Main Navigation Adopters Documentation Blog Community Contribute

Appearance

Sidebar Navigation

Getting Started

Podrick and the Infinite Garden

Introduction to Gardener

Architecture

Gardener Projects

Gardener Shoots

Control Plane Components

Shoot Lifecycle

Features

Hibernation

Workerless Shoots

Credential Rotation

External DNS Management

Certificate Management

Vertical Pod Autoscaler

Cluster Autoscaler

Common Pitfalls

Guides

Set Up Client Tools

Kubeconfig Context as bash Prompt

Fun with kubectl Aliases

Organizing Access Using kubeconfig Files

High Availability

Best Practices

Chaos Engineering

Control Plane

Administer Client (Shoot) Clusters

Backup and Restore of Kubernetes Objects

Fix Problematic Conversion Webhooks

Create / Delete a Shoot Cluster

Create a Shoot Cluster Into an Existing AWS VPC

Enabling Trust Between Shoot and Garden Clusters

AI/ML Workloads on GPU Clusters

Shoot Cluster Maintenance

Authenticating with an Identity Provider

Scalability of Gardener Managed Kubernetes Clusters

Tailscale

Networking

Enable IPv4/IPv6 (dual-stack) Ingress on AWS

Support for IPv6 on GCP

Support for IPv6 on AWS

Manage Certificates with Gardener

Manage Certificates with Gardener for Default Domain

Managing DNS with Gardener

Monitor and Troubleshoot

Analyzing Node Removal and Failures

How to Debug a Pod

Get a Shell to a Gardener Shoot Worker Node

Shoot Deletion Stuck Due to Unmanaged Resources

tail -f /var/log/my-application.log

Applications

Access a Port of a Pod Locally

Kubernetes Antipatterns

Kubernetes Application CI/CD using Structured Authentication

Remove Committed Secrets in Github 💀

Orchestration of Container Startup

Integrity and Immutability

Dockerfile Pitfalls

Dynamic Volume Provisioning

Container Image Not Updating

Auditing Kubernetes for Secure Setup

Install Knative in Gardener Clusters

Container Image Not Pulled

Namespace Isolation

Specifying a Disruption Budget for Kubernetes Controllers

Using Prometheus and Grafana to Monitor K8s

Custom Seccomp Profile

Out-Dated HTML and JS Files Delivered

Shoot Pod Autoscaling Best Practices

Gardener

Advanced

containerd Registry Configuration

Control Plane Endpoints And Ports

Necessary Labeling for Custom CSI Components

Custom containerd Configuration

Readiness of Shoot Worker Nodes

Cleanup of Shoot Clusters in Deletion

Taints and Tolerations for Seeds and Shoots

API Reference

Authentication

Core V1

Core

Extensions

Operations

Operator

Provider Local

Resources

Security

Seedmanagement

Autoscaling

DNS Autoscaling

In-Place Resource Updates

Shoot Autoscaling

Concepts

Gardener Admission Controller

APIServer Admission Plugins

Gardener API Server

Architecture

Backup and Restore

Cluster API

Gardener Controller Manager

etcd

gardenadm

gardenlet

Gardener Node Agent

Gardener Operator

Gardener Resource Manager

Gardener Scheduler

Extensions

Resource Admission in the Garden Cluster

CA Rotation

Cluster

ControlPlane Webhooks

Conventions

Force Deletion

Access to the Garden Cluster for Extensions

Healthcheck Library

Heartbeat

Logging And Monitoring

Managedresources

Migration

Project Roles

Provider Local

Reconcile Trigger

Referenced Resources

Registering Extension Controllers

Resources

BackupBucket

BackupEntry

Bastion

ContainerRuntime

ControlPlane

DNS Record

Extension

Infrastructure

Network

OperatingSystemConfig

Selfhostedshootexposure

Worker

Shoot Health Status Conditions

Shoot Maintenance

Shoot Webhooks

Static Manifests

Validation Guidelines For Extensions

Deployment

Authentication Gardener Control Plane

Configuring Logging

Deploy Gardenlet

Deploy Gardenlet Automatically

Deploy Gardenlet Manually

Deploy Gardenlet Via Operator

Feature Gates

Scoped API Access for gardenlets and Extensions

Getting Started Locally

Getting Started Locally With Extensions

Getting Started Locally With Gardenadm

Getting Started Remotely

Image Vector

Migration V0 To V1

Secret Binding Provider Controller

Setup Gardener

Version Skew Policy

Networking

Custom DNS Configuration

DNS Search Path Optimization

Dual-stack network migration

ExposureClasses

NodeLocalDNS Configuration

KUBERNETES_SERVICE_HOST Environment Variable Injection

Shoot Networking Configurations

