VPC Service Controls supports Workload Identity Federation for GKE in rules, in Preview

VPC Service Controls feature (Status: Preview): Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resources protected by a service perimeter is available in Preview.

You can specify the following Workload Identity Federation for GKE principals in ingress and egress rules:

• All GKE Pods that use a Kubernetes service account (by service account name or ID)
• All GKE Pods in a Kubernetes namespace
• All GKE Pods in a cluster

For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.