/gke-workload-identity
設定並診斷 GKE Pod 的 Workload Identity Federation 驗證失敗（如 403 權限被拒、找不到預設憑證、metadata server 無法連線），並驗證叢集與節點集區設定。
- 安裝次數
- 2400
- 專案星數
- 2.2 萬 ★
- 授權
- Apache-2.0
- 專案更新
- 2026-11-02
怎麼裝
npx skills add https://github.com/google/skills --skill gke-workload-identity安裝前請先看過原文內容。中文說明是 AI 翻譯，不保證安全。
原文
Configures and diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find default credentials", or GKE metadata server unreachable) by verifying cluster and node-pool Workload Identity configuration, the Kubernetes ServiceAccount (KSA) to IAM binding (direct principal binding and legacy Google ServiceAccount impersonation), target-resource IAM roles, and gke-metadata-server health. Use when setting up KSA/GSA bindings (`roles/iam.workloadIdentityUser`, `iam.gke.io/gcp-service-account`) or when a Pod cannot authenticate to Google Cloud APIs. Don't use for in-cluster Kubernetes RBAC errors (API-server authorization), general workload crashes (use gke-workload-troubleshooting), or Pod Security Standards and NetworkPolicies (use gke-workload-security).