Medium: Workload Identity explained using kaniko

kaniko-executor-wi.yaml

apiVersion: v1
kind: Pod
metadata:
  name: kaniko-wi
spec:
  containers:
  - name: kaniko
    image: gcr.io/kaniko-project/executor:v1.9.1
    args: ["--dockerfile=Dockerfile",
           "--context=gs://${GCS_BUCKET}/path/to/context.tar.gz",
           "--destination=gcr.io/${PROJECT_ID}/${IMAGE_NAME}:${IMAGE_TAG}",
           "--cache=true"]
  restartPolicy: Never
  serviceAccountName: kaniko-wi-ksa
  nodeSelector:
    iam.gke.io/gke-metadata-server-enabled: "true"