Meta tags:
description=Set up backend mTLS by using managed identity.;

Headings (most frequently used words):

the, create, managed, identity, certificate, workload, verify, and, pool, config, ca, manager, identities, to, an, trust, of, that, for, load, your, configure, service, certificates, backend, resources, root, inline, creation, is, balancers, stay, organized, with, collections, save, categorize, content, based, on, preferences, before, you, begin, issue, authorize, request, from, balancer, assign, automatically, created, configuration, what, next, required, roles, namespace, attestation, policy, issuance, optional, update, console, gcloud, authentication, spiffe, id, part, san, in, 509, svid, contains, spiffetruststores, field, products, pricing, support, engage,

Text of the page (most frequently used words):
the (423), #identity (155), #workload (127), and (102), certificate (95), pool (84), create (76), managed (75), service (75), for (74), you (62), trust (60), project (51), backend (45), config (44), following (44), gcloud (38), iam (38), roles (38), workload_identity_pool_id (36), access (36), with (35), global (35), identities (33), project_number (32), that (32), cloud (30), google (29), certificates (28), project_id (28), root (28), manager (27), load (27), this (26), region (26), name (24), domain (22), projects (22), created (21), use (21), inline (21), using (21), pools (21), configure (20), compute (20), balancer (20), manage (19), resources (19), replace (19), your (19), command (18), account (18), accounts (18), policies (17), output (17), com (17), end (16), namespace_id (16), authentication (15), managed_identity_id (15), example (15), configuration (15), can (15), policy (15), role (15), must (15), federation (15), need (14), number (14), describe (14), namespace (14), root_ca_pool_id (14), file (14), locations (13), begin (13), verify (13), algorithm (13), location (13), privateca (13), grant (13), from (13), issuance (13), are (12), 509 (12), googleapis (12), formatted (11), pemcertificate (11), key (11), spiffe (11), security (11), set (11), workloads (10), 2025 (10), which (10), field (10), after (10), have (10), get (10), json (10), characters (10), overview (10), workforce (10), about (9), other (9), more (9), authenticate (9), pem (9), goog (9), automatically (9), contains (9), used (9), resource (9), enable (9), alphanumeric (9), attestation (9), best (9), custom (9), management (9), troubleshoot (9), samples (8), see (8), prefix (8), section (8), earlier (8), application (8), principal (8), update (8), permissions (8), admin (8), agent (8), allow (8), keys (8), pam (8), practices (8), code (7), thumb (7), learn (7), issue (7), values (7), view (7), format (7), run (7), attached (7), add (7), console (7), only (7), lifetime (7), certificate_lifetime (7), unique (7), permission (7), audit (7), its (6), certificate_material (6), includes (6), trustanchors (6), data (6), subject (6), similar (6), backendservice (6), where (6), backend_service_name (6), beta (6), services (6), configured (6), select (6), request (6), rotation_window_percentage (6), optional (6), between (6), authority (6), tier (6), lived (6), organization (6), usage (6), tools (6), oauth (6), logging (6), credentials (6), terms (5), mtls (5), 06t10 (5), any (5), tlssettings (5), located (5), flag (5), creating (5), cli (5), mode (5), trust_domain (5), contain (5), lowercase (5), start (5), change (5), short (5), pipelines (5), auth (5), api (5), temporary (5), boundary (5), job (5), functions (5), all (4), down (4), information (4), updated (4), details (4), spiffetruststores (4), configs (4), public (4), uri (4), when (4), san (4), note (4), svid (4), encoded (4), active (4), network (4), check (4), health_check_name (4), https (4), related (4), balancing (4), assign (4), workloadidentitypools (4), value (4), billing (4), capools (4), was (4), within (4), then (4), dashes (4), character (4), specific (4), required (4), through (4), predefined (4), networking (4), owner (4), attach (4), storage (4), deny (4), logs (4), credential (4), grants (4), elevated (4), delete (4), providers (4), product (4), users (4), microsoft (4), entra (4), sign (3), architecture (3), support (3), products (3), understand (3), otherwise (3), content (3), engine (3), trusted (3), createtime (3), updatetime (3), certificate_material2 (3), certificate_material1 (3), mi_trust_config_id (3), represented (3), specified (3), additionaltrustbundles (3), version (3), not (3), part (3), state (3), networksecurity (3), backendauthenticationconfigs (3), bac (3), starting (3), referred (3), trustconfig (3), clientcertificate (3), creation (3), isn (3), health (3), whether (3), been (3), steps (3), external (3), bind (3), authorize (3), might (3), inlinetrustconfig (3), inlinecertificateissuanceconfig (3), path (3), domains (3), cic (3), cat (3), sed (3), default (3), cannot (3), rule (3), namespaces (3), enterprise (3), resourcemanager (3), apis (3), how (3), review (3), document (3), balancers (3), guides (3), monitor (3), scim (3), tags (3), gke (3), groups (3), 한국어 (2), 日本語 (2), עברית (2), português (2), brasil (2), italiano (2), indonesia (2), français (2), español (2), américa (2), latina (2), deutsch (2), english (2), site (2), youtube (2), events (2), started (2), pricing (2), missing (2), last (2), 2026 (2), utc (2), page (2), licensed (2), under (2), license (2), send (2), feedback (2), etag (2), trustconfigs (2), e4f05160 (2), f20f (2), 4109 (2), aae3 (2), 4c1a68891742 (2), additional (2), called (2), sha256 (2), before (2), nov (2), gmt (2), x509v3 (2), alternative (2), however (2), scope (2), indicates (2), client (2), client_auth (2), has (2), managedidentity (2), crt (2), 181fa461 (2), 3b53 (2), 40fa (2), 8515 (2), 507d47337c5d (2), 477b381f (2), d349 (2), 4a8f (2), a6f2 (2), f2bbaa7109bd (2), mi_client_certificate_id (2), mi_backend_authentication_config_id (2), also (2), authenticationconfig (2), port (2), port_name (2), healthchecks (2), www (2), external_managed (2), protocol (2), stage (2), setting (2), backends (2), binding (2), poolreader (2), member (2), authorizes (2), chains (2), projectnumber (2), workloadcertificaterequester (2), quota (2), like (2), including (2), another (2), even (2), same (2), trust_domain_name (2), percentage (2), renewal (2), triggers (2), issued (2), seconds (2), encryption (2), generate (2), private (2), keyalgorithm (2), rotationwindowpercentage (2), certificate_material4 (2), certificate_material3 (2), trust_domain_name2 (2), trust_domain_name1 (2), different (2), tc_json_file_path (2), cic_json_file_path (2), into (2), follows (2), eof (2), certificate_path (2), download (2), anchors (2), uses (2), mutually (2), hours (2), defaults (2), type (2), lets (2), provision (2), organized (2), boundaries (2), issues (2), subordinate (2), volume (2), don (2), key_algorithm (2), root_ca_organization (2), root_ca_cn (2), root_ca_id (2), roots (2), granting (2), folders (2), organizations (2), projectcreator (2), creator (2), certificatemanager (2), already (2), serviceusage (2), new (2), pre (2), based (2), documentation (2), sdk (2), languages (2), frameworks (2), infrastructure (2), costs (2), observability (2), monitoring (2), migration (2), industry (2), solutions (2), distributed (2), hybrid (2), multicloud (2), databases (2), analytics (2), hosting (2), development (2), bindings (2), errors (2), error (2), messages (2), patterns (2), integration (2), help (2), controls (2), optimize (2), test (2), user (2), migrate (2), restrict (2), settings (2), entitlements (2), control (2), edit (2), conditions (2), conditional (2), choose (2), types (2), legged (2), agents (2), disable (2), list (2), integrate (2), their (2), libraries (2), deployment (2), federate (2), applications (2), federated (2), oidc (2), saml (2), okta (2), cross (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, third, decade, climate, action, join, cookies, privacy, tech, twitter, blog, engage, training, certification, center, getting, github, system, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missingtheinformationsamplesineed, otherdown, tell, except, noted, java, registered, trademark, oracle, affiliates, developers, apache, creative, commons, attribution, over, what, next, 048030758z, kdokfm5w6il2hpvdukzwpuypyrkrnvq4jqmeice, 6rq, 07t08, 760754841z, host, extended, bundle, associated, bundles, 0x2, signature, ecdsa, issuer, validity, info, ecpublickey, 256, bit, extensions, critical, abridged, echo, openssl, x509, text, noout, print, human, readable, corresponds, property, identifies, stores, 187892797z, expiretime, 07t22, 47z, extendedkeyusage, clientauth, true, 427339950z, usedby, 237734973z, xwyxl1vyvoh4qiwf3nhkhavxgcuoqon7xdqais8esvs, 964275141z, affinitycookiettlsec, connectiondraining, drainingtimeoutsec, creationtimestamp, 06t02, 680, description, enablecdn, false, fingerprint, ltzwas8aylg, 719352032, kind, loadbalancingscheme, portname, selflink, backendservices, sessionaffinity, none, timeoutsec, 423b651f, d549, 4a9f, a4f2, g2bcaa7108bd, sections, verifying, scheme, checks, while, continue, outlined, finish, configuring, click, enter, option, expand, advanced, configurations, relevant, follow, additionally, instance, group, pertain, assigning, assigned, signed, reader, requester, present, correctly, correct, newer, region1, across, specify, omit, anchor, encode, one, line, string, downloaded, preceding, step, certs, validate, peer, maps, receive, want, explicitly, declare, relationship, recognizes, accepts, valid, rsa_4096, rsa_3072, rsa_2048, ecdsa_p384, ecdsa_p256, 86400s, 24h, days, variable, needs, verifies, verification, passes, requests, identifier, defined, administrative, single, production, environment, recommended, practice, two, hierarchy, devops, high, kms, include, rsa, pkcs1, 4096, common, length, uppercase, underscores, hyphens, auto, meant, long, low, able, components, securityadmin, networkadmin, such, loadbalanceradmin, targethttpsproxy, serviceaccountadmin, workloadidentitypooladmin, ask, administrator, quota_project, added, allowlist, likely, serviceusageadmin, selecting, doesn, require, granted, may, participate, existing, adhere, approach, walks, process, followed, attaching, explains, each, feature, offerings, general, features, available, limited, launch, descriptions, preview, save, categorize, preferences, stay, collections, home, withcond, resolve, insights, history, analyze, token, privileged, secure, vpc, intelligence, securely, prevent, exfiltration, interfaces, restore, previous, downscoped, multiple, approve, withdraw, remediate, excessive, entitlement, revoke, export, setup, remove, apply, lint, limits, conditionally, changes, auditing, grantable, suggestions, gemini, assistance, find, right, propagation, inheritance, principals, own, deploy, built, managing, upload, rotation, let, customers, kubernetes, directory, aws, azure, gce, undelete, impersonation, obtain, bigquery, power, pingone, aic, pingfederate, large, provisioning, discover, free, skip, main,

