GKE KSA to GSA mapping

Google Cloud Serverless Applications
,
1

My requirement is to use a single GKE cluster to spin up pod that can impersonate one of 1000 app specific gsas.

How can I achieve this with minimal operational complexity. How am I am trying this out is to have a single platform GSA, which can impersonate into any of the 1000 app specific gsas and have the kubernetes KSA mapped to this platform GSA. But I do not know how to make the pod (which uses the platform gsa) to impersonate one of the 1000 app specific gsas.

Or is there a better solution.
Thanks In Advance

2

How is the pod going to access the services it’s trying to call? Or put another way, what is the code in your pod actually doing?

3

The code currently uses dataproc/bigquery/gcs. But the code should be capable of accessing any GCP service based on the access / restrictions bound to the GSA . The number of GSAs can be well above 1000 (~10K).

4

@garisingh I am planning to use the below command in the pod to create the cred-config.json file. Once the file is generated I will use that to set ADC. Idea is to dynamically create the cred-config.json files for each application specific gsa.

gcloud iam workload-identity-pools create-cred-config \
    projects/PROJECT_ID/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_I \
    --service-account=app_specific_gsa \
    --service-account-token-lifetime-seconds=700 \
    --output-file=cred-config.json \
    --credential-source-file=/run/secrets/kubernetes.io/serviceaccount/token \
    --credential-source-type=text

I have the values for the project_id and the pool_id (the gke cluster’s projectid.svc.goog).
Now I am stuck with the provider_id.

As per my limited knowledge, the GKE cluster should act as the provider right so that, please correct me and help to get a valid provider_id to be used within a GKE.
Then I will execute the below command that set ups the authentication details and subsequent commands will get valid tokens and work.

gcloud auth login --cred-file=cred-config.jsoneg:
gcloud compute instances list --project=app-specific-project_id