Google Kubernetes Engine manifest for Workload Identity using Google Cloud IAM

gke_iam.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  # Create a GKE Service Account that binds to a GCP Service Account
  name: my_service_gke_serviceaccount
  namespace: default
  annotations:
    iam.gke.io/gcp-service-account: my-project-gcp-serviceaccount@project-123456.iam.gserviceaccount.com
---
apiVersion: v1
kind: Pod
metadata:
  name: workload-identity-test
  namespace: default
spec:
  containers:
  - image: google/cloud-sdk:slim
    name: workload-identity-test
    command: ["sleep","infinity"]
  # Run this Pod using the GKE Service Account (above)
  serviceAccountName: my_service_gke_serviceaccount
  nodeSelector:
    iam.gke.io/gke-metadata-server-enabled: "true"