Project

NamespacedCloudProfiles

Projects

Service Account Manager

Security

Default Seccomp Profile

ETCD Encryption Config

Admission Configuration for the `PodSecurity` Admission Plugin

Audit a Kubernetes Cluster

Shoot Serviceaccounts

Shoot

Access Restrictions

Shoot Workload Identity

Accessing Shoot Clusters

Shoot Hibernation

Shoot Info Configmap

Shoot cluster supported Kubernetes versions and specifics

Shoot Cluster Limits

Shoot Machine Preservation

Shoot Maintenance

Shoot Cluster Purposes

Shoot Scheduling Profiles

Shoot Status

Shoot Supported Architectures

Workerless `Shoot`s

Shoot Worker Nodes Settings

Shoot Operations

SecretBinding to CredentialsBinding Migration

Shoot Credentials Rotation

Trigger Shoot Operations Through Annotations

Shoot Updates and Upgrades

Shoot Kubernetes and Operating System Versioning in Gardener

Supported Kubernetes Versions

Controlling the Kubernetes Versions for Specific Worker Pools

Worker Pool Manual Rollout

Cloudprofile Capabilities

Configmap

Configuration

Control Plane Migration

Disaster Recovery Garden

Enabling In-Place Pod Resource Updates

Immutable Backup Buckets

Istio

Kube Apiserver Loadbalancing

Live Control Plane Migration

Logging

Managed Seed

Network Policies

Nginx Ingress Retirement and Migration Guide

Overlapping Network Ranges

Seed Bootstrapping

Seed Settings

Topology Aware Routing

Trusted Tls For Control Planes

Trusted Tls For Garden Runtime

Upgrade Gardener

Well Known Labels Annotations

Proposals

0001 Gardener Extensibility

0002 Backup Infrastructure

0003 Networking Extensibility

0004 Core Gardener Cloud Api

0005 Versioning Policy

0006 Etcd Druid

0007 Shoot Control Plane Migration

0008 Shoot Apiserver Via Sni

0009 Integration Test Framework

0010 Container Runtime Extensibility

0011 Apiserver Network Proxy

0012 Oidc Webhook Authenticator

0013 Automated Seed Management

0014 Reversed Cluster Vpn

0015 Bastion Management

0016 Adminkubeconfig Subresource

0017 Shoot Control Plane Migration Bad Case

0018 Shoot Ca Rotation

0019 Observability Stack Operator Migration

0020 Ha Control Planes

0021 Ipv6 Singlestack Local

0022 Improved Shootstate Usage

0023 Autoscaling Kube Apiserver Via Independent Hpa And Vpa

0024 Shoot Oidc Issuer

0025 Namespaced Cloudprofiles

0026 Workload Identity

0027 Cloudprofile Bastion Section

0028 Self Hosted Shoot Clusters

0030 Apiserver Proxy

0031 Inplace Node Updates

0032 Version Classification Lifecycle

0033 Machine Image Capabilities

0034 Observability2.0 Opentelemetry

Observability 2.0

0035 Observability2.0 Victorialogs

0036 Self Hosted Shoot Exposure

0037 Scaling Advisor

0038 Autoscaling Persistentvolumeclaims

0039 Live Control Plane Migration

0043 Spegel Registry Support In The Registry Cache Extension

0049 Gardener Landscape Kit

0057 Replace Nginx Ingress Shoot Addon With Traefik Extension

Security and Compliance

Kubernetes Cluster Hardening Procedure

Run DISA K8s STIGs Ruleset

Gardener Compliance Report

Regional Restrictions

Reporting a Security Incident

List of Extensions

Infrastructure Extensions

Provider Alibaba Cloud

Deployment

Create a Kubernetes Cluster on Alibaba Cloud with Gardener

Operations

Usage

Provider AWS

Deployment

Create a Kubernetes Cluster on AWS with Gardener

Operations

proposals

Flexible Network Configuration (BYOI)

Resource Tags

Usage

Provider Azure

Azure Permissions

Azure Resource Tagging

Deployment

Create a Kubernetes Cluster on Azure with Gardener

Operations

Usage

Provider GCP

Deployment

Gcp Resource Labels

Create a Кubernetes Cluster on GCP with Gardener

Operations

Usage

Provider OpenStack

Deployment

Openstack Resource Tagging

Operations

Usage

Operating System Extensions

Network Extensions

Calico CNI

Deployment

Operations

Shoot Overlay Network

Usage

Others

Access Control List Extension

Kubernetes Auditing

Api Reference

Auditing

Config

Configuration for Garden Clusters

Event Format for Garden Clusters

Configuration for Shoot Clusters

Event Format for Shoot Clusters

Registry Cache

Registry cache

Configuring the Registry Cache Extension

Observability

How to provide credentials for upstream registry?

Registry mirror

How to provide a certificate authority bundle for a private mirror?

