The problem: federation is easy to explain and tedious to wire

Most clusters I've worked on have at least one pod with an AWS access key or a GCP service-account JSON key sitting in a Kubernetes Secret . Someone minted it, someone copied it in, and nobody is sure when it last rotated.

Clouds providers have had a better answer for years. AWS has AssumeRoleWithWebIdentity and GCP has Workload Identity Federation. The workload presents a JWT from an issuer the cloud trusts and gets back credentials that expire in minutes. The catch is the setup.

For one pod in namespace payments that needs S3 in one AWS account and GCS in one GCP project, you need:

An issuer that will mint a token for that specific workload.…