Text of the page (random words):
egin certificate n certificate_material2 n end certificate trust_domain_name2 trustanchors pemcertificate begin certificate n certificate_material3 n end certificate pemcertificate begin certificate n certificate_material4 n end certificate eof replace the following trust_domain_name the trust domain can be any trust domain like example com including another or even the same workload identity pool trust domain for a workload identity pool trust domain the trust domain name is formatted as follows workload_identity_pool_id global project_number workload id goog in the format replace the following workload_identity_pool_id the id of the workload identity pool project_number the project number of the project that contains the workload identity pool certificate_material the pem formatted ca certificate trusted to issue certificates in the trust domain the following command can be used to encode a pem formatted certificate file into a one line string cat trust anchor pem sed s g sed z s n tr n sed s n g after you create the inline trust config you need to update the workload identity pool with the trust configuration update the workload identity pool to bind the ca to the workload identity pool you need to update the workload identity pool with the ca s certificate issuance config using the inline certificate issuance config file flag if you have created an inline trust config you need to update the workload identity pool with the trust configuration using the inline trust config file flag gcloud iam workload identity pools update workload_identity_pool_id location global inline certificate issuance config file cic_json_file_path inline trust config file tc_json_file_path project project_id replace the following workload_identity_pool_id the workload identity pool id cic_json_file_path the path to the json formatted configuration file cic json for the inline certificate issuance config that you created earlier tc_json_file_path the path to the json formatted configuration file tc json for the inline trust config that you created earlier if your workloads authenticate across different trust domains you must specify this file otherwise you can omit inline trust config verify that the workload identity pool was updated to verify that your workload identity pool was updated with the certificate issuance config and the trust config run the following command gcloud iam workload identity pools describe workload_identity_pool_id location global project project_id replace the following workload_identity_pool_id the workload identity pool id project_id the project id the output is similar to the following inlinecertificateissuanceconfig capools region projects project_number locations region1 capools root_ca_pool_id keyalgorithm algorithm lifetime certificate_lifetime rotationwindowpercentage rotation_window_percentage inlinetrustconfig additionaltrustbundles trust_domain_name1 trustanchors pemcertificate begin certificate certificate_material1 end certificate pemcertificate begin certificate certificate_material2 end certificate trust_domain_name2 trustanchors pemcertificate begin certificate certificate_material3 end certificate pemcertificate begin certificate certificate_material4 end certificate mode trust_domain name projects project_number locations global workloadidentitypools workload_identity_pool_id state active this output includes the following values project_number the project number region the region where the root ca pool is located root_ca_pool_id the id of the root ca pool algorithm the encryption algorithm used to generate the private key certificate_lifetime the lifetime of the workload certificates issued by the ca pool in seconds rotation_window_percentage the percentage of the certificate s lifetime at which a renewal triggers trust_domain_name the trust domain can be any trust domain like example com including another or even the same workload identity pool trust domain certificate_material the pem formatted ca certificate trusted to issue certificates in the trust domain workload_identity_pool_id the workload identity pool id if inlinecertificateissuanceconfig or inlinetrustconfig isn t present in the output verify that you ve correctly configured your gcloud cli to use the correct project for billing and quota you might need to update to a newer version of the gcloud cli authorize managed workload identities to request certificates from the ca pool after you bind the ca to the workload identity pool you need to authorize managed workload identities to