Free Report! Gartner® Hype Cycle™ for Monitoring and Observability.Read more

Kubernetes Dynamic Cluster Name

Google Cloud supports mapping Kubernetes service accounts to Google Cloud IAM service accounts using a feature called Workload Identity Federation.


BindPlane requires access to Google Pub/Sub when operating in High Availability using a multi-replica Deployment.

BindPlane can authenticate to Pub/Sub using OAuth Scopes or with Workload Identity Federation. This guide will focus on how to configure workload identity.


You must have access to a Google Kubernetes Engine cluster with workload identity enabled. GKE Autopilot has workload identity enabled by default.


Review the Configure applications to use Workload Identity Federation for GKE instructions.

If you deploy BindPlane to a cluster without the Pub/Sub OAUTH scopes, you can expect to see the following error logs:

2  "level":"error",
3  "timestamp":"2024-04-25T18:49:15.243Z",
4  "message":"failed to build server during server startup",
5  "error":"failed to init eventbus: create topic: check topic: rpc error: code = PermissionDenied desc = User not authorized to perform this action."

This is because the Kubernetes service account has not been mapped to IAM.

Kubernetes Service Account

The BindPlane OP Helm Chart creates service accounts for you. The name of the service account is derived from the name of your Helm deployment.

You can find your service account with kubectl -n <namespace> get sa.

1$ kubectl -n default get sa 
4bindplane   0         12m
5default     0         19m
1$ kubectl -n default get sa bindplane -o yaml
3apiVersion: v1
4kind: ServiceAccount
6  annotations:
7 bindplane
8 default
9  labels:
10 bindplane
11 Helm
12 bindplane
13 bindplane
14  name: bindplane
15  namespace: default

All pods deployed by the Helm chart will use this service account.

IAM Mapping

Step 4 in Configure applications to use Workload Identity Federation for GKE instructs you to create an IAM policy binding that binds the Kubernetes service account to your project's IAM.

1gcloud projects add-iam-policy-binding projects/PROJECT_ID \
2    --role=roles/pubsub.admin \
3    --member=principal:// \
4    --condition=None

Restart BindPlane

If you previously deployed BindPlane, and the pods are crashing due to Pub/Sub permission errors, restart the pods by deleting them or using the kubectl rollout restart command.

Once the new pods are started, they will not return Pub/Sub errors if the workload identity mapping was successful.