Medium: Workload Identity explained using kaniko

kaniko-executor-k8s-secret.yaml

apiVersion: v1
kind: Pod
metadata:
  name: kaniko-k8s-secret
spec:
  containers:
    - name: kaniko
      image: gcr.io/kaniko-project/executor:v1.9.1
      args: ["--dockerfile=Dockerfile",
             "--context=gs://${GCS_BUCKET}/path/to/context.tar.gz",
             "--destination=gcr.io/${PROJECT}/${IMAGE_NAME}:${IMAGE_TAG}",
             "--cache=true"]
      volumeMounts:
        - name: kaniko-secret
          mountPath: /secret
      env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /secret/kaniko-secret.json
  restartPolicy: Never
  volumes:
    - name: kaniko-secret
      secret:
        secretName: kaniko-secret