request certificates from the ca pool grant the ca service workload certificate requester role roles privateca workloadcertificaterequester to the trust domain this role authorizes the trust domain to request certificates from the ca service certificate chains gcloud privateca pools add iam policy binding root_ca_pool_id location region role roles privateca workloadcertificaterequester member principal iam googleapis com projects project_number name locations global workloadidentitypools workload_identity_pool_id project project_id replace the following root_ca_pool_id the id for the root ca pool region the region of the root ca pool project_number the project number to get project_number from project_id run the following command gcloud projects describe project_id format value projectnumber workload_identity_pool_id the workload identity pool id project_id the project id grant the ca service pool reader role roles privateca poolreader to the trust domain this role authorizes the trust domain to get the signed x 509 certificates from the ca s certificate chains gcloud privateca pools add iam policy binding root_ca_pool_id location region role roles privateca poolreader member principal iam googleapis com projects project_number name locations global workloadidentitypools workload_identity_pool_id project project_id replace the following root_ca_pool_id the id of the root ca pool region the region of the root ca pool project_number the project number workload_identity_pool_id the workload identity pool id project_id the project id create the load balancer and assign the managed identity to the backend service managed identity can only be assigned when creating the backend service the steps in this section only pertain to assigning a managed identity to the backend service of the load balancer this is part of the backend configuration of the load balancer to set up a global external application load balancer load balancer follow the steps in set up a global external application load balancer with vm instance group backends at the stage where you are setting up the backend service of the load balancer you need to additionally do the following console in the google cloud console go to the load balancing page go to load balancing in the backend configuration section add the relevant details to create a backend service expand the advanced configurations section in the backend authentication section select the managed identity option to assign a managed identity to the backend service in the managed identity field enter the managed workload identity that you created earlier click create continue the steps as outlined in set up the load balancer to finish configuring the load balancer gcloud to assign a managed identity to the backend service add the identity flag while using the gcloud beta compute backend services create command gcloud beta compute backend services create backend_service_name load balancing scheme external_managed protocol https health checks health_check_name identity workload_identity_pool_id global project_number workload id goog ns namespace_id sa managed_identity_id global replace the following backend_service_name the name of the backend service health_check_name the name of the health check workload_identity_pool_id workload identity pool id project_number the project number namespace_id the namespace id managed_identity_id the managed identity id automatically created resources after a managed identity is configured on the backend service of the load balancer the following resources are automatically created by managed workload identity backend authentication config attached to the backend service of the load balancer certificate manager managed identity certificate attached to the backend authentication config certificate manager trust config attached to the backend authentication config the following sections are related to verifying your configuration to check whether the automatically created resources have been configured verify your configuration verify your configuration to check whether the automatically created resources have been configured the automatically created resources have an mi prefix which indicates that the resource is created by managed workload identity verify the creation of the backend authentication config and managed identity to verify the creation of the backend authentication config and managed identity use the gcloud beta compute backend services describe command to describe the backend service gcloud beta compute backend services describe backend_service_name global the output is similar to the following affinitycookiettlsec 0 connectiondraining drainingtimeoutsec 0 creationtimestamp 2025 11 06t02 15 43 680 08 00 description enablecdn false fingerprint ltzwas8aylg healthchecks https www googleapis com compute beta projects project_id global healthchecks health_check_name id 719352032 kind compute backendservice loadbalancingscheme external_managed name backend_service_name port 80 portname port_name protocol https selflink https www googleapis com compute beta projects project_id global backendservices backend_service_name sessionaffinity none timeoutsec 30 tlssettings authenticationconfig