Lightning Talk: Don’t Make Me Impersonate My Identity
summary
Claims that Workload Identity Federation is the recommended way to give pods cloud identities, using the cluster as an OIDC provider so pods present JWT-like tokens to cloud APIs. Describes GKE/Kubernetes service accounts mapped into cloud role bindings so IAM can grant granular access without exporting secrets or using node credentials. Notes Google Cloud now lets role bindings reference Kubernetes service accounts directly, removing earlier impersonation steps and cutting configuration complexity and customer confusion. Also mentions x509 via SPIFFE.
AI-written summary · about
related talks
34mThrow Away Your Passwords: Trusting Workload Identity
23mKeynote: Cloud & Cloud Native Identity and Access Management: Challenges & Opportunities
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
11mThe Hardest Part of Building Your Own Cloud: Identity