[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Managing a Kubernetes cluster > Supporting an IAM workload identity federation in a Kubernetes cluster # Enabling support for a Yandex Identity and Access Management workload identity federation in a Yandex Managed Service for Kubernetes cluster Managed Service for Kubernetes supports integration with Identity and Access Management _workload identity federations_. [Workload identity federations](../../../iam/concepts/workload-identity.md) allow you to configure a link between external systems and Yandex Cloud via the [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) protocol. This allows external systems to perform actions with Yandex Cloud resources under IAM [service accounts](../../../iam/concepts/users/service-accounts.md) without using [authorized keys](../../../iam/concepts/authorization/key.md). This is a more secure method that minimizes the risk of credential leakage and the possibility of unauthorized access. When this option is enabled, Managed Service for Kubernetes automatically creates an OIDC provider for the specific cluster and provides the following parameters for integration with workload identity federations: * `Issuer URL`. * `JWKS key set URL`. {% note tip %} This guide describes how to set up a Managed Service for Kubernetes cluster and node groups. For a complete guide on integration with Identity and Access Management workload identity federations, see [Accessing the Yandex Cloud API from a Managed Service for Kubernetes cluster using a workload identity federation in Identity and Access Management](../../tutorials/wlif-managed-k8s-integration.md). {% endnote %} 1. If you do not have a Managed Service for Kubernetes cluster yet: 1. [Create a cluster](kubernetes-cluster-create.md). 1. [Create](../node-group/node-group-create.md) a node group. 1. [Set up](../connect/security-groups.md) security groups for the cluster and node group. 1. To use the Yandex Cloud API, your cluster nodes must have internet access. Make sure your cluster nodes have public IP addresses assigned to them or the subnet they reside in has a configured [NAT gateway](../../../vpc/concepts/gateways.md#nat-gateway) or [NAT instance](../../../tutorials/routing/nat-instance/index.md). Also make sure the security group rules allow unrestricted outgoing traffic for your cluster nodes. 1. Set up integration with a workload identity federation for the cluster and node group: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder with your cluster. 1. Navigate to **Managed Service for Kubernetes**. 1. Click ![image](../../../_assets/console-icons/ellipsis.svg) next to the cluster and select **Edit**. 1. Enable the workload identity federation in the **Identity and access management** field. 1. Click **Save**. 1. Under **Identity and access management** on the cluster overview page, copy the **Issuer URL** and **JWKS key set URL** values. You will need them to complete the integration. 1. Navigate to the **Node group** tab. 1. Click ![image](../../../_assets/console-icons/ellipsis.svg) next to the node group and select **Edit**. 1. Enable the workload identity federation in the **Identity and access management** field. 1. Click **Save**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Enable support for integration with workload identity federation in the cluster: ```bash yc managed-kubernetes cluster update \ --id \ --enable-workload-identity-federation ``` Result: ```text done (3s) ... workload_identity_federation: enabled: true issuer: https://storage.yandexcloud.net/mk8s-oidc/v1/clusters/catc7433801j******** jwks_uri: https://storage.yandexcloud.net/mk8s-oidc/v1/clusters/catc7433801j********/jwks.json ``` Copy the `workload_identity_federation.issuer` and `workload_identity_federation.jwks_uri` values. You will need them to complete the integration. 1. Enable support for integration with workload identity federation in the node group: ```bash yc managed-kubernetes node-group update \ --id \ --enable-workload-identity-federation ``` Result: ```text done (12s) ... workload_identity_federation: enabled: true ``` - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. 1. Add the `workload_identity_federation` section to the cluster manifest in the Terraform configuration file: ```hcl resource "yandex_kubernetes_cluster" "my_cluster" { ... workload_identity_federation { enabled = true } } ``` 1. Add the `workload_identity_federation` section to the node group manifest in the Terraform configuration file: ```hcl resource "yandex_kubernetes_node_group" "my_node_group" { ... workload_identity_federation { enabled = true } } ``` 1. Make sure the configuration files are correct. 1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure. 1. Run this command: ```bash terraform validate ``` Terraform will show any errors found in your configuration files. 1. Confirm resource changes. 1. Run this command to view the planned changes: ```bash terraform plan ``` If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources. 1. If everything looks correct, apply the changes: 1. Run this command: ```bash terraform apply ``` 1. Confirm updating the resources. 1. Wait for the operation to complete. 1. Get the issuer URL (`issuer`) and the JWKS keyset URL (`jwks_uri`) to configure the workload identity federation using the Terraform [yandex_kubernetes_cluster](../../../terraform/data-sources/kubernetes_cluster.md) data source. You can aslo [find out](kubernetes-cluster-list.md#get) these parameters in the [management console](https://console.yandex.cloud), using the CLI or API. - API {#api} 1. Use the [update](../../managed-kubernetes/api-ref/Cluster/update.md) REST API method for the [Cluster](../../managed-kubernetes/api-ref/Cluster/index.md) resource or the [ClusterService/Update](../../managed-kubernetes/api-ref/grpc/Cluster/update.md) gRPC API call. {% note info %} Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`. {% endnote %} Provide the following in the request: * Cluster ID in the `clusterId` parameter. * `updateMask` set to `workloadIdentityFederation.enabled`. {% note warning %} The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string. {% endnote %} * `workloadIdentityFederation` set to `"enabled": "true"`. Copy the `workloadIdentityFederation.issuer` and `workloadIdentityFederation.jwksUri` values from the response. You will need them later. 1. Use the [update](../../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call. Provide the following in the request: * Node group ID in the `nodeGroupId` parameter. * `updateMask` set to `workloadIdentityFederation.enabled`. * `workloadIdentityFederation` set to `"enabled": "true"`. {% endlist %} ### See also {#see-also} * [Workload identity federations](../../../iam/concepts/workload-identity.md) * [Accessing the Yandex Cloud API from a Managed Service for Kubernetes cluster using a workload identity federation in Identity and Access Management](../../tutorials/wlif-managed-k8s-integration.md)