다음 명령어를 사용하여 IAM 서비스 계정과 Kubernetes 서비스 계정을 나열합니다.
IAM 서비스 계정:create-service-account 도구를 사용하여 Apigee Hybrid를 처음 설치하는 동안 IAM 서비스 계정('Google 서비스 계정'이라고도 함)을 이미 만들었을 수 있습니다. Apigee Hybrid에 필요한 IAM 서비스 계정 목록은 서비스 계정 정보를 참조하세요.
다음 명령어를 사용하여 프로젝트의 IAM 서비스 계정 목록을 확인할 수 있습니다.
gcloud iam service-accounts list --project PROJECT_ID
Kubernetes 서비스 계정: Apigee Hybrid 차트는 helm install 또는 helm update 명령어를 실행할 때 각 구성요소에 필요한 Kubernetes 서비스 계정을 만듭니다.
kubectl get sa 명령어를 사용하여 클러스터의 Kubernetes 서비스 계정을 확인할 수 있습니다.
kubectl get sa -n APIGEE_NAMESPACEkubectl get sa -n apigee-system
워크로드 아이덴티티 제휴 구성 단계에서 생성된 워크로드 아이덴티티 풀과 공급업체의 기본 대상은 다음과 같습니다. 이 기본 대상을 사용하거나 예상한 커스텀 대상을 설정하고 나중에 사용할 수 있도록 이 값을 저장하세요.
Kubernetes 워크로드 배포의 1단계를 수행한 후 중지합니다. Google 서비스 계정마다 사용자 인증 정보 구성 파일이 하나씩 있습니다. 각 사용자 인증 정보 구성 파일을 저장하고 --credential-source-file 매개변수에 입력한 경로(예: /var/run/service-account/token)를 저장합니다.
워크로드 아이덴티티 제휴를 사용하도록 Apigee Hybrid 구성
사용자 인증 정보 소스 파일 및 출력 파일(credential-configuration.json)을 다음 차트 디렉터리에 복사합니다. 이 값은 Kubernetes 워크로드 배포의 1단계에서 제공한 값입니다.
apigee-datastore/
apigee-env
apigee-org/
apigee-telemetry/
클러스터의 재정의 파일을 다음과 같이 전역적으로 변경합니다.
gcp:
workloadIdentity:
enabled: false # must be set to false to use Workload Identity Federation
federatedWorkloadIdentity:
enabled: true
audience: "AUDIENCE"
credentialSourceFile: "CREDENTIAL_SOURCE_FILE"
각 항목의 의미는 다음과 같습니다.
AUDIENCE는 워크로드 아이덴티티 공급업체의 허용된 대상으로, Kubernetes 워크로드 배포의 1단계에서 구성한 사용자 인증 정보 구성 json 파일의 .audience 아래의 값입니다.
