Topik ini menjelaskan cara mengaktifkan Workload Identity untuk penginstalan hybrid Apigee di platform AKS dan EKS.
Ringkasan
Workload identity federation memungkinkan aplikasi yang berjalan di luar Google Cloud meniru akun layanan Google Cloud Platform menggunakan kredensial dari penyedia identitas eksternal.
Menggunakan workload identity federation dapat membantu Anda meningkatkan keamanan dengan memungkinkan aplikasi menggunakan mekanisme autentikasi yang disediakan oleh lingkungan eksternal dan dapat membantu mengganti kunci akun layanan.
Untuk menggunakan Workload Identity Federation dengan Apigee hybrid, konfigurasikan cluster Anda terlebih dahulu, lalu terapkan fitur tersebut ke penginstalan Apigee hybrid.
Konfigurasikan cluster Anda untuk menggunakan Workload Identity Federation.
Cantumkan akun layanan IAM dan akun layanan Kubernetes Anda dengan perintah berikut:
Akun layanan IAM: Anda kemungkinan besar telah membuat akun layanan IAM (juga disebut "akun layanan Google") selama penginstalan awal Apigee hybrid dengan alat create-service-account. Lihat Tentang akun layanan untuk mengetahui daftar akun layanan IAM yang diperlukan oleh Apigee hybrid.
Anda dapat melihat daftar akun layanan IAM di project dengan perintah berikut:
gcloud iam service-accounts list --project PROJECT_ID
Akun layanan Kubernetes: Diagram campuran Apigee membuat akun layanan Kubernetes yang diperlukan untuk setiap komponen saat Anda menjalankan perintah helm install atau helm update.
Anda dapat melihat akun layanan Kubernetes di cluster dengan perintah kubectl get sa:
kubectl get sa -n APIGEE_NAMESPACEkubectl get sa -n apigee-system
Pada langkah Mengonfigurasi Workload Identity Federation, audiens default untuk penyedia dan Workload Identity pool yang dibuat adalah sebagai berikut. Gunakan default ini atau tetapkan audiens yang diharapkan kustom, dan simpan nilai ini untuk digunakan nanti.
Berhenti setelah langkah 1 di bagian Men-deploy workload Kubernetes. Akan ada satu file konfigurasi kredensial untuk setiap akun layanan Google. Simpan setiap file konfigurasi kredensial dan simpan jalur yang dimasukkan untuk parameter --credential-source-file, misalnya: /var/run/service-account/token.
Mengonfigurasi Apigee hybrid untuk menggunakan Workload Identity Federation
Salin file sumber kredensial dan file output (credential-configuration.json) ke dalam direktori diagram berikut. Ini adalah nilai yang Anda berikan di langkah 1 pada bagian Men-deploy workload Kubernetes.
apigee-datastore/
apigee-env
apigee-org/
apigee-telemetry/
Lakukan perubahan global berikut pada file penggantian cluster Anda:
gcp:
workloadIdentity:
enabled: false # must be set to false to use Workload Identity Federation
federatedWorkloadIdentity:
enabled: true
audience: "AUDIENCE"
credentialSourceFile: "CREDENTIAL_SOURCE_FILE"
Dengan keterangan:
AUDIENCE adalah audiens yang diizinkan dari Penyedia Identitas Beban Kerja, nilai di bagian .audience dalam file json konfigurasi kredensial yang Anda konfigurasikan di langkah 1 di bagian Men-deploy beban kerja Kubernetes.
