<p>This doc <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a> explains that if you enable workload identity on a running cluster and create a new node on that cluster which would have workload identity automatically enabled ,then you should configure your application to use workload identity before moving the pods over to the new node pool.</p>
<p>How do you know if your application needs to be configured to use workload identity or not?
I'm guessing it depends on what services your application currently makes use of and how they currently authenticate?
What would the consequences be of not configuring them to use workload identity before moving them to the new node pool where workload identity is enabled?</p>
<p>Some context. I'm busy enabling GKE backup, but to get this running I need to enable workload identity on the cluster and then obviously on the node pool too.</p>

<blockquote>
<p>How do you know if your application needs to be configured to use
workload identity or not?</p>
</blockquote>
<p>That will be hard to say, it depends on your application if it's using any <strong>GCP</strong> service or needs <strong>Auth</strong> or not.</p>
<p>If it's not using and running simple  <strong>API/Tasks</strong> you can run it without <strong>workload</strong> <strong>identity</strong> just drain node and migrate to new pool.</p>
<p>If you are using the <strong>Oauth</strong>, <strong>Key</strong> or another method, storing value in <strong>Env variable</strong> to <strong>Authenticate</strong> to <strong>Google</strong> service will work however best practice is to go with <strong>Workload identity</strong> for security reasons.</p>
