Google Workload Identity

workflows/<name>.yaml

spec:
  nodes:
    - id: gcp-auth
      taskRef:
        name: pipeline/gcp-auth
        version: "0.3.2"
      permissions:
        idToken: write          # this node only; siblings get nothing
      inputs:
        method:
          value: wif
        workloadIdentityProvider:
          secretRef: { name: WORKLOAD_IDENTITY_PROVIDER }
        serviceAccount:
          secretRef: { name: SERVICE_ACCOUNT_EMAIL }
        # audience defaults to the issuer's origin, https://api.cuttlefish.sh
    - id: terraform-plan
      taskRef:
        name: pipeline/terraform
        version: "0.3.0"        # sources .gcp-credentials/env.sh itself

.github/workflows/<name>.yml

permissions:
  contents: read
  id-token: write
jobs:
  plan:
    runs-on: [self-hosted, cuttlefish, linux]
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          # omit when the provider leaves allowedAudiences unset
          audience: https://api.cuttlefish.sh

An inline node that authenticates itself

- id: deploy
  image: google/cloud-sdk:slim
  permissions: { idToken: write }
  script: |
    curl -fsS -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
      "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://api.cuttlefish.sh" \
      | jq -r .value > /tmp/oidc
    cat > /tmp/creds.json <<EOF
    {"type": "external_account",
     "audience": "//iam.googleapis.com/${WIF_PROVIDER}",
     "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
     "token_url": "https://sts.googleapis.com/v1/token",
     "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SA_EMAIL}:generateAccessToken",
     "credential_source": {"file": "/tmp/oidc"}}
    EOF
    gcloud auth login --cred-file=/tmp/creds.json

Create the Cuttlefish provider

PROJECT_ID=<gcp-project>; POOL_ID=<pool>
PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')
REPO=<owner>/<repo>; REPO_ID=$(gh api "repos/$REPO" --jq .id)
CF_PROJECT=<cuttlefish project id>

gcloud iam workload-identity-pools providers create-oidc cuttlefish \
  --project="$PROJECT_ID" --location=global --workload-identity-pool="$POOL_ID" \
  --issuer-uri="https://api.cuttlefish.sh" \
  --allowed-audiences="https://api.cuttlefish.sh" \
  --attribute-mapping="google.subject=assertion.sub,\
attribute.repository=assertion.repository,\
attribute.project_id=assertion.project_id,\
attribute.trust_tier=assertion.trust_tier,\
attribute.event_name=assertion.event_name,\
attribute.ref=assertion.ref,\
attribute.deploy=assertion.repository + ':' + assertion.project_id + ':' + assertion.trust_tier + ':' + assertion.ref,\
attribute.plan=assertion.repository + ':' + assertion.project_id" \
  --attribute-condition="assertion.repository == '${REPO}' \
&& assertion.repository_id == '${REPO_ID}' \
&& assertion.project_id == '${CF_PROJECT}'"

Bind each account to the principal set it may serve

POOL="projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}"

# Plan: any run of the repository in this Cuttlefish project, pull requests included.
gcloud iam service-accounts add-iam-policy-binding "terraform-plan@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/${POOL}/attribute.plan/${REPO}:${CF_PROJECT}"

# Apply / deploy: only trusted runs of main.
gcloud iam service-accounts add-iam-policy-binding "terraform-apply@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/${POOL}/attribute.deploy/${REPO}:${CF_PROJECT}:trusted:refs/heads/main"

From a node with permissions.idToken: write

AUD_PROVIDER="//iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/cuttlefish"
TOKEN=$(curl -fsS -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
  "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://api.cuttlefish.sh" | jq -r .value)

# What the provider will see (no signature check here):
echo "$TOKEN" | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null \
  | jq '{iss, aud, sub, repository, project_id, trust_tier, event_name, ref}'

curl -fsS https://sts.googleapis.com/v1/token \
  -d grant_type=urn:ietf:params:oauth:grant-type:token-exchange \
  -d requested_token_type=urn:ietf:params:oauth:token-type:access_token \
  -d subject_token_type=urn:ietf:params:oauth:token-type:jwt \
  -d scope=https://www.googleapis.com/auth/cloud-platform \
  -d audience="$AUD_PROVIDER" -d subject_token="$TOKEN" | jq 'has("access_token")'