CREDENTIAL_SOURCE_FILE adalah nama file dan jalur ke file sumber kredensial yang digunakan oleh Workload Identity Federation untuk mendapatkan kredensial akun layanan. Ini adalah nilai yang Anda berikan untuk credential-source-file saat mengonfigurasi Workload Identity Federation dengan perintah create-cred-config di langkah 1 pada bagian Men-deploy workload Kubernetes. Contoh:
Konfigurasikan penggantian untuk setiap komponen menggunakan Workload Identity Federation. Pilih petunjuk untuk file sertifikat, secret Kubernetes, atau Vault yang sesuai untuk penginstalan Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eWorkload Identity Federation enables applications outside Google Cloud to impersonate a Google Cloud service account using external identity provider credentials, enhancing security.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Workload Identity Federation for Apigee hybrid on AKS and EKS, you must first configure your cluster according to Google Cloud instructions, followed by applying the feature to your Apigee hybrid installation.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration process involves listing IAM service accounts and Kubernetes service accounts, setting a default or custom audience for Workload Identity pools, and saving credential configuration files.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid components can be configured individually to utilize Workload Identity Federation, either globally or selectively for specific services like UDCA or Synchronizer, by updating the cluster's overrides file and applying the changes.\u003c/p\u003e\n"],["\u003cp\u003eCredential source files can be managed through various methods such as cert files, Kubernetes secrets, or Vault, and the changes should be applied to the relevant components using the \u003ccode\u003ehelm update\u003c/code\u003e command in the specified order.\u003c/p\u003e\n"]]],[],null,["# Enabling Workload Identity Federation on AKS and EKS\n\n| You are currently viewing version 1.12 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable Workload Identity for Apigee hybrid installations on **AKS** and **EKS** platforms.\n\nOverview\n--------\n\n\nWorkload identity federation lets applications running outside Google Cloud impersonate a Google Cloud Platform service account by using credentials from an external identity provider.\n\n\nUsing workload identity federation can help you improve security by letting applications use the authentication mechanisms that the external environment provides and can help [replace service account keys](/iam/docs/best-practices-service-accounts#using_service_accounts).\n\n\nFor an overview, see [Best practices for using Workload Identity Federation](/iam/docs/best-practices-for-using-workload-identity-federation).\n| **Note:** The `apige-logger` component does not support Workload Identity Federation. See the [known issue](/apigee/docs/release/known-issues#hybrid-apigee-logger-wif).\n\nSet up Workload Identity Federation\n-----------------------------------\n\n\nTo use Workload Identity Federation with Apigee hybrid, first configure you cluster and then apply the feature to your Apigee hybrid installation.\n\n### Configure your cluster to use Workload Identity Federation.\n\n\nFollow the Google Cloud instructions to [Configure Workload Identity Federation for Kubernetes](/iam/docs/workload-identity-federation-with-kubernetes), with the following modifications:\n\n- List your IAM service accounts and Kubernetes service accounts with the following commands:\n - **IAM service accounts:** You most likely have already created the IAM service accounts (also called \"Google service accounts\") during initial installation of Apigee hybrid with the [`create-service-account`](/apigee/docs/hybrid/v1.12/create-service-account) tool. See [About service accounts](/apigee/docs/hybrid/v1.12/sa-about#recommended-sas) for a list of IAM service accounts needed by Apigee hybrid.\n\n\n You can see a list of IAM service accounts in your project with the following command: \n\n ```\n gcloud iam service-accounts list --project PROJECT_ID\n ```\n - **Kubernetes service accounts:** The Apigee hybrid charts create the necessary Kubernetes service accounts for each component when you run the `helm install` or `helm update` command.\n\n\n You can see the Kubernetes service accounts in your cluster with the `kubectl get sa` commands: \n\n kubectl get sa -n APIGEE_NAMESPACE\n kubectl get sa -n apigee-system\n\n- In the step [Configure Workload Identity Federation](/iam/docs/workload-identity-federation-with-kubernetes#configure), the default audience for created Workload Identity pools and providers is as follows. Use this default or set a custom expected audience, and save this value for later use. \n\n ```\n https://iam.googleapis.com/projects/PROJECT_NUM/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID\n ```\n- Stop after **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy). There will be one credential configuration file for each Google service account. Save each credential configuration file and save the path entered for the `--credential-source-file` parameter, for example: `/var/run/service-account/token`. **Tip:** You can also find the values for `audience` and `credentialSourceFile` in the credential configuration json file, under the paths `.audience` and `.credential_source.file` respectively. You will need these values for the overrides file to configure Apigee hybrid.