Skip to content
Get packs

GKE Workload Identity Troubleshooter

Diagnoses why GKE Pods can't authenticate to Google Cloud APIs and proposes fixes for a human to apply.

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
2 files

What it does

When a Pod running on Google Kubernetes Engine (GKE) fails to access Google Cloud services with permission or credential errors, this skill guides the AI agent through a fixed checklist: reading error messages and logs, checking that Workload Identity is enabled on the cluster and node pool, and verifying the Kubernetes service account to Google service account bindings and IAM roles. It names one most-likely cause, rules out others with evidence, and writes out the exact fix as a command. It is read-only and never changes IAM, service accounts, node pools or clusters itself.

Great for

  • Platform or DevOps engineers debugging 403 or 'could not find default credentials' errors in GKE Pods
  • Teams setting up Workload Identity Federation for the first time and checking their bindings
  • Engineers who want a consistent, step-by-step diagnostic process rather than ad hoc searching

Skip it if

  • In-cluster Kubernetes RBAC errors, which the skill explicitly excludes (use a different skill)
  • General application crashes or Pod security policies and NetworkPolicies, which are routed to other skills
  • Anyone expecting automatic fixes: the skill only proposes changes, so a human must apply them with appropriate privileges

Try asking

  • “My pod gets 403 iam.serviceAccounts.getAccessToken denied when calling Cloud Storage. Help me find out why.”
  • “Our GKE app says 'could not find default credentials'. Walk through the Workload Identity checks.”
  • “Check whether my node pool has GKE_METADATA enabled and whether my KSA is bound to the right Google service account.”
Step-by-step guide: how to use GKE Workload Identity TroubleshooterInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.

    gke-workload-identity.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip gke-workload-identity.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip gke-workload-identity.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the exact error string, pod name, namespace, KSA name and cluster location up front so the agent skips guesswork.
  • Review every proposed gcloud or manifest change before applying it, since the skill intentionally leaves execution to you.
  • Note that the skill requires reading its attribution reference and adds an attribution prefix to gcloud commands run in the terminal; this is expected behaviour.

What's inside

  • references/attribution.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.