Configuring the Registry Mirror Extension

Certificate Services

Changing alerting settings

Using a custom Issuer

Deployment

Tutorials

Gateway Api Gateways

Istio Gateways

Gardener yourself a Shoot with Istio, custom Domains, and Certificates

DNS Services

Deployment

DNS Providers

Lakom Service

Deployment

Lakom

Oci Registries

Shoot Extension

Networking Problem Detector

Deployment

Shoot Networking Problemdetector

Other Components

etcd-druid

api-reference

Etcd Druid Api

benchmark

etcd Network Latency

Bootstrapping With Existing Cluster

Concepts

Bootstrap With Existing Cluster

Etcd Cluster Components

Etcd Cluster Resource Protection

Deployment

Configure Etcd Druid

Feature Gates in Etcd-Druid

Getting started locally

Getting Started Locally

Manage Azurite Emulator

Manage Gcs Emulator

Manage S3 Emulator

Prepare Helm Charts

Production Setup Recommendations

Version Compatibility Matrix

Managing Etcd Clusters

monitoring

Metrics

Proposals

DEP Title

01 Multi Node Etcd Clusters

02 Snapshot Compaction

03 Scaling Up An Etcd Cluster

EtcdMember Custom Resource

operator out-of-band tasks

Immutable etcd Cluster Backups

StatefulSet Quorum-Aware Updates with OnDelete Strategy

Recovering Etcd Clusters

Securing Etcd Clusters

Using Additional Advertise Peer Urls

Using Druid Client

Using Etcdopstask

Validating Etcd Clusters

Machine Controller Manager

Proposals

Excess Reserve Capacity

GRPC Based Implementation of Cloud Providers

Hotupdate Instances

Initialize Machine

Machine Preservation

To-Do

Outline

FAQ

Deployment

Machine Preservation

Machine

Machine Deployment

Machine Set

Prerequisite

Network Problem Detector

Dashboard

Access Restrictions

Automating Project Resource Management

Connect Kubectl

Custom Fields

Customization

Migrate Secret Bindings

Project Operations

Terminal Shortcuts

Using Terminal

Webterminals

Working With Projects

Gardenctl

Help

Gardenctl

Gardenctl Config

Gardenctl Config Delete Garden

Gardenctl Config Set Garden

Gardenctl Config Set Openstack Authurl

Gardenctl Config View

Gardenctl Kubeconfig

Gardenctl Kubectl Env

Gardenctl Kubectl Env Bash

Gardenctl Kubectl Env Fish

Gardenctl Kubectl Env Powershell

Gardenctl Kubectl Env Zsh

Gardenctl Provider Env

Gardenctl Provider Env Bash

Gardenctl Provider Env Fish

Gardenctl Provider Env Powershell

Gardenctl Provider Env Zsh

Gardenctl Rc

Gardenctl Rc Bash

Gardenctl Rc Fish

Gardenctl Rc Powershell

Gardenctl Rc Zsh

Gardenctl Resolve

Gardenctl Resolve Garden

Gardenctl Resolve Project

Gardenctl Resolve Seed

Gardenctl Resolve Shoot

Gardenctl Ssh Patch

Gardenctl Ssh

Gardenctl Target

Gardenctl Target Control Plane

Gardenctl Target Garden

Gardenctl Target Project

Gardenctl Target Seed

Gardenctl Target Shoot

Gardenctl Target Unset

Gardenctl Target View

Gardenctl Version

Provider Env

Targeting

FAQ

How do you add K8S feature gates to a shoot cluster?

Can you migrate the content of one cluster to another cluster?

Can you backup your Kubernetes cluster resources?

How can you get the status of a shoot API server?

How do you configure Multi-AZ worker pools for different extensions?

What are the meanings of different DNS configuration options?

Upgrading Kubernetes Versions

Can you run privileged containers?

Reconciliation

How can you report a security incident?

How do you rotate IaaS keys for a running cluster?

Glossary

Resources

Videos

Why Kubernetes

High Performance Microservices with Kubernetes, Go, and gRPC

Building Small Containers

Organizing with Namespaces

Readiness != Liveness

The Ins and Outs of Networking

Report an issue

Page Content

Workloadidentity

Aws
Azure
Gcp

Last updated:

Funded by the European Union – NextGenerationEU.

The views and opinions expressed are solely those of the author(s) and do not necessarily reflect the views of the European Union or the European Commission. Neither the European Union nor the European Commission can be held responsible for them.

Workloadidentity | Gardener is a project of the NeoNephos Foundation. For applicable policies including privacy policy, terms of use and trademark usage guidelines, please see https://linuxfoundation.eu. Linux is a registered trademark of Linus Torvalds.

Building this site is powered by

Terms of Use|Privacy Statement|Legal Disclosure

Resources

Provider Alibaba Cloud

Provider AWS

proposals

Provider Azure

Provider GCP

Provider OpenStack

Provider STACKIT

CoreOS/FlatCar OS

SUSE CHost OS

Ubuntu OS

Calico CNI

Cilium CNI

Kubernetes Auditing

Api Reference

Registry Cache

Registry cache

Registry mirror

Certificate Services

Tutorials

DNS Services

Tutorials

Workloadidentity

Lakom Service

Egress Filtering

Networking Problem Detector

OpenID Connect Services

Node Audit Logging

Concepts

Deployment

Concepts

Deployment

Getting started locally

Proposals

Documents

Proposals

To-Do

Workloadidentity