Google trusts pods running in GKE. Every pod gets a native cloud identity, automatic credential roataion and seamless access to every GCP service. This is because they are running in Google infrastructure. Your onprem pods do not get any of that because they are running outside of GCP. They are strangers to Google Infrastructure. And the answer to this problem has been using service account keys, base64 them into a secret and hope no one takes a look closely. This talk talks about ending the pattern. Without moving your workloads to GKE and making Google extend the same trust to your on-prem Kubernetes clusters that it gives to its own. With Workload Identity Federation and OIDC, we built a platform at trivago where Google trusts every pod that runs on-prem and thinks it's running in it's own infrastructure. Allowing native support to access GCP Services, no key rotation, no tickets. No secret keys. We will cover this architecture end to end, and along with this an end to end demo.
Platform and Site Reliability Engineer at trivago
