관리형 워크로드 ID를 사용하면 강력하게 증명된 ID를 Compute Engine 워크로드에 결합할 수 있습니다. Google Cloud 는 상호 TLS(mTLS) 인증을 통해 다른 워크로드와 함께 워크로드를 안정적으로 인증하는 데 사용할 수 있는 Certificate Authority Service에서 발급된 X.509 사용자 인증 정보를 프로비저닝합니다.
이러한 상호 운용성을 달성하기 위해 관리형 워크로드 아이덴티티는 워크로드 간 통신의 식별 및 보안을 위한 프레임워크와 표준 집합을 정의하는 Secure Production Identity Framework For Everyone(SPIFFE)을 기반으로 합니다. SPIFFE에서 관리형 워크로드 아이덴티티는 spiffe://POOL_ID.global.PROJECT_NUMBER.workload.id.goog/ns/NAMESPACE_ID/sa/MANAGED_IDENTITY_ID 형식을 사용하여 표현됩니다.
관리형 워크로드 아이덴티티를 다른 워크로드 인증에 사용할 수 있지만 Google Cloud API 인증에 사용할 수 없습니다.
리소스 계층 구조
관리형 워크로드 아이덴티티는 풀 내의 모든 ID에 대한 트러스트 경계 역할을 하는 워크로드 아이덴티티 풀 내에서 정의됩니다. 워크로드 아이덴티티 풀은 관리형 워크로드 아이덴티티의 SPIFFE 식별자의 트러스트 도메인 구성요소를 형성합니다. 조직의 개발, 스테이징 또는 프로덕션과 같은 각 논리적 환경에 대해 새로운 풀을 만드는 것이 좋습니다.
워크로드 아이덴티티 풀 내에서 관리형 워크로드 아이덴티티는 namespaces라는 관리 경계로 구성됩니다. 네임스페이스를 사용하면 관련 워크로드 아이덴티티를 구성하고 액세스 권한을 부여할 수 있습니다.
워크로드에서 관리형 워크로드 아이덴티티의 사용자 인증 정보를 발급하려면 먼저 증명 정책을 사용하여 워크로드에서 관리형 워크로드 아이덴티티를 사용하도록 허용해야 합니다. 워크로드 증명 정책을 사용하면 프로젝트 ID 또는 리소스 이름과 같은 워크로드의 검증 가능한 속성을 기반으로 관리형 워크로드 아이덴티티에 대해 사용자 인증 정보를 발급할 수 있는 워크로드를 정의할 수 있습니다. 워크로드 증명 정책은 신뢰할 수 있는 워크로드만 관리형 ID를 사용할 수 있도록 합니다.
워크로드에 연결된 서비스 계정을 기반으로 워크로드에서 관리형 워크로드 아이덴티티를 사용하도록 승인할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eManaged workload identities bind strongly attested identities to Compute Engine workloads, enabling reliable authentication with other workloads via mutual TLS (mTLS).\u003c/p\u003e\n"],["\u003cp\u003eThese identities are provisioned with X.509 credentials from Certificate Authority Service and adhere to the Secure Production Identity Framework For Everyone (SPIFFE) standards.\u003c/p\u003e\n"],["\u003cp\u003eManaged workload identities cannot authenticate with Google Cloud APIs, but they are structured within workload identity pools, which establish trust boundaries for identities.\u003c/p\u003e\n"],["\u003cp\u003eWorkload attestation policies are required to ensure only trusted workloads can use a managed identity by defining which workloads can obtain credentials based on their verifiable attributes.\u003c/p\u003e\n"],["\u003cp\u003eNamespaces are used within a pool to organize workload identities and create administrative boundaries, to help grant access to related identities.\u003c/p\u003e\n"]]],[],null,["# Managed workload identities overview\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the\n| General Service Terms section of the\n| [Service Specific Terms](/terms/service-terms#1).\n| Pre-GA features are available \"as is\" and might have limited support. For more\n| information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nManaged workload identities lets you bind strongly attested identities to your\nGoogle Kubernetes Engine (GKE) and Compute Engine workloads.\n\nGoogle Cloud provisions X.509 credentials and trust anchors that are issued from\n[Certificate Authority Service](/certificate-authority-service). The credentials and\ntrust anchors can be used to reliably authenticate your workload with other\nworkloads through [mutual TLS (mTLS)](/chrome-enterprise-premium/docs/understand-mtls)\nauthentication.\n\nManaged workload identities for GKE is available in [Preview](/products#product-launch-stages).\nManaged workload identities for Compute Engine is available in [Preview](/products#product-launch-stages),\nby request. [Request access to the managed workload identities for Compute Engine Preview](https://forms.gle/KC1Lq77gMn3kTtWDA).\n\nSPIFFE interoperability\n-----------------------\n\nTo enable interoperability across dynamic and heterogeneous environments,\nmanaged workload identities is based on [Secure Production Identity Framework For Everyone (SPIFFE)](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/).\nSPIFFE defines a framework and set of standards for identifying, authenticating,\nand securing communications between workloads. SPIFFE workloads are identified\nby a unique SPIFFE ID. In Google Cloud, a SPIFFE ID has the following\nformats:\n\n- Compute Engine workloads:\n\n `spiffe://`\u003cvar translate=\"no\"\u003ePOOL_ID\u003c/var\u003e`.global.`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`.workload.id.goog/ns/`\u003cvar translate=\"no\"\u003eNAMESPACE_ID\u003c/var\u003e`/sa/`\u003cvar translate=\"no\"\u003eMANAGED_IDENTITY_ID\u003c/var\u003e\n- GKE workloads:\n\n `spiffe://`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.svc.id.goog/ns/`\u003cvar translate=\"no\"\u003eKUBERNETES_NAMESPACE\u003c/var\u003e`/sa/`\u003cvar translate=\"no\"\u003eKUBERNETES_SERVICE_ACCOUNT\u003c/var\u003e\n\nResource hierarchy\n------------------\n\nThis section describes managed workload identity resources.\n\n### Workload identity pools\n\nManaged workload identities are defined within a *workload identity pool*,\nwhich acts as a trust boundary for all identities within the pool. The workload\nidentity pool forms the trust domain component of the managed workload\nidentity's SPIFFE identifier. We recommend creating a new pool for each logical\nenvironment in your organization, such as development, staging, or production.\n\n### Namespaces\n\nWithin a workload identity pool, managed workload identities are organized\ninto administrative boundaries called *namespaces*. Namespaces help you\norganize and grant access to related workload identities.\n\n### Attestation policies\n\nManaged workload identity for Compute Engine requires that you configure\n*attestation policies*.\n\nManaged workload identity for GKE manages attestation policies\nfor you.\n\nWorkload attestation policies let you define which workload can be issued a\ncredential for a managed workload identity based on the workload's verifiable\nattributes, such as project ID or resource name. A workload attestation policy\nensures that only trusted workloads can use the managed identity.\n\nWhat's next\n-----------\n\n- [Configure managed workload identity authentication for Compute Engine](/iam/docs/create-managed-workload-identities).\n\n- [Configure managed workload identity authentication for GKE](/iam/docs/create-managed-workload-identities-gke).\n\n- Learn more about [using managed workload identities with Compute Engine\n workloads](/compute/docs/access/authenticate-workloads-over-mtls).\n\nTry it for yourself\n-------------------\n\n\nIf you're new to Google Cloud, create an account to evaluate how our\nproducts perform in real-world scenarios. New customers also get $300 in\nfree credits to run, test, and deploy workloads.\n[Get started for free](https://console.cloud.google.com/freetrial)"]]
