Community
crossplane-configuration-gcp-workload-identity
By livewyer-ops
Last changed 3 months ago
Compatibility
Crossplane (2.0+)
Upbound Crossplane (UXP) (2.0+)
Languages
Source Code

Notice something off about this package? Help us keep the marketplace safe and trustworthy by reporting inappropriate content or behavior.

Report this package
Overview
This is where you can describe your project.
ReadmeDependenciesXRDsCompositions

crossplane-configuration-gcp-workload-identity

A Crossplane Configuration for setting up GCP Workload Identity to enable Kubernetes workloads to authenticate with Google Cloud services using service accounts.

Overview

This Configuration provides a Composite Resource Definition (XRD) and Composition for automating the setup of GCP Workload Identity, which allows Kubernetes pods to authenticate to Google Cloud services without storing service account keys.

The configuration automates:

  • Creation of GCP Service Accounts
  • IAM role bindings for GCP projects
  • Kubernetes Service Account creation with appropriate annotations
  • Workload Identity IAM policy bindings

Features

  • Multi-Project Support: Grant permissions across multiple GCP projects
  • Flexible IAM Roles: Assign multiple IAM roles to the workload identity
  • Kubernetes Integration: Automatically creates and configures Kubernetes Service Accounts
  • Customizable: Control service account mounting and namespace placement

Prerequisites

This Configuration requires:

Installation

Install this Configuration using the Crossplane CLI:

kubectl crossplane install configuration ghcr.io/livewyer-ops/crossplane-configuration-gcp-workload-identity:latest

Or create a Configuration resource:

apiVersion: pkg.crossplane.io/v1
kind: Configuration
metadata:
  name: gcp-workload-identity
spec:
  package: ghcr.io/livewyer-ops/crossplane-configuration-gcp-workload-identity:latest

Usage

Create a WorkloadIdentity resource:

apiVersion: gcp.livewyer.io/v1alpha1
kind: WorkloadIdentity
metadata:
  name: my-app-workload-identity
  namespace: default
spec:
  forProvider:
    projectId: my-gcp-project
    serviceAccountName: my-app
    roles:
      - roles/storage.objectViewer
      - roles/cloudsql.client
    additionalProjects:
      - projectId: another-project
        roles:
          - roles/secretmanager.secretAccessor

Parameters

ParameterRequiredDescription
projectIdYesGCP project ID where the service account will be created
rolesYesList of IAM roles to grant in the primary project
serviceAccountNameNoName for the Kubernetes Service Account
serviceAccountNamespaceNoNamespace for the Kubernetes Service Account (defaults to resource namespace)
additionalProjectsNoList of additional projects with roles to grant access
automountServiceAccountTokenNoEnable automatic token mounting (default: true)

Examples

See the examples/ directory for more usage examples:

Development

Building the Configuration

Build the Configuration package using the Crossplane CLI:

crossplane xpkg build

With custom options:

crossplane xpkg build --package-root=. --package-file=gcp-workload-identity.xpkg --examples-root=./examples

Publishing

Login to your registry:

crossplane xpkg login

Push the package:

crossplane xpkg push -f gcp-workload-identity.xpkg your-org/crossplane-configuration-gcp-workload-identity:v1.0.0

License

MIT License - see LICENSE for details

Maintainer

Maintained by Livewyer - bowen@livewyer.com

Links

Discover the building blocks for your internal cloud platform.
© 2026 Upbound, Inc.
Solutions
Learn
Company
Community
More