OIDC with Google Cloud

1. Create a workload identity pool and provider

gcloud iam workload-identity-pools create slipway \
  --location=global --display-name="Slipway"

gcloud iam workload-identity-pools providers create-oidc slipway \
  --location=global --workload-identity-pool=slipway \
  --issuer-uri="https://slipway.example.com" \
  --attribute-mapping="google.subject=assertion.sub,attribute.org=assertion.org,attribute.project=assertion.project,attribute.environment=assertion.environment,attribute.ref=assertion.ref" \
  --attribute-condition="assertion.org == 'acme' && assertion.project == 'api'"

The --attribute-condition is your first line of defence: tokens that do not satisfy it cannot use the pool at all. If you set --allowed-audiences, request the same audience when you use the token; otherwise the provider’s default audience applies.

2. Allow a service account to be impersonated

gcloud iam service-accounts add-iam-policy-binding \
  deployer@acme-prod.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/slipway/attribute.environment/production"

Binding to attribute.environment/production means only deploy jobs bound to the production environment can impersonate this service account.

3. Use it in a job

Write the token to a file and create a credential configuration that points at it:

permissions: { id_token: write }
jobs:
  - name: deploy
    environment: { name: production, service: api }
    steps:
      - run: |
          umask 077
          printf %s "$SLIPWAY_ID_TOKEN" > /tmp/slipway-id-token
          gcloud iam workload-identity-pools create-cred-config \
            projects/123456789/locations/global/workloadIdentityPools/slipway/providers/slipway \
            --service-account=deployer@acme-prod.iam.gserviceaccount.com \
            --credential-source-file=/tmp/slipway-id-token \
            --output-file=/tmp/gcp-creds.json
          echo "GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp-creds.json" >> "$SLIPWAY_ENV"
          gcloud auth login --cred-file=/tmp/gcp-creds.json
      - run: gcloud run deploy api --image "$IMAGE" --region europe-west1

With the built-in Google Cloud integration, enter the provider resource name and service account once and the platform does the exchange for Cloud Run, GKE and Cloud Monitoring.