Description
GKE Workload Identity troubleshooting is an agent skill for finding out why a Pod running on Google Kubernetes Engine cannot authenticate to Google Cloud APIs when it uses Workload Identity Federation. It is built around the symptoms people usually report: HTTP 403 errors that mention the iam.serviceAccounts.getAccessToken permission being denied, errors saying default credentials cannot be found or that the metadata server cannot be reached, and API calls that unexpectedly run as the node's default Compute Engine service account instead of the identity assigned to the workload. The skill follows a read-only boundary, which means it inspects the configuration and proposes fixes rather than changing live resources itself. It also covers configuring Workload Identity Federation for GKE, not only diagnosing failures. Its routing notes send cluster-level security flags to a separate platform security skill. It is aimed at developers and platform engineers who need an application to reach Google Cloud services without storing keys. It is published by Google on skills.sh under the google skills repository, with about 1.6K installs. The skills.sh listing shows Gen Agent Trust Hub, Socket and Snyk all passing.…
Highlights
- Diagnoses 403 and permission-denied errors for Pods
- Detects calls running as the node's default service account
- Read-only diagnosis with proposed fixes
- Checks bindings between Kubernetes and Google Cloud service accounts
- Routes cluster-level security to a separate skill
Ratings & Reviews
No ratings yet
Be the first to rate gke-workload-identity.
People also visit
gke-workload-identity FAQ
What problems does it diagnose?
Pods that get 403 permission errors on getAccessToken, cannot find default credentials, or use the node's default service account.
Does it change my cluster?
It works read-only and proposes fixes for you to apply.
Where are cluster-level security flags covered?
The skill routes those to a separate platform security skill.
How do I install it?
Run npx skills add https://github.com/google/skills --skill gke-workload-identity.
What security audits has it passed?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best gke-workload-identity alternatives?
Popular alternatives to gke-workload-identity include gke-backup-dr, gke-cluster-autoscaler and gke-cost-analysis. See all gke-workload-identity alternatives