\n\n### Configure Apigee hybrid to use Workload Identity Federation\n\n| **Tip:** You can configure your hybrid installation to use Workload Identity Federation for any or all components. For example UDCA can use Workload Identity Federation while Synchronizer uses Google IAM service accounts or vice versa.\n\n1. Copy the credential source file and the output file (`credential-configuration.json`) into the following chart directories. These were the values you provided in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy).\n - `apigee-datastore/`\n - `apigee-env`\n - `apigee-org/`\n - `apigee-telemetry/`\n\n | **Tip:** You can use a subdirectory for these files, for example: `apigee-datastore/fwi/`\n2. Make the following global changes to your cluster's overrides file: \n\n ```\n gcp:\n workloadIdentity:\n enabled: false # must be set to false to use Workload Identity Federation\n federatedWorkloadIdentity:\n enabled: true\n audience: \"AUDIENCE\"\n credentialSourceFile: \"CREDENTIAL_SOURCE_FILE\"\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003eAUDIENCE\u003c/var\u003e is the allowed audience of the Workload Identity Provider, the value under `.audience` in the credential configuration json file you configured in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy).\n - \u003cvar translate=\"no\"\u003eCREDENTIAL_SOURCE_FILE\u003c/var\u003e is the filename and path to the credential source file used by Workload Identity Federation to obtain the credentials for the service accounts. This is the value you provide for `credential-source-file` when you configure Workload Identity Federation with the `create-cred-config` command in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy). For example:\n - For example: \n\n ```\n gcp:\n workloadIdentity:\n enabled: false\n federatedWorkloadIdentity:\n enabled: true\n audience: \"//iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/aws-pool/providers/aws-provider\"\n credentialSourceFile: \"/var/run/service-account/token\"\n ```\n3. Configure the overrides for each component using Workload Identity Federation. Select the instructions for cert files, Kubernetes secrets, or Vault as appropriate for your installation.\n\n ### Cert file\n\n Replace the value of `serviceAccountPath` with the credential source file. This must be the path relative to the chart directory. For example: \n\n ```\n udca:\n serviceAccountPath: fwi/credential-configuration.json\n ```\n\n ### K8s Secret\n\n 1. Create a new Kubernetes secret using for the credential source file. \n\n ```\n kubectl create secret -n apigee generic SECRET_NAME --from-file=\"client_secret.json=CREDENTIAL_CONFIGURATION_FILE\"\n ```\n\n For example: \n\n ```\n kubectl create secret -n apigee generic udca-fwi-secret --from-file=\"client_secret.json=./fwi/credential-configuration.json\"\n ```\n 2. Replace the value of `serviceAccountRef` with the new secret. For example: \n\n ```\n udca:\n serviceAccountRef: udca-fwi-secret\n ```\n\n ### Vault\n\n Update the service account key, `SAKEY` in Vault with the credential source file. For example, for UDCA (the procedure is similar for all components): \n\n ```\n SAKEY=$(cat ./fwi/credential-configuration.json); kubectl -n apigee exec vault-0 -- vault kv patch secret/apigee/orgsakeys udca=\"$SAKEY\"\n ```\n4. Apply the changes to each affected component with the `helm update` command:\n\n\n If you are using Vault for the first time with this cluster, update the `apigee-operator` chart: \n\n ```\n helm upgrade operator apigee-operator/ \\\n --namespace apigee-system \\\n --atomic \\\n -f overrides.yaml\n ```\n\n\n Update the rest of the affected charts in the following order: \n\n ```\n helm upgrade datastore apigee-datastore/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ``` \n\n ```\n helm upgrade telemetry apigee-telemetry/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ``` \n\n ```\n helm upgrade $ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ```\n\n\n Update the `apigee-env` chart for each env, replacing \u003cvar translate=\"no\"\u003eENV_NAME\u003c/var\u003e each time: \n\n ```\n helm upgrade $ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --atomic \\\n --set env=$ENV_NAME \\\n -f overrides.yaml\n ```\n\n See the [Apigee hybrid Helm reference](/apigee/docs/hybrid/v1.12/helm-reference) for a list of components and their corresponding charts.\n\nFor more information about Workload Identity Federation and best practices, see [Best practices for using workload identity federation](/iam/docs/best-practices-for-using-workload-identity-federation)."]]
