GKE Workload Identity Permission Auditor

Threat/Impact Level: HIGH | Downtime Risk: HIGH | Time to Fix: 10–20 mins

TL;DR

• What broke: The Kubernetes Service Account (KSA) is not correctly bound to a Google Service Account (GSA) — either the iam.workloadIdentityUser IAM binding is missing, the KSA annotation is wrong, or the node pool never had Workload Identity enabled.
• How to fix it: Verify the node pool has --workload-pool set, annotate the KSA with the correct GSA email, and grant roles/iam.workloadIdentityUser to the GSA with the correct member principal.
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your KSA YAML and IAM policy, and get the corrected binding generated locally without leaking your project IDs.

ERROR: (gcloud) There was a problem refreshing your current auth tokens:
Request had insufficient authentication scopes.

-- or --

google.api_core.exceptions.PermissionDenied: 403 Permission 'storage.objects.get'
denied on resource 'projects/_/buckets/my-bucket/objects/config.json'
for service account: [PROJECT_NUMBER]-compute@developer.gserviceaccount.com

-- or --

Failed to retrieve access token: metadata server returned HTTP 403

Node Pool → workload-pool=[PROJECT_ID].svc.id.goog
    └── KSA annotation → iam.gke.io/gcp-service-account=[GSA_EMAIL]
        └── IAM binding → serviceAccount:[PROJECT_ID].svc.id.goog[NAMESPACE/KSA_NAME]
            └── role → roles/iam.workloadIdentityUser ON [GSA]

How to Fix It (The Solution)

Step 0 — Verify the node pool actually has Workload Identity enabled

gcloud container node-pools describe [POOL_NAME] \
  --cluster=[CLUSTER_NAME] \
  --region=[REGION] \
  --format="value(config.workloadMetadataConfig.mode)"
# Must return: GKE_METADATA
# If it returns EXPOSE_SEND_METADATA or nothing, Workload Identity is OFF at the node level.

Enable it (rolling node upgrade — expect brief disruption):

gcloud container node-pools update [POOL_NAME] \
  --cluster=[CLUSTER_NAME] \
  --region=[REGION] \
  --workload-metadata=GKE_METADATA

Basic Fix — Repair the KSA annotation and IAM binding

1. Annotate the Kubernetes Service Account:

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: my-app-ksa
   namespace: production
-  annotations: {}
+  annotations:
+    iam.gke.io/gcp-service-account: my-app-gsa@[PROJECT_ID].iam.gserviceaccount.com

2. Grant the IAM binding on the GSA:

-# Missing binding — the GSA has no workloadIdentityUser grant
+gcloud iam service-accounts add-iam-policy-binding \
+  my-app-gsa@[PROJECT_ID].iam.gserviceaccount.com \
+  --role="roles/iam.workloadIdentityUser" \
+  --member="serviceAccount:[PROJECT_ID].svc.id.goog[production/my-app-ksa]"

IAM propagation takes up to 60 seconds. Restart the pod after applying.

Enterprise Best Practice — Terraform with explicit Workload Identity enforcement

 resource "google_container_node_pool" "app_nodes" {
   name    = "app-pool"
   cluster = google_container_cluster.primary.name
 
   node_config {
-    workload_metadata_config {
-      mode = "EXPOSE_SEND_METADATA"
-    }
+    workload_metadata_config {
+      mode = "GKE_METADATA"
+    }
     # Scope down the node SA — it should have zero project permissions
+    service_account = google_service_account.node_sa.email
+    oauth_scopes    = ["https://www.googleapis.com/auth/cloud-platform"]
   }
 }
 
 resource "google_service_account_iam_member" "workload_identity_binding" {
   service_account_id = google_service_account.app_gsa.name
   role               = "roles/iam.workloadIdentityUser"
-  member             = "serviceAccount:[PROJECT_ID].svc.id.goog[default/my-app-ksa]"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${var.ksa_name}]"
 }

Verification command — run this after every change:

# Impersonate the KSA from inside a debug pod in the same namespace
kubectl run wi-test --image=google/cloud-sdk:slim \
  --serviceaccount=my-app-ksa \
  --namespace=production \
  --rm -it --restart=Never -- \
  gcloud auth print-identity-token
# A valid JWT = binding is working. A 403 = still broken.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

package kubernetes.workload_identity

deny[msg] {
  input.kind == "ServiceAccount"
  not input.metadata.annotations["iam.gke.io/gcp-service-account"]
  msg := sprintf("ServiceAccount '%v' in namespace '%v' is missing Workload Identity annotation.",
    [input.metadata.name, input.metadata.namespace])
}

checkov -d . --check CKV_GCP_69  # Checks GKE_METADATA mode on node pools
checkov -d . --check CKV_GCP_24  # Checks node SA is not the default compute SA

- name: Checkov Workload Identity Scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: ./terraform
    check: CKV_GCP_69,CKV_GCP_24
    soft_fail: false  # Hard block on merge

# Find all KSAs without the WI annotation across all namespaces
kubectl get serviceaccounts --all-namespaces -o json | \
  jq '.items[] | select(.metadata.annotations["iam.gke.io/gcp-service-account"] == null) | \
  "\(.metadata.namespace)/\(.metadata.name)"'