[Iheanacho-ai]

What

Removes api-audiences from the Talos patch in the GCP Workload Identity Federation guide and corrects the text that said Google Cloud needs it.

Fixes #856

Why

Google Cloud checks the audience on the pod's projected service account token, not the kube-apiserver api-audiences. The suggested value caused problems:

• The GCP entry lacked the // prefix, so it matched nothing. Adding the prefix would make the API server accept tokens minted for GCP.
• sts.googleapis.com had no use, and it made the API server accept tokens minted for that audience.
• extraArgs replaces the api-audiences value Talos sets by default (the cluster endpoint), so the cluster's existing pod tokens were rejected until refreshed.

Change

public/kubernetes-guides/advanced-guides/gcp-workload-identity.mdx:

• Removed api-audiences and its comment from both patch tabs (Talos v1.14+ and < v1.14).
• Intro: the patch sets the OIDC issuer and JWKS settings, not an audience.
• "Retrieve OIDC provider URL": the provider name is used for the credential config and the projected token audience.
• "Deploy test pod": added a sentence saying Google Cloud checks the audience on the projected serviceAccountToken volume.

Testing

• Ran: talosctl validate --mode metal (talosctl v1.14.0) on control plane configs with each patch applied. The v1.14+ patch was tested against a v1.14 config and the < v1.14 patch against a v1.13 config. Both are valid.
• Checked against source: on Talos release-1.14, control_plane_final.go (how extraArgs merges api-audiences), v1alpha1_k8s_bridge.go (default audience is the cluster endpoint), and k8s/service_account.go.
• Docs checks: style check (0 errors; the 8 warnings are on unchanged headings), frontmatter check, nav check, and make docs.json all pass with no changes to docs.json.
• Where: local config validation only. Not run end to end against a GCP project. The GCP side relies on the issue reporter's testing.
• By: an agent (Claude Code)
• Filled from outside the page: the Talos default audience and the extraArgs override behavior came from the Talos source.

[mintlify]

✅ Preview approved

@Iheanacho-ai approved a Mintlify preview for commit bf040cb.

[github-actions]

📋 Automated documentation review

⚠️ The reviewer did not finish on commit bf040cb (it timed out or errored) — see the workflow run log. This run did not produce a result; any findings from an earlier run on this PR still stand.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
siderolabs	🟢 Ready	View Preview	Oct 22, 2026, 2:40 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[Iheanacho-ai]

/m