You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer.

Create a Google service account.

Create a Kubernetes service account in a Workload Identity-enabled cluster.

Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.

Map the Kubernetes service account to the workload.

Repeat for each workload.

Create a Google service account.

Create a node pool, and set the Google service account as the default identity.

Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations.

Repeat for each workload.

Create a Google service account.

Create a service account key for the Google service account.

Create a Kubernetes secret with a service account key.

Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path.

Repeat for each workload.

Create a Google service account.

Create a node pool without taints, and set the Google service account as the default identity.

Grant IAM permissions to the Google service account.