# AUTHORED ONLY — not run from this repo.
# Validate with: kubectl --dry-run=client, kubeval, yamllint.
# Apply to your own GKE cluster per the GKE primer instructions.
---
id: cloud-native-gke-workload-identity
name: "GKE Workload Identity"
description: "ServiceAccount with iam.gke.io/gcp-service-account annotation; pod authenticates to GCP via the GKE metadata server."
labels:
  customer: any
  profile: gke
  chart-test-swarm/target-k8s-version: gke-1.30
cluster:
  provider: gke
  k8s_version: "1.30"
  preinstall:
    - kind: raw_manifest
      path: chart-test/fixtures/cloud-native/gke/workload-identity-binding.yaml
      namespace: sample
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    gke.workloadIdentity.enabled: "true"
    gke.workloadIdentity.gcpServiceAccount: "<REPLACE_WITH_GCP_SA_EMAIL>"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: sample
  - type: smoke-script
    path: chart-test/assertions/cloud-native/gke/workload-identity.sh
tags: [cloud-native]
mechanisms: ['cloud:gke', 'addon:workload-identity']
category: cloud-native
tier: authored-only
integration: gke-workload-identity