networksecurity googleapis com projects project_id locations global backendauthenticationconfigs mi bac 423b651f d549 4a9f a4f2 g2bcaa7108bd identity workload_identity_pool_id global project_number workload id goog ns namespace_id sa managed_identity_id this output includes the following values project_id the project id health_check_name the name of the health check backend_service_name the name of the backend service port_name the port name region the region where the root ca pool is located workload_identity_pool_id the workload identity pool id project_number the project number namespace_id the namespace id managed_identity_id the managed identity id the backend authentication config is created automatically and is attached to the backendservice tlssettings authenticationconfig field the backend authentication config starting with the mi prefix is referred to as mi_backend_authentication_config_id in the following section the managed workload identity is also attached to the backendservice tlssettings identity field it has the following format workload_identity_pool_id global project_number workload id goog ns namespace_id sa managed_identity_id note the spiffe prefix isn t used in the identity field of the backend service backendservice tlssettings identity however the spiffe prefix is used when it is represented as a uri in the subject alternative name san of an x 509 certificate verify the creation of the certificate manager managed identity certificate and the certificate manager trust config to verify that the certificate manager managed identity certificate and the certificate manager trust config are attached to the backend authentication config resource use the gcloud network security backend authentication configs describe command gcloud network security backend authentication configs describe mi_backend_authentication_config_id location global the output is similar to the following clientcertificate projects project_number locations global certificates mi crt 181fa461 3b53 40fa 8515 507d47337c5d createtime 2025 11 06t10 15 56 237734973z etag xwyxl1vyvoh4qiwf3nhkhavxgcuoqon7xdqais8esvs name projects locations global backendauthenticationconfigs mi bac 477b381f d349 4a8f a6f2 f2bbaa7109bd trustconfig projects project_number locations global trustconfigs mi tc e4f05160 f20f 4109 aae3 4c1a68891742 updatetime 2025 11 06t10 16 01 964275141z the clientcertificate and the trustconfig are automatically created by managed workload identity and attached to the backend authentication config resource the clientcertificate starting with the mi prefix is referred to as mi_client_certificate_id in the following section the trustconfig starting with the mi prefix is referred to as mi_trust_config_id in the following section verify that the certificate manager certificate is a managed identity certificate to view the details of the certificate manager managed identity certificate use the gcloud certificate manager certificates describe command gcloud certificate manager certificates describe mi_client_certificate_id the output is similar to the following createtime 2025 11 06t10 15 46 187892797z expiretime 2025 11 07t22 55 47z extendedkeyusage clientauth true managedidentity identity workload_identity_pool_id global project_number workload id goog ns namespace_id sa managed_identity_id state active name projects project_id locations global certificates mi crt 181fa461 3b53 40fa 8515 507d47337c5d pemcertificate begin certificate n certificate_material n end certificate scope client_auth updatetime 2025 11 06t10 15 49 427339950z usedby name networksecurity googleapis com projects project_number locations global backendauthenticationconfigs mi bac 477b381f d349 4a8f a6f2 f2bbaa7109bd this output includes the following values workload_identity_pool_id the workload identity pool id project_number the project number namespace_id the namespace id managed_identity_id the managed identity id certificate_material the x 509 svid in a pem encoded format the certificate manager managed identity certificate has a managedidentity property which identifies it as a managed identity certificate the certificate manager managed identity certificate resource stores the x 509 svid in a pem encoded format the scope of the certificate manager managed identity certificate is client_auth which indicates that this certificate is used as a client certificate in backend mtls verify that the spiffe id is a part of the san in the x 509 svid the x 509 svid contains the spiffe id encoded as a uri in the san field this spiffe id corresponds to the managed identity in the workload identity pool note the spiffe prefix is not used in the identity field of the backend service backendservice tlssettings identity however the spiffe prefix is used when it is represented as a uri in the san of an x 509 certificate to print a human readable format of the certificate run the following command echo e begin certificate n certificate_material n end certificate openssl x509 text noout the output is similar to the following abridged certificate data version 3 0x2 signature algorithm ecdsa with sha256 issuer o example com cn example ca validity not before nov 6 10 15 48 20...