Core concept
Key file (JSON): historically. Rotation risk + storage. Avoid where possible.
Advertisement
How it works
Workload Identity Federation: external identities (AWS, Azure, OIDC) assume GCP SA. No keys.
Advertisement
Trade-offs + gotchas
Every GCP workload. GKE Workload Identity for pods. Federation for cross-cloud.