Google 會運用 AI 技術將內容翻譯成你偏好的語言，但可能會出錯。

設定受管理工作負載的生命週期管理機制

本文說明如何使用 Certificate Manager (第 2 代)，為 Compute Engine 和 Google Kubernetes Engine (GKE) 等受管理的工作負載設定憑證生命週期管理。您可以透過憑證核發設定，將受管理的工作負載身分池連結至憑證授權單位服務集區，自動核發及續約憑證。這有助於避免憑證過期導致服務中斷。

代管型 Workload Identity 的運作方式

代管工作負載身分會為 Compute Engine 和 GKE 工作負載提供經過驗證的身分，以及工作負載用來透過相互傳輸層安全標準 (mTLS) 驗證彼此的憑證和信任錨點。受管理的工作負載身分會歸入 workload identity pool，這個集區會做為其中身分的信任邊界。

將工作負載身分集區連結至 CA 服務集區後，「Google Cloud 」會自動為工作負載核發及續約憑證。這項自動化功能可免除手動管理憑證的麻煩，並防止服務中斷。

事前準備

登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs, if any are not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs, if any are not already enabled.

Roles required to enable APIs

Enable the APIs

請確認您已建立 workload identity pool，並具備受管理的工作負載身分。詳情請參閱「設定 Compute Engine 的受管理工作負載身分驗證」或「設定 GKE 的受管理工作負載身分驗證」。
確認您有現有的憑證授權單位服務集區，可向工作負載核發憑證。詳情請參閱「建立 CA 集區」。

必要的角色

如要取得設定生命週期管理所需的權限，請要求管理員授予您專案的下列 IAM 角色：

Certificate Manager 編輯者 (roles/certificatemanager.editor)
CA 服務憑證管理員 (roles/privateca.certificateManager)
Workload Identity 集區管理員 (roles/iam.workloadIdentityPoolAdmin)

如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和組織的存取權」。

您或許也能透過自訂角色或其他預先定義的角色，取得必要權限。