워크로드 아이덴티티 제휴를 사용하면 Azure용 GKE에서 Google 서비스 계정을 사용하여 Azure에 인증할 수 있습니다. Azure에 인증하는 이 방법은 기존 AzureClient 인증 방법보다 간단합니다. 기존 방법을 사용하면 인증서를 관리하고 Azure Active Directory(AD)에 수동으로 업로드해야 했습니다.
Azure AD 애플리케이션에서 제휴 ID 사용자 인증 정보를 구성하려면 다음 명령어를 실행하세요. 참고로 각 Azure AD 애플리케이션에 최대 20개의 사용자 인증 정보를 추가할 수 있습니다.
credential.json이라는 JSON 파일을 만듭니다.
{
"name": "CREDENTIAL_NAME",
"issuer": "https://accounts.google.com",
"subject": "service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com",
"audiences": ["api://AzureADTokenExchange"],
"description": "Allow GKE on Azure to authenticate to the Azure AD application using a Google service account."
}
CREDENTIAL_NAME: 사용자 인증 정보 이름
PROJECT_NUMBER: 클러스터를 호스팅하는 Google Cloud 프로젝트 수입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-31(UTC)"],[],[],null,["# Create an Azure Active Directory application\n============================================\n\nIn this section, you create an\n[Azure Active Directory](https://azure.microsoft.com/en-us/services/active-directory/)\n(Azure AD) application and service principal objects. GKE on Azure\nuses these objects to store configuration information on Azure.\n\n1. To create the Azure AD application, run the following command:\n\n az ad app create --display-name \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with a name for your\n application---for example, `anthos-clusters`.\n2. To save the application's ID to an environment variable for later use, run\n the following command:\n\n APPLICATION_ID=$(az ad app list --all \\\n --query \"[?displayName=='\u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e'].appId\" \\\n --output tsv)\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with the name of your\n application.\n3. To create a service principal for the application, run the following command:\n\n az ad sp create --id \"${APPLICATION_ID}\"\n\nSet up Workload identity federation\n-----------------------------------\n\n\u003cbr /\u003e\n\n| **Note:** GKE on Azure provides two\n| methods of authenticating to Azure: workload identity federation\n| authentication and *AzureClient* authentication. We recommend that you use\n| the workload identity federation method described in this document, because\n| it's simpler and more secure.\n\n\u003cbr /\u003e\n\nWorkload identity federation allows GKE on Azure to authenticate to Azure\nusing a Google service account. This method of authenticating to Azure is\nsimpler than the legacy AzureClient authentication method, which requires\nyou to manage certificates and manually upload them to Azure Active Directory\n(AD).\n\nTo configure a federated identity credential on your Azure AD\napplication, run the following commands. Note that you can add up to twenty\ncredentials to each Azure AD application.\n\n1. Create a JSON file named `credential.json`.\n\n ```json\n {\n \"name\": \"CREDENTIAL_NAME\",\n \"issuer\": \"https://accounts.google.com\",\n \"subject\": \"service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com\",\n \"audiences\": [\"api://AzureADTokenExchange\"],\n \"description\": \"Allow GKE on Azure to authenticate to the Azure AD application using a Google service account.\"\n }\n ```\n - \u003cvar translate=\"no\"\u003eCREDENTIAL_NAME\u003c/var\u003e: the credential name.\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the number of the Google Cloud project that hosts the cluster.\n2. Create a federated identity credential on the Azure AD application:\n\n az ad app federated-credential create --id \"${APPLICATION_ID}\" --parameters credential.json\n\nFor more details, see the Azure documentation\n[Azure AD workload identity federation with Google Cloud](https://blog.identitydigest.com/azuread-federate-gcp/).\n\nYou can also provision the Azure federated identity credential using Terraform.\nFor details, see [azuread_application_federated_identity_credential](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_federated_identity_credential).\n\nWhat's next\n-----------\n\n- [Create Azure role assignments](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-role-assignments)"]]
