Google 會運用 AI 技術將內容翻譯成你偏好的語言，但可能會出錯。

設定受管理工作負載的生命週期管理機制

本文說明如何使用 Certificate Manager (第 2 代)，為 Compute Engine 和 Google Kubernetes Engine (GKE) 等代管工作負載設定憑證生命週期管理。您可以使用憑證核發設定，將代管 workload identity pool 連結至憑證授權單位服務集區，自動核發及更新憑證。這有助於避免因憑證過期而導致服務中斷。

代管 Workload Identity 的運作方式

代管 Workload Identity會為 Compute Engine 和 GKE 工作負載提供經過驗證的身分，以及憑證和信任錨點，工作負載會使用這些項目，透過相互傳輸層安全標準 (mTLS) 相互驗證。受管理的工作負載身分會分組至 workload identity pool，做為其中身分的信任邊界。

將 workload identity pool 連結至 CA 服務集區後，Google Cloud 會自動為工作負載核發及更新憑證。這項自動化功能可免除手動管理憑證，並防止服務中斷。

事前準備

登入 Google Cloud 帳戶。如果您未曾使用過 Google Cloud，歡迎建立帳戶，親自體驗實際使用我們產品的成效。新客戶還能獲得價值 $300 美元的免費抵免額，用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs, if any are not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

If you're using an existing project for this guide, verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Compute Engine, Certificate Manager, Certificate Authority Service APIs, if any are not already enabled.

Roles required to enable APIs

Enable the APIs

確認您已有具備代管型 Workload Identity 的 workload identity pool。詳情請參閱「設定 Compute Engine 的代管 Workload Identity 驗證」或「設定 GKE 的代管 Workload Identity 驗證」。
確認您已有 CA 服務集區，可向工作負載核發憑證。詳情請參閱「建立 CA 集區」。

必要的角色

如要取得設定生命週期管理所需的權限，請要求管理員在專案中授予您下列 IAM 角色：

Certificate Manager 編輯者 (roles/certificatemanager.editor)
CA Certificate Manager (roles/privateca.certificateManager)
Workload Identity 集區管理員 (roles/iam.workloadIdentityPoolAdmin)

如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和組織的存取權」。

您或許也能透過自訂角色或其他預先定義的角色，取得必要權限。