Workload Identity Federation exchanges a Pod identity for a short-lived token

The application uses Application Default Credentials. The GKE metadata server intercepts the request and performs federation without placing a key file in the container.

1ApplicationRequests a Google Cloud access token through ADC.

2GKE metadata serverIdentifies the Pod and requests a Kubernetes ServiceAccount JWT.

3Kubernetes APISigns a bound token for the workload identity.

4Security Token ServiceExchanges the JWT for a short-lived federated token.

5Google APIIAM evaluates the workload principal's permissions.

Enabling federation grants no permission by itself; IAM policy must name the workload principal.

Workload Identity Federation exchanges a Pod identity for a short-lived token

Workload Identity Federation for GKE is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. GKE creates a project workload identity pool and runs a metadata server that intercepts credential requests. Security Token Service exchanges the signed Kubernetes token for a federated access token. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `gcloud projects get-iam-policy PROJECT_ID`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: Strict egress policies must allow the metadata-server path, and hostNetwork Pods have special behavior that must be checked in current documentation. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. Human and automation access use IAM plus RBAC next.