{"id":19748713,"url":"https://github.com/doitintl/workload-identity-analyzer","last_synced_at":"2025-10-31T07:48:54.656Z","repository":{"id":59480221,"uuid":"530665923","full_name":"doitintl/workload-identity-analyzer","owner":"doitintl","description":"A tool to analyze a workload running in GKE and make sure that Workload Identity is configured properly","archived":false,"fork":false,"pushed_at":"2023-02-16T15:37:12.000Z","size":29,"stargazers_count":16,"open_issues_count":2,"forks_count":4,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-04-14T23:38:13.447Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/doitintl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-30T13:18:38.000Z","updated_at":"2023-07-14T08:04:01.000Z","dependencies_parsed_at":"2023-01-18T20:35:14.378Z","dependency_job_id":null,"html_url":"https://github.com/doitintl/workload-identity-analyzer","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fworkload-identity-analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fworkload-identity-analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fworkload-identity-analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fworkload-identity-analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/doitintl","download_url":"https://codeload.github.com/doitintl/workload-identity-analyzer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224203978,"owners_count":17273027,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T02:23:09.973Z","updated_at":"2025-10-31T07:48:49.608Z","avatar_url":"https://github.com/doitintl.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## GKE Workload Identity Analyzer\n\nThis script takes a Pod name (running in the current context) and performs checks to ensure that [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) is properly configured.\n\n### Performed checks\n\n- Workload Identity enabled on the GKE cluster\n- Pod has `.spec.serviceAccountName` configured\n- KSA (configured in previous step) exists\n- KSA is annotated correctly with a GSA\n- GSA (configured in previous step) exists in the project\n- KSA has `roles/iam.workloadIdentityUser` on the GSA\n- GSA IAM roles in the project\n\n[![Supported Versions](https://img.shields.io/pypi/pyversions/wi-analyzer.svg)](https://pypi.org/project/wi-analyzer)\n\n## Prerequisites\n\n- [`gcloud` cli](https://cloud.google.com/sdk/docs/install) installed and configured\n- Application Default Credentials generated [using gcloud](https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login)\n- [`kubectl`](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl) installed and configured with cluster access\n- [current kubectl context](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#define-clusters-users-and-contexts) pointing to the relevant cluster\n- python 3 and [pip](https://pypi.org/project/pip/) installed\n- if running from source, python requirements installed: `pip install -r requirements.txt`\n\n## Installation\n\nThis package is published to [PyPI](https://pypi.org/project/wi-analyzer/) and can be installed using `pip`:\n\n```bash\npip install wi-analyzer\n```\n\n### Necessary project access\n\nThe script can be run by a user with the [`Viewer`](https://cloud.google.com/iam/docs/understanding-roles#basic-definitions) role in the project.\n\nAlternatively, the user will need enough GKE cluster access to read Pods and ServiceAccounts, plus the following IAM permissions:\n\n- container.clusters.get\n- iam.serviceAccounts.get\n- iam.serviceAccounts.getIamPolicy\n- resourcemanager.projects.getIamPolicy\n\nIf the GSA is in a different GCP project than the GKE cluster, you'll need the last 3 permissions on that project instead.\n\n## Using the tool\n\n```bash\n$ wi-analyzer --help\nusage: wi-analyzer [-h] [-n NAMESPACE] [-d] pod\n\nGKE Workload Identity Analyzer\n\npositional arguments:\n  pod                   Kubernetes Pod name to check\n\noptions:\n  -h, --help            show this help message and exit\n  -n NAMESPACE, --namespace NAMESPACE\n                        Kubernetes Namespace to run in\n  -p PROJECT, --project PROJECT\n                        GCP Project holding the cluster\n  -l LOCATION, --location LOCATION\n                        The GCP location of the cluster\n  -c CLUSTER, --cluster CLUSTER\n                        The name of the cluster\n  -d, --debug           Enable debug logging\n```\n\nConfigure your current context to point at the cluster where the workload is running.\nEither configure the relevant [namespace for the current context](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#setting-the-namespace-preference) or pass the namespace name using the `-n` flag.\n\nPass a pod name to check - it can be part of a Deployment, Job, StatefulSet, etc, but it has to be running already.\n\n## TODO\n\n- Support [Fleet Workload Identity](https://cloud.google.com/anthos/fleet-management/docs/use-workload-identity) (GKE WI for Anthos)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fworkload-identity-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdoitintl%2Fworkload-identity-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fworkload-identity-analyzer/lists"}