This document describes the deprecation and shutdown of Identity Service for GKE, including the timeline and milestones and any migration steps that you must take. Identity Service for GKE isn't available in organizations that were created on or after July 1, 2025. In version 1.37 and later, GKE clusters don't support this feature in any organization.
This deprecation applies only to GKE clusters that run on Google Cloud. The GKE Identity Service feature that's available in the connect gateway and for Google Distributed Cloud (software only) products isn't deprecated.
Timeline and milestones
The following timeline describes the deprecation and shutdown schedule for Identity Service for GKE:
July 1, 2025: Identity Service for GKE isn't supported in Google Cloud organizations that are created on or after this date.
July 1, 2026: Identity Service for GKE is deprecated in version 1.36 and earlier. These versions can still use Identity Service for GKE until the end of support date for the minor version.
Identity Service for GKE isn't supported in version 1.37 and later. You can't upgrade clusters that use Identity Service for GKE to version 1.37 or later.
Blocked upgrades to version 1.37 and later
If you have clusters that use Identity Service for GKE, then GKE blocks automatic and manual cluster upgrades to version 1.37 or later.
Automatic upgrades remain paused until the end of standard support for the minor version. If your cluster is enrolled in the Extended channel, then automatic upgrades are paused until the end of extended support. When the minor version reaches the end of support date, GKE automatically upgrades the cluster to the next minor version. If Identity Service for GKE is still enabled in that cluster, authentication workflows will fail.
To upgrade your cluster to version 1.37 or later, you must disable Identity Service for GKE. To authenticate from external identity providers (IdPs), use Workforce Identity Federation. For more information, see Migrate from Identity Service for GKE.
Migrate from Identity Service for GKE
If you rely on Identity Service for GKE to authenticate from third-party IdPs, then migrate to Workforce Identity Federation. Workforce Identity Federation supports multiple protocols, doesn't install components in the cluster, and is integrated with IAM.
The following table describes the difference in principal syntax between Workforce Identity Federation and Identity Service for GKE:
| Identity Service for GKE syntax | Workforce Identity Federation syntax |
|---|---|
amal@example.com |
principal://iam.googleapis.com/locations/global/workforcePools/full-time-employees/subject/amal@example.com
|
sre-group |
principalSet://iam.googleapis.com/locations/global/workforcePools/full-time-employees/group/sre-group
|
To migrate a cluster to use Workforce Identity Federation, follow these steps:
Set up Workforce Identity Federation for your organization and external IdP. For instructions, see Configure Workforce Identity Federation.
Update the manifests for any RoleBindings and ClusterRoleBindings in your clusters to use the Workforce Identity Federation identifier syntax. Use one of the following options:
Programmatic updates: install and run the
gke-identity-service-migratortool. For instructions, see theGoogleCloudPlatform/gke-utilitiesrepository README.This tool finds existing RBAC bindings that use the Identity Service for GKE syntax and creates new manifests that use the corresponding Workforce Identity Federation principal identifiers.
Manual updates: for every binding that references an authenticated user or group, create a separate copy of the object's manifest file that uses the Workforce Identity Federation identifier syntax.
Apply the updated manifests for RoleBindings and ClusterRoleBindings to your cluster.
Test that users can access the same resources when they authenticate using Workforce Identity Federation.
Remove the obsolete RBAC bindings from your cluster.
Disable Identity Service for GKE:
gcloud container clusters update CLUSTER_NAME \ --no-enable-identity-service