CREDENTIAL_SOURCE_FILE은 서비스 계정의 사용자 인증 정보를 가져오기 위해 워크로드 아이덴티티 제휴에 사용되는 사용자 인증 정보 소스 파일의 파일 이름과 경로입니다. 이 값은 Kubernetes 워크로드 배포의 1단계에서 create-cred-config 명령어로 워크로드 아이덴티티 제휴를 구성할 때 credential-source-file에 제공하는 값입니다. 예를 들면 다음과 같습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[[["\u003cp\u003eWorkload Identity Federation enables applications outside Google Cloud to impersonate a Google Cloud service account using external identity provider credentials, enhancing security.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Workload Identity Federation for Apigee hybrid on AKS and EKS, you must first configure your cluster according to Google Cloud instructions, followed by applying the feature to your Apigee hybrid installation.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration process involves listing IAM service accounts and Kubernetes service accounts, setting a default or custom audience for Workload Identity pools, and saving credential configuration files.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid components can be configured individually to utilize Workload Identity Federation, either globally or selectively for specific services like UDCA or Synchronizer, by updating the cluster's overrides file and applying the changes.\u003c/p\u003e\n"],["\u003cp\u003eCredential source files can be managed through various methods such as cert files, Kubernetes secrets, or Vault, and the changes should be applied to the relevant components using the \u003ccode\u003ehelm update\u003c/code\u003e command in the specified order.\u003c/p\u003e\n"]]],[],null,["# Enabling Workload Identity Federation on AKS and EKS\n\n| You are currently viewing version 1.12 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable Workload Identity for Apigee hybrid installations on **AKS** and **EKS** platforms.\n\nOverview\n--------\n\n\nWorkload identity federation lets applications running outside Google Cloud impersonate a Google Cloud Platform service account by using credentials from an external identity provider.\n\n\nUsing workload identity federation can help you improve security by letting applications use the authentication mechanisms that the external environment provides and can help [replace service account keys](/iam/docs/best-practices-service-accounts#using_service_accounts).\n\n\nFor an overview, see [Best practices for using Workload Identity Federation](/iam/docs/best-practices-for-using-workload-identity-federation).\n| **Note:** The `apige-logger` component does not support Workload Identity Federation. See the [known issue](/apigee/docs/release/known-issues#hybrid-apigee-logger-wif).\n\nSet up Workload Identity Federation\n-----------------------------------\n\n\nTo use Workload Identity Federation with Apigee hybrid, first configure you cluster and then apply the feature to your Apigee hybrid installation.\n\n### Configure your cluster to use Workload Identity Federation.\n\n\nFollow the Google Cloud instructions to [Configure Workload Identity Federation for Kubernetes](/iam/docs/workload-identity-federation-with-kubernetes), with the following modifications:\n\n- List your IAM service accounts and Kubernetes service accounts with the following commands:\n - **IAM service accounts:** You most likely have already created the IAM service accounts (also called \"Google service accounts\") during initial installation of Apigee hybrid with the [`create-service-account`](/apigee/docs/hybrid/v1.12/create-service-account) tool. See [About service accounts](/apigee/docs/hybrid/v1.12/sa-about#recommended-sas) for a list of IAM service accounts needed by Apigee hybrid.\n\n\n You can see a list of IAM service accounts in your project with the following command: \n\n ```\n gcloud iam service-accounts list --project PROJECT_ID\n ```\n - **Kubernetes service accounts:** The Apigee hybrid charts create the necessary Kubernetes service accounts for each component when you run the `helm install` or `helm update` command.\n\n\n You can see the Kubernetes service accounts in your cluster with the `kubectl get sa` commands: \n\n kubectl get sa -n APIGEE_NAMESPACE\n kubectl get sa -n apigee-system\n\n- In the step [Configure Workload Identity Federation](/iam/docs/workload-identity-federation-with-kubernetes#configure), the default audience for created Workload Identity pools and providers is as follows. Use this default or set a custom expected audience, and save this value for later use. \n\n ```\n https://iam.googleapis.com/projects/PROJECT_NUM/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID\n ```\n- Stop after **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy). There will be one credential configuration file for each Google service account. Save each credential configuration file and save the path entered for the `--credential-source-file` parameter, for example: `/var/run/service-account/token`. **Tip:** You can also find the values for `audience` and `credentialSourceFile` in the credential configuration json file, under the paths `.audience` and `.credential_source.file` respectively. You will need these values for the overrides file to configure Apigee hybrid.