to Workload Identity:"
kubectl get ns -o json \
  | jq -r '.items[]
    | .metadata
    | {name: .name, annotations: (.annotations // {})
      | with_entries(select(.key | test("iam.gke.io|workloadIdentity|gsa"))) }
    | select(.annotations != {})
    | "NAMESPACE: \(.name)\n  ANNOTATIONS: \(.annotations)\n"' || true

echo "ServiceAccount-level annotations (recommended for Workload Identity):"
kubectl get sa --all-namespaces -o json \
  | jq -r '.items[]
    | .metadata as $m
    | ($m.annotations // {}) as $a
    | select(($a | keys[]? | test("iam.gke.io/gcp-service-account")))?
    | "NAMESPACE: \($m.namespace)\n  SA: \($m.name)\n  iam.gke.io/gcp-service-account: \($a["iam.gke.io/gcp-service-account"])\n"' || true

echo
echo "Interpretation:"
echo "- Service accounts used with Workload Identity should have annotation:"
echo "    iam.gke.io/gcp-service-account: <gsa-name>@${PROJECT_ID}.iam.gserviceaccount.com"
echo "- Workloads lacking this annotation on their service account will not use a dedicated GCP service account."

echo
echo "=== Workloads and the service accounts they use ==="
echo "Deployments:"
kubectl get deploy --all-namespaces -o json \
  | jq -r '.items[]
    | "DEPLOYMENT: \(.metadata.namespace)/\(.metadata.name)\n  SERVICE ACCOUNT: \(.spec.template.spec.serviceAccountName // "default")\n"' || true

echo
echo "StatefulSets:"
kubectl get statefulset --all-namespaces -o json \
  | jq -r '.items[]
    | "STATEFULSET: \(.metadata.namespace)/\(.metadata.name)\n  SERVICE ACCOUNT: \(.spec.template.spec.serviceAccountName // "default")\n"' || true

echo
echo "DaemonSets:"
kubectl get daemonset --all-namespaces -o json \
  | jq -r '.items[]
    | "DAEMONSET: \(.metadata.namespace)/\(.metadata.name)\n  SERVICE ACCOUNT: \(.spec.template.spec.serviceAccountName // "default")\n"' || true

echo
cat <<'EOF'
How to review this output for CIS GKE 5.2.2:

1) Cluster-level:
   - Problem if: workloadIdentityConfig is null or missing.
   - Desired: workloadIdentityConfig.workloadPool is set (e.g. "PROJECT_ID.svc.id.goog").

2) Node pools:
   - Problem if: any node pool shows config.workloadMetadataConfig.mode = "GCE_METADATA" or is blank.
   - Desired: all node pools show mode = "GKE_METADATA".

3) Workload Identity usage:
   - Identify important Deployments/StatefulSets/DaemonSets and note their serviceAccountName.
   - For each such ServiceAccount:
       * Problem if: it has no iam.gke.io/gcp-service-account annotation
         (workload will either use node credentials or fail, depending on config).
       * Desired: annotation exists and references a dedicated GCP service account.

This script only reports state; enabling Workload Identity or changing node pools
must be done through gcloud / console / IaC as described in the benchmark guidance.
EOF