<p>This doc <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a> explains that if you enable workload identity on a running cluster and create a new node on that cluster which would have workload identity automatically enabled ,then you should configure your application to use workload identity before moving the pods over to the new node pool.</p>
<p>How do you know if your application needs to be configured to use workload identity or not?
I'm guessing it depends on what services your application currently makes use of and how they currently authenticate?
What would the consequences be of not configuring them to use workload identity before moving them to the new node pool where workload identity is enabled?</p>
<p>Some context. I'm busy enabling GKE backup, but to get this running I need to enable workload identity on the cluster and then obviously on the node pool too.</p>

<p>There are a couple of things that should decide the impact. Depending on how the applications authenticate to google.</p>
<ol>
<li>No authentication: can just be moved</li>
<li>Authenticating with service account json files: can be moved, but recommended to switch to workload identity for security reasons</li>
<li>Authenticating with the default compute engine service account: Not possible, you will probably need to setup workload identity first to provide a more applicable SA for the pods</li>
</ol>