\n\n### Configure Apigee hybrid to use Workload Identity Federation\n\n| **Tip:** You can configure your hybrid installation to use Workload Identity Federation for any or all components. For example UDCA can use Workload Identity Federation while Synchronizer uses Google IAM service accounts or vice versa.\n\n1. Copy the credential source file and the output file (`credential-configuration.json`) into the following chart directories. These were the values you provided in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy).\n - `apigee-datastore/`\n - `apigee-env`\n - `apigee-org/`\n - `apigee-telemetry/`\n\n | **Tip:** You can use a subdirectory for these files, for example: `apigee-datastore/fwi/`\n2. Make the following global changes to your cluster's overrides file: \n\n ```\n gcp:\n workloadIdentity:\n enabled: false # must be set to false to use Workload Identity Federation\n federatedWorkloadIdentity:\n enabled: true\n audience: \"AUDIENCE\"\n credentialSourceFile: \"CREDENTIAL_SOURCE_FILE\"\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003eAUDIENCE\u003c/var\u003e is the allowed audience of the Workload Identity Provider, the value under `.audience` in the credential configuration json file you configured in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy).\n - \u003cvar translate=\"no\"\u003eCREDENTIAL_SOURCE_FILE\u003c/var\u003e is the filename and path to the credential source file used by Workload Identity Federation to obtain the credentials for the service accounts. This is the value you provide for `credential-source-file` when you configure Workload Identity Federation with the `create-cred-config` command in **step 1** under [Deploy a Kubernetes workload](/iam/docs/workload-identity-federation-with-kubernetes#deploy). For example:\n - For example: \n\n ```\n gcp:\n workloadIdentity:\n enabled: false\n federatedWorkloadIdentity:\n enabled: true\n audience: \"//iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/aws-pool/providers/aws-provider\"\n credentialSourceFile: \"/var/run/service-account/token\"\n ```\n3. Configure the overrides for each component using Workload Identity Federation. Select the instructions for cert files, Kubernetes secrets, or Vault as appropriate for your installation.\n\n ### Cert file\n\n Replace the value of `serviceAccountPath` with the credential source file. This must be the path relative to the chart directory. For example: \n\n ```\n udca:\n serviceAccountPath: fwi/credential-configuration.json\n ```\n\n ### K8s Secret\n\n 1. Create a new Kubernetes secret using for the credential source file. \n\n ```\n kubectl create secret -n apigee generic SECRET_NAME --from-file=\"client_secret.json=CREDENTIAL_CONFIGURATION_FILE\"\n ```\n\n For example: \n\n ```\n kubectl create secret -n apigee generic udca-fwi-secret --from-file=\"client_secret.json=./fwi/credential-configuration.json\"\n ```\n 2. Replace the value of `serviceAccountRef` with the new secret. For example: \n\n ```\n udca:\n serviceAccountRef: udca-fwi-secret\n ```\n\n ### Vault\n\n Update the service account key, `SAKEY` in Vault with the credential source file. For example, for UDCA (the procedure is similar for all components): \n\n ```\n SAKEY=$(cat ./fwi/credential-configuration.json); kubectl -n apigee exec vault-0 -- vault kv patch secret/apigee/orgsakeys udca=\"$SAKEY\"\n ```\n4. Apply the changes to each affected component with the `helm update` command:\n\n\n If you are using Vault for the first time with this cluster, update the `apigee-operator` chart: \n\n ```\n helm upgrade operator apigee-operator/ \\\n --namespace apigee-system \\\n --atomic \\\n -f overrides.yaml\n ```\n\n\n Update the rest of the affected charts in the following order: \n\n ```\n helm upgrade datastore apigee-datastore/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ``` \n\n ```\n helm upgrade telemetry apigee-telemetry/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ``` \n\n ```\n helm upgrade $ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f overrides.yaml\n ```\n\n\n Update the `apigee-env` chart for each env, replacing \u003cvar translate=\"no\"\u003eENV_NAME\u003c/var\u003e each time: \n\n ```\n helm upgrade $ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --atomic \\\n --set env=$ENV_NAME \\\n -f overrides.yaml\n ```\n\n See the [Apigee hybrid Helm reference](/apigee/docs/hybrid/v1.12/helm-reference) for a list of components and their corresponding charts.\n\nFor more information about Workload Identity Federation and best practices, see [Best practices for using workload identity federation](/iam/docs/best-practices-for-using-workload-identity-federation)."]]
