1. Open the GCP console and select the project for which you want to enable the Workload Identity.
2. Go to the “IAM & Admin” section from the left-hand side menu.
3. Click on “Service Accounts” from the IAM menu.
4. Select the service account for which you want to enable Workload Identity.
5. Click on “Edit” from the top menu bar.
6. Scroll down to the “Identity and API access” section.
7. Click on the “Enable Workload Identity” checkbox.
8. Click on “Save” to enable the Workload Identity for the selected service account.
9. Repeat the above steps for all the service accounts in your GCP project.

​

1. Open the Cloud Shell in GCP console.
2. Run the following command to enable the Workload Identity API:

gcloud services enable iamcredentials.googleapis.com

3. Create a Kubernetes service account:

gcloud iam service-accounts create [SA-NAME] --description "[SA-DESCRIPTION]" --display-name "[SA-DISPLAY-NAME]"

4. Bind the Kubernetes service account to the GCP service account:

gcloud iam service-accounts add-iam-policy-binding [SA-NAME] --member "serviceAccount:[PROJECT-ID].svc.id.goog[namespace/[NAMESPACE]/sa/[SA-NAME]]" --role "roles/iam.workloadIdentityUser"

5. Annotate the Kubernetes service account to use the GCP service account:

kubectl annotate serviceaccount --namespace [NAMESPACE] [SA-NAME] iam.gke.io/gcp-service-account=[SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

6. Verify that the workload identity is enabled by running the following command:

kubectl run --rm -i --tty workload-identity-test --image google/cloud-sdk --restart Never -- /bin/bash

7. Run the following command to authenticate using the Kubernetes service account:

gcloud auth activate-service-account --key-file=/var/run/secrets/kubernetes.io/serviceaccount/token

8. Run the following command to verify that the authentication was successful:

gcloud auth list

1. Install the necessary libraries:
   pip install google-auth google-auth-httplib2 google-auth-oauthlib google-cloud-storage
   
2. Set up an authentication method for your GCP account. You can either use a service account or your own user credentials.
3. Create a Python script that will enable Workload Identity for your GCP project. Here’s an example script that you can modify according to your needs:
   from google.oauth2 import service_account
   from googleapiclient.discovery import build
   
   # Set up authentication
   credentials = service_account.Credentials.from_service_account_file(
       'path/to/service_account.json')
   
   # Set up the Cloud IAM API client
   service = build('iam', 'v1', credentials=credentials)
   
   # Set up the request body
   body = {
       'projectId': 'your-project-id',
       'enabled': True
   }
   
   # Send the request to enable Workload Identity
   response = service.projects().setWorkloadIdentityPoolConfig(
       name='projects/your-project-id',
       body=body
   ).execute()
   
   # Print the response
   print(response)
   
4. Replace 'path/to/service_account.json' with the path to your service account file.
5. Replace 'your-project-id' with the ID of the GCP project that you want to enable Workload Identity for.
6. Save the Python script and run it using the command python script_name.py.
7. Verify that Workload Identity has been enabled for your GCP project by checking the Cloud IAM page in the GCP console.