Configure lifecycle management for managed workloads

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This document shows how to configure certificate lifecycle management for managed workloads such as Compute Engine and Google Kubernetes Engine (GKE), using Certificate Manager (2nd gen). You can automate certificate issuance and renewal by linking a managed workload identity pool to a Certificate Authority Service pool using a certificate issuance configuration. This helps prevent service outages caused by expired certificates.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the APIs

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the APIs

Required roles

To get the permissions that you need to configure lifecycle management, ask your administrator to grant you the following IAM roles on your project:

• Certificate Manager Editor (roles/certificatemanager.editor)
• CA Service Certificate Manager (roles/privateca.certificateManager)
• Workload Identity Pool Admin (roles/iam.workloadIdentityPoolAdmin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Configure lifecycle for managed workloads

Configure a managed workload identity pool to specify how associated workloads receive and renew certificates from your existing CA Service pool.

1. In the Google Cloud console, go to the Certificate Manager (2nd gen) page.

   Go to Certificate Manager (2nd gen)

2. In the navigation pane, click Manage Lifecycle.
3. Select the Managed Workload Identity tab.
4. Locate the workload identity pool that you want to configure, and then click Configure lifecycle management.
5. Select the Region and the CA pool for the region.
6. In the Certificate lifetime field, specify the validity of the issued certificate. The value must be between 21 and 30 days.
7. Set the Rotation window to a value between 50 and 80. This is the percentage of the certificate's lifetime that triggers a renewal.
8. In the Key algorithm field, select the encryption algorithm to use to generate the private key.
9. Click Update.

What's next

• View certificate inventory
• Create issuance configuration
• Monitor your certificates
• Configure lifecycle management for load balancers
• Create trust configuration