OIDC with Google Cloud

See the general OIDC documentation before diving into the Google Cloud specific setup.

Google Cloud specific setup

When configuring the token in the RWX Vault UI, it's customary to name the token gcp. After setting the name and audience in the UI, you'll see copyable audience and subject values that you can copy to your service provider. See documentation below for specific instructions for each service provider.

You can then reference the token in RWX run definitions like this:

${{ vaults.your-vault.oidc.gcp }}

The RWX OIDC token subject is provided by RWX Vaults for the token that you configured. Use this value for <SUBJECT_ATTRIBUTE_VALUE> below, and replace <PROJECT_ID> with your appropriate Google Cloud project ID.

The vault name is included in the token subject. If you use multiple vaults — perhaps one for development resources and another for production resources — create multiple Workload Identity Providers.

When adding the OIDC token to RWX, you must provide the audience from the Workload Identity Provider. RWX will get the default audience below if you're using that.

OIDC provider

Configure a workload provider and pool by following Google's Workload Identity Federation documentation.

When prompted for the new workload provider and pool settings, use the following values:

  • Issuer (URL): https://cloud.rwx.com/mint
  • Map the google.subject attribute to the assertion.sub claim
  • Add an attribute condition: google.subject == '<SUBJECT_ATTRIBUTE_VALUE>'

When using the gcloud CLI, a Workload Identity Pool can be created with:

gcloud iam workload-identity-pools create "rwx-pool" \
  --project="<PROJECT_ID>" \
  --location="global" \
  --display-name="RWX Pool"

Get the full ID of the Workload Identity Pool with:

gcloud iam workload-identity-pools describe "rwx-pool" \
  --project="<PROJECT_ID>" \
  --location="global" \
  --format="value(name)"

The Workload Identity Pool ID is in the format:

projects/123456789/locations/global/workloadIdentityPools/rwx-pool

Replace <WORKLOAD_IDENTITY_POOL_ID> below with this value.

Create a Workload Identity Provider in the pool:

gcloud iam workload-identity-pools providers create-oidc "rwx" \
  --project="<PROJECT_ID>" \
  --location="global" \
  --workload-identity-pool="rwx-pool" \
  --display-name="RWX OIDC Provider" \
  --attribute-mapping="google.subject=assertion.sub" \
  --attribute-condition="google.subject == '<SUBJECT_ATTRIBUTE_VALUE>'" \
  --issuer-uri="https://cloud.rwx.com/mint"

Get the full Workload Identity Provider ID:

gcloud iam workload-identity-pools providers describe "rwx" \
  --project="<PROJECT_ID>" \
  --location="global" \
  --workload-identity-pool="rwx-pool" \
  --format="value(name)"

The Workload Identity Provider ID is in the format:

projects/123456789/locations/global/workloadIdentityPools/rwx-pool/providers/rwx

Use this value for the workload-identity-provider in the google-cloud/auth-oidc package.

The Workload Identity Provider ID can be used to generate the default audience when setting up the OIDC token in your RWX vault by prefixing it with //iam.googleapis.com. It can be found using the gcloud CLI:

echo "//iam.googleapis.com/$(gcloud iam workload-identity-pools providers describe 'rwx' \
  --project='<PROJECT_ID>' \
  --location='global' \
  --workload-identity-pool='rwx-pool' \
  --format='value(name)')"

//iam.googleapis.com/<WORKLOAD_IDENTITY_POOL_ID>/providers/rwx

If you're using the default audience, you may now add the OIDC token to your RWX Vault, using the value above as the audience.

If you've configured your provider to use a different audience, provide it to the google-cloud/auth-oidc package and as the audience for the RWX Vault OIDC token.

If you aren't using a Google Cloud Service Account, you may add permissions directly to the provider. For example, access is provided to the secret my-secret here:

gcloud secrets add-iam-policy-binding "my-secret" \
  --project="<PROJECT_ID>" \
  --role="roles/secretmanager.secretAccessor" \
  --member="principalSet://iam.googleapis.com/<WORKLOAD_IDENTITY_POOL_ID>/subject/<SUBJECT_ATTRIBUTE_VALUE>"

Authenticating as a service account (optional)

When authenticating as a Google Cloud Service Account, access must be granted to allow the RWX OIDC provider to impersonate the account:

gcloud iam service-accounts add-iam-policy-binding "my-service-account@<PROJECT_ID>.iam.gserviceaccount.com" \
  --project="<PROJECT_ID>" \
  --role="roles/iam.workloadIdentityUser" \
  --member="principal://iam.googleapis.com/<WORKLOAD_IDENTITY_POOL>/subject/<SUBJECT_ATTRIBUTE_VALUE>"

Use the service account email address ID value for the service-account in the google-cloud/auth-oidc package.

Authenticating in an RWX run

The google-cloud/auth-oidc package creates authentication hooks for tasks that use it. Install the Google Cloud CLI and provide the Workload Identity Provider ID from the previous step:

tasks:
  - key: google-cloud-cli
    call: google-cloud/install-cli 1.1.8

  - key: google-cloud-auth
    call: google-cloud/auth-oidc 2.0.2
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}

  - key: task-that-needs-google-cloud
    use: [google-cloud-cli, google-cloud-auth]
    run: gcloud ...
    env:
      GCP_OIDC_TOKEN_PATH: ${{ vaults.your-vault.oidc.gcp.path }}

The package accepts either a token file path in GCP_OIDC_TOKEN_PATH or the token contents in GCP_OIDC_TOKEN, but not both. With GCP_OIDC_TOKEN_PATH, Google Cloud Application Default Credentials continue reading refreshed tokens during long-running tasks. Every task that authenticates must use the authentication hook and provide one of these environment variables.

To impersonate a service account, also set the service-account parameter. You can set project-id to select the default project for the Google